commit 4d856f72c10ecb060868ed10ff1b1453943fc6c8 Author: Linus Torvalds Date: Sun Sep 15 14:19:32 2019 -0700 Linux 5.3 commit 72dbcf72156641fde4d8ea401e977341bfd35a05 Author: Linus Torvalds Date: Sun Sep 15 12:32:03 2019 -0700 Revert "ext4: make __ext4_get_inode_loc plug" This reverts commit b03755ad6f33b7b8cd7312a3596a2dbf496de6e7. This is sad, and done for all the wrong reasons. Because that commit is good, and does exactly what it says: avoids a lot of small disk requests for the inode table read-ahead. However, it turns out that it causes an entirely unrelated problem: the getrandom() system call was introduced back in 2014 by commit c6e9d6f38894 ("random: introduce getrandom(2) system call"), and people use it as a convenient source of good random numbers. But part of the current semantics for getrandom() is that it waits for the entropy pool to fill at least partially (unlike /dev/urandom). And at least ArchLinux apparently has a systemd that uses getrandom() at boot time, and the improvements in IO patterns means that existing installations suddenly start hanging, waiting for entropy that will never happen. It seems to be an unlucky combination of not _quite_ enough entropy, together with a particular systemd version and configuration. Lennart says that the systemd-random-seed process (which is what does this early access) is supposed to not block any other boot activity, but sadly that doesn't actually seem to be the case (possibly due bogus dependencies on cryptsetup for encrypted swapspace). The correct fix is to fix getrandom() to not block when it's not appropriate, but that fix is going to take a lot more discussion. Do we just make it act like /dev/urandom by default, and add a new flag for "wait for entropy"? Do we add a boot-time option? Or do we just limit the amount of time it will wait for entropy? So in the meantime, we do the revert to give us time to discuss the eventual fix for the fundamental problem, at which point we can re-apply the ext4 inode table access optimization. Reported-by: Ahmed S. Darwish Cc: Ted Ts'o Cc: Willy Tarreau Cc: Alexander E. Patrakov Cc: Lennart Poettering Signed-off-by: Linus Torvalds commit 1609d7604b847a9820e63393d1a3b6cac7286d40 Merge: 1f9c632cde0c a9c20bb0206a Author: Linus Torvalds Date: Sat Sep 14 16:07:40 2019 -0700 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm Pull kvm fixes from Paolo Bonzini: "The main change here is a revert of reverts. We recently simplified some code that was thought unnecessary; however, since then KVM has grown quite a few cond_resched()s and for that reason the simplified code is prone to livelocks---one CPUs tries to empty a list of guest page tables while the others keep adding to them. This adds back the generation-based zapping of guest page tables, which was not unnecessary after all. On top of this, there is a fix for a kernel memory leak and a couple of s390 fixlets as well" * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: KVM: x86/mmu: Reintroduce fast invalidate/zap for flushing memslot KVM: x86: work around leak of uninitialized stack contents KVM: nVMX: handle page fault in vmread KVM: s390: Do not leak kernel stack data in the KVM_S390_INTERRUPT ioctl KVM: s390: kvm_s390_vm_start_migration: check dirty_bitmap before using it as target for memset() commit 1f9c632cde0c3d781463a88ce430a8dd4a7c1a0e Merge: b03c036e6f96 0d4a3f2abbef Author: Linus Torvalds Date: Sat Sep 14 16:02:49 2019 -0700 Merge tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost Pull virtio fix from Michael Tsirkin: "A last minute revert The 32-bit build got broken by the latest defence in depth patch. Revert and we'll try again in the next cycle" * tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost: Revert "vhost: block speculation of translated descriptors" commit b03c036e6f96340dd311817c7b964dad183c4141 Merge: 36024fcf8d28 474efecb65dc Author: Linus Torvalds Date: Sat Sep 14 15:58:02 2019 -0700 Merge tag 'riscv/for-v5.3' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux Pull RISC-V fix from Paul Walmsley: "Last week, Palmer and I learned that there was an error in the RISC-V kernel image header format that could make it less compatible with the ARM64 kernel image header format. I had missed this error during my original reviews of the patch. The kernel image header format is an interface that impacts bootloaders, QEMU, and other user tools. Those packages must be updated to align with whatever is merged in the kernel. We would like to avoid proliferating these image formats by keeping the RISC-V header as close as possible to the existing ARM64 header. Since the arch/riscv patch that adds support for the image header was merged with our v5.3-rc1 pull request as commit 0f327f2aaad6a ("RISC-V: Add an Image header that boot loader can parse."), we think it wise to try to fix this error before v5.3 is released. The fix itself should be backwards-compatible with any project that has already merged support for premature versions of this interface. It primarily involves ensuring that the RISC-V image header has something useful in the same field as the ARM64 image header" * tag 'riscv/for-v5.3' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux: riscv: modify the Image header to improve compatibility with the ARM64 header commit 0d4a3f2abbef73b9e5bb5f12213c275565473588 Author: Michael S. Tsirkin Date: Sat Sep 14 15:21:51 2019 -0400 Revert "vhost: block speculation of translated descriptors" This reverts commit a89db445fbd7f1f8457b03759aa7343fa530ef6b. I was hasty to include this patch, and it breaks the build on 32 bit. Defence in depth is good but let's do it properly. Cc: stable@vger.kernel.org Signed-off-by: Michael S. Tsirkin commit 36024fcf8d28999f270908e75675d43b099ff7b3 Merge: 1c4c5e2528af 4d7ffcf3bf1b Author: Linus Torvalds Date: Sat Sep 14 12:20:38 2019 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from David Miller: 1) Don't corrupt xfrm_interface parms before validation, from Nicolas Dichtel. 2) Revert use of usb-wakeup in btusb, from Mario Limonciello. 3) Block ipv6 packets in bridge netfilter if ipv6 is disabled, from Leonardo Bras. 4) IPS_OFFLOAD not honored in ctnetlink, from Pablo Neira Ayuso. 5) Missing ULP check in sock_map, from John Fastabend. 6) Fix receive statistic handling in forcedeth, from Zhu Yanjun. 7) Fix length of SKB allocated in 6pack driver, from Christophe JAILLET. 8) ip6_route_info_create() returns an error pointer, not NULL. From Maciej Żenczykowski. 9) Only add RDS sock to the hashes after rs_transport is set, from Ka-Cheong Poon. 10) Don't double clean TX descriptors in ixgbe, from Ilya Maximets. 11) Presence of transmit IPSEC offload in an SKB is not tested for correctly in ixgbe and ixgbevf. From Steffen Klassert and Jeff Kirsher. 12) Need rcu_barrier() when register_netdevice() takes one of the notifier based failure paths, from Subash Abhinov Kasiviswanathan. 13) Fix leak in sctp_do_bind(), from Mao Wenan. * git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (72 commits) cdc_ether: fix rndis support for Mediatek based smartphones sctp: destroy bucket if failed to bind addr sctp: remove redundant assignment when call sctp_get_port_local sctp: change return type of sctp_get_port_local ixgbevf: Fix secpath usage for IPsec Tx offload sctp: Fix the link time qualifier of 'sctp_ctrlsock_exit()' ixgbe: Fix secpath usage for IPsec TX offload. net: qrtr: fix memort leak in qrtr_tun_write_iter net: Fix null de-reference of device refcount ipv6: Fix the link time qualifier of 'ping_v6_proc_exit_net()' tun: fix use-after-free when register netdev failed tcp: fix tcp_ecn_withdraw_cwr() to clear TCP_ECN_QUEUE_CWR ixgbe: fix double clean of Tx descriptors with xdp ixgbe: Prevent u8 wrapping of ITR value to something less than 10us mlx4: fix spelling mistake "veify" -> "verify" net: hns3: fix spelling mistake "undeflow" -> "underflow" net: lmc: fix spelling mistake "runnin" -> "running" NFC: st95hf: fix spelling mistake "receieve" -> "receive" net/rds: An rds_sock is added too early to the hash table mac80211: Do not send Layer 2 Update frame before authorization ... commit 1c4c5e2528af0c803fb1171632074f4070229a75 Merge: 592b8d8759ce 87b5d602a1cc Author: Linus Torvalds Date: Sat Sep 14 12:08:19 2019 -0700 Merge tag 'mmc-v5.3-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc Pull MMC fixes from Ulf Hansson: - tmio: Fixup runtime PM management during probe and remove - sdhci-pci-o2micro: Fix eMMC initialization for an AMD SoC - bcm2835: Prevent lockups when terminating work * tag 'mmc-v5.3-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc: mmc: tmio: Fixup runtime PM management during remove mmc: tmio: Fixup runtime PM management during probe Revert "mmc: tmio: move runtime PM enablement to the driver implementations" Revert "mmc: sdhci: Remove unneeded quirk2 flag of O2 SD host controller" Revert "mmc: bcm2835: Terminate timeout work synchronously" commit 592b8d8759ceb7086e1683e1796c7110e6c2ae8f Merge: a7f89616b737 e6bb711600db Author: Linus Torvalds Date: Sat Sep 14 11:54:57 2019 -0700 Merge tag 'drm-fixes-2019-09-13' of git://anongit.freedesktop.org/drm/drm Pull drm fixes from Dave Airlie: "From the maintainer summit, just some last minute fixes for final: lima: - fix gem_wait ioctl core: - constify modes list i915: - DP MST high color depth regression - GPU hangs on vulkan compute workloads" * tag 'drm-fixes-2019-09-13' of git://anongit.freedesktop.org/drm/drm: drm/lima: fix lima_gem_wait() return value drm/i915: Restore relaxed padding (OCL_OOB_SUPPRES_ENABLE) for skl+ drm/i915: Limit MST to <= 8bpc once again drm/modes: Make the whitelist more const commit a9c20bb0206ae9384bd470a6832dd8913730add9 Merge: 002c5f73c508 53936b5bf35e Author: Paolo Bonzini Date: Sat Sep 14 09:25:30 2019 +0200 Merge tag 'kvm-s390-master-5.3-1' of git://git.kernel.org/pub/scm/linux/kernel/git/kvms390/linux into kvm-master KVM: s390: Fixes for 5.3 - prevent a user triggerable oops in the migration code - do not leak kernel stack content commit 002c5f73c508f7df5681bda339831c27f3c1aef4 Author: Sean Christopherson Date: Thu Sep 12 19:46:02 2019 -0700 KVM: x86/mmu: Reintroduce fast invalidate/zap for flushing memslot James Harvey reported a livelock that was introduced by commit d012a06ab1d23 ("Revert "KVM: x86/mmu: Zap only the relevant pages when removing a memslot""). The livelock occurs because kvm_mmu_zap_all() as it exists today will voluntarily reschedule and drop KVM's mmu_lock, which allows other vCPUs to add shadow pages. With enough vCPUs, kvm_mmu_zap_all() can get stuck in an infinite loop as it can never zap all pages before observing lock contention or the need to reschedule. The equivalent of kvm_mmu_zap_all() that was in use at the time of the reverted commit (4e103134b8623, "KVM: x86/mmu: Zap only the relevant pages when removing a memslot") employed a fast invalidate mechanism and was not susceptible to the above livelock. There are three ways to fix the livelock: - Reverting the revert (commit d012a06ab1d23) is not a viable option as the revert is needed to fix a regression that occurs when the guest has one or more assigned devices. It's unlikely we'll root cause the device assignment regression soon enough to fix the regression timely. - Remove the conditional reschedule from kvm_mmu_zap_all(). However, although removing the reschedule would be a smaller code change, it's less safe in the sense that the resulting kvm_mmu_zap_all() hasn't been used in the wild for flushing memslots since the fast invalidate mechanism was introduced by commit 6ca18b6950f8d ("KVM: x86: use the fast way to invalidate all pages"), back in 2013. - Reintroduce the fast invalidate mechanism and use it when zapping shadow pages in response to a memslot being deleted/moved, which is what this patch does. For all intents and purposes, this is a revert of commit ea145aacf4ae8 ("Revert "KVM: MMU: fast invalidate all pages"") and a partial revert of commit 7390de1e99a70 ("Revert "KVM: x86: use the fast way to invalidate all pages""), i.e. restores the behavior of commit 5304b8d37c2a5 ("KVM: MMU: fast invalidate all pages") and commit 6ca18b6950f8d ("KVM: x86: use the fast way to invalidate all pages") respectively. Fixes: d012a06ab1d23 ("Revert "KVM: x86/mmu: Zap only the relevant pages when removing a memslot"") Reported-by: James Harvey Cc: Alex Willamson Cc: Paolo Bonzini Cc: stable@vger.kernel.org Signed-off-by: Sean Christopherson Signed-off-by: Paolo Bonzini commit 541ab2aeb28251bf7135c7961f3a6080eebcc705 Author: Fuqian Huang Date: Thu Sep 12 12:18:17 2019 +0800 KVM: x86: work around leak of uninitialized stack contents Emulation of VMPTRST can incorrectly inject a page fault when passed an operand that points to an MMIO address. The page fault will use uninitialized kernel stack memory as the CR2 and error code. The right behavior would be to abort the VM with a KVM_EXIT_INTERNAL_ERROR exit to userspace; however, it is not an easy fix, so for now just ensure that the error code and CR2 are zero. Signed-off-by: Fuqian Huang Cc: stable@vger.kernel.org [add comment] Signed-off-by: Paolo Bonzini commit f7eea636c3d505fe6f1d1066234f1aaf7171b681 Author: Paolo Bonzini Date: Sat Sep 14 00:26:27 2019 +0200 KVM: nVMX: handle page fault in vmread The implementation of vmread to memory is still incomplete, as it lacks the ability to do vmread to I/O memory just like vmptrst. Cc: stable@vger.kernel.org Signed-off-by: Paolo Bonzini commit 474efecb65dceb15f793b6e2f2b226e952f0f8e9 Author: Paul Walmsley Date: Fri Sep 13 18:35:50 2019 -0700 riscv: modify the Image header to improve compatibility with the ARM64 header Part of the intention during the definition of the RISC-V kernel image header was to lay the groundwork for a future merge with the ARM64 image header. One error during my original review was not noticing that the RISC-V header's "magic" field was at a different size and position than the ARM64's "magic" field. If the existing ARM64 Image header parsing code were to attempt to parse an existing RISC-V kernel image header format, it would see a magic number 0. This is undesirable, since it's our intention to align as closely as possible with the ARM64 header format. Another problem was that the original "res3" field was not being initialized correctly to zero. Address these issues by creating a 32-bit "magic2" field in the RISC-V header which matches the ARM64 "magic" field. RISC-V binaries will store "RSC\x05" in this field. The intention is that the use of the existing 64-bit "magic" field in the RISC-V header will be deprecated over time. Increment the minor version number of the file format to indicate this change, and update the documentation accordingly. Fix the assembler directives in head.S to ensure that reserved fields are properly zero-initialized. Signed-off-by: Paul Walmsley Reported-by: Palmer Dabbelt Reviewed-by: Palmer Dabbelt Cc: Atish Patra Cc: Karsten Merker Link: https://lore.kernel.org/linux-riscv/194c2f10c9806720623430dbf0cc59a965e50448.camel@wdc.com/T/#u Link: https://lore.kernel.org/linux-riscv/mhng-755b14c4-8f35-4079-a7ff-e421fd1b02bc@palmer-si-x1e/T/#t commit 4d7ffcf3bf1be98d876c570cab8fc31d9fa92725 Author: Bjørn Mork Date: Thu Sep 12 10:42:00 2019 +0200 cdc_ether: fix rndis support for Mediatek based smartphones A Mediatek based smartphone owner reports problems with USB tethering in Linux. The verbose USB listing shows a rndis_host interface pair (e0/01/03 + 10/00/00), but the driver fails to bind with [ 355.960428] usb 1-4: bad CDC descriptors The problem is a failsafe test intended to filter out ACM serial functions using the same 02/02/ff class/subclass/protocol as RNDIS. The serial functions are recognized by their non-zero bmCapabilities. No RNDIS function with non-zero bmCapabilities were known at the time this failsafe was added. But it turns out that some Wireless class RNDIS functions are using the bmCapabilities field. These functions are uniquely identified as RNDIS by their class/subclass/protocol, so the failing test can safely be disabled. The same applies to the two types of Misc class RNDIS functions. Applying the failsafe to Communication class functions only retains the original functionality, and fixes the problem for the Mediatek based smartphone. Tow examples of CDC functional descriptors with non-zero bmCapabilities from Wireless class RNDIS functions are: 0e8d:000a Mediatek Crosscall Spider X5 3G Phone CDC Header: bcdCDC 1.10 CDC ACM: bmCapabilities 0x0f connection notifications sends break line coding and serial state get/set/clear comm features CDC Union: bMasterInterface 0 bSlaveInterface 1 CDC Call Management: bmCapabilities 0x03 call management use DataInterface bDataInterface 1 and 19d2:1023 ZTE K4201-z CDC Header: bcdCDC 1.10 CDC ACM: bmCapabilities 0x02 line coding and serial state CDC Call Management: bmCapabilities 0x03 call management use DataInterface bDataInterface 1 CDC Union: bMasterInterface 0 bSlaveInterface 1 The Mediatek example is believed to apply to most smartphones with Mediatek firmware. The ZTE example is most likely also part of a larger family of devices/firmwares. Suggested-by: Lars Melin Signed-off-by: Bjørn Mork Signed-off-by: David S. Miller commit ae3b06ed55b1554e9a91bf959c6b0b5e212e7f4d Merge: 8f6617badcc9 29b99f54a8e6 Author: David S. Miller Date: Fri Sep 13 22:06:20 2019 +0200 Merge branch 'sctp_do_bind-leak' Mao Wenan says: ==================== fix memory leak for sctp_do_bind First two patches are to do cleanup, remove redundant assignment, and change return type of sctp_get_port_local. Third patch is to fix memory leak for sctp_do_bind if failed to bind address. v2: add one patch to change return type of sctp_get_port_local. ==================== Signed-off-by: David S. Miller commit 29b99f54a8e63f871cf4060406d09fd8b0d744d8 Author: Mao Wenan Date: Thu Sep 12 12:02:19 2019 +0800 sctp: destroy bucket if failed to bind addr There is one memory leak bug report: BUG: memory leak unreferenced object 0xffff8881dc4c5ec0 (size 40): comm "syz-executor.0", pid 5673, jiffies 4298198457 (age 27.578s) hex dump (first 32 bytes): 02 00 00 00 81 88 ff ff 00 00 00 00 00 00 00 00 ................ f8 63 3d c1 81 88 ff ff 00 00 00 00 00 00 00 00 .c=............. backtrace: [<0000000072006339>] sctp_get_port_local+0x2a1/0xa00 [sctp] [<00000000c7b379ec>] sctp_do_bind+0x176/0x2c0 [sctp] [<000000005be274a2>] sctp_bind+0x5a/0x80 [sctp] [<00000000b66b4044>] inet6_bind+0x59/0xd0 [ipv6] [<00000000c68c7f42>] __sys_bind+0x120/0x1f0 net/socket.c:1647 [<000000004513635b>] __do_sys_bind net/socket.c:1658 [inline] [<000000004513635b>] __se_sys_bind net/socket.c:1656 [inline] [<000000004513635b>] __x64_sys_bind+0x3e/0x50 net/socket.c:1656 [<0000000061f2501e>] do_syscall_64+0x72/0x2e0 arch/x86/entry/common.c:296 [<0000000003d1e05e>] entry_SYSCALL_64_after_hwframe+0x49/0xbe This is because in sctp_do_bind, if sctp_get_port_local is to create hash bucket successfully, and sctp_add_bind_addr failed to bind address, e.g return -ENOMEM, so memory leak found, it needs to destroy allocated bucket. Reported-by: Hulk Robot Signed-off-by: Mao Wenan Acked-by: Neil Horman Acked-by: Marcelo Ricardo Leitner Signed-off-by: David S. Miller commit e0e4b8de10ad3affe83cc91a1cf6d1e48cca333e Author: Mao Wenan Date: Thu Sep 12 12:02:18 2019 +0800 sctp: remove redundant assignment when call sctp_get_port_local There are more parentheses in if clause when call sctp_get_port_local in sctp_do_bind, and redundant assignment to 'ret'. This patch is to do cleanup. Signed-off-by: Mao Wenan Acked-by: Neil Horman Acked-by: Marcelo Ricardo Leitner Signed-off-by: David S. Miller commit 8e2ef6abd4653b1cfeefe262017ecdd5eaf40fef Author: Mao Wenan Date: Thu Sep 12 12:02:17 2019 +0800 sctp: change return type of sctp_get_port_local Currently sctp_get_port_local() returns a long which is either 0,1 or a pointer casted to long. It's neither of the callers use the return value since commit 62208f12451f ("net: sctp: simplify sctp_get_port"). Now two callers are sctp_get_port and sctp_do_bind, they actually assumend a casted to an int was the same as a pointer casted to a long, and they don't save the return value just check whether it is zero or non-zero, so it would better change return type from long to int for sctp_get_port_local. Signed-off-by: Mao Wenan Acked-by: Marcelo Ricardo Leitner Signed-off-by: David S. Miller commit 8f6617badcc96a582678ea36ea96490c5ff26eb4 Author: Jeff Kirsher Date: Thu Sep 12 12:07:34 2019 -0700 ixgbevf: Fix secpath usage for IPsec Tx offload Port the same fix for ixgbe to ixgbevf. The ixgbevf driver currently does IPsec Tx offloading based on an existing secpath. However, the secpath can also come from the Rx side, in this case it is misinterpreted for Tx offload and the packets are dropped with a "bad sa_idx" error. Fix this by using the xfrm_offload() function to test for Tx offload. CC: Shannon Nelson Fixes: 7f68d4306701 ("ixgbevf: enable VF IPsec offload operations") Reported-by: Jonathan Tooker Signed-off-by: Jeff Kirsher Acked-by: Shannon Nelson Signed-off-by: David S. Miller commit 87b5d602a1cc76169b8d81ec2c74c8d95d9350dc Author: Ulf Hansson Date: Fri Sep 13 11:20:22 2019 +0200 mmc: tmio: Fixup runtime PM management during remove Accessing the device when it may be runtime suspended is a bug, which is the case in tmio_mmc_host_remove(). Let's fix the behaviour. Cc: stable@vger.kernel.org Signed-off-by: Ulf Hansson Tested-by: Geert Uytterhoeven commit aa86f1a3887523d78bfadd1c4e4df8f919336511 Author: Ulf Hansson Date: Fri Sep 13 11:19:26 2019 +0200 mmc: tmio: Fixup runtime PM management during probe The tmio_mmc_host_probe() calls pm_runtime_set_active() to update the runtime PM status of the device, as to make it reflect the current status of the HW. This works fine for most cases, but unfortunate not for all. Especially, there is a generic problem when the device has a genpd attached and that genpd have the ->start|stop() callbacks assigned. More precisely, if the driver calls pm_runtime_set_active() during ->probe(), genpd does not get to invoke the ->start() callback for it, which means the HW isn't really fully powered on. Furthermore, in the next phase, when the device becomes runtime suspended, genpd will invoke the ->stop() callback for it, potentially leading to usage count imbalance problems, depending on what's implemented behind the callbacks of course. To fix this problem, convert to call pm_runtime_get_sync() from tmio_mmc_host_probe() rather than pm_runtime_set_active(). Additionally, to avoid bumping usage counters and unnecessary re-initializing the HW the first time the tmio driver's ->runtime_resume() callback is called, introduce a state flag to keeping track of this. Cc: stable@vger.kernel.org Signed-off-by: Ulf Hansson Tested-by: Geert Uytterhoeven commit 8861474a105c91e812d38cd65d3be795c7f32c4f Author: Ulf Hansson Date: Fri Sep 13 10:03:15 2019 +0200 Revert "mmc: tmio: move runtime PM enablement to the driver implementations" This reverts commit 7ff213193310ef8d0ee5f04f79d791210787ac2c. It turns out that the above commit introduces other problems. For example, calling pm_runtime_set_active() must not be done prior calling pm_runtime_enable() as that makes it fail. This leads to additional problems, such as clock enables being wrongly balanced. Rather than fixing the problem on top, let's start over by doing a revert. Fixes: 7ff213193310 ("mmc: tmio: move runtime PM enablement to the driver implementations") Signed-off-by: Ulf Hansson Tested-by: Geert Uytterhoeven commit a7f89616b7376495424f682b6086e0c391a89a1d Merge: 1b304a1ae45d 97a61369830a Author: Linus Torvalds Date: Fri Sep 13 09:52:01 2019 +0100 Merge branch 'for-5.3-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup Pull cgroup fix from Tejun Heo: "Roman found and fixed a bug in the cgroup2 freezer which allows new child cgroup to escape frozen state" * 'for-5.3-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup: cgroup: freezer: fix frozen state inheritance kselftests: cgroup: add freezer mkdir test commit 1b304a1ae45de4df7d773f0a39d1100aabca615b Merge: 505a8ec7e11a 18dfa7117a3f Author: Linus Torvalds Date: Fri Sep 13 09:48:47 2019 +0100 Merge tag 'for-5.3-rc8-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux Pull btrfs fixes from David Sterba: "Here are two fixes, one of them urgent fixing a bug introduced in 5.2 and reported by many users. It took time to identify the root cause, catching the 5.3 release is higly desired also to push the fix to 5.2 stable tree. The bug is a mess up of return values after adding proper error handling and honestly the kind of bug that can cause sleeping disorders until it's caught. My appologies to everybody who was affected. Summary of what could happen: 1) either a hang when committing a transaction, if this happens there's no risk of corruption, still the hang is very inconvenient and can't be resolved without a reboot 2) writeback for some btree nodes may never be started and we end up committing a transaction without noticing that, this is really serious and that will lead to the "parent transid verify failed" messages" * tag 'for-5.3-rc8-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux: Btrfs: fix unwritten extent buffers and hangs on future writeback attempts Btrfs: fix assertion failure during fsync and use of stale transaction commit 97a61369830ab085df5aed0ff9256f35b07d425a Author: Roman Gushchin Date: Thu Sep 12 10:56:45 2019 -0700 cgroup: freezer: fix frozen state inheritance If a new child cgroup is created in the frozen cgroup hierarchy (one or more of ancestor cgroups is frozen), the CGRP_FREEZE cgroup flag should be set. Otherwise if a process will be attached to the child cgroup, it won't become frozen. The problem can be reproduced with the test_cgfreezer_mkdir test. This is the output before this patch: ~/test_freezer ok 1 test_cgfreezer_simple ok 2 test_cgfreezer_tree ok 3 test_cgfreezer_forkbomb Cgroup /sys/fs/cgroup/cg_test_mkdir_A/cg_test_mkdir_B isn't frozen not ok 4 test_cgfreezer_mkdir ok 5 test_cgfreezer_rmdir ok 6 test_cgfreezer_migrate ok 7 test_cgfreezer_ptrace ok 8 test_cgfreezer_stopped ok 9 test_cgfreezer_ptraced ok 10 test_cgfreezer_vfork And with this patch: ~/test_freezer ok 1 test_cgfreezer_simple ok 2 test_cgfreezer_tree ok 3 test_cgfreezer_forkbomb ok 4 test_cgfreezer_mkdir ok 5 test_cgfreezer_rmdir ok 6 test_cgfreezer_migrate ok 7 test_cgfreezer_ptrace ok 8 test_cgfreezer_stopped ok 9 test_cgfreezer_ptraced ok 10 test_cgfreezer_vfork Reported-by: Mark Crossen Signed-off-by: Roman Gushchin Fixes: 76f969e8948d ("cgroup: cgroup v2 freezer") Cc: Tejun Heo Cc: stable@vger.kernel.org # v5.2+ Signed-off-by: Tejun Heo commit 44e9d308a51fbf6d2e5a913f7452a5d5f1902249 Author: Roman Gushchin Date: Thu Sep 12 10:56:44 2019 -0700 kselftests: cgroup: add freezer mkdir test Add a new cgroup freezer selftest, which checks that if a cgroup is frozen, their new child cgroups will properly inherit the frozen state. It creates a parent cgroup, freezes it, creates a child cgroup and populates it with a dummy process. Then it checks that both parent and child cgroup are frozen. Signed-off-by: Roman Gushchin Cc: Tejun Heo Cc: Shuah Khan Signed-off-by: Tejun Heo commit 505a8ec7e11ae5236c4a154a1e24ef49a8349600 Author: Chris Wilson Date: Thu Sep 12 13:56:34 2019 +0100 Revert "drm/i915/userptr: Acquire the page lock around set_page_dirty()" The userptr put_pages can be called from inside try_to_unmap, and so enters with the page lock held on one of the object's backing pages. We cannot take the page lock ourselves for fear of recursion. Reported-by: Lionel Landwerlin Reported-by: Martin Wilck Reported-by: Leo Kraav Fixes: aa56a292ce62 ("drm/i915/userptr: Acquire the page lock around set_page_dirty()") References: https://bugzilla.kernel.org/show_bug.cgi?id=203317 Signed-off-by: Chris Wilson Cc: Tvrtko Ursulin Cc: Jani Nikula Cc: Joonas Lahtinen Cc: stable@vger.kernel.org Signed-off-by: Linus Torvalds commit 98dcb386e5c3d53da2ed0b14b5930a01c90ad36a Merge: 95217783b7f6 a0eb9abd8af9 Author: Linus Torvalds Date: Thu Sep 12 14:50:14 2019 +0100 Merge tag 'for-linus-20190912' of gitolite.kernel.org:pub/scm/linux/kernel/git/brauner/linux Pull clone3 fix from Christian Brauner: "This is a last-minute bugfix for clone3() that should go in before we release 5.3 with clone3(). clone3() did not verify that the exit_signal argument was set to a valid signal. This can be used to cause a crash by specifying a signal greater than NSIG. e.g. -1. The commit from Eugene adds a check to copy_clone_args_from_user() to verify that the exit signal is limited by CSIGNAL as with legacy clone() and that the signal is valid. With this we don't get the legacy clone behavior were an invalid signal could be handed down and would only be detected and then ignored in do_notify_parent(). Users of clone3() will now get a proper error right when they pass an invalid exit signal. Note, that this is not a change in user-visible behavior since no kernel with clone3() has been released yet" * tag 'for-linus-20190912' of gitolite.kernel.org:pub/scm/linux/kernel/git/brauner/linux: fork: block invalid exit signals with clone3() commit 95217783b7f6f331e7a6675e0a31fb9a5a1b9a36 Merge: ad32b4800c2b afa8b475c1ae Author: Linus Torvalds Date: Thu Sep 12 14:47:35 2019 +0100 Merge branch 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 fixes from Ingo Molnar: "A KVM guest fix, and a kdump kernel relocation errors fix" * 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/timer: Force PIT initialization when !X86_FEATURE_ARAT x86/purgatory: Change compiler flags from -mcmodel=kernel to -mcmodel=large to fix kexec relocation errors commit e6bb711600db23eef2fa0c16a2d361e17b45bb28 Merge: 911ad0b6110d 21670bd78a25 Author: Dave Airlie Date: Thu Sep 12 23:14:29 2019 +1000 Merge tag 'drm-misc-fixes-2019-09-12' of git://anongit.freedesktop.org/drm/drm-misc into drm-fixes drm-misc-fixes for v5.3 final: - Constify modes whitelist harder. - Fix lima driver gem_wait ioctl. Signed-off-by: Dave Airlie From: Maarten Lankhorst Link: https://patchwork.freedesktop.org/patch/msgid/99e52e7a-d4ce-6a2c-0501-bc559a710955@linux.intel.com commit 911ad0b6110d385474cb1dd91b1ef51ca6aeff93 Merge: f74c2bb98776 2eb0964eec5f Author: Dave Airlie Date: Thu Sep 12 23:11:36 2019 +1000 Merge tag 'drm-intel-fixes-2019-09-11' of git://anongit.freedesktop.org/drm/drm-intel into drm-fixes Final drm/i915 fixes for v5.3: - Fox DP MST high color depth regression - Fix GPU hangs on Vulkan compute workloads Signed-off-by: Dave Airlie From: Jani Nikula Link: https://patchwork.freedesktop.org/patch/msgid/877e6e27qm.fsf@intel.com commit a0eb9abd8af92d1aa34bc1e24dfbd1ba0bd6a56c Author: Eugene Syromiatnikov Date: Wed Sep 11 18:45:40 2019 +0100 fork: block invalid exit signals with clone3() Previously, higher 32 bits of exit_signal fields were lost when copied to the kernel args structure (that uses int as a type for the respective field). Moreover, as Oleg has noted, exit_signal is used unchecked, so it has to be checked for sanity before use; for the legacy syscalls, applying CSIGNAL mask guarantees that it is at least non-negative; however, there's no such thing is done in clone3() code path, and that can break at least thread_group_leader. This commit adds a check to copy_clone_args_from_user() to verify that the exit signal is limited by CSIGNAL as with legacy clone() and that the signal is valid. With this we don't get the legacy clone behavior were an invalid signal could be handed down and would only be detected and ignored in do_notify_parent(). Users of clone3() will now get a proper error when they pass an invalid exit signal. Note, that this is not user-visible behavior since no kernel with clone3() has been released yet. The following program will cause a splat on a non-fixed clone3() version and will fail correctly on a fixed version: #define _GNU_SOURCE #include #include #include #include #include #include #include #include int main(int argc, char *argv[]) { pid_t pid = -1; struct clone_args args = {0}; args.exit_signal = -1; pid = syscall(__NR_clone3, &args, sizeof(struct clone_args)); if (pid < 0) exit(EXIT_FAILURE); if (pid == 0) exit(EXIT_SUCCESS); wait(NULL); exit(EXIT_SUCCESS); } Fixes: 7f192e3cd316 ("fork: add clone3") Reported-by: Oleg Nesterov Suggested-by: Oleg Nesterov Suggested-by: Dmitry V. Levin Signed-off-by: Eugene Syromiatnikov Link: https://lore.kernel.org/r/4b38fa4ce420b119a4c6345f42fe3cec2de9b0b5.1568223594.git.esyr@redhat.com [christian.brauner@ubuntu.com: simplify check and rework commit message] Signed-off-by: Christian Brauner commit 53936b5bf35e140ae27e4bbf0447a61063f400da Author: Thomas Huth Date: Thu Sep 12 13:54:38 2019 +0200 KVM: s390: Do not leak kernel stack data in the KVM_S390_INTERRUPT ioctl When the userspace program runs the KVM_S390_INTERRUPT ioctl to inject an interrupt, we convert them from the legacy struct kvm_s390_interrupt to the new struct kvm_s390_irq via the s390int_to_s390irq() function. However, this function does not take care of all types of interrupts that we can inject into the guest later (see do_inject_vcpu()). Since we do not clear out the s390irq values before calling s390int_to_s390irq(), there is a chance that we copy random data from the kernel stack which could be leaked to the userspace later. Specifically, the problem exists with the KVM_S390_INT_PFAULT_INIT interrupt: s390int_to_s390irq() does not handle it, and the function __inject_pfault_init() later copies irq->u.ext which contains the random kernel stack data. This data can then be leaked either to the guest memory in __deliver_pfault_init(), or the userspace might retrieve it directly with the KVM_S390_GET_IRQ_STATE ioctl. Fix it by handling that interrupt type in s390int_to_s390irq(), too, and by making sure that the s390irq struct is properly pre-initialized. And while we're at it, make sure that s390int_to_s390irq() now directly returns -EINVAL for unknown interrupt types, so that we immediately get a proper error code in case we add more interrupt types to do_inject_vcpu() without updating s390int_to_s390irq() sometime in the future. Cc: stable@vger.kernel.org Reviewed-by: David Hildenbrand Reviewed-by: Christian Borntraeger Reviewed-by: Janosch Frank Signed-off-by: Thomas Huth Link: https://lore.kernel.org/kvm/20190912115438.25761-1-thuth@redhat.com Signed-off-by: Christian Borntraeger commit b456d72412ca8797234449c25815e82f4e1426c0 Author: Christophe JAILLET Date: Wed Sep 11 18:02:39 2019 +0200 sctp: Fix the link time qualifier of 'sctp_ctrlsock_exit()' The '.exit' functions from 'pernet_operations' structure should be marked as __net_exit, not __net_init. Fixes: 8e2d61e0aed2 ("sctp: fix race on protocol/netns initialization") Signed-off-by: Christophe JAILLET Acked-by: Marcelo Ricardo Leitner Signed-off-by: David S. Miller commit f39b683d35dfa93a58f1b400a8ec0ff81296b37c Author: Steffen Klassert Date: Thu Sep 12 13:01:44 2019 +0200 ixgbe: Fix secpath usage for IPsec TX offload. The ixgbe driver currently does IPsec TX offloading based on an existing secpath. However, the secpath can also come from the RX side, in this case it is misinterpreted for TX offload and the packets are dropped with a "bad sa_idx" error. Fix this by using the xfrm_offload() function to test for TX offload. Fixes: 592594704761 ("ixgbe: process the Tx ipsec offload") Reported-by: Michael Marley Signed-off-by: Steffen Klassert Signed-off-by: David S. Miller commit 18dfa7117a3f379862dcd3f67cadd678013bb9dd Author: Filipe Manana Date: Wed Sep 11 17:42:00 2019 +0100 Btrfs: fix unwritten extent buffers and hangs on future writeback attempts The lock_extent_buffer_io() returns 1 to the caller to tell it everything went fine and the callers needs to start writeback for the extent buffer (submit a bio, etc), 0 to tell the caller everything went fine but it does not need to start writeback for the extent buffer, and a negative value if some error happened. When it's about to return 1 it tries to lock all pages, and if a try lock on a page fails, and we didn't flush any existing bio in our "epd", it calls flush_write_bio(epd) and overwrites the return value of 1 to 0 or an error. The page might have been locked elsewhere, not with the goal of starting writeback of the extent buffer, and even by some code other than btrfs, like page migration for example, so it does not mean the writeback of the extent buffer was already started by some other task, so returning a 0 tells the caller (btree_write_cache_pages()) to not start writeback for the extent buffer. Note that epd might currently have either no bio, so flush_write_bio() returns 0 (success) or it might have a bio for another extent buffer with a lower index (logical address). Since we return 0 with the EXTENT_BUFFER_WRITEBACK bit set on the extent buffer and writeback is never started for the extent buffer, future attempts to writeback the extent buffer will hang forever waiting on that bit to be cleared, since it can only be cleared after writeback completes. Such hang is reported with a trace like the following: [49887.347053] INFO: task btrfs-transacti:1752 blocked for more than 122 seconds. [49887.347059] Not tainted 5.2.13-gentoo #2 [49887.347060] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [49887.347062] btrfs-transacti D 0 1752 2 0x80004000 [49887.347064] Call Trace: [49887.347069] ? __schedule+0x265/0x830 [49887.347071] ? bit_wait+0x50/0x50 [49887.347072] ? bit_wait+0x50/0x50 [49887.347074] schedule+0x24/0x90 [49887.347075] io_schedule+0x3c/0x60 [49887.347077] bit_wait_io+0x8/0x50 [49887.347079] __wait_on_bit+0x6c/0x80 [49887.347081] ? __lock_release.isra.29+0x155/0x2d0 [49887.347083] out_of_line_wait_on_bit+0x7b/0x80 [49887.347084] ? var_wake_function+0x20/0x20 [49887.347087] lock_extent_buffer_for_io+0x28c/0x390 [49887.347089] btree_write_cache_pages+0x18e/0x340 [49887.347091] do_writepages+0x29/0xb0 [49887.347093] ? kmem_cache_free+0x132/0x160 [49887.347095] ? convert_extent_bit+0x544/0x680 [49887.347097] filemap_fdatawrite_range+0x70/0x90 [49887.347099] btrfs_write_marked_extents+0x53/0x120 [49887.347100] btrfs_write_and_wait_transaction.isra.4+0x38/0xa0 [49887.347102] btrfs_commit_transaction+0x6bb/0x990 [49887.347103] ? start_transaction+0x33e/0x500 [49887.347105] transaction_kthread+0x139/0x15c So fix this by not overwriting the return value (ret) with the result from flush_write_bio(). We also need to clear the EXTENT_BUFFER_WRITEBACK bit in case flush_write_bio() returns an error, otherwise it will hang any future attempts to writeback the extent buffer, and undo all work done before (set back EXTENT_BUFFER_DIRTY, etc). This is a regression introduced in the 5.2 kernel. Fixes: 2e3c25136adfb ("btrfs: extent_io: add proper error handling to lock_extent_buffer_for_io()") Fixes: f4340622e0226 ("btrfs: extent_io: Move the BUG_ON() in flush_write_bio() one level up") Reported-by: Zdenek Sojka Link: https://lore.kernel.org/linux-btrfs/GpO.2yos.3WGDOLpx6t%7D.1TUDYM@seznam.cz/T/#u Reported-by: Stefan Priebe - Profihost AG Link: https://lore.kernel.org/linux-btrfs/5c4688ac-10a7-fb07-70e8-c5d31a3fbb38@profihost.ag/T/#t Reported-by: Drazen Kacar Link: https://lore.kernel.org/linux-btrfs/DB8PR03MB562876ECE2319B3E579590F799C80@DB8PR03MB5628.eurprd03.prod.outlook.com/ Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=204377 Signed-off-by: Filipe Manana Signed-off-by: David Sterba commit 410f954cb1d1c79ae485dd83a175f21954fd87cd Author: Filipe Manana Date: Tue Sep 10 15:26:49 2019 +0100 Btrfs: fix assertion failure during fsync and use of stale transaction Sometimes when fsync'ing a file we need to log that other inodes exist and when we need to do that we acquire a reference on the inodes and then drop that reference using iput() after logging them. That generally is not a problem except if we end up doing the final iput() (dropping the last reference) on the inode and that inode has a link count of 0, which can happen in a very short time window if the logging path gets a reference on the inode while it's being unlinked. In that case we end up getting the eviction callback, btrfs_evict_inode(), invoked through the iput() call chain which needs to drop all of the inode's items from its subvolume btree, and in order to do that, it needs to join a transaction at the helper function evict_refill_and_join(). However because the task previously started a transaction at the fsync handler, btrfs_sync_file(), it has current->journal_info already pointing to a transaction handle and therefore evict_refill_and_join() will get that transaction handle from btrfs_join_transaction(). From this point on, two different problems can happen: 1) evict_refill_and_join() will often change the transaction handle's block reserve (->block_rsv) and set its ->bytes_reserved field to a value greater than 0. If evict_refill_and_join() never commits the transaction, the eviction handler ends up decreasing the reference count (->use_count) of the transaction handle through the call to btrfs_end_transaction(), and after that point we have a transaction handle with a NULL ->block_rsv (which is the value prior to the transaction join from evict_refill_and_join()) and a ->bytes_reserved value greater than 0. If after the eviction/iput completes the inode logging path hits an error or it decides that it must fallback to a transaction commit, the btrfs fsync handle, btrfs_sync_file(), gets a non-zero value from btrfs_log_dentry_safe(), and because of that non-zero value it tries to commit the transaction using a handle with a NULL ->block_rsv and a non-zero ->bytes_reserved value. This makes the transaction commit hit an assertion failure at btrfs_trans_release_metadata() because ->bytes_reserved is not zero but the ->block_rsv is NULL. The produced stack trace for that is like the following: [192922.917158] assertion failed: !trans->bytes_reserved, file: fs/btrfs/transaction.c, line: 816 [192922.917553] ------------[ cut here ]------------ [192922.917922] kernel BUG at fs/btrfs/ctree.h:3532! [192922.918310] invalid opcode: 0000 [#1] SMP DEBUG_PAGEALLOC PTI [192922.918666] CPU: 2 PID: 883 Comm: fsstress Tainted: G W 5.1.4-btrfs-next-47 #1 [192922.919035] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.11.2-0-gf9626ccb91-prebuilt.qemu-project.org 04/01/2014 [192922.919801] RIP: 0010:assfail.constprop.25+0x18/0x1a [btrfs] (...) [192922.920925] RSP: 0018:ffffaebdc8a27da8 EFLAGS: 00010286 [192922.921315] RAX: 0000000000000051 RBX: ffff95c9c16a41c0 RCX: 0000000000000000 [192922.921692] RDX: 0000000000000000 RSI: ffff95cab6b16838 RDI: ffff95cab6b16838 [192922.922066] RBP: ffff95c9c16a41c0 R08: 0000000000000000 R09: 0000000000000000 [192922.922442] R10: ffffaebdc8a27e70 R11: 0000000000000000 R12: ffff95ca731a0980 [192922.922820] R13: 0000000000000000 R14: ffff95ca84c73338 R15: ffff95ca731a0ea8 [192922.923200] FS: 00007f337eda4e80(0000) GS:ffff95cab6b00000(0000) knlGS:0000000000000000 [192922.923579] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [192922.923948] CR2: 00007f337edad000 CR3: 00000001e00f6002 CR4: 00000000003606e0 [192922.924329] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [192922.924711] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [192922.925105] Call Trace: [192922.925505] btrfs_trans_release_metadata+0x10c/0x170 [btrfs] [192922.925911] btrfs_commit_transaction+0x3e/0xaf0 [btrfs] [192922.926324] btrfs_sync_file+0x44c/0x490 [btrfs] [192922.926731] do_fsync+0x38/0x60 [192922.927138] __x64_sys_fdatasync+0x13/0x20 [192922.927543] do_syscall_64+0x60/0x1c0 [192922.927939] entry_SYSCALL_64_after_hwframe+0x49/0xbe (...) [192922.934077] ---[ end trace f00808b12068168f ]--- 2) If evict_refill_and_join() decides to commit the transaction, it will be able to do it, since the nested transaction join only increments the transaction handle's ->use_count reference counter and it does not prevent the transaction from getting committed. This means that after eviction completes, the fsync logging path will be using a transaction handle that refers to an already committed transaction. What happens when using such a stale transaction can be unpredictable, we are at least having a use-after-free on the transaction handle itself, since the transaction commit will call kmem_cache_free() against the handle regardless of its ->use_count value, or we can end up silently losing all the updates to the log tree after that iput() in the logging path, or using a transaction handle that in the meanwhile was allocated to another task for a new transaction, etc, pretty much unpredictable what can happen. In order to fix both of them, instead of using iput() during logging, use btrfs_add_delayed_iput(), so that the logging path of fsync never drops the last reference on an inode, that step is offloaded to a safe context (usually the cleaner kthread). The assertion failure issue was sporadically triggered by the test case generic/475 from fstests, which loads the dm error target while fsstress is running, which lead to fsync failing while logging inodes with -EIO errors and then trying later to commit the transaction, triggering the assertion failure. CC: stable@vger.kernel.org # 4.4+ Reviewed-by: Josef Bacik Signed-off-by: Filipe Manana Signed-off-by: David Sterba commit 13a17cc0526f08d1df9507f7484176371cd263a0 Author: Igor Mammedov Date: Wed Sep 11 03:52:18 2019 -0400 KVM: s390: kvm_s390_vm_start_migration: check dirty_bitmap before using it as target for memset() If userspace doesn't set KVM_MEM_LOG_DIRTY_PAGES on memslot before calling kvm_s390_vm_start_migration(), kernel will oops with: Unable to handle kernel pointer dereference in virtual kernel address space Failing address: 0000000000000000 TEID: 0000000000000483 Fault in home space mode while using kernel ASCE. AS:0000000002a2000b R2:00000001bff8c00b R3:00000001bff88007 S:00000001bff91000 P:000000000000003d Oops: 0004 ilc:2 [#1] SMP ... Call Trace: ([<001fffff804ec552>] kvm_s390_vm_set_attr+0x347a/0x3828 [kvm]) [<001fffff804ecfc0>] kvm_arch_vm_ioctl+0x6c0/0x1998 [kvm] [<001fffff804b67e4>] kvm_vm_ioctl+0x51c/0x11a8 [kvm] [<00000000008ba572>] do_vfs_ioctl+0x1d2/0xe58 [<00000000008bb284>] ksys_ioctl+0x8c/0xb8 [<00000000008bb2e2>] sys_ioctl+0x32/0x40 [<000000000175552c>] system_call+0x2b8/0x2d8 INFO: lockdep is turned off. Last Breaking-Event-Address: [<0000000000dbaf60>] __memset+0xc/0xa0 due to ms->dirty_bitmap being NULL, which might crash the host. Make sure that ms->dirty_bitmap is set before using it or return -EINVAL otherwise. Cc: Fixes: afdad61615cc ("KVM: s390: Fix storage attributes migration with memory slots") Signed-off-by: Igor Mammedov Link: https://lore.kernel.org/kvm/20190911075218.29153-1-imammedo@redhat.com/ Reviewed-by: David Hildenbrand Reviewed-by: Christian Borntraeger Reviewed-by: Claudio Imbrenda Reviewed-by: Cornelia Huck Reviewed-by: Janosch Frank Signed-off-by: Janosch Frank Signed-off-by: Christian Borntraeger commit a21b7f0cff1906a93a0130b74713b15a0b36481d Author: Navid Emamdoost Date: Wed Sep 11 10:09:02 2019 -0500 net: qrtr: fix memort leak in qrtr_tun_write_iter In qrtr_tun_write_iter the allocated kbuf should be release in case of error or success return. v2 Update: Thanks to David Miller for pointing out the release on success path as well. Signed-off-by: Navid Emamdoost Signed-off-by: David S. Miller commit 10cc514f451a0f239aa34f91bc9dc954a9397840 Author: Subash Abhinov Kasiviswanathan Date: Tue Sep 10 14:02:57 2019 -0600 net: Fix null de-reference of device refcount In event of failure during register_netdevice, free_netdev is invoked immediately. free_netdev assumes that all the netdevice refcounts have been dropped prior to it being called and as a result frees and clears out the refcount pointer. However, this is not necessarily true as some of the operations in the NETDEV_UNREGISTER notifier handlers queue RCU callbacks for invocation after a grace period. The IPv4 callback in_dev_rcu_put tries to access the refcount after free_netdev is called which leads to a null de-reference- 44837.761523: <6> Unable to handle kernel paging request at virtual address 0000004a88287000 44837.761651: <2> pc : in_dev_finish_destroy+0x4c/0xc8 44837.761654: <2> lr : in_dev_finish_destroy+0x2c/0xc8 44837.762393: <2> Call trace: 44837.762398: <2> in_dev_finish_destroy+0x4c/0xc8 44837.762404: <2> in_dev_rcu_put+0x24/0x30 44837.762412: <2> rcu_nocb_kthread+0x43c/0x468 44837.762418: <2> kthread+0x118/0x128 44837.762424: <2> ret_from_fork+0x10/0x1c Fix this by waiting for the completion of the call_rcu() in case of register_netdevice errors. Fixes: 93ee31f14f6f ("[NET]: Fix free_netdev on register_netdev failure.") Cc: Sean Tranchetti Signed-off-by: Subash Abhinov Kasiviswanathan Signed-off-by: David S. Miller commit d23dbc479a8e813db4161a695d67da0e36557846 Author: Christophe JAILLET Date: Tue Sep 10 13:29:59 2019 +0200 ipv6: Fix the link time qualifier of 'ping_v6_proc_exit_net()' The '.exit' functions from 'pernet_operations' structure should be marked as __net_exit, not __net_init. Fixes: d862e5461423 ("net: ipv6: Implement /proc/net/icmp6.") Signed-off-by: Christophe JAILLET Signed-off-by: David S. Miller commit 77f22f92dff8e7b45c7786a430626d38071d4670 Author: Yang Yingliang Date: Tue Sep 10 18:56:57 2019 +0800 tun: fix use-after-free when register netdev failed I got a UAF repport in tun driver when doing fuzzy test: [ 466.269490] ================================================================== [ 466.271792] BUG: KASAN: use-after-free in tun_chr_read_iter+0x2ca/0x2d0 [ 466.271806] Read of size 8 at addr ffff888372139250 by task tun-test/2699 [ 466.271810] [ 466.271824] CPU: 1 PID: 2699 Comm: tun-test Not tainted 5.3.0-rc1-00001-g5a9433db2614-dirty #427 [ 466.271833] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org 04/01/2014 [ 466.271838] Call Trace: [ 466.271858] dump_stack+0xca/0x13e [ 466.271871] ? tun_chr_read_iter+0x2ca/0x2d0 [ 466.271890] print_address_description+0x79/0x440 [ 466.271906] ? vprintk_func+0x5e/0xf0 [ 466.271920] ? tun_chr_read_iter+0x2ca/0x2d0 [ 466.271935] __kasan_report+0x15c/0x1df [ 466.271958] ? tun_chr_read_iter+0x2ca/0x2d0 [ 466.271976] kasan_report+0xe/0x20 [ 466.271987] tun_chr_read_iter+0x2ca/0x2d0 [ 466.272013] do_iter_readv_writev+0x4b7/0x740 [ 466.272032] ? default_llseek+0x2d0/0x2d0 [ 466.272072] do_iter_read+0x1c5/0x5e0 [ 466.272110] vfs_readv+0x108/0x180 [ 466.299007] ? compat_rw_copy_check_uvector+0x440/0x440 [ 466.299020] ? fsnotify+0x888/0xd50 [ 466.299040] ? __fsnotify_parent+0xd0/0x350 [ 466.299064] ? fsnotify_first_mark+0x1e0/0x1e0 [ 466.304548] ? vfs_write+0x264/0x510 [ 466.304569] ? ksys_write+0x101/0x210 [ 466.304591] ? do_preadv+0x116/0x1a0 [ 466.304609] do_preadv+0x116/0x1a0 [ 466.309829] do_syscall_64+0xc8/0x600 [ 466.309849] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 466.309861] RIP: 0033:0x4560f9 [ 466.309875] Code: 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 466.309889] RSP: 002b:00007ffffa5166e8 EFLAGS: 00000206 ORIG_RAX: 0000000000000127 [ 466.322992] RAX: ffffffffffffffda RBX: 0000000000400460 RCX: 00000000004560f9 [ 466.322999] RDX: 0000000000000003 RSI: 00000000200008c0 RDI: 0000000000000003 [ 466.323007] RBP: 00007ffffa516700 R08: 0000000000000004 R09: 0000000000000000 [ 466.323014] R10: 0000000000000000 R11: 0000000000000206 R12: 000000000040cb10 [ 466.323021] R13: 0000000000000000 R14: 00000000006d7018 R15: 0000000000000000 [ 466.323057] [ 466.323064] Allocated by task 2605: [ 466.335165] save_stack+0x19/0x80 [ 466.336240] __kasan_kmalloc.constprop.8+0xa0/0xd0 [ 466.337755] kmem_cache_alloc+0xe8/0x320 [ 466.339050] getname_flags+0xca/0x560 [ 466.340229] user_path_at_empty+0x2c/0x50 [ 466.341508] vfs_statx+0xe6/0x190 [ 466.342619] __do_sys_newstat+0x81/0x100 [ 466.343908] do_syscall_64+0xc8/0x600 [ 466.345303] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 466.347034] [ 466.347517] Freed by task 2605: [ 466.348471] save_stack+0x19/0x80 [ 466.349476] __kasan_slab_free+0x12e/0x180 [ 466.350726] kmem_cache_free+0xc8/0x430 [ 466.351874] putname+0xe2/0x120 [ 466.352921] filename_lookup+0x257/0x3e0 [ 466.354319] vfs_statx+0xe6/0x190 [ 466.355498] __do_sys_newstat+0x81/0x100 [ 466.356889] do_syscall_64+0xc8/0x600 [ 466.358037] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 466.359567] [ 466.360050] The buggy address belongs to the object at ffff888372139100 [ 466.360050] which belongs to the cache names_cache of size 4096 [ 466.363735] The buggy address is located 336 bytes inside of [ 466.363735] 4096-byte region [ffff888372139100, ffff88837213a100) [ 466.367179] The buggy address belongs to the page: [ 466.368604] page:ffffea000dc84e00 refcount:1 mapcount:0 mapping:ffff8883df1b4f00 index:0x0 compound_mapcount: 0 [ 466.371582] flags: 0x2fffff80010200(slab|head) [ 466.372910] raw: 002fffff80010200 dead000000000100 dead000000000122 ffff8883df1b4f00 [ 466.375209] raw: 0000000000000000 0000000000070007 00000001ffffffff 0000000000000000 [ 466.377778] page dumped because: kasan: bad access detected [ 466.379730] [ 466.380288] Memory state around the buggy address: [ 466.381844] ffff888372139100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 466.384009] ffff888372139180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 466.386131] >ffff888372139200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 466.388257] ^ [ 466.390234] ffff888372139280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 466.392512] ffff888372139300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 466.394667] ================================================================== tun_chr_read_iter() accessed the memory which freed by free_netdev() called by tun_set_iff(): CPUA CPUB tun_set_iff() alloc_netdev_mqs() tun_attach() tun_chr_read_iter() tun_get() tun_do_read() tun_ring_recv() register_netdevice() <-- inject error goto err_detach tun_detach_all() <-- set RCV_SHUTDOWN free_netdev() <-- called from err_free_dev path netdev_freemem() <-- free the memory without check refcount (In this path, the refcount cannot prevent freeing the memory of dev, and the memory will be used by dev_put() called by tun_chr_read_iter() on CPUB.) (Break from tun_ring_recv(), because RCV_SHUTDOWN is set) tun_put() dev_put() <-- use the memory freed by netdev_freemem() Put the publishing of tfile->tun after register_netdevice(), so tun_get() won't get the tun pointer that freed by err_detach path if register_netdevice() failed. Fixes: eb0fb363f920 ("tuntap: attach queue 0 before registering netdevice") Reported-by: Hulk Robot Suggested-by: Jason Wang Signed-off-by: Yang Yingliang Signed-off-by: David S. Miller commit ad32b4800c2b59a303e337ec1f6c2f122418cebe Merge: 6dcf6a4eb95a 060423bfdee3 Author: Linus Torvalds Date: Thu Sep 12 11:07:31 2019 +0100 Merge tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost Pull virtio fixes from Michael Tsirkin: "Last minute bugfixes. A couple of security things. And an error handling bugfix that is never encountered by most people, but that also makes it kind of safe to push at the last minute, and it helps push the fix to stable a bit sooner" * tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost: vhost: make sure log_num < in_num vhost: block speculation of translated descriptors virtio_ring: fix unmap of indirect descriptors commit 6dcf6a4eb95a8a78c181cd27132f41aca36aeb94 Merge: 95779fe8506d 310aa0a25b33 Author: Linus Torvalds Date: Thu Sep 12 11:04:50 2019 +0100 Merge branch 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull perf fix from Ingo Molnar: "Fix an initialization bug in the hw-breakpoints, which triggered on the ARM platform" * 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: perf/hw_breakpoint: Fix arch_hw_breakpoint use-before-initialization commit 95779fe8506d4f750f1e66e958b6b3c405182d7a Merge: 840ce8f8073e eddf3e9c7c7e Author: Linus Torvalds Date: Thu Sep 12 11:02:00 2019 +0100 Merge branch 'irq-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull irq fix from Ingo Molnar: "Fix a race in the IRQ resend mechanism, which can result in a NULL dereference crash" * 'irq-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: genirq: Prevent NULL pointer dereference in resend_irqs() commit 840ce8f8073edb3ff3d2c2c7a6ef211f4176961c Merge: 9c09f6234871 c1432423a168 Author: Linus Torvalds Date: Thu Sep 12 10:58:47 2019 +0100 Merge tag 'pinctrl-v5.3-3' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl Pull pin control fix from Linus Walleij: "Hopefully last pin control fix: a single patch for some Aspeed problems. The BMCs are much happier now" * tag 'pinctrl-v5.3-3' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl: pinctrl: aspeed: Fix spurious mux failures on the AST2500 commit 9c09f623487178867d8000af337585b84b1f53d9 Merge: 3120b9a6a3f7 61f7f7c8f978 Author: Linus Torvalds Date: Thu Sep 12 09:53:38 2019 +0100 Merge tag 'gpio-v5.3-6' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio Pull GPIO fixes from Linus Walleij: "I don't really like to send so many fixes at the very last minute, but the bug-sport activity is unpredictable. Four fixes, three are -stable material that will go everywhere, one is for the current cycle: - An ACPI DSDT error fixup of the type we always see and Hans invariably gets to fix. - A OF quirk fix for the current release (v5.3) - Some consistency checks on the userspace ABI. - A memory leak" * tag 'gpio-v5.3-6' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio: gpiolib: acpi: Add gpiolib_acpi_run_edge_events_on_boot option and blacklist gpiolib: of: fix fallback quirks handling gpio: fix line flag validation in lineevent_create gpio: fix line flag validation in linehandle_create gpio: mockup: add missing single_release() commit c1432423a16825ef94e019808ed7330ee33ffc69 Author: Andrew Jeffery Date: Thu Aug 29 16:47:38 2019 +0930 pinctrl: aspeed: Fix spurious mux failures on the AST2500 Commit 674fa8daa8c9 ("pinctrl: aspeed-g5: Delay acquisition of regmaps") was determined to be a partial fix to the problem of acquiring the LPC Host Controller and GFX regmaps: The AST2500 pin controller may need to fetch syscon regmaps during expression evaluation as well as when setting mux state. For example, this case is hit by attempting to export pins exposing the LPC Host Controller as GPIOs. An optional eval() hook is added to the Aspeed pinmux operation struct and called from aspeed_sig_expr_eval() if the pointer is set by the SoC-specific driver. This enables the AST2500 to perform the custom action of acquiring its regmap dependencies as required. John Wang tested the fix on an Inspur FP5280G2 machine (AST2500-based) where the issue was found, and I've booted the fix on Witherspoon (AST2500) and Palmetto (AST2400) machines, and poked at relevant pins under QEMU by forcing mux configurations via devmem before exporting GPIOs to exercise the driver. Fixes: 7d29ed88acbb ("pinctrl: aspeed: Read and write bits in LPC and GFX controllers") Fixes: 674fa8daa8c9 ("pinctrl: aspeed-g5: Delay acquisition of regmaps") Reported-by: John Wang Tested-by: John Wang Signed-off-by: Andrew Jeffery Link: https://lore.kernel.org/r/20190829071738.2523-1-andrew@aj.id.au Signed-off-by: Linus Walleij commit 13d5231cc062fd037b2464d3595351d328d1cdf7 Merge: af38d07ed391 bf280c0387eb Author: David S. Miller Date: Thu Sep 12 00:05:52 2019 +0100 Merge branch '10GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/jkirsher/net-queue Jeff Kirsher says: ==================== Intel Wired LAN Driver Updates 2019-09-11 This series contains fixes to ixgbe. Alex fixes up the adaptive ITR scheme for ixgbe which could result in a value that was either 0 or something less than 10 which was causing issues with hardware features, like RSC, that do not function well with ITR values that low. Ilya Maximets fixes the ixgbe driver to limit the number of transmit descriptors to clean by the number of transmit descriptors used in the transmit ring, so that the driver does not try to "double" clean the same descriptors. ==================== Signed-off-by: David S. Miller commit af38d07ed391b21f7405fa1f936ca9686787d6d2 Author: Neal Cardwell Date: Mon Sep 9 16:56:02 2019 -0400 tcp: fix tcp_ecn_withdraw_cwr() to clear TCP_ECN_QUEUE_CWR Fix tcp_ecn_withdraw_cwr() to clear the correct bit: TCP_ECN_QUEUE_CWR. Rationale: basically, TCP_ECN_DEMAND_CWR is a bit that is purely about the behavior of data receivers, and deciding whether to reflect incoming IP ECN CE marks as outgoing TCP th->ece marks. The TCP_ECN_QUEUE_CWR bit is purely about the behavior of data senders, and deciding whether to send CWR. The tcp_ecn_withdraw_cwr() function is only called from tcp_undo_cwnd_reduction() by data senders during an undo, so it should zero the sender-side state, TCP_ECN_QUEUE_CWR. It does not make sense to stop the reflection of incoming CE bits on incoming data packets just because outgoing packets were spuriously retransmitted. The bug has been reproduced with packetdrill to manifest in a scenario with RFC3168 ECN, with an incoming data packet with CE bit set and carrying a TCP timestamp value that causes cwnd undo. Before this fix, the IP CE bit was ignored and not reflected in the TCP ECE header bit, and sender sent a TCP CWR ('W') bit on the next outgoing data packet, even though the cwnd reduction had been undone. After this fix, the sender properly reflects the CE bit and does not set the W bit. Note: the bug actually predates 2005 git history; this Fixes footer is chosen to be the oldest SHA1 I have tested (from Sep 2007) for which the patch applies cleanly (since before this commit the code was in a .h file). Fixes: bdf1ee5d3bd3 ("[TCP]: Move code from tcp_ecn.h to tcp*.c and tcp.h & remove it") Signed-off-by: Neal Cardwell Acked-by: Yuchung Cheng Acked-by: Soheil Hassas Yeganeh Cc: Eric Dumazet Signed-off-by: Eric Dumazet Signed-off-by: David S. Miller commit 060423bfdee3f8bc6e2c1bac97de24d5415e2bc4 Author: yongduan Date: Wed Sep 11 17:44:24 2019 +0800 vhost: make sure log_num < in_num The code assumes log_num < in_num everywhere, and that is true as long as in_num is incremented by descriptor iov count, and log_num by 1. However this breaks if there's a zero sized descriptor. As a result, if a malicious guest creates a vring desc with desc.len = 0, it may cause the host kernel to crash by overflowing the log array. This bug can be triggered during the VM migration. There's no need to log when desc.len = 0, so just don't increment log_num in this case. Fixes: 3a4d5c94e959 ("vhost_net: a kernel-level virtio server") Cc: stable@vger.kernel.org Reviewed-by: Lidong Chen Signed-off-by: ruippan Signed-off-by: yongduan Acked-by: Michael S. Tsirkin Reviewed-by: Tyler Hicks Signed-off-by: Michael S. Tsirkin commit a89db445fbd7f1f8457b03759aa7343fa530ef6b Author: Michael S. Tsirkin Date: Sun Sep 8 07:04:08 2019 -0400 vhost: block speculation of translated descriptors iovec addresses coming from vhost are assumed to be pre-validated, but in fact can be speculated to a value out of range. Userspace address are later validated with array_index_nospec so we can be sure kernel info does not leak through these addresses, but vhost must also not leak userspace info outside the allowed memory table to guests. Following the defence in depth principle, make sure the address is not validated out of node range. Signed-off-by: Michael S. Tsirkin Cc: stable@vger.kernel.org Acked-by: Jason Wang Tested-by: Jason Wang commit bf280c0387ebbf8eebad1036fca8f7b85ebfde32 Author: Ilya Maximets Date: Thu Aug 22 20:12:37 2019 +0300 ixgbe: fix double clean of Tx descriptors with xdp Tx code doesn't clear the descriptors' status after cleaning. So, if the budget is larger than number of used elems in a ring, some descriptors will be accounted twice and xsk_umem_complete_tx will move prod_tail far beyond the prod_head breaking the completion queue ring. Fix that by limiting the number of descriptors to clean by the number of used descriptors in the Tx ring. 'ixgbe_clean_xdp_tx_irq()' function refactored to look more like 'ixgbe_xsk_clean_tx_ring()' since we're allowed to directly use 'next_to_clean' and 'next_to_use' indexes. CC: stable@vger.kernel.org Fixes: 8221c5eba8c1 ("ixgbe: add AF_XDP zero-copy Tx support") Signed-off-by: Ilya Maximets Tested-by: William Tu Tested-by: Eelco Chaudron Signed-off-by: Jeff Kirsher commit 377228accbbb8b9738f615d791aa803f41c067e0 Author: Alexander Duyck Date: Wed Sep 4 08:07:11 2019 -0700 ixgbe: Prevent u8 wrapping of ITR value to something less than 10us There were a couple cases where the ITR value generated via the adaptive ITR scheme could exceed 126. This resulted in the value becoming either 0 or something less than 10. Switching back and forth between a value less than 10 and a value greater than 10 can cause issues as certain hardware features such as RSC to not function well when the ITR value has dropped that low. CC: stable@vger.kernel.org Fixes: b4ded8327fea ("ixgbe: Update adaptive ITR algorithm") Reported-by: Gregg Leventhal Signed-off-by: Alexander Duyck Tested-by: Andrew Bowers Signed-off-by: Jeff Kirsher commit f4b752a6b2708bfdf7fbe8a241082c8104f4ce05 Author: Colin Ian King Date: Wed Sep 11 15:18:11 2019 +0100 mlx4: fix spelling mistake "veify" -> "verify" There is a spelling mistake in a mlx4_err error message. Fix it. Signed-off-by: Colin Ian King Signed-off-by: David S. Miller commit c3dc1fa72249e4472b90ecef4dbafe25f0f07889 Author: Colin Ian King Date: Wed Sep 11 15:08:16 2019 +0100 net: hns3: fix spelling mistake "undeflow" -> "underflow" There is a spelling mistake in a .msg literal string. Fix it. Signed-off-by: Colin Ian King Signed-off-by: David S. Miller commit b93fb20f016c057d8a48c4ad62d493dfc5096d0c Author: Colin Ian King Date: Wed Sep 11 12:37:34 2019 +0100 net: lmc: fix spelling mistake "runnin" -> "running" There is a spelling mistake in the lmc_trace message. Fix it. Signed-off-by: Colin Ian King Signed-off-by: David S. Miller commit 90aa11f1bc5dbb0c392775ed63ced23a3873bcd2 Author: Colin Ian King Date: Wed Sep 11 11:38:48 2019 +0100 NFC: st95hf: fix spelling mistake "receieve" -> "receive" There is a spelling mistake in a dev_err message. Fix it. Signed-off-by: Colin Ian King Signed-off-by: David S. Miller commit c5c1a030a7dbf8dd4e1fa4405ae9a89dc1d2a8db Author: Ka-Cheong Poon Date: Wed Sep 11 02:58:05 2019 -0700 net/rds: An rds_sock is added too early to the hash table In rds_bind(), an rds_sock is added to the RDS bind hash table before rs_transport is set. This means that the socket can be found by the receive code path when rs_transport is NULL. And the receive code path de-references rs_transport for congestion update check. This can cause a panic. An rds_sock should not be added to the bind hash table before all the needed fields are set. Reported-by: syzbot+4b4f8163c2e246df3c4c@syzkaller.appspotmail.com Signed-off-by: Ka-Cheong Poon Signed-off-by: David S. Miller commit 3e493173b7841259a08c5c8e5cbe90adb349da7e Author: Jouni Malinen Date: Wed Sep 11 16:03:05 2019 +0300 mac80211: Do not send Layer 2 Update frame before authorization The Layer 2 Update frame is used to update bridges when a station roams to another AP even if that STA does not transmit any frames after the reassociation. This behavior was described in IEEE Std 802.11F-2003 as something that would happen based on MLME-ASSOCIATE.indication, i.e., before completing 4-way handshake. However, this IEEE trial-use recommended practice document was published before RSN (IEEE Std 802.11i-2004) and as such, did not consider RSN use cases. Furthermore, IEEE Std 802.11F-2003 was withdrawn in 2006 and as such, has not been maintained amd should not be used anymore. Sending out the Layer 2 Update frame immediately after association is fine for open networks (and also when using SAE, FT protocol, or FILS authentication when the station is actually authenticated by the time association completes). However, it is not appropriate for cases where RSN is used with PSK or EAP authentication since the station is actually fully authenticated only once the 4-way handshake completes after authentication and attackers might be able to use the unauthenticated triggering of Layer 2 Update frame transmission to disrupt bridge behavior. Fix this by postponing transmission of the Layer 2 Update frame from station entry addition to the point when the station entry is marked authorized. Similarly, send out the VLAN binding update only if the STA entry has already been authorized. Signed-off-by: Jouni Malinen Reviewed-by: Johannes Berg Signed-off-by: David S. Miller commit 49baa01c8b99ef92958e18fb58ebeb5dfdcde8af Author: Daniel Drake Date: Thu Sep 5 12:55:57 2019 +0800 Revert "mmc: sdhci: Remove unneeded quirk2 flag of O2 SD host controller" This reverts commit 414126f9e5abf1973c661d24229543a9458fa8ce. This commit broke eMMC storage access on a new consumer MiniPC based on AMD SoC, which has eMMC connected to: 02:00.0 SD Host controller: O2 Micro, Inc. Device 8620 (rev 01) (prog-if 01) Subsystem: O2 Micro, Inc. Device 0002 During probe, several errors are seen including: mmc1: Got data interrupt 0x02000000 even though no data operation was in progress. mmc1: Timeout waiting for hardware interrupt. mmc1: error -110 whilst initialising MMC card Reverting this commit allows the eMMC storage to be detected & usable again. Signed-off-by: Daniel Drake Fixes: 414126f9e5ab ("mmc: sdhci: Remove unneeded quirk2 flag of O2 SD host controller") Cc: stable@vger.kernel.org # v5.1+ Signed-off-by: Ulf Hansson commit aea64b583601aa5e0d6ea51a0420e46e43710bd4 Author: Stefan Wahren Date: Sun Sep 8 09:45:52 2019 +0200 Revert "mmc: bcm2835: Terminate timeout work synchronously" The commit 37fefadee8bb ("mmc: bcm2835: Terminate timeout work synchronously") causes lockups in case of hardware timeouts due the timeout work also calling cancel_delayed_work_sync() on its own. So revert it. Fixes: 37fefadee8bb ("mmc: bcm2835: Terminate timeout work synchronously") Cc: stable@vger.kernel.org Signed-off-by: Stefan Wahren Signed-off-by: Ulf Hansson commit 61f7f7c8f978b1c0d80e43c83b7d110ca0496eb4 Author: Hans de Goede Date: Tue Aug 27 22:28:35 2019 +0200 gpiolib: acpi: Add gpiolib_acpi_run_edge_events_on_boot option and blacklist Another day; another DSDT bug we need to workaround... Since commit ca876c7483b6 ("gpiolib-acpi: make sure we trigger edge events at least once on boot") we call _AEI edge handlers at boot. In some rare cases this causes problems. One example of this is the Minix Neo Z83-4 mini PC, this device has a clear DSDT bug where it has some copy and pasted code for dealing with Micro USB-B connector host/device role switching, while the mini PC does not even have a micro-USB connector. This code, which should not be there, messes with the DDC data pin from the HDMI connector (switching it to GPIO mode) breaking HDMI support. To avoid problems like this, this commit adds a new gpiolib_acpi.run_edge_events_on_boot kernel commandline option, which allows disabling the running of _AEI edge event handlers at boot. The default value is -1/auto which uses a DMI based blacklist, the initial version of this blacklist contains the Neo Z83-4 fixing the HDMI breakage. Cc: stable@vger.kernel.org Cc: Daniel Drake Cc: Ian W MORRISON Reported-by: Ian W MORRISON Suggested-by: Ian W MORRISON Fixes: ca876c7483b6 ("gpiolib-acpi: make sure we trigger edge events at least once on boot") Signed-off-by: Hans de Goede Link: https://lore.kernel.org/r/20190827202835.213456-1-hdegoede@redhat.com Acked-by: Mika Westerberg Reviewed-by: Andy Shevchenko Tested-by: Ian W MORRISON Signed-off-by: Linus Walleij commit 3dfdecc6d1256835ac0612b2a8f7595466d66327 Author: Randy Dunlap Date: Mon Sep 9 14:54:21 2019 -0700 lib/Kconfig: fix OBJAGG in lib/ menu structure Keep the "Library routines" menu intact by moving OBJAGG into it. Otherwise OBJAGG is displayed/presented as an orphan in the various config menus. Fixes: 0a020d416d0a ("lib: introduce initial implementation of object aggregation manager") Signed-off-by: Randy Dunlap Cc: Jiri Pirko Cc: Ido Schimmel Cc: David S. Miller Tested-by: Ido Schimmel Signed-off-by: David S. Miller commit 49f6c90bf6805948b597eabb499e500a47cf24be Author: Mao Wenan Date: Wed Sep 11 09:36:23 2019 +0800 net: sonic: replace dev_kfree_skb in sonic_send_packet sonic_send_packet will be processed in irq or non-irq context, so it would better use dev_kfree_skb_any instead of dev_kfree_skb. Fixes: d9fb9f384292 ("*sonic/natsemi/ns83829: Move the National Semi-conductor drivers") Signed-off-by: Mao Wenan Signed-off-by: David S. Miller commit 2507e6ab7a9a440773be476141a255934468c5ef Author: Navid Emamdoost Date: Tue Sep 10 18:01:40 2019 -0500 wimax: i2400: fix memory leak In i2400m_op_rfkill_sw_toggle cmd buffer should be released along with skb response. Signed-off-by: Navid Emamdoost Signed-off-by: David S. Miller commit f794dc2304d83ab998c2eee5bab0549aff5c53a2 Author: Xin Long Date: Mon Sep 9 15:33:29 2019 +0800 sctp: fix the missing put_user when dumping transport thresholds This issue causes SCTP_PEER_ADDR_THLDS sockopt not to be able to dump a transport thresholds info. Fix it by adding 'goto' put_user in sctp_getsockopt_paddr_thresholds. Fixes: 8add543e369d ("sctp: add SCTP_FUTURE_ASSOC for SCTP_PEER_ADDR_THLDS sockopt") Signed-off-by: Xin Long Acked-by: Marcelo Ricardo Leitner Acked-by: Neil Horman Signed-off-by: David S. Miller commit d4d6ec6dac07f263f06d847d6f732d6855522845 Author: Cong Wang Date: Sun Sep 8 13:40:51 2019 -0700 sch_hhf: ensure quantum and hhf_non_hh_weight are non-zero In case of TCA_HHF_NON_HH_WEIGHT or TCA_HHF_QUANTUM is zero, it would make no progress inside the loop in hhf_dequeue() thus kernel would get stuck. Fix this by checking this corner case in hhf_change(). Fixes: 10239edf86f1 ("net-qdisc-hhf: Heavy-Hitter Filter (HHF) qdisc") Reported-by: syzbot+bc6297c11f19ee807dc2@syzkaller.appspotmail.com Reported-by: syzbot+041483004a7f45f1f20a@syzkaller.appspotmail.com Reported-by: syzbot+55be5f513bed37fc4367@syzkaller.appspotmail.com Cc: Jamal Hadi Salim Cc: Jiri Pirko Cc: Terry Lam Signed-off-by: Cong Wang Signed-off-by: David S. Miller commit 8b142a00edcf8422ca48b8de88d286efb500cb53 Author: Cong Wang Date: Sun Sep 8 12:11:23 2019 -0700 net_sched: check cops->tcf_block in tc_bind_tclass() At least sch_red and sch_tbf don't implement ->tcf_block() while still have a non-zero tc "class". Instead of adding nop implementations to each of such qdisc's, we can just relax the check of cops->tcf_block() in tc_bind_tclass(). They don't support TC filter anyway. Reported-by: syzbot+21b29db13c065852f64b@syzkaller.appspotmail.com Cc: Jamal Hadi Salim Cc: Jiri Pirko Signed-off-by: Cong Wang Signed-off-by: David S. Miller commit 3120b9a6a3f7487f96af7bd634ec49c87ef712ab Merge: 56037cadf604 fb377eb80c80 Author: Linus Torvalds Date: Tue Sep 10 12:34:13 2019 +0100 Merge tag 'ipc-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arnd/asm-generic Pull ipc regression fixes from Arnd Bergmann: "Fix ipc regressions from y2038 patches These are two regression fixes for bugs that got introduced during the system call rework that went into linux-5.1 but only bisected and fixed now: - One patch affects semtimedop() on many of the less common 32-bit architectures, this just needs a single-line bugfix. - The other affects only sparc64 and has a slightly more invasive workaround to apply the same change to sparc64 that was done to the generic code used everywhere else" * tag 'ipc-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arnd/asm-generic: ipc: fix sparc64 ipc() wrapper ipc: fix semtimedop for generic 32-bit architectures commit 1dea33e84d33a5220aeda4ca9e918de0fd77c078 Author: Dmitry Torokhov Date: Tue Sep 3 16:18:56 2019 -0700 gpiolib: of: fix fallback quirks handling We should only try to execute fallback quirks handling when previous call returned -ENOENT, and not when we did not get -EPROBE_DEFER. The other errors should be treated as hard errors: we did find the GPIO description, but for some reason we failed to handle it properly. The fallbacks should only be executed when previous handlers returned -ENOENT, which means the mapping/description was not found. Also let's remove the explicit deferral handling when iterating through GPIO suffixes: it is not needed anymore as we will not be calling fallbacks for anything but -ENOENT. Fixes: df451f83e1fc ("gpio: of: fix Freescale SPI CS quirk handling") Signed-off-by: Dmitry Torokhov Link: https://lore.kernel.org/r/20190903231856.GA165165@dtor-ws Reviewed-by: Andy Shevchenko Signed-off-by: Linus Walleij commit aefde297da7b07cfc86487400ab3e06cfe6b2856 Merge: f74c2bb98776 5ca2f54b597c Author: Linus Walleij Date: Tue Sep 10 11:12:04 2019 +0100 Merge tag 'gpio-v5.4-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux into fixes gpio: fixes for v5.4 - fix a memory leak in gpio-mockup - fix two flag validation bugs in gpiolib's character device ioctl()'s commit 94a72b3f024fc7e9ab640897a1e38583a470659d Author: Nicolas Dichtel Date: Fri Sep 6 11:47:02 2019 +0200 bridge/mdb: remove wrong use of NLM_F_MULTI NLM_F_MULTI must be used only when a NLMSG_DONE message is sent at the end. In fact, NLMSG_DONE is sent only at the end of a dump. Libraries like libnl will wait forever for NLMSG_DONE. Fixes: 949f1e39a617 ("bridge: mdb: notify on router port add and del") CC: Nikolay Aleksandrov Signed-off-by: Nicolas Dichtel Acked-by: Nikolay Aleksandrov Signed-off-by: David S. Miller commit c8dc55956b09b53ccffceb6e3146981210e27821 Author: Michal Suchanek Date: Mon Sep 9 22:44:51 2019 +0200 net/ibmvnic: Fix missing { in __ibmvnic_reset Commit 1c2977c09499 ("net/ibmvnic: free reset work of removed device from queue") adds a } without corresponding { causing build break. Fixes: 1c2977c09499 ("net/ibmvnic: free reset work of removed device from queue") Signed-off-by: Michal Suchanek Reviewed-by: Tyrel Datwyler Reviewed-by: Juliet Kim Signed-off-by: David S. Miller commit 21670bd78a25001cf8ef2679b378c73fb73b904f Author: Vasily Khoruzhick Date: Sat Sep 7 19:48:00 2019 -0700 drm/lima: fix lima_gem_wait() return value drm_gem_reservation_object_wait() returns 0 if it succeeds and -ETIME if it timeouts, but lima driver assumed that 0 is error. Cc: stable@vger.kernel.org Fixes: a1d2a6339961e ("drm/lima: driver for ARM Mali4xx GPUs") Signed-off-by: Vasily Khoruzhick Signed-off-by: Qiang Yu Link: https://patchwork.freedesktop.org/patch/msgid/20190908024800.23229-1-anarsoul@gmail.com commit 56037cadf60461b4a2996b4d8f0057c4d343c17c Merge: f74c2bb98776 3829100a6372 Author: Linus Torvalds Date: Mon Sep 9 10:58:57 2019 -0700 Merge tag 'regulator-fix-v5.3-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator Pull regulator fixes from Mark Brown: "This is obviouly very late, containing three small and simple driver specific fixes. The main one is the TWL fix, this fixes issues with cpufreq on the PMICs used with BeagleBoard generation OMAP SoCs which had been broken due to changes in the generic OPP code exposing a bug in the regulator driver for these devices causing them to think that OPPs weren't supported on the system. Sorry about sending this so late, I hadn't registered that the TWL issue manifested in cpufreq" * tag 'regulator-fix-v5.3-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator: regulator: twl: voltage lists for vdd1/2 on twl4030 regulator: act8945a-regulator: fix ldo register addresses in set_mode hook regulator: slg51000: Fix a couple NULL vs IS_ERR() checks commit cf8f1696709ad5bb3138ed8c771c2eb98950cd8a Author: Matthias Lange Date: Fri Sep 6 16:59:01 2019 +0200 virtio_ring: fix unmap of indirect descriptors The function virtqueue_add_split() DMA-maps the scatterlist buffers. In case a mapping error occurs the already mapped buffers must be unmapped. This happens by jumping to the 'unmap_release' label. In case of indirect descriptors the release is wrong and may leak kernel memory. Because the implementation assumes that the head descriptor is already mapped it starts iterating over the descriptor list starting from the head descriptor. However for indirect descriptors the head descriptor is never mapped in case of an error. The fix is to initialize the start index with zero in case of indirect descriptors and use the 'desc' pointer directly for iterating over the descriptor chain. Signed-off-by: Matthias Lange Signed-off-by: Michael S. Tsirkin commit 2eb0964eec5f1d99f9eaf4963eee267acc72b615 Author: Chris Wilson Date: Wed Sep 4 11:07:07 2019 +0100 drm/i915: Restore relaxed padding (OCL_OOB_SUPPRES_ENABLE) for skl+ This bit was fliped on for "syncing dependencies between camera and graphics". BSpec has no recollection why, and it is causing unrecoverable GPU hangs with Vulkan compute workloads. From BSpec, setting bit5 to 0 enables relaxed padding requirements for buffers, 1D and 2D non-array, non-MSAA, non-mip-mapped linear surfaces; and *must* be set to 0h on skl+ to ensure "Out of Bounds" case is suppressed. Reported-by: Jason Ekstrand Suggested-by: Jason Ekstrand Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=110998 Fixes: 8424171e135c ("drm/i915/gen9: h/w w/a: syncing dependencies between camera and graphics") Signed-off-by: Chris Wilson Tested-by: denys.kostin@globallogic.com Cc: Jason Ekstrand Cc: Mika Kuoppala Cc: # v4.1+ Reviewed-by: Mika Kuoppala Link: https://patchwork.freedesktop.org/patch/msgid/20190904100707.7377-1-chris@chris-wilson.co.uk (cherry picked from commit 9d7b01e93526efe79dbf75b69cc5972b5a4f7b37) Signed-off-by: Jani Nikula commit bb1a71f9c4672fbfcf2158fd57d0c5c0cdae5612 Author: Ville Syrjälä Date: Wed Aug 28 13:20:59 2019 +0300 drm/i915: Limit MST to <= 8bpc once again My attempt at allowing MST to use the higher color depths has regressed some configurations. Apparently people have setups where all MST streams will fit into the DP link with 8bpc but won't fit with higher color depths. What we really should be doing is reducing the bpc for all the streams on the same link until they start to fit. But that requires a bit more work, so in the meantime let's revert back closer to the old behavior and limit MST to at most 8bpc. Cc: stable@vger.kernel.org Cc: Lyude Paul Tested-by: Geoffrey Bennett Fixes: f1477219869c ("drm/i915: Remove the 8bpc shackles from DP MST") Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=111505 Signed-off-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20190828102059.2512-1-ville.syrjala@linux.intel.com Reviewed-by: Lyude Paul (cherry picked from commit 75427b2a2bffc083d51dec389c235722a9c69b05) Signed-off-by: Jani Nikula commit 5ca2f54b597c816df54ff1b28eb99cf7262b955d Author: Kent Gibson Date: Mon Sep 9 03:24:06 2019 +0000 gpio: fix line flag validation in lineevent_create lineevent_create should not allow any of GPIOHANDLE_REQUEST_OUTPUT, GPIOHANDLE_REQUEST_OPEN_DRAIN or GPIOHANDLE_REQUEST_OPEN_SOURCE to be set. Fixes: d7c51b47ac11 ("gpio: userspace ABI for reading/writing GPIO lines") Cc: stable Signed-off-by: Kent Gibson Signed-off-by: Bartosz Golaszewski commit e95fbc130a162ba9ad956311b95aa0da269eea48 Author: Kent Gibson Date: Mon Sep 9 03:22:18 2019 +0000 gpio: fix line flag validation in linehandle_create linehandle_create should not allow both GPIOHANDLE_REQUEST_INPUT and GPIOHANDLE_REQUEST_OUTPUT to be set. Fixes: d7c51b47ac11 ("gpio: userspace ABI for reading/writing GPIO lines") Cc: stable Signed-off-by: Kent Gibson Signed-off-by: Bartosz Golaszewski commit 59929d3a2eb6c4abafc5b61a20c98aa8728ec378 Author: Wei Yongjun Date: Wed Sep 4 14:18:34 2019 +0000 gpio: mockup: add missing single_release() When using single_open() for opening, single_release() should be used instead of seq_release(), otherwise there is a memory leak. Fixes: 2a9e27408e12 ("gpio: mockup: rework debugfs interface") Cc: stable Signed-off-by: Wei Yongjun Signed-off-by: Bartosz Golaszewski commit f74c2bb98776e2de508f4d607cd519873065118e Author: Linus Torvalds Date: Sun Sep 8 13:33:15 2019 -0700 Linux 5.3-rc8 commit 983f700eab89c73562f308fc49b1561377d3920e Merge: def8b72f0e40 bfafddd8de42 Author: Linus Torvalds Date: Sun Sep 8 09:34:55 2019 -0700 Merge tag 'compiler-attributes-for-linus-v5.3-rc8' of git://github.com/ojeda/linux Pull section attribute fix from Miguel Ojeda: "Fix Oops in Clang-compiled kernels (Nick Desaulniers)" * tag 'compiler-attributes-for-linus-v5.3-rc8' of git://github.com/ojeda/linux: include/linux/compiler.h: fix Oops for Clang-compiled kernels commit def8b72f0e40f2c9d9f1843af020a955e36a7cf4 Merge: 950b07c14e8c 89f2c0425cb5 Author: Linus Torvalds Date: Sun Sep 8 09:30:31 2019 -0700 Merge tag 'gpio-v5.3-5' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio Pull GPIO fixes from Linus Walleij: "All related to the PCA953x driver when handling chips with more than 8 ports, now that works again" * tag 'gpio-v5.3-5' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio: gpio: pca953x: use pca953x_read_regs instead of regmap_bulk_read gpio: pca953x: correct type of reg_direction commit bfafddd8de426d894fcf3e062370b1efaa195ebc Author: Nick Desaulniers Date: Wed Aug 28 15:55:23 2019 -0700 include/linux/compiler.h: fix Oops for Clang-compiled kernels GCC unescapes escaped string section names while Clang does not. Because __section uses the `#` stringification operator for the section name, it doesn't need to be escaped. This fixes an Oops observed in distro's that use systemd and not net.core.bpf_jit_enable=1, when their kernels are compiled with Clang. Link: https://github.com/ClangBuiltLinux/linux/issues/619 Link: https://bugs.llvm.org/show_bug.cgi?id=42950 Link: https://marc.info/?l=linux-netdev&m=156412960619946&w=2 Link: https://lore.kernel.org/lkml/20190904181740.GA19688@gmail.com/ Acked-by: Will Deacon Reported-by: Sedat Dilek Suggested-by: Josh Poimboeuf Tested-by: Sedat Dilek Signed-off-by: Nick Desaulniers [Cherry-picked from the __section cleanup series for 5.3] [Adjusted commit message] Signed-off-by: Miguel Ojeda commit afa8b475c1aec185a8e106c48b3832e0b88bc2de Author: Jan Stancek Date: Sun Sep 8 00:50:40 2019 +0200 x86/timer: Force PIT initialization when !X86_FEATURE_ARAT KVM guests with commit c8c4076723da ("x86/timer: Skip PIT initialization on modern chipsets") applied to guest kernel have been observed to have unusually higher CPU usage with symptoms of increase in vm exits for HLT and MSW_WRITE (MSR_IA32_TSCDEADLINE). This is caused by older QEMUs lacking support for X86_FEATURE_ARAT. lapic clock retains CLOCK_EVT_FEAT_C3STOP and nohz stays inactive. There's no usable broadcast device either. Do the PIT initialization if guest CPU lacks X86_FEATURE_ARAT. On real hardware it shouldn't matter as ARAT and DEADLINE come together. Fixes: c8c4076723da ("x86/timer: Skip PIT initialization on modern chipsets") Signed-off-by: Jan Stancek Signed-off-by: Thomas Gleixner commit 950b07c14e8c59444e2359f15fd70ed5112e11a0 Author: Linus Torvalds Date: Sat Sep 7 14:25:54 2019 -0700 Revert "x86/apic: Include the LDR when clearing out APIC registers" This reverts commit 558682b5291937a70748d36fd9ba757fb25b99ae. Chris Wilson reports that it breaks his CPU hotplug test scripts. In particular, it breaks offlining and then re-onlining the boot CPU, which we treat specially (and the BIOS does too). The symptoms are that we can offline the CPU, but it then does not come back online again: smpboot: CPU 0 is now offline smpboot: Booting Node 0 Processor 0 APIC 0x0 smpboot: do_boot_cpu failed(-1) to wakeup CPU#0 Thomas says he knows why it's broken (my personal suspicion: our magic handling of the "cpu0_logical_apicid" thing), but for 5.3 the right fix is to just revert it, since we've never touched the LDR bits before, and it's not worth the risk to do anything else at this stage. [ Hotpluging of the boot CPU is special anyway, and should be off by default. See the "BOOTPARAM_HOTPLUG_CPU0" config option and the cpu0_hotplug kernel parameter. In general you should not do it, and it has various known limitations (hibernate and suspend require the boot CPU, for example). But it should work, even if the boot CPU is special and needs careful treatment - Linus ] Link: https://lore.kernel.org/lkml/156785100521.13300.14461504732265570003@skylake-alporthouse-com/ Reported-by: Chris Wilson Acked-by: Thomas Gleixner Cc: Bandan Das Signed-off-by: Linus Torvalds commit fb377eb80c80339b580831a3c0fcce34a4c9d1ad Author: Arnd Bergmann Date: Thu Sep 5 16:48:38 2019 +0200 ipc: fix sparc64 ipc() wrapper Matt bisected a sparc64 specific issue with semctl, shmctl and msgctl to a commit from my y2038 series in linux-5.1, as I missed the custom sys_ipc() wrapper that sparc64 uses in place of the generic version that I patched. The problem is that the sys_{sem,shm,msg}ctl() functions in the kernel now do not allow being called with the IPC_64 flag any more, resulting in a -EINVAL error when they don't recognize the command. Instead, the correct way to do this now is to call the internal ksys_old_{sem,shm,msg}ctl() functions to select the API version. As we generally move towards these functions anyway, change all of sparc_ipc() to consistently use those in place of the sys_*() versions, and move the required ksys_*() declarations into linux/syscalls.h The IS_ENABLED(CONFIG_SYSVIPC) check is required to avoid link errors when ipc is disabled. Reported-by: Matt Turner Fixes: 275f22148e87 ("ipc: rename old-style shmctl/semctl/msgctl syscalls") Cc: stable@vger.kernel.org Tested-by: Matt Turner Tested-by: Anatoly Pugachev Signed-off-by: Arnd Bergmann commit b3a9964cfa690150e49ae75ba16416ccaac3a8ba Merge: d3464ccd105b a8e0abae2fe0 Author: Linus Torvalds Date: Sat Sep 7 11:48:28 2019 -0700 Merge tag 'char-misc-5.3-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc Pull Documentation updates from Greg KH: "A few small patches for the documenation file that came in through the char-misc tree in -rc7 for your tree. They fix the mistake in the .rst format that kept the table of companies from showing up in the html output, and most importantly, add people's names to the list showing support for our process" * tag 'char-misc-5.3-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: Documentation/process: Add Qualcomm process ambassador for hardware security issues Documentation/process/embargoed-hardware-issues: Microsoft ambassador Documentation/process: Add Google contact for embargoed hardware issues Documentation/process: Volunteer as the ambassador for Xen commit a8e0abae2fe0e788fa3d92c043605d1211c13735 Author: Trilok Soni Date: Fri Sep 6 12:01:57 2019 -0700 Documentation/process: Add Qualcomm process ambassador for hardware security issues Add Trilok Soni as process ambassador for hardware security issues from Qualcomm. Signed-off-by: Trilok Soni Link: https://lore.kernel.org/r/1567796517-8964-1-git-send-email-tsoni@codeaurora.org Signed-off-by: Greg Kroah-Hartman commit d3464ccd105b42f87302572ee1f097e6e0b432c6 Merge: 1e3778cb223e cf24aac38698 Author: Linus Torvalds Date: Sat Sep 7 10:00:34 2019 -0700 Merge tag 'dmaengine-fix-5.3' of git://git.infradead.org/users/vkoul/slave-dma Pull dmaengine fixes from Vinod Koul: "Some late fixes for drivers: - memory leak in ti crossbar dma driver - cleanup of omap dma probe - Fix for link list configuration in sprd dma driver - Handling fixed for DMACHCLR if iommu is mapped in rcar dma" * tag 'dmaengine-fix-5.3' of git://git.infradead.org/users/vkoul/slave-dma: dmaengine: rcar-dmac: Fix DMACHCLR handling if iommu is mapped dmaengine: sprd: Fix the DMA link-list configuration dmaengine: ti: omap-dma: Add cleanup in omap_dma_probe() dmaengine: ti: dma-crossbar: Fix a memory leak bug commit 28abe579625249161f5de943b8f8713aa8c48452 Author: Fred Lotter Date: Fri Sep 6 19:29:41 2019 +0200 nfp: flower: cmsg rtnl locks can timeout reify messages Flower control message replies are handled in different locations. The truly high priority replies are handled in the BH (tasklet) context, while the remaining replies are handled in a predefined Linux work queue. The work queue handler orders replies into high and low priority groups, and always start servicing the high priority replies within the received batch first. Reply Type: Rtnl Lock: Handler: CMSG_TYPE_PORT_MOD no BH tasklet (mtu) CMSG_TYPE_TUN_NEIGH no BH tasklet CMSG_TYPE_FLOW_STATS no BH tasklet CMSG_TYPE_PORT_REIFY no WQ high CMSG_TYPE_PORT_MOD yes WQ high (link/mtu) CMSG_TYPE_MERGE_HINT yes WQ low CMSG_TYPE_NO_NEIGH no WQ low CMSG_TYPE_ACTIVE_TUNS no WQ low CMSG_TYPE_QOS_STATS no WQ low CMSG_TYPE_LAG_CONFIG no WQ low A subset of control messages can block waiting for an rtnl lock (from both work queue priority groups). The rtnl lock is heavily contended for by external processes such as systemd-udevd, systemd-network and libvirtd, especially during netdev creation, such as when flower VFs and representors are instantiated. Kernel netlink instrumentation shows that external processes (such as systemd-udevd) often use successive rtnl_trylock() sequences, which can result in an rtnl_lock() blocked control message to starve for longer periods of time during rtnl lock contention, i.e. netdev creation. In the current design a single blocked control message will block the entire work queue (both priorities), and introduce a latency which is nondeterministic and dependent on system wide rtnl lock usage. In some extreme cases, one blocked control message at exactly the wrong time, just before the maximum number of VFs are instantiated, can block the work queue for long enough to prevent VF representor REIFY replies from getting handled in time for the 40ms timeout. The firmware will deliver the total maximum number of REIFY message replies in around 300us. Only REIFY and MTU update messages require replies within a timeout period (of 40ms). The MTU-only updates are already done directly in the BH (tasklet) handler. Move the REIFY handler down into the BH (tasklet) in order to resolve timeouts caused by a blocked work queue waiting on rtnl locks. Signed-off-by: Fred Lotter Signed-off-by: Simon Horman Signed-off-by: David S. Miller commit 3dcbdb134f329842a38f0e6797191b885ab00a00 Author: Shmulik Ladkani Date: Fri Sep 6 12:23:50 2019 +0300 net: gso: Fix skb_segment splat when splitting gso_size mangled skb having linear-headed frag_list Historically, support for frag_list packets entering skb_segment() was limited to frag_list members terminating on exact same gso_size boundaries. This is verified with a BUG_ON since commit 89319d3801d1 ("net: Add frag_list support to skb_segment"), quote: As such we require all frag_list members terminate on exact MSS boundaries. This is checked using BUG_ON. As there should only be one producer in the kernel of such packets, namely GRO, this requirement should not be difficult to maintain. However, since commit 6578171a7ff0 ("bpf: add bpf_skb_change_proto helper"), the "exact MSS boundaries" assumption no longer holds: An eBPF program using bpf_skb_change_proto() DOES modify 'gso_size', but leaves the frag_list members as originally merged by GRO with the original 'gso_size'. Example of such programs are bpf-based NAT46 or NAT64. This lead to a kernel BUG_ON for flows involving: - GRO generating a frag_list skb - bpf program performing bpf_skb_change_proto() or bpf_skb_adjust_room() - skb_segment() of the skb See example BUG_ON reports in [0]. In commit 13acc94eff12 ("net: permit skb_segment on head_frag frag_list skb"), skb_segment() was modified to support the "gso_size mangling" case of a frag_list GRO'ed skb, but *only* for frag_list members having head_frag==true (having a page-fragment head). Alas, GRO packets having frag_list members with a linear kmalloced head (head_frag==false) still hit the BUG_ON. This commit adds support to skb_segment() for a 'head_skb' packet having a frag_list whose members are *non* head_frag, with gso_size mangled, by disabling SG and thus falling-back to copying the data from the given 'head_skb' into the generated segmented skbs - as suggested by Willem de Bruijn [1]. Since this approach involves the penalty of skb_copy_and_csum_bits() when building the segments, care was taken in order to enable this solution only when required: - untrusted gso_size, by testing SKB_GSO_DODGY is set (SKB_GSO_DODGY is set by any gso_size mangling functions in net/core/filter.c) - the frag_list is non empty, its item is a non head_frag, *and* the headlen of the given 'head_skb' does not match the gso_size. [0] https://lore.kernel.org/netdev/20190826170724.25ff616f@pixies/ https://lore.kernel.org/netdev/9265b93f-253d-6b8c-f2b8-4b54eff1835c@fb.com/ [1] https://lore.kernel.org/netdev/CA+FuTSfVsgNDi7c=GUU8nMg2hWxF2SjCNLXetHeVPdnxAW5K-w@mail.gmail.com/ Fixes: 6578171a7ff0 ("bpf: add bpf_skb_change_proto helper") Suggested-by: Willem de Bruijn Cc: Daniel Borkmann Cc: Eric Dumazet Cc: Alexander Duyck Signed-off-by: Shmulik Ladkani Reviewed-by: Willem de Bruijn Reviewed-by: Alexander Duyck Signed-off-by: David S. Miller commit 8652f17c658d03f5c87b8dee6e8e52480c6cd37d Author: Maciej Żenczykowski Date: Thu Sep 5 20:56:37 2019 -0700 ipv6: addrconf_f6i_alloc - fix non-null pointer check to !IS_ERR() Fixes a stupid bug I recently introduced... ip6_route_info_create() returns an ERR_PTR(err) and not a NULL on error. Fixes: d55a2e374a94 ("net-ipv6: fix excessive RTF_ADDRCONF flag on ::1/128 local route (and others)'") Cc: David Ahern Cc: Lorenzo Colitti Cc: Eric Dumazet Signed-off-by: Maciej Żenczykowski Reported-by: syzbot Signed-off-by: Eric Dumazet Signed-off-by: David S. Miller commit fe163e534e5eecdfd7b5920b0dfd24c458ee85d6 Author: Eric Biggers Date: Thu Sep 5 19:36:37 2019 -0700 isdn/capi: check message length in capi_write() syzbot reported: BUG: KMSAN: uninit-value in capi_write+0x791/0xa90 drivers/isdn/capi/capi.c:700 CPU: 0 PID: 10025 Comm: syz-executor379 Not tainted 4.20.0-rc7+ #2 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x173/0x1d0 lib/dump_stack.c:113 kmsan_report+0x12e/0x2a0 mm/kmsan/kmsan.c:613 __msan_warning+0x82/0xf0 mm/kmsan/kmsan_instr.c:313 capi_write+0x791/0xa90 drivers/isdn/capi/capi.c:700 do_loop_readv_writev fs/read_write.c:703 [inline] do_iter_write+0x83e/0xd80 fs/read_write.c:961 vfs_writev fs/read_write.c:1004 [inline] do_writev+0x397/0x840 fs/read_write.c:1039 __do_sys_writev fs/read_write.c:1112 [inline] __se_sys_writev+0x9b/0xb0 fs/read_write.c:1109 __x64_sys_writev+0x4a/0x70 fs/read_write.c:1109 do_syscall_64+0xbc/0xf0 arch/x86/entry/common.c:291 entry_SYSCALL_64_after_hwframe+0x63/0xe7 [...] The problem is that capi_write() is reading past the end of the message. Fix it by checking the message's length in the needed places. Reported-and-tested-by: syzbot+0849c524d9c634f5ae66@syzkaller.appspotmail.com Signed-off-by: Eric Biggers Signed-off-by: David S. Miller commit 1c2977c094998de032fee6e898c88b4a05483d08 Author: Juliet Kim Date: Thu Sep 5 17:30:01 2019 -0400 net/ibmvnic: free reset work of removed device from queue Commit 36f1031c51a2 ("ibmvnic: Do not process reset during or after device removal") made the change to exit reset if the driver has been removed, but does not free reset work items of the adapter from queue. Ensure all reset work items are freed when breaking out of the loop early. Fixes: 36f1031c51a2 ("ibmnvic: Do not process reset during or after device removal”) Signed-off-by: Juliet Kim Signed-off-by: David S. Miller commit 63b2ed4e10b2e6c913e1d8cdd728e7fba4115a3d Author: Stefan Chulski Date: Thu Sep 5 19:46:18 2019 +0300 net: phylink: Fix flow control resolution Regarding to IEEE 802.3-2015 standard section 2 28B.3 Priority resolution - Table 28-3 - Pause resolution In case of Local device Pause=1 AsymDir=0, Link partner Pause=1 AsymDir=1, Local device resolution should be enable PAUSE transmit, disable PAUSE receive. And in case of Local device Pause=1 AsymDir=1, Link partner Pause=1 AsymDir=0, Local device resolution should be enable PAUSE receive, disable PAUSE transmit. Fixes: 9525ae83959b ("phylink: add phylink infrastructure") Signed-off-by: Stefan Chulski Reported-by: Shaul Ben-Mayor Acked-by: Russell King Signed-off-by: David S. Miller commit b82573fdbef809803d06295f318f7ad1a2c5ceb9 Author: Christophe JAILLET Date: Mon Aug 26 21:02:09 2019 +0200 net/hamradio/6pack: Fix the size of a sk_buff used in 'sp_bump()' We 'allocate' 'count' bytes here. In fact, 'dev_alloc_skb' already add some extra space for padding, so a bit more is allocated. However, we use 1 byte for the KISS command, then copy 'count' bytes, so count+1 bytes. Explicitly allocate and use 1 more byte to be safe. Signed-off-by: Christophe JAILLET Signed-off-by: David S. Miller commit 0c04eb72d332ef6e12c3ecb0c638359e65ad29d9 Merge: 74346c434cd2 2339cd6cd0b5 Author: David S. Miller Date: Sat Sep 7 09:52:29 2019 +0200 Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf Alexei Starovoitov says: ==================== pull-request: bpf 2019-09-06 The following pull-request contains BPF updates for your *net* tree. The main changes are: 1) verifier precision tracking fix, from Alexei. ==================== Signed-off-by: David S. Miller commit 1e3778cb223e861808ae0daccf353536e7573eed Merge: 7641033e17ef 0622800d2ebc Author: Linus Torvalds Date: Fri Sep 6 16:18:43 2019 -0700 Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull SCSI fix from James Bottomley: "Just a single lpfc fix adjusting the number of available queues for high CPU count systems" * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: scsi: lpfc: Raise config max for lpfc_fcp_mq_threshold variable commit 7641033e17efe472c0e2fd6da00f1b75dc6788f3 Merge: 9772152b4b3c 274b924088e9 Author: Linus Torvalds Date: Fri Sep 6 16:14:32 2019 -0700 Merge tag 'libnvdimm-fix-5.3-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm Pull libnvdimm fix from Dan Williams: "Restore support for 1GB alignment namespaces, truncate the end of misaligned namespaces" * tag 'libnvdimm-fix-5.3-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm: libnvdimm/pfn: Fix namespace creation on misaligned addresses commit 9772152b4b3cd32a1aadf75e3d1a16a072d3e4a5 Merge: 36daa831b555 0c043d70d047 Author: Linus Torvalds Date: Fri Sep 6 16:12:30 2019 -0700 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input Pull input fix from Dmitry Torokhov: "A tiny update from Benjamin removing a mistakenly added Elan PNP ID so that the device is again handled by hid-multitouch" * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: Input: elan_i2c - remove Lenovo Legion Y7000 PnpID commit 0c043d70d04711fe6c380df9065fdc44192c49bf Author: Benjamin Tissoires Date: Fri Sep 6 12:02:32 2019 -0700 Input: elan_i2c - remove Lenovo Legion Y7000 PnpID Looks like the Bios of the Lenovo Legion Y7000 is using ELAN061B when the actual device is supposed to be used with hid-multitouch. Remove it from the list of the supported device, hoping that no one will complain about the loss in functionality. Link: https://bugzilla.kernel.org/show_bug.cgi?id=203467 Fixes: 738c06d0e456 ("Input: elan_i2c - add hardware ID for multiple Lenovo laptops") Signed-off-by: Benjamin Tissoires Signed-off-by: Dmitry Torokhov commit 36daa831b55538dc2e4a906de20c5d91033ebb21 Merge: 30d7030b2fb3 8928e917aeaf Author: Linus Torvalds Date: Fri Sep 6 12:53:31 2019 -0700 Merge tag 'armsoc-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc Pull ARM SoC fixes from Arnd Bergmann: "There are three more fixes for this week: - The Windows-on-ARM laptops require a workaround to prevent crashing at boot from ACPI - The Renesas 'draak' board needs one bugfix for the backlight regulator - Also for Renesas, the 'hihope' board accidentally had its eMMC turned off in the 5.3 merge window" * tag 'armsoc-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: soc: qcom: geni: Provide parameter error checking arm64: dts: renesas: hihope-common: Fix eMMC status arm64: dts: renesas: r8a77995: draak: Fix backlight regulator name commit 78e05972c5e6c8e9ca4c00ccc6985409da69f904 Author: Arnd Bergmann Date: Thu Sep 5 16:20:09 2019 +0200 ipc: fix semtimedop for generic 32-bit architectures As Vincent noticed, the y2038 conversion of semtimedop in linux-5.1 broke when commit 00bf25d693e7 ("y2038: use time32 syscall names on 32-bit") changed all system calls on all architectures that take a 32-bit time_t to point to the _time32 implementation, but left out semtimedop in the asm-generic header. This affects all 32-bit architectures using asm-generic/unistd.h: h8300, unicore32, openrisc, nios2, hexagon, c6x, arc, nds32 and csky. The notable exception is riscv32, which has dropped support for the time32 system calls entirely. Reported-by: Vincent Chen Cc: stable@vger.kernel.org Cc: Vincent Chen Cc: Greentime Hu Cc: Yoshinori Sato Cc: Guan Xuetao Cc: Stafford Horne Cc: Jonas Bonn Cc: Stefan Kristiansson Cc: Ley Foon Tan Cc: Richard Kuo Cc: Mark Salter Cc: Aurelien Jacquiot Cc: Guo Ren Fixes: 00bf25d693e7 ("y2038: use time32 syscall names on 32-bit") Signed-off-by: Arnd Bergmann commit 30d7030b2fb39d9b53270b2fe0caac8e8792890c Merge: 76f5e9f870b0 b0841eefd969 Author: Linus Torvalds Date: Fri Sep 6 12:44:08 2019 -0700 Merge tag 'configfs-for-5.3' of git://git.infradead.org/users/hch/configfs Pull configfs fixes from Christoph Hellwig: "Late configfs fixes from Al that fix pretty nasty removal vs attribute access races" * tag 'configfs-for-5.3' of git://git.infradead.org/users/hch/configfs: configfs: provide exclusion between IO and removals configfs: new object reprsenting tree fragments configfs_register_group() shouldn't be (and isn't) called in rmdirable parts configfs: stash the data we need into configfs_buffer at open time commit 76f5e9f870b045546b9a429f21b65205baf69c0c Merge: 044597100037 754265bcab78 Author: Linus Torvalds Date: Fri Sep 6 12:22:36 2019 -0700 Merge tag 'iommu-fixes-v5.3-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu Pull IOMMU fixes from Joerg Roedel: - Revert an Intel VT-d patch that caused problems for some users. - Removal of a feature in the Intel VT-d driver that was never supported in hardware. This qualifies as a fix because the code for this feature sets reserved bits in the invalidation queue descriptor, causing failed invalidations on real hardware. - Two fixes for AMD IOMMU driver to fix a race condition and to add a missing IOTLB flush when kernel is booted in kdump mode. * tag 'iommu-fixes-v5.3-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu: iommu/amd: Fix race in increase_address_space() iommu/amd: Flush old domains in kdump kernel iommu/vt-d: Remove global page flush support Revert "iommu/vt-d: Avoid duplicated pci dma alias consideration" commit 0445971000375859008414f87e7c72fa0d809cf8 Merge: 08d433d81215 8ad8e02c2fa7 Author: Linus Torvalds Date: Fri Sep 6 09:01:49 2019 -0700 Merge tag 'mmc-v5.3-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc Pull MMC fix from Ulf Hansson: "Revert in order to fix card init for some eMMCs that need retries for CMD6" * tag 'mmc-v5.3-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc: Revert "mmc: core: do not retry CMD6 in __mmc_switch()" commit 08d433d8121598f7c2a45f3461c534746b1ed05b Merge: 9d098a6234c1 1e19ec6c3c41 Author: Linus Torvalds Date: Fri Sep 6 08:58:19 2019 -0700 Merge tag 'drm-fixes-2019-09-06' of git://anongit.freedesktop.org/drm/drm Pull drm fixes from Dave Airlie: "Live from my friend's couch in Barcelona, latest round of drm fixes. The command line parser regression fixes look a bit larger because they come with selftests included for the bugs they fix. Otherwise a single nouveau, single ingenic and single vmwgfx fix: nouveau: - add missing MODULE_FIRMWARE definitions igenic: - hardcode panel type DPI vmwgfx: - double free fix core: - command line mode parser fixes" * tag 'drm-fixes-2019-09-06' of git://anongit.freedesktop.org/drm/drm: drm/vmwgfx: Fix double free in vmw_recv_msg() drm/nouveau/sec2/gp102: add missing MODULE_FIRMWAREs drm/selftests: modes: Add more unit tests for the cmdline parser drm/modes: Introduce a whitelist for the named modes drm/modes: Fix the command line parser to take force options into account drm/modes: Add a switch to differentiate free standing options drm/ingenic: Hardcode panel type to DPI commit 9d098a6234c135c3fd1692fc451908b5c2a43244 Merge: 13da6ac106be 02fa5d7b17a7 Author: Linus Torvalds Date: Fri Sep 6 08:56:06 2019 -0700 Merge tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost Pull virtio fixes from Michael Tsirkin: "virtio, vhost, and balloon bugfixes. A couple of last minute bugfixes. And a revert of a failed attempt at metadata access optimization - we'll try again in the next cycle" * tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost: mm/balloon_compaction: suppress allocation warnings Revert "vhost: access vq metadata through kernel virtual address" vhost: Remove unnecessary variable virtio-net: lower min ring num_free for efficiency vhost/test: fix build for vhost test vhost/test: fix build for vhost test commit a3200debde5fda3e25f7e22cb2bc17a9280f7811 Author: Maxime Ripard Date: Fri Sep 6 10:46:14 2019 +0300 drm/modes: Make the whitelist more const The commit 3764137906a5 ("drm/modes: Introduce a whitelist for the named modes") introduced a whitelist in the named modes lookup code in order to be a bit more robust. However, even though the char pointers were made const, the array itself was not. Let's fix that. Fixes: 3764137906a5 ("drm/modes: Introduce a whitelist for the named modes") Suggested-by: Jani Nikula Reviewed-by: Jani Nikula Signed-off-by: Maxime Ripard Link: https://patchwork.freedesktop.org/patch/msgid/20190906074614.30608-1-mripard@kernel.org commit 13da6ac106be36d7c2d7f201fd8850a9ac235e6b Merge: d41a3effbb53 a8318c13e79b Author: Linus Torvalds Date: Fri Sep 6 08:54:45 2019 -0700 Merge tag 'powerpc-5.3-5' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux Pull powerpc fixes from Michael Ellerman: "One fix for a boot hang on some Freescale machines when PREEMPT is enabled. Two CVE fixes for bugs in our handling of FP registers and transactional memory, both of which can result in corrupted FP state, or FP state leaking between processes. Thanks to: Chris Packham, Christophe Leroy, Gustavo Romero, Michael Neuling" * tag 'powerpc-5.3-5' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux: powerpc/tm: Fix restoring FP/VMX facility incorrectly on interrupts powerpc/tm: Fix FP/VMX unavailable exceptions inside a transaction powerpc/64e: Drop stale call to smp_processor_id() which hangs SMP startup commit 74346c434cd24cce73d971da950f0b5b82bac0d6 Merge: b0a3caeafded 8b51dc729147 Author: David S. Miller Date: Fri Sep 6 15:21:44 2019 +0200 Merge tag 'wireless-drivers-for-davem-2019-09-05' of git://git.kernel.org/pub/scm/linux/kernel/git/kvalo/wireless-drivers Kalle Valo says: ==================== wireless-drivers fixes for 5.3 Fourth set of fixes for 5.3, and hopefully really the last one. Quite a few CVE fixes this time but at least to my knowledge none of them have a known exploit. mt76 * workaround firmware hang by disabling hardware encryption on MT7630E * disable 5GHz band for MT7630E as it's not working properly mwifiex * fix IE parsing to avoid a heap buffer overflow iwlwifi * fix for QuZ device initialisation rt2x00 * another fix for rekeying * revert a commit causing degradation in rx signal levels rsi * fix a double free ==================== Signed-off-by: David S. Miller commit b0a3caeafded18111b638cf1adeba10bfd58a12d Author: Radhey Shyam Pandey Date: Thu Sep 5 18:26:08 2019 +0530 MAINTAINERS: add myself as maintainer for xilinx axiethernet driver I am maintaining xilinx axiethernet driver in xilinx tree and would like to maintain it in the mainline kernel as well. Hence adding myself as a maintainer. Also Anirudha and John has moved to new roles, so based on request removing them from the maintainer list. Signed-off-by: Radhey Shyam Pandey Acked-by: John Linn Acked-by: Michal Simek Signed-off-by: David S. Miller commit b88dd52c62bb5c5d58f0963287f41fd084352c57 Author: Eric Dumazet Date: Thu Sep 5 05:20:22 2019 -0700 net: sched: fix reordering issues Whenever MQ is not used on a multiqueue device, we experience serious reordering problems. Bisection found the cited commit. The issue can be described this way : - A single qdisc hierarchy is shared by all transmit queues. (eg : tc qdisc replace dev eth0 root fq_codel) - When/if try_bulk_dequeue_skb_slow() dequeues a packet targetting a different transmit queue than the one used to build a packet train, we stop building the current list and save the 'bad' skb (P1) in a special queue. (bad_txq) - When dequeue_skb() calls qdisc_dequeue_skb_bad_txq() and finds this skb (P1), it checks if the associated transmit queues is still in frozen state. If the queue is still blocked (by BQL or NIC tx ring full), we leave the skb in bad_txq and return NULL. - dequeue_skb() calls q->dequeue() to get another packet (P2) The other packet can target the problematic queue (that we found in frozen state for the bad_txq packet), but another cpu just ran TX completion and made room in the txq that is now ready to accept new packets. - Packet P2 is sent while P1 is still held in bad_txq, P1 might be sent at next round. In practice P2 is the lead of a big packet train (P2,P3,P4 ...) filling the BQL budget and delaying P1 by many packets :/ To solve this problem, we have to block the dequeue process as long as the first packet in bad_txq can not be sent. Reordering issues disappear and no side effects have been seen. Fixes: a53851e2c321 ("net: sched: explicit locking in gso_cpu fallback") Signed-off-by: Eric Dumazet Cc: John Fastabend Acked-by: John Fastabend Signed-off-by: David S. Miller commit 2e9550ed67cc861e6607d63e7d1036dce28f4902 Merge: f4b633b911fd 769a807d0b41 Author: David S. Miller Date: Fri Sep 6 15:09:16 2019 +0200 Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec Steffen Klassert says: ==================== pull request (net): ipsec 2019-09-05 1) Several xfrm interface fixes from Nicolas Dichtel: - Avoid an interface ID corruption on changelink. - Fix wrong intterface names in the logs. - Fix a list corruption when changing network namespaces. - Fix unregistation of the underying phydev. 2) Fix a potential warning when merging xfrm_plocy nodes. From Florian Westphal. Please pull or let me know if there are problems. ==================== Signed-off-by: David S. Miller commit f4b633b911fd3b4cbe1dc065e8fb064078d0889d Author: Zhu Yanjun Date: Thu Sep 5 05:15:42 2019 -0400 forcedeth: use per cpu to collect xmit/recv statistics When testing with a background iperf pushing 1Gbit/sec traffic and running both ifconfig and netstat to collect statistics, some deadlocks occurred. Ifconfig and netstat will call nv_get_stats64 to get software xmit/recv statistics. In the commit f5d827aece36 ("forcedeth: implement ndo_get_stats64() API"), the normal tx/rx variables is to collect tx/rx statistics. The fix is to replace normal tx/rx variables with per cpu 64-bit variable to collect xmit/recv statistics. The per cpu variable will avoid deadlocks and provide fast efficient statistics updates. In nv_probe, the per cpu variable is initialized. In nv_remove, this per cpu variable is freed. In xmit/recv process, this per cpu variable will be updated. In nv_get_stats64, this per cpu variable on each cpu is added up. Then the driver can get xmit/recv packets statistics. A test runs for several days with this commit, the deadlocks disappear and the performance is better. Tested: - iperf SMP x86_64 -> Client connecting to 1.1.1.108, TCP port 5001 TCP window size: 85.0 KByte (default) ------------------------------------------------------------ [ 3] local 1.1.1.105 port 38888 connected with 1.1.1.108 port 5001 [ ID] Interval Transfer Bandwidth [ 3] 0.0-10.0 sec 1.10 GBytes 943 Mbits/sec ifconfig results: enp0s9 Link encap:Ethernet HWaddr 00:21:28:6f:de:0f inet addr:1.1.1.105 Bcast:0.0.0.0 Mask:255.255.255.0 UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:5774764531 errors:0 dropped:0 overruns:0 frame:0 TX packets:633534193 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:1000 RX bytes:7646159340904 (7.6 TB) TX bytes:11425340407722 (11.4 TB) netstat results: Kernel Interface table Iface MTU Met RX-OK RX-ERR RX-DRP RX-OVR TX-OK TX-ERR TX-DRP TX-OVR Flg ... enp0s9 1500 0 5774764531 0 0 0 633534193 0 0 0 BMRU ... Fixes: f5d827aece36 ("forcedeth: implement ndo_get_stats64() API") CC: Joe Jin CC: JUNXIAO_BI Reported-and-tested-by: Nan san Signed-off-by: Zhu Yanjun Signed-off-by: David S. Miller commit 6e1cdedcf0362fed3aedfe051d46bd7ee2a85fe1 Author: Mao Wenan Date: Thu Sep 5 09:57:12 2019 +0800 net: sonic: return NETDEV_TX_OK if failed to map buffer NETDEV_TX_BUSY really should only be used by drivers that call netif_tx_stop_queue() at the wrong moment. If dma_map_single() is failed to map tx DMA buffer, it might trigger an infinite loop. This patch use NETDEV_TX_OK instead of NETDEV_TX_BUSY, and change printk to pr_err_ratelimited. Fixes: d9fb9f384292 ("*sonic/natsemi/ns83829: Move the National Semi-conductor drivers") Signed-off-by: Mao Wenan Signed-off-by: David S. Miller commit 1f493162b59b09224de4d9c94e4392807e0edcce Author: Sasha Levin Date: Fri Sep 6 05:58:52 2019 -0400 Documentation/process/embargoed-hardware-issues: Microsoft ambassador Add Sasha Levin as Microsoft's process ambassador. Signed-off-by: Sasha Levin Signed-off-by: Sasha Levin Link: https://lore.kernel.org/r/20190906095852.23568-1-sashal@kernel.org Signed-off-by: Greg Kroah-Hartman commit 8928e917aeafaf38d65cc5cbc1f11e952dbed062 Author: Lee Jones Date: Thu Sep 5 09:25:55 2019 +0100 soc: qcom: geni: Provide parameter error checking When booting with ACPI, the Geni Serial Engine is not set as the I2C/SPI parent and thus, the wrapper (parent device) is unassigned. This causes the kernel to crash with a null dereference error. Link: https://lore.kernel.org/r/20190905082555.15020-1-lee.jones@linaro.org Fixes: 8bc529b25354 ("soc: qcom: geni: Add support for ACPI") Acked-by: Bjorn Andersson Reviewed-by: Stephen Boyd Signed-off-by: Lee Jones Signed-off-by: Arnd Bergmann commit 754265bcab78a9014f0f99cd35e0d610fcd7dfa7 Author: Joerg Roedel Date: Fri Sep 6 10:39:54 2019 +0200 iommu/amd: Fix race in increase_address_space() After the conversion to lock-less dma-api call the increase_address_space() function can be called without any locking. Multiple CPUs could potentially race for increasing the address space, leading to invalid domain->mode settings and invalid page-tables. This has been happening in the wild under high IO load and memory pressure. Fix the race by locking this operation. The function is called infrequently so that this does not introduce a performance regression in the dma-api path again. Reported-by: Qian Cai Fixes: 256e4621c21a ('iommu/amd: Make use of the generic IOVA allocator') Signed-off-by: Joerg Roedel commit 36b7200f67dfe75b416b5281ed4ace9927b513bc Author: Stuart Hayes Date: Thu Sep 5 12:09:48 2019 -0500 iommu/amd: Flush old domains in kdump kernel When devices are attached to the amd_iommu in a kdump kernel, the old device table entries (DTEs), which were copied from the crashed kernel, will be overwritten with a new domain number. When the new DTE is written, the IOMMU is told to flush the DTE from its internal cache--but it is not told to flush the translation cache entries for the old domain number. Without this patch, AMD systems using the tg3 network driver fail when kdump tries to save the vmcore to a network system, showing network timeouts and (sometimes) IOMMU errors in the kernel log. This patch will flush IOMMU translation cache entries for the old domain when a DTE gets overwritten with a new domain number. Signed-off-by: Stuart Hayes Fixes: 3ac3e5ee5ed5 ('iommu/amd: Copy old trans table from old kernel') Signed-off-by: Joerg Roedel commit e16c2983fba0fa6763e43ad10916be35e3d8dc05 Author: Steve Wahl Date: Thu Sep 5 15:23:46 2019 -0500 x86/purgatory: Change compiler flags from -mcmodel=kernel to -mcmodel=large to fix kexec relocation errors The last change to this Makefile caused relocation errors when loading a kdump kernel. Restore -mcmodel=large (not -mcmodel=kernel), -ffreestanding, and -fno-zero-initialized-bsss, without reverting to the former practice of resetting KBUILD_CFLAGS. Purgatory.ro is a standalone binary that is not linked against the rest of the kernel. Its image is copied into an array that is linked to the kernel, and from there kexec relocates it wherever it desires. With the previous change to compiler flags, the error "kexec: Overflow in relocation type 11 value 0x11fffd000" was encountered when trying to load the crash kernel. This is from kexec code trying to relocate the purgatory.ro object. From the error message, relocation type 11 is R_X86_64_32S. The x86_64 ABI says: "The R_X86_64_32 and R_X86_64_32S relocations truncate the computed value to 32-bits. The linker must verify that the generated value for the R_X86_64_32 (R_X86_64_32S) relocation zero-extends (sign-extends) to the original 64-bit value." This type of relocation doesn't work when kexec chooses to place the purgatory binary in memory that is not reachable with 32 bit addresses. The compiler flag -mcmodel=kernel allows those type of relocations to be emitted, so revert to using -mcmodel=large as was done before. Also restore the -ffreestanding and -fno-zero-initialized-bss flags because they are appropriate for a stand alone piece of object code which doesn't explicitly zero the bss, and one other report has said undefined symbols are encountered without -ffreestanding. These identical compiler flag changes need to happen for every object that becomes part of the purgatory.ro object, so gather them together first into PURGATORY_CFLAGS_REMOVE and PURGATORY_CFLAGS, and then apply them to each of the objects that have C source. Do not apply any of these flags to kexec-purgatory.o, which is not part of the standalone object but part of the kernel proper. Tested-by: Vaibhav Rustagi Tested-by: Andreas Smas Signed-off-by: Steve Wahl Reviewed-by: Nick Desaulniers Cc: Borislav Petkov Cc: H. Peter Anvin Cc: Linus Torvalds Cc: None Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: clang-built-linux@googlegroups.com Cc: dimitri.sivanich@hpe.com Cc: mike.travis@hpe.com Cc: russ.anderson@hpe.com Fixes: b059f801a937 ("x86/purgatory: Use CFLAGS_REMOVE rather than reset KBUILD_CFLAGS") Link: https://lkml.kernel.org/r/20190905202346.GA26595@swahl-linux Signed-off-by: Ingo Molnar commit 1e19ec6c3c417a0893fcfae7abfba623e781d876 Merge: 7610bb0bde4c 424c38a4e325 Author: Dave Airlie Date: Fri Sep 6 16:25:45 2019 +1000 Merge tag 'drm-misc-fixes-2019-09-05' of git://anongit.freedesktop.org/drm/drm-misc into drm-fixes drm-misc-fixes for v5.3 final: - Make ingenic panel type DPI insteado f unknown. - Fixes for command line parser modes. Signed-off-by: Dave Airlie From: Maarten Lankhorst Link: https://patchwork.freedesktop.org/patch/msgid/606d87b2-1840-c893-eb30-d6c471c9e50a@linux.intel.com commit 7610bb0bde4c210212cdbb3be9b502eaad10731a Merge: b0dfce90e342 08b0c891605a Author: Dave Airlie Date: Fri Sep 6 16:23:25 2019 +1000 Merge branch 'vmwgfx-fixes-5.3' of git://people.freedesktop.org/~thomash/linux into drm-fixes Single vmwgfx double free fix. Signed-off-by: Dave Airlie commit 310aa0a25b338b3100c94880c9a69bec8ce8c3ae Author: Mark-PK Tsai Date: Fri Sep 6 14:01:16 2019 +0800 perf/hw_breakpoint: Fix arch_hw_breakpoint use-before-initialization If we disable the compiler's auto-initialization feature, if -fplugin-arg-structleak_plugin-byref or -ftrivial-auto-var-init=pattern are disabled, arch_hw_breakpoint may be used before initialization after: 9a4903dde2c86 ("perf/hw_breakpoint: Split attribute parse and commit") On our ARM platform, the struct step_ctrl in arch_hw_breakpoint, which used to be zero-initialized by kzalloc(), may be used in arch_install_hw_breakpoint() without initialization. Signed-off-by: Mark-PK Tsai Cc: Alexander Shishkin Cc: Alix Wu Cc: Arnaldo Carvalho de Melo Cc: Jiri Olsa Cc: Linus Torvalds Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: YJ Chiang Link: https://lkml.kernel.org/r/20190906060115.9460-1-mark-pk.tsai@mediatek.com [ Minor edits. ] Signed-off-by: Ingo Molnar commit d41a3effbb53b1bcea41e328d16a4d046a508381 Author: Hillf Danton Date: Mon Sep 2 13:37:29 2019 +0100 keys: Fix missing null pointer check in request_key_auth_describe() If a request_key authentication token key gets revoked, there's a window in which request_key_auth_describe() can see it with a NULL payload - but it makes no check for this and something like the following oops may occur: BUG: Kernel NULL pointer dereference at 0x00000038 Faulting instruction address: 0xc0000000004ddf30 Oops: Kernel access of bad area, sig: 11 [#1] ... NIP [...] request_key_auth_describe+0x90/0xd0 LR [...] request_key_auth_describe+0x54/0xd0 Call Trace: [...] request_key_auth_describe+0x54/0xd0 (unreliable) [...] proc_keys_show+0x308/0x4c0 [...] seq_read+0x3d0/0x540 [...] proc_reg_read+0x90/0x110 [...] __vfs_read+0x3c/0x70 [...] vfs_read+0xb4/0x1b0 [...] ksys_read+0x7c/0x130 [...] system_call+0x5c/0x70 Fix this by checking for a NULL pointer when describing such a key. Also make the read routine check for a NULL pointer to be on the safe side. [DH: Modified to not take already-held rcu lock and modified to also check in the read routine] Fixes: 04c567d9313e ("[PATCH] Keys: Fix race between two instantiators of a key") Reported-by: Sachin Sant Signed-off-by: Hillf Danton Signed-off-by: David Howells Tested-by: Sachin Sant Signed-off-by: Linus Torvalds commit eddf3e9c7c7e4d0707c68d1bb22cc6ec8aef7d4a Author: Yunfeng Ye Date: Wed Sep 4 20:46:25 2019 +0800 genirq: Prevent NULL pointer dereference in resend_irqs() The following crash was observed: Unable to handle kernel NULL pointer dereference at 0000000000000158 Internal error: Oops: 96000004 [#1] SMP pc : resend_irqs+0x68/0xb0 lr : resend_irqs+0x64/0xb0 ... Call trace: resend_irqs+0x68/0xb0 tasklet_action_common.isra.6+0x84/0x138 tasklet_action+0x2c/0x38 __do_softirq+0x120/0x324 run_ksoftirqd+0x44/0x60 smpboot_thread_fn+0x1ac/0x1e8 kthread+0x134/0x138 ret_from_fork+0x10/0x18 The reason for this is that the interrupt resend mechanism happens in soft interrupt context, which is a asynchronous mechanism versus other operations on interrupts. free_irq() does not take resend handling into account. Thus, the irq descriptor might be already freed before the resend tasklet is executed. resend_irqs() does not check the return value of the interrupt descriptor lookup and derefences the return value unconditionally. 1): __setup_irq irq_startup check_irq_resend // activate softirq to handle resend irq 2): irq_domain_free_irqs irq_free_descs free_desc call_rcu(&desc->rcu, delayed_free_desc) 3): __do_softirq tasklet_action resend_irqs desc = irq_to_desc(irq) desc->handle_irq(desc) // desc is NULL --> Ooops Fix this by adding a NULL pointer check in resend_irqs() before derefencing the irq descriptor. Fixes: a4633adcdbc1 ("[PATCH] genirq: add genirq sw IRQ-retrigger") Signed-off-by: Yunfeng Ye Signed-off-by: Thomas Gleixner Reviewed-by: Zhiqiang Liu Cc: stable@vger.kernel.org Link: https://lkml.kernel.org/r/1630ae13-5c8e-901e-de09-e740b6a426a7@huawei.com commit a3f5e1f5783974813b5d43beb38c4eeaa67afbef Merge: 19e4147a04a4 2a36c16efab2 Author: Linus Torvalds Date: Thu Sep 5 10:26:20 2019 -0700 Merge tag 'sound-5.3-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "A collection of small HD-audio fixes: - A regression fix for Realtek codecs due to the recent initialization procedure change - A fix for potential endless loop at the quirk table lookup - Quirks for Lenovo, ASUS and HP machines" * tag 'sound-5.3-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: ALSA: hda/realtek - Fix the problem of two front mics on a ThinkCentre ALSA: hda/realtek - Enable internal speaker & headset mic of ASUS UX431FL ALSA: hda/realtek - Add quirk for HP Pavilion 15 ALSA: hda/realtek - Fix overridden device-specific initialization ALSA: hda - Fix potential endless loop at applying quirks commit 19e4147a04a43d210dbacda76e0988f90bb0ba45 Merge: 262f7eeddc85 4030b4c585c4 Author: Linus Torvalds Date: Thu Sep 5 09:47:32 2019 -0700 Merge branch 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 fixes from Ingo Molnar: "Misc fixes: - EFI boot fix for signed kernels - an AC flags fix related to UBSAN - Hyper-V infinite loop fix" * 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/hyper-v: Fix overflow bug in fill_gva_list() x86/uaccess: Don't leak the AC flags into __get_user() argument evaluation x86/boot: Preserve boot_params.secure_boot from sanitizing commit 262f7eeddc85c657e3087561dc8c3cfe227363ff Merge: 13133f933ac4 1251201c0d34 Author: Linus Torvalds Date: Thu Sep 5 09:38:31 2019 -0700 Merge branch 'sched-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull scheduler fixes from Ingo Molnar: "This fixes an ABI bug introduced this cycle, plus fixes a throttling bug" * 'sched-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: sched/core: Fix uclamp ABI bug, clean up and robustify sched_read_attr() ABI logic and code sched/fair: Don't assign runtime for throttled cfs_rq commit 13133f933ac463f233fbf118061c4c47cd72eecf Merge: 3b47fd5ca9ea 52d083472e0b Author: Linus Torvalds Date: Thu Sep 5 09:23:02 2019 -0700 Merge tag 'clang-format-for-linus-v5.3-rc8' of git://github.com/ojeda/linux Pull clang-format update from Miguel Ojeda: "Update with the latest for_each macro list" * tag 'clang-format-for-linus-v5.3-rc8' of git://github.com/ojeda/linux: clang-format: Update with the latest for_each macro list commit 13212a648f3142a5fa893b1f66baa7eb95f3e3a8 Merge: d9a2b63ca917 ae688e1720fd Author: Arnd Bergmann Date: Thu Sep 5 17:56:29 2019 +0200 Merge tag 'renesas-fixes2-for-v5.3' of git://git.kernel.org/pub/scm/linux/kernel/git/horms/renesas into arm/fixes Second Round of Renesas ARM Based SoC Fixes for v5.3 * RZ/G2M based HiHope main board - Re-enabled accidently disabled SDHI3 (eMMC) support * tag 'renesas-fixes2-for-v5.3' of git://git.kernel.org/pub/scm/linux/kernel/git/horms/renesas: arm64: dts: renesas: hihope-common: Fix eMMC status Link: https://lore.kernel.org/r/cover.1567675986.git.horms+renesas@verge.net.au Signed-off-by: Arnd Bergmann commit 08b0c891605acf727e43e3e03a25857d3e789b61 Author: Dan Carpenter Date: Thu Aug 15 11:30:50 2019 +0300 drm/vmwgfx: Fix double free in vmw_recv_msg() We recently added a kfree() after the end of the loop: if (retries == RETRIES) { kfree(reply); return -EINVAL; } There are two problems. First the test is wrong and because retries equals RETRIES if we succeed on the last iteration through the loop. Second if we fail on the last iteration through the loop then the kfree is a double free. When you're reading this code, please note the break statement at the end of the while loop. This patch changes the loop so that if it's not successful then "reply" is NULL and we can test for that afterward. Cc: Fixes: 6b7c3b86f0b6 ("drm/vmwgfx: fix memory leak when too many retries have occurred") Signed-off-by: Dan Carpenter Reviewed-by: Thomas Hellstrom Signed-off-by: Thomas Hellstrom commit 2339cd6cd0b5401fa3fe886bf1c0cb8822041957 Author: Alexei Starovoitov Date: Tue Sep 3 15:16:17 2019 -0700 bpf: fix precision tracking of stack slots The problem can be seen in the following two tests: 0: (bf) r3 = r10 1: (55) if r3 != 0x7b goto pc+0 2: (7a) *(u64 *)(r3 -8) = 0 3: (79) r4 = *(u64 *)(r10 -8) .. 0: (85) call bpf_get_prandom_u32#7 1: (bf) r3 = r10 2: (55) if r3 != 0x7b goto pc+0 3: (7b) *(u64 *)(r3 -8) = r0 4: (79) r4 = *(u64 *)(r10 -8) When backtracking need to mark R4 it will mark slot fp-8. But ST or STX into fp-8 could belong to the same block of instructions. When backtracing is done the parent state may have fp-8 slot as "unallocated stack". Which will cause verifier to warn and incorrectly reject such programs. Writes into stack via non-R10 register are rare. llvm always generates canonical stack spill/fill. For such pathological case fall back to conservative precision tracking instead of rejecting. Reported-by: syzbot+c8d66267fd2b5955287e@syzkaller.appspotmail.com Fixes: b5dc0163d8fd ("bpf: precise scalar_value tracking") Signed-off-by: Alexei Starovoitov Signed-off-by: Daniel Borkmann commit 7bdf4de1267780aa194b3a28c85a6c4d617b0bdb Author: Donald Sharp Date: Wed Sep 4 10:11:58 2019 -0400 net: Properly update v4 routes with v6 nexthop When creating a v4 route that uses a v6 nexthop from a nexthop group. Allow the kernel to properly send the nexthop as v6 via the RTA_VIA attribute. Broken behavior: $ ip nexthop add via fe80::9 dev eth0 $ ip nexthop show id 1 via fe80::9 dev eth0 scope link $ ip route add 4.5.6.7/32 nhid 1 $ ip route show default via 10.0.2.2 dev eth0 4.5.6.7 nhid 1 via 254.128.0.0 dev eth0 10.0.2.0/24 dev eth0 proto kernel scope link src 10.0.2.15 $ Fixed behavior: $ ip nexthop add via fe80::9 dev eth0 $ ip nexthop show id 1 via fe80::9 dev eth0 scope link $ ip route add 4.5.6.7/32 nhid 1 $ ip route show default via 10.0.2.2 dev eth0 4.5.6.7 nhid 1 via inet6 fe80::9 dev eth0 10.0.2.0/24 dev eth0 proto kernel scope link src 10.0.2.15 $ v2, v3: Addresses code review comments from David Ahern Fixes: dcb1ecb50edf (“ipv4: Prepare for fib6_nh from a nexthop object”) Signed-off-by: Donald Sharp Reviewed-by: David Ahern Signed-off-by: David S. Miller commit e9752c830a93d5ab5ed5f5ac184828449a8c52fd Merge: 44580a0118d3 91bfb564853f Author: David S. Miller Date: Thu Sep 5 11:59:39 2019 +0200 Merge branch 'nexthops-Fix-multipath-notifications-for-IPv6-and-selftests' David Ahern says: ==================== nexthops: Fix multipath notifications for IPv6 and selftests A couple of bug fixes noticed while testing Donald's patch. ==================== Signed-off-by: David S. Miller commit 91bfb564853f4aaa0487a2b5e9c6ecd400768abd Author: David Ahern Date: Tue Sep 3 15:22:13 2019 -0700 selftest: A few cleanups for fib_nexthops.sh Cleanups of the tests in fib_nexthops.sh 1. Several tests noted unexpected route output, but the discrepancy was not showing in the summary output and overlooked in the verbose output. Add a WARNING message to the summary output to make it clear a test is not showing expected output. 2. Several check_* calls are missing extra data like scope and metric causing mismatches when the nexthops or routes are correct - some of them are a side effect of the evolving iproute2 command. Update the data to the expected output. 3. Several check_routes are checking for the wrong nexthop data, most likely a copy-paste-update error. 4. A couple of tests were re-using a nexthop id that already existed. Fix those to use a new id. Fixes: 6345266a9989 ("selftests: Add test cases for nexthop objects") Signed-off-by: David Ahern Signed-off-by: David S. Miller commit 4255ff0544ee307e9a8acf66000e6fd49e9203f8 Author: David Ahern Date: Tue Sep 3 15:22:12 2019 -0700 ipv6: Fix RTA_MULTIPATH with nexthop objects A change to the core nla helpers was missed during the push of the nexthop changes. rt6_fill_node_nexthop should be calling nla_nest_start_noflag not nla_nest_start. Currently, iproute2 does not print multipath data because of parsing issues with the attribute. Fixes: f88d8ea67fbd ("ipv6: Plumb support for nexthop object in a fib6_info") Signed-off-by: David Ahern Signed-off-by: David S. Miller commit 44580a0118d3ede95fec4dce32df5f75f73cd663 Author: John Fastabend Date: Tue Sep 3 13:24:50 2019 -0700 net: sock_map, fix missing ulp check in sock hash case sock_map and ULP only work together when ULP is loaded after the sock map is loaded. In the sock_map case we added a check for this to fail the load if ULP is already set. However, we missed the check on the sock_hash side. Add a ULP check to the sock_hash update path. Fixes: 604326b41a6fb ("bpf, sockmap: convert to generic sk_msg interface") Reported-by: syzbot+7a6ee4d0078eac6bf782@syzkaller.appspotmail.com Signed-off-by: John Fastabend Signed-off-by: David S. Miller commit ebe26aca98fcf9fbe5017b5cbe216413cee69df5 Author: Moritz Fischer Date: Tue Sep 3 11:46:52 2019 -0700 net: fixed_phy: Add forward declaration for struct gpio_desc; Add forward declaration for struct gpio_desc in order to address the following: ./include/linux/phy_fixed.h:48:17: error: 'struct gpio_desc' declared inside parameter list [-Werror] ./include/linux/phy_fixed.h:48:17: error: its scope is only this definition or declaration, which is probably not what you want [-Werror] Fixes: 71bd106d2567 ("net: fixed-phy: Add fixed_phy_register_with_gpiod() API") Signed-off-by: Moritz Fischer Reviewed-by: Florian Fainelli Signed-off-by: David S. Miller commit 42dec1dbe38239cf91cc1f4df7830c66276ced37 Author: Xin Long Date: Tue Sep 3 17:53:12 2019 +0800 tipc: add NULL pointer check before calling kfree_rcu Unlike kfree(p), kfree_rcu(p, rcu) won't do NULL pointer check. When tipc_nametbl_remove_publ returns NULL, the panic below happens: BUG: unable to handle kernel NULL pointer dereference at 0000000000000068 RIP: 0010:__call_rcu+0x1d/0x290 Call Trace: tipc_publ_notify+0xa9/0x170 [tipc] tipc_node_write_unlock+0x8d/0x100 [tipc] tipc_node_link_down+0xae/0x1d0 [tipc] tipc_node_check_dest+0x3ea/0x8f0 [tipc] ? tipc_disc_rcv+0x2c7/0x430 [tipc] tipc_disc_rcv+0x2c7/0x430 [tipc] ? tipc_rcv+0x6bb/0xf20 [tipc] tipc_rcv+0x6bb/0xf20 [tipc] ? ip_route_input_slow+0x9cf/0xb10 tipc_udp_recv+0x195/0x1e0 [tipc] ? tipc_udp_is_known_peer+0x80/0x80 [tipc] udp_queue_rcv_skb+0x180/0x460 udp_unicast_rcv_skb.isra.56+0x75/0x90 __udp4_lib_rcv+0x4ce/0xb90 ip_local_deliver_finish+0x11c/0x210 ip_local_deliver+0x6b/0xe0 ? ip_rcv_finish+0xa9/0x410 ip_rcv+0x273/0x362 Fixes: 97ede29e80ee ("tipc: convert name table read-write lock to RCU") Reported-by: Li Shuang Signed-off-by: Xin Long Signed-off-by: David S. Miller commit 6a87691c40ecaf0dc3f5902ad138039c91083d50 Merge: d55a2e374a94 68d19d7d9957 Author: David S. Miller Date: Thu Sep 5 08:31:53 2019 +0200 Merge branch 'for-upstream' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth Johan Hedberg says: ==================== pull request: bluetooth 2019-09-05 Here are a few more Bluetooth fixes for 5.3. I hope they can still make it. There's one USB ID addition for btusb, two reverts due to discovered regressions, and two other important fixes. ==================== Signed-off-by: David S. Miller commit 68d19d7d995759b96169da5aac313363f92a9075 Author: Marcel Holtmann Date: Wed Sep 4 20:13:08 2019 +0200 Revert "Bluetooth: validate BLE connection interval updates" This reverts commit c49a8682fc5d298d44e8d911f4fa14690ea9485e. There are devices which require low connection intervals for usable operation including keyboards and mice. Forcing a static connection interval for these types of devices has an impact in latency and causes a regression. Signed-off-by: Marcel Holtmann Signed-off-by: Johan Hedberg commit f56f791f6d8e8296c9dd194506ee2b703b1227d4 Author: Kees Cook Date: Wed Sep 4 09:24:49 2019 -0700 Documentation/process: Add Google contact for embargoed hardware issues This adds myself as the Google contact for embargoed hardware security issues and fixes some small typos. Cc: Thomas Gleixner Cc: Matt Linton Cc: Matthew Garrett Signed-off-by: Kees Cook Acked-by: Guenter Roeck Link: https://lore.kernel.org/r/201909040922.56496BF70@keescook Signed-off-by: Greg Kroah-Hartman commit 02e740aeca79e9a3c464bc2ebb510457c85d2015 Author: Andrew Cooper Date: Wed Sep 4 19:17:02 2019 +0100 Documentation/process: Volunteer as the ambassador for Xen Cc: Jonathan Corbet Cc: Thomas Gleixner Cc: Tyler Hicks Cc: Ben Hutchings Cc: Konrad Rzeszutek Wilk Cc: Josh Poimboeuf Cc: Jiri Kosina Signed-off-by: Andrew Cooper Link: https://lore.kernel.org/r/20190904181702.19788-1-andrew.cooper3@citrix.com Signed-off-by: Greg Kroah-Hartman commit d55a2e374a94fa34a3048c6a2be535266e506d97 Author: Maciej Żenczykowski Date: Mon Sep 2 09:23:36 2019 -0700 net-ipv6: fix excessive RTF_ADDRCONF flag on ::1/128 local route (and others) There is a subtle change in behaviour introduced by: commit c7a1ce397adacaf5d4bb2eab0a738b5f80dc3e43 'ipv6: Change addrconf_f6i_alloc to use ip6_route_info_create' Before that patch /proc/net/ipv6_route includes: 00000000000000000000000000000001 80 00000000000000000000000000000000 00 00000000000000000000000000000000 00000000 00000003 00000000 80200001 lo Afterwards /proc/net/ipv6_route includes: 00000000000000000000000000000001 80 00000000000000000000000000000000 00 00000000000000000000000000000000 00000000 00000002 00000000 80240001 lo ie. the above commit causes the ::1/128 local (automatic) route to be flagged with RTF_ADDRCONF (0x040000). AFAICT, this is incorrect since these routes are *not* coming from RA's. As such, this patch restores the old behaviour. Fixes: c7a1ce397ada ("ipv6: Change addrconf_f6i_alloc to use ip6_route_info_create") Cc: David Ahern Cc: Lorenzo Colitti Signed-off-by: Maciej Żenczykowski Reviewed-by: David Ahern Signed-off-by: David S. Miller commit 10eb56c582c557c629271f1ee31e15e7a9b2558b Author: Xin Long Date: Mon Sep 2 23:24:21 2019 +0800 sctp: use transport pf_retrans in sctp_do_8_2_transport_strike Transport should use its own pf_retrans to do the error_count check, instead of asoc's. Otherwise, it's meaningless to make pf_retrans per transport. Fixes: 5aa93bcf66f4 ("sctp: Implement quick failover draft from tsvwg") Signed-off-by: Xin Long Acked-by: Marcelo Ricardo Leitner Acked-by: Neil Horman Signed-off-by: David S. Miller commit 591328948ba60423e28d000da99d34f7586de54a Author: David Howells Date: Mon Sep 2 11:34:08 2019 +0100 rxrpc: Fix misplaced traceline There's a misplaced traceline in rxrpc_input_packet() which is looking at a packet that just got released rather than the replacement packet. Fix this by moving the traceline after the assignment that moves the new packet pointer to the actual packet pointer. Fixes: d0d5c0cd1e71 ("rxrpc: Use skb_unshare() rather than skb_cow_data()") Reported-by: Hillf Danton Signed-off-by: David Howells Signed-off-by: David S. Miller commit d471c6f77480ce893642ba55152da1ea57ddc8d6 Merge: e33b4325e60e 110e48725db6 Author: David S. Miller Date: Thu Sep 5 00:03:55 2019 +0200 Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf Pablo Neira Ayuso says: ==================== Netfilter fixes for net The following patchset contains Netfilter fixes for net: 1) br_netfilter drops IPv6 packets if ipv6 is disabled, from Leonardo Bras. 2) nft_socket hits BUG() due to illegal skb->sk caching, patch from Fernando Fernandez Mancera. 3) nft_fib_netdev could be called with ipv6 disabled, leading to crash in the fib lookup, also from Leonardo. 4) ctnetlink honors IPS_OFFLOAD flag, just like nf_conntrack sysctl does. 5) Properly set up flowtable entry timeout, otherwise immediate removal by garbage collector might occur. ==================== Signed-off-by: David S. Miller commit b0841eefd9693827afb9888235e26ddd098f9cef Author: Al Viro Date: Sat Aug 31 09:43:43 2019 +0200 configfs: provide exclusion between IO and removals Make sure that attribute methods are not called after the item has been removed from the tree. To do so, we * at the point of no return in removals, grab ->frag_sem exclusive and mark the fragment dead. * call the methods of attributes with ->frag_sem taken shared and only after having verified that the fragment is still alive. The main benefit is for method instances - they are guaranteed that the objects they are accessing *and* all ancestors are still there. Another win is that we don't need to bother with extra refcount on config_item when opening a file - the item will be alive for as long as it stays in the tree, and we won't touch it/attributes/any associated data after it's been removed from the tree. Signed-off-by: Al Viro Signed-off-by: Christoph Hellwig commit 3b47fd5ca9ead91156bcdf6435279ad0b14a650c Merge: 089cf7f6ecb2 eb3d8f42231a Author: Linus Torvalds Date: Wed Sep 4 11:09:53 2019 -0700 Merge tag 'nfs-for-5.3-4' of git://git.linux-nfs.org/projects/trondmy/linux-nfs Pull NFS client bugfix from Trond Myklebust: "Regression fix inode fileid checks in attribute revalidation code" * tag 'nfs-for-5.3-4' of git://git.linux-nfs.org/projects/trondmy/linux-nfs: NFS: Fix inode fileid checks in attribute revalidation code commit 1251201c0d34fadf69d56efa675c2b7dd0a90eca Author: Ingo Molnar Date: Wed Sep 4 09:55:32 2019 +0200 sched/core: Fix uclamp ABI bug, clean up and robustify sched_read_attr() ABI logic and code Thadeu Lima de Souza Cascardo reported that 'chrt' broke on recent kernels: $ chrt -p $$ chrt: failed to get pid 26306's policy: Argument list too long and he has root-caused the bug to the following commit increasing sched_attr size and breaking sched_read_attr() into returning -EFBIG: a509a7cd7974 ("sched/uclamp: Extend sched_setattr() to support utilization clamping") The other, bigger bug is that the whole sched_getattr() and sched_read_attr() logic of checking non-zero bits in new ABI components is arguably broken, and pretty much any extension of the ABI will spuriously break the ABI. That's way too fragile. Instead implement the perf syscall's extensible ABI instead, which we already implement on the sched_setattr() side: - if user-attributes have the same size as kernel attributes then the logic is unchanged. - if user-attributes are larger than the kernel knows about then simply skip the extra bits, but set attr->size to the (smaller) kernel size so that tooling can (in principle) handle older kernel as well. - if user-attributes are smaller than the kernel knows about then just copy whatever user-space can accept. Also clean up the whole logic: - Simplify the code flow - there's no need for 'ret' for example. - Standardize on 'kattr/uattr' and 'ksize/usize' naming to make sure we always know which side we are dealing with. - Why is it called 'read' when what it does is to copy to user? This code is so far away from VFS read() semantics that the naming is actively confusing. Name it sched_attr_copy_to_user() instead, which mirrors other copy_to_user() functionality. - Move the attr->size assignment from the head of sched_getattr() to the sched_attr_copy_to_user() function. Nothing else within the kernel should care about the size of the structure. With these fixes the sched_getattr() syscall now nicely supports an extensible ABI in both a forward and backward compatible fashion, and will also fix the chrt bug. As an added bonus the bogus -EFBIG return is removed as well, which as Thadeu noted should have been -E2BIG to begin with. Reported-by: Thadeu Lima de Souza Cascardo Tested-by: Dietmar Eggemann Tested-by: Thadeu Lima de Souza Cascardo Acked-by: Thadeu Lima de Souza Cascardo Cc: Arnaldo Carvalho de Melo Cc: Jiri Olsa Cc: Linus Torvalds Cc: Patrick Bellasi Cc: Peter Zijlstra Cc: Thomas Gleixner Fixes: a509a7cd7974 ("sched/uclamp: Extend sched_setattr() to support utilization clamping") Link: https://lkml.kernel.org/r/20190904075532.GA26751@gmail.com Signed-off-by: Ingo Molnar commit d94dfd798c4839b642f534580109dc6dfc3901a9 Author: Navid Emamdoost Date: Sat Aug 31 14:23:40 2019 -0500 Bluetooth: bpa10x: change return value When returning from bpa10x_send_frame, it is necessary to propagate any potential errno returned from usb_submit_urb. Signed-off-by: Navid Emamdoost Signed-off-by: Marcel Holtmann commit 31fb1bbdabb34d53e3d83f0353085d9b79977786 Author: Harish Bandi Date: Wed Sep 4 10:04:16 2019 +0530 Bluetooth: hci_qca: disable irqs when spinlock is acquired Looks like Deadlock is observed in hci_qca while performing stress and stability tests. Since same lock is getting acquired from qca_wq_awake_rx and hci_ibs_tx_idle_timeout seeing spinlock recursion, irqs should be disable while acquiring the spinlock always. Signed-off-by: Harish Bandi Signed-off-by: Marcel Holtmann commit 6d0762b19c5963ff9e178e8af3626532ee04d93d Author: Jian-Hong Pan Date: Tue Sep 3 17:10:42 2019 +0800 Bluetooth: btrtl: Additional Realtek 8822CE Bluetooth devices The ASUS X412FA laptop contains a Realtek RTL8822CE device with an associated BT chip using a USB ID of 04ca:4005. This ID is added to the driver. The /sys/kernel/debug/usb/devices portion for this device is: T: Bus=01 Lev=01 Prnt=01 Port=09 Cnt=04 Dev#= 4 Spd=12 MxCh= 0 D: Ver= 1.00 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=04ca ProdID=4005 Rev= 0.00 S: Manufacturer=Realtek S: Product=Bluetooth Radio S: SerialNumber=00e04c000001 C:* #Ifs= 2 Cfg#= 1 Atr=a0 MxPwr=500mA I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=1ms E: Ad=02(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms E: Ad=82(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms Buglink: https://bugzilla.kernel.org/show_bug.cgi?id=204707 Signed-off-by: Jian-Hong Pan Signed-off-by: Marcel Holtmann commit d9a2b63ca9175015672e2a294b143fdc6e4d7a4c Merge: 089cf7f6ecb2 45f5d5a9e34d Author: Arnd Bergmann Date: Wed Sep 4 14:38:34 2019 +0200 Merge tag 'renesas-fixes-for-v5.3' of git://git.kernel.org/pub/scm/linux/kernel/git/horms/renesas into arm/fixes Renesas ARM Based SoC Fixes for v5.3 * R-Car D3 (r8a77995) based Draak Board - Correct backlight regulator name in device tree * tag 'renesas-fixes-for-v5.3' of git://git.kernel.org/pub/scm/linux/kernel/git/horms/renesas: arm64: dts: renesas: r8a77995: draak: Fix backlight regulator name Signed-off-by: Arnd Bergmann commit a8318c13e79badb92bc6640704a64cc022a6eb97 Author: Gustavo Romero Date: Wed Sep 4 00:55:28 2019 -0400 powerpc/tm: Fix restoring FP/VMX facility incorrectly on interrupts When in userspace and MSR FP=0 the hardware FP state is unrelated to the current process. This is extended for transactions where if tbegin is run with FP=0, the hardware checkpoint FP state will also be unrelated to the current process. Due to this, we need to ensure this hardware checkpoint is updated with the correct state before we enable FP for this process. Unfortunately we get this wrong when returning to a process from a hardware interrupt. A process that starts a transaction with FP=0 can take an interrupt. When the kernel returns back to that process, we change to FP=1 but with hardware checkpoint FP state not updated. If this transaction is then rolled back, the FP registers now contain the wrong state. The process looks like this: Userspace: Kernel Start userspace with MSR FP=0 TM=1 < ----- ... tbegin bne Hardware interrupt ---- > .... ret_from_except restore_math() /* sees FP=0 */ restore_fp() tm_active_with_fp() /* sees FP=1 (Incorrect) */ load_fp_state() FP = 0 -> 1 < ----- Return to userspace with MSR TM=1 FP=1 with junk in the FP TM checkpoint TM rollback reads FP junk When returning from the hardware exception, tm_active_with_fp() is incorrectly making restore_fp() call load_fp_state() which is setting FP=1. The fix is to remove tm_active_with_fp(). tm_active_with_fp() is attempting to handle the case where FP state has been changed inside a transaction. In this case the checkpointed and transactional FP state is different and hence we must restore the FP state (ie. we can't do lazy FP restore inside a transaction that's used FP). It's safe to remove tm_active_with_fp() as this case is handled by restore_tm_state(). restore_tm_state() detects if FP has been using inside a transaction and will set load_fp and call restore_math() to ensure the FP state (checkpoint and transaction) is restored. This is a data integrity problem for the current process as the FP registers are corrupted. It's also a security problem as the FP registers from one process may be leaked to another. Similarly for VMX. A simple testcase to replicate this will be posted to tools/testing/selftests/powerpc/tm/tm-poison.c This fixes CVE-2019-15031. Fixes: a7771176b439 ("powerpc: Don't enable FP/Altivec if not checkpointed") Cc: stable@vger.kernel.org # 4.15+ Signed-off-by: Gustavo Romero Signed-off-by: Michael Neuling Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20190904045529.23002-2-gromero@linux.vnet.ibm.com commit 8205d5d98ef7f155de211f5e2eb6ca03d95a5a60 Author: Gustavo Romero Date: Wed Sep 4 00:55:27 2019 -0400 powerpc/tm: Fix FP/VMX unavailable exceptions inside a transaction When we take an FP unavailable exception in a transaction we have to account for the hardware FP TM checkpointed registers being incorrect. In this case for this process we know the current and checkpointed FP registers must be the same (since FP wasn't used inside the transaction) hence in the thread_struct we copy the current FP registers to the checkpointed ones. This copy is done in tm_reclaim_thread(). We use thread->ckpt_regs.msr to determine if FP was on when in userspace. thread->ckpt_regs.msr represents the state of the MSR when exiting userspace. This is setup by check_if_tm_restore_required(). Unfortunatley there is an optimisation in giveup_all() which returns early if tsk->thread.regs->msr (via local variable `usermsr`) has FP=VEC=VSX=SPE=0. This optimisation means that check_if_tm_restore_required() is not called and hence thread->ckpt_regs.msr is not updated and will contain an old value. This can happen if due to load_fp=255 we start a userspace process with MSR FP=1 and then we are context switched out. In this case thread->ckpt_regs.msr will contain FP=1. If that same process is then context switched in and load_fp overflows, MSR will have FP=0. If that process now enters a transaction and does an FP instruction, the FP unavailable will not update thread->ckpt_regs.msr (the bug) and MSR FP=1 will be retained in thread->ckpt_regs.msr. tm_reclaim_thread() will then not perform the required memcpy and the checkpointed FP regs in the thread struct will contain the wrong values. The code path for this happening is: Userspace: Kernel Start userspace with MSR FP/VEC/VSX/SPE=0 TM=1 < ----- ... tbegin bne fp instruction FP unavailable ---- > fp_unavailable_tm() tm_reclaim_current() tm_reclaim_thread() giveup_all() return early since FP/VMX/VSX=0 /* ckpt MSR not updated (Incorrect) */ tm_reclaim() /* thread_struct ckpt FP regs contain junk (OK) */ /* Sees ckpt MSR FP=1 (Incorrect) */ no memcpy() performed /* thread_struct ckpt FP regs not fixed (Incorrect) */ tm_recheckpoint() /* Put junk in hardware checkpoint FP regs */ .... < ----- Return to userspace with MSR TM=1 FP=1 with junk in the FP TM checkpoint TM rollback reads FP junk This is a data integrity problem for the current process as the FP registers are corrupted. It's also a security problem as the FP registers from one process may be leaked to another. This patch moves up check_if_tm_restore_required() in giveup_all() to ensure thread->ckpt_regs.msr is updated correctly. A simple testcase to replicate this will be posted to tools/testing/selftests/powerpc/tm/tm-poison.c Similarly for VMX. This fixes CVE-2019-15030. Fixes: f48e91e87e67 ("powerpc/tm: Fix FP and VMX register corruption") Cc: stable@vger.kernel.org # 4.12+ Signed-off-by: Gustavo Romero Signed-off-by: Michael Neuling Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20190904045529.23002-1-gromero@linux.vnet.ibm.com commit 02fa5d7b17a761f53ef1eedfc254e1f33bd226b0 Author: Nadav Amit Date: Tue Aug 20 02:16:46 2019 -0700 mm/balloon_compaction: suppress allocation warnings There is no reason to print warnings when balloon page allocation fails, as they are expected and can be handled gracefully. Since VMware balloon now uses balloon-compaction infrastructure, and suppressed these warnings before, it is also beneficial to suppress these warnings to keep the same behavior that the balloon had before. Cc: Jason Wang Signed-off-by: Nadav Amit Signed-off-by: Michael S. Tsirkin Reviewed-by: David Hildenbrand commit 3d2c7d37047557175fb41de044091050b5f0d73b Author: Michael S. Tsirkin Date: Sat Aug 10 13:53:21 2019 -0400 Revert "vhost: access vq metadata through kernel virtual address" This reverts commit 7f466032dc ("vhost: access vq metadata through kernel virtual address"). The commit caused a bunch of issues, and while commit 73f628ec9e ("vhost: disable metadata prefetch optimization") disabled the optimization it's not nice to keep lots of dead code around. Signed-off-by: Michael S. Tsirkin commit 896fc242bc1d261c1178838487a0a54b260625cc Author: Yunsheng Lin Date: Tue Aug 20 20:36:32 2019 +0800 vhost: Remove unnecessary variable It is unnecessary to use ret variable to return the error code, just return the error code directly. Signed-off-by: Yunsheng Lin Signed-off-by: Michael S. Tsirkin commit 718be6bab26fb01fa0147a2b614a3eefd96a2957 Author: ? jiang Date: Tue Aug 20 02:51:23 2019 +0000 virtio-net: lower min ring num_free for efficiency This change lowers ring buffer reclaim threshold from 1/2*queue to budget for better performance. According to our test with qemu + dpdk, packet dropping happens when the guest is not able to provide free buffer in avail ring timely with default 1/2*queue. The value in the patch has been tested and does show better performance. Test setup: iperf3 to generate packets to guest (total 30mins, pps 400k, UDP) avg packets drop before: 2842 avg packets drop after: 360(-87.3%) Further, current code suffers from a starvation problem: the amount of work done by try_fill_recv is not bounded by the budget parameter, thus (with large queues) once in a while userspace gets blocked for a long time while queue is being refilled. Trigger refills earlier to make sure the amount of work to do is limited. Signed-off-by: jiangkidd Acked-by: Jason Wang Acked-by: Michael S. Tsirkin Signed-off-by: Michael S. Tsirkin commit 264b563b8675771834419057cbe076c1a41fb666 Author: Tiwei Bie Date: Wed Aug 28 13:37:00 2019 +0800 vhost/test: fix build for vhost test Since vhost_exceeds_weight() was introduced, callers need to specify the packet weight and byte weight in vhost_dev_init(). Note that, the packet weight isn't counted in this patch to keep the original behavior unchanged. Fixes: e82b9b0727ff ("vhost: introduce vhost_exceeds_weight()") Cc: stable@vger.kernel.org Signed-off-by: Tiwei Bie Signed-off-by: Michael S. Tsirkin Acked-by: Jason Wang commit 93d2c4de8d8129b97ee1e1a222aedb0719d2fcd9 Author: Tiwei Bie Date: Wed Aug 28 13:36:59 2019 +0800 vhost/test: fix build for vhost test Since below commit, callers need to specify the iov_limit in vhost_dev_init() explicitly. Fixes: b46a0bf78ad7 ("vhost: fix OOB in get_rx_bufs()") Cc: stable@vger.kernel.org Signed-off-by: Tiwei Bie Signed-off-by: Michael S. Tsirkin Acked-by: Jason Wang commit 2a36c16efab254dd6017efeb35ad88ecc96f2328 Author: Hui Wang Date: Wed Sep 4 13:53:27 2019 +0800 ALSA: hda/realtek - Fix the problem of two front mics on a ThinkCentre This ThinkCentre machine has a new realtek codec alc222, it is not in the support list, we add it in the realtek.c then this machine can apply FIXUPs for the realtek codec. And this machine has two front mics which can't be handled by PA so far, it uses the pin 0x18 and 0x19 as the front mics, as a result the existing FIXUP ALC294_FIXUP_LENOVO_MIC_LOCATION doesn't work on this machine. Fortunately another FIXUP ALC283_FIXUP_HEADSET_MIC also can change the location for one of the two mics on this machine. Link: https://lore.kernel.org/r/20190904055327.9883-1-hui.wang@canonical.com Signed-off-by: Hui Wang Cc: Signed-off-by: Takashi Iwai commit cf24aac38698bfa1d021afd3883df3c4c65143a4 Author: Yoshihiro Shimoda Date: Mon Sep 2 20:44:03 2019 +0900 dmaengine: rcar-dmac: Fix DMACHCLR handling if iommu is mapped The commit 20c169aceb45 ("dmaengine: rcar-dmac: clear pertinence number of channels") forgets to clear the last channel by DMACHCLR in rcar_dmac_init() (and doesn't need to clear the first channel) if iommu is mapped to the device. So, this patch fixes it by using "channels_mask" bitfield. Note that the hardware and driver don't support more than 32 bits in DMACHCLR register anyway, so this patch should reject more than 32 channels in rcar_dmac_parse_of(). Fixes: 20c169aceb459575 ("dmaengine: rcar-dmac: clear pertinence number of channels") Signed-off-by: Yoshihiro Shimoda Reviewed-by: Simon Horman Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/r/1567424643-26629-1-git-send-email-yoshihiro.shimoda.uh@renesas.com Signed-off-by: Vinod Koul commit 689379c2f383b1fdfdff03e84cf659daf62f2088 Author: Baolin Wang Date: Fri Aug 30 15:37:45 2019 +0800 dmaengine: sprd: Fix the DMA link-list configuration For the Spreadtrum DMA link-list mode, when the DMA engine got a slave hardware request, which will trigger the DMA engine to load the DMA configuration from the link-list memory automatically. But before the slave hardware request, the slave will get an incorrect residue due to the first node used to trigger the link-list was configured as the last source address and destination address. Thus we should make sure the first node was configured the start source address and destination address, which can fix this issue. Fixes: 4ac695464763 ("dmaengine: sprd: Support DMA link-list mode") Signed-off-by: Baolin Wang Link: https://lore.kernel.org/r/77868edb7aff9d5cb12ac3af8827ef2e244441a6.1567150471.git.baolin.wang@linaro.org Signed-off-by: Vinod Koul commit 110e48725db6262f260f10727d0fb2d3d25895e4 Author: Pablo Neira Ayuso Date: Mon Sep 2 19:37:43 2019 +0200 netfilter: nf_flow_table: set default timeout after successful insertion Set up the default timeout for this new entry otherwise the garbage collector might quickly remove it right after the flowtable insertion. Fixes: ac2a66665e23 ("netfilter: add generic flow table infrastructure") Signed-off-by: Pablo Neira Ayuso commit b067fa009c884401d23846251031c1f14d8a9c77 Author: Pablo Neira Ayuso Date: Mon Sep 2 19:37:42 2019 +0200 netfilter: ctnetlink: honor IPS_OFFLOAD flag If this flag is set, timeout and state are irrelevant to userspace. Fixes: 90964016e5d3 ("netfilter: nf_conntrack: add IPS_OFFLOAD status bit") Signed-off-by: Pablo Neira Ayuso commit 88209141392a4a2521a2f67c13d7db5e84efbb58 Author: Leonardo Bras Date: Fri Aug 30 15:13:53 2019 -0300 netfilter: nft_fib_netdev: Terminate rule eval if protocol=IPv6 and ipv6 module is disabled If IPv6 is disabled on boot (ipv6.disable=1), but nft_fib_inet ends up dealing with a IPv6 packet, it causes a kernel panic in fib6_node_lookup_1(), crashing in bad_page_fault. The panic is caused by trying to deference a very low address (0x38 in ppc64le), due to ipv6.fib6_main_tbl = NULL. BUG: Kernel NULL pointer dereference at 0x00000038 The kernel panic was reproduced in a host that disabled IPv6 on boot and have to process guest packets (coming from a bridge) using it's ip6tables. Terminate rule evaluation when packet protocol is IPv6 but the ipv6 module is not loaded. Signed-off-by: Leonardo Bras Acked-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit 8ad8e02c2fa70cfddc1ded53ba9001c9d444075d Author: Jan Kaisrlik Date: Tue Aug 20 13:42:29 2019 +0200 Revert "mmc: core: do not retry CMD6 in __mmc_switch()" Turns out the commit 3a0681c7448b ("mmc: core: do not retry CMD6 in __mmc_switch()") breaks initialization of a Toshiba THGBMNG5 eMMC card, when using the meson-gx-mmc.c driver on a custom board based on Amlogic A113D. The CMD6 that switches the card into HS200 mode is then one that fails and according to the below printed messages from the log: [ 1.648951] mmc0: mmc_select_hs200 failed, error -84 [ 1.648988] mmc0: error -84 whilst initialising MMC card After some analyze, it turns out that adding a delay of ~5ms inside mmc_select_bus_width() but after mmc_compare_ext_csds() has been executed, also fixes the problem. Adding yet some more debug code, trying to figure out if potentially the card could be in a busy state, both by using CMD13 and ->card_busy() ops concluded that this was not the case. Therefore, let's simply revert the commit that dropped support for retrying of CMD6, as this also fixes the problem. Fixes: 3a0681c7448b ("mmc: core: do not retry CMD6 in __mmc_switch()") Cc: stable@vger.kernel.org Signed-off-by: Jan Kaisrlik Signed-off-by: Ulf Hansson commit 8b51dc7291473093c821195c4b6af85fadedbc2f Author: Hui Peng Date: Mon Aug 19 18:02:29 2019 -0400 rsi: fix a double free bug in rsi_91x_deinit() `dev` (struct rsi_91x_usbdev *) field of adapter (struct rsi_91x_usbdev *) is allocated and initialized in `rsi_init_usb_interface`. If any error is detected in information read from the device side, `rsi_init_usb_interface` will be freed. However, in the higher level error handling code in `rsi_probe`, if error is detected, `rsi_91x_deinit` is called again, in which `dev` will be freed again, resulting double free. This patch fixes the double free by removing the free operation on `dev` in `rsi_init_usb_interface`, because `rsi_91x_deinit` is also used in `rsi_disconnect`, in that code path, the `dev` field is not (and thus needs to be) freed. This bug was found in v4.19, but is also present in the latest version of kernel. Fixes CVE-2019-15504. Reported-by: Hui Peng Reported-by: Mathias Payer Signed-off-by: Hui Peng Reviewed-by: Guenter Roeck Signed-off-by: Kalle Valo commit 13fa451568ab9e8b3074ef741477c7938c713c42 Author: Stanislaw Gruszka Date: Thu Aug 29 13:29:59 2019 +0200 Revert "rt2800: enable TX_PIN_CFG_LNA_PE_ bits per band" This reverts commit 9ad3b55654455258a9463384edb40077439d879f. As reported by Sergey: "I got some problem after upgrade kernel to 5.2 version (debian testing linux-image-5.2.0-2-amd64). 5Ghz client stopped to see AP. Some tests with 1metre distance between client-AP: 2.4Ghz -22dBm, for 5Ghz - 53dBm !, for longer distance (8m + walls) 2.4 - 61dBm, 5Ghz not visible." It was identified that rx signal level degradation was caused by 9ad3b5565445 ("rt2800: enable TX_PIN_CFG_LNA_PE_ bits per band"). So revert this commit. Cc: # v5.1+ Reported-and-tested-by: Sergey Maranchuk Signed-off-by: Stanislaw Gruszka Signed-off-by: Kalle Valo commit 14d5e14c8a6c257eb322ddeb294ac4c243a7d2e1 Author: Stanislaw Gruszka Date: Fri Aug 23 14:48:03 2019 +0200 rt2x00: clear up IV's on key removal After looking at code I realized that my previous fix 95844124385e ("rt2x00: clear IV's on start to fix AP mode regression") was incomplete. We can still have wrong IV's after re-keyring. To fix that, clear up IV's also on key removal. Fixes: 710e6cc1595e ("rt2800: do not nullify initialization vector data") Signed-off-by: Stanislaw Gruszka tested-by: Emil Karlson Signed-off-by: Kalle Valo commit 968dcfb4905245dc64d65312c0d17692fa087b99 Author: Luca Coelho Date: Thu Aug 29 11:13:46 2019 +0300 iwlwifi: assign directly to iwl_trans->cfg in QuZ detection We were erroneously assigning the new configuration to a local variable cfg, but that was not being assigned to anything, so the change was getting lost. Assign directly to iwl_trans->cfg instead. Fixes: 5a8c31aa6357 ("iwlwifi: pcie: fix recognition of QuZ devices") Cc: stable@vger.kernel.org # 5.2 Signed-off-by: Luca Coelho Signed-off-by: Kalle Valo commit 7caac62ed598a196d6ddf8d9c121e12e082cac3a Author: Wen Huang Date: Wed Aug 28 10:07:51 2019 +0800 mwifiex: Fix three heap overflow at parsing element in cfg80211_ap_settings mwifiex_update_vs_ie(),mwifiex_set_uap_rates() and mwifiex_set_wmm_params() call memcpy() without checking the destination size.Since the source is given from user-space, this may trigger a heap buffer overflow. Fix them by putting the length check before performing memcpy(). This fix addresses CVE-2019-14814,CVE-2019-14815,CVE-2019-14816. Signed-off-by: Wen Huang Acked-by: Ganapathi Bhat Signed-off-by: Kalle Valo commit 70702265a04aa0ce5a7bde77d13456209992b32f Author: Stanislaw Gruszka Date: Tue Aug 13 15:36:56 2019 +0200 mt76: mt76x0e: disable 5GHz band for MT7630E MT7630E hardware does support 5GHz, but we do not properly configure phy for 5GHz channels. Scanning at this band not only do not show any APs but also can hang the firmware. Since vendor reference driver do not support 5GHz we don't know how properly configure 5GHz channels. So disable this band for MT7630E . Cc: stable@vger.kernel.org Signed-off-by: Stanislaw Gruszka Signed-off-by: Kalle Valo commit 34b0e9b767bfa09ae233ca0d6ceb299bf2e24600 Author: Stanislaw Gruszka Date: Tue Aug 13 15:36:40 2019 +0200 mt76: mt76x0e: don't use hw encryption for MT7630E Since 41634aa8d6db ("mt76: only schedule txqs from the tx tasklet") I can observe firmware hangs on MT7630E on station mode: tx stop functioning after minor activity (rx keep working) and on module unload device fail to stop with messages: [ 5446.141413] mt76x0e 0000:06:00.0: TX DMA did not stop [ 5449.176764] mt76x0e 0000:06:00.0: TX DMA did not stop Loading module again results in failure to associate with AP. Only machine power off / power on cycle can make device work again. It's unclear why commit 41634aa8d6db causes the problem, but it is related to HW encryption. Since issue is a firmware hang, that is super hard to debug, just disable HW encryption as fix for the issue. Fixes: 41634aa8d6db ("mt76: only schedule txqs from the tx tasklet") Signed-off-by: Stanislaw Gruszka Signed-off-by: Kalle Valo commit 8744daf4b0699b724ee0a56b313a6c0c4ea289e3 Author: Jacob Pan Date: Mon Aug 26 08:53:29 2019 -0700 iommu/vt-d: Remove global page flush support Global pages support is removed from VT-d spec 3.0. Since global pages G flag only affects first-level paging structures and because DMA request with PASID are only supported by VT-d spec. 3.0 and onward, we can safely remove global pages support. For kernel shared virtual address IOTLB invalidation, PASID granularity and page selective within PASID will be used. There is no global granularity supported. Without this fix, IOTLB invalidation will cause invalid descriptor error in the queued invalidation (QI) interface. Fixes: 1c4f88b7f1f9 ("iommu/vt-d: Shared virtual address in scalable mode") Reported-by: Sanjay K Kumar Signed-off-by: Jacob Pan Signed-off-by: Joerg Roedel commit b0dfce90e342714b8351ecd1265013a13da23086 Merge: 089cf7f6ecb2 55f7e5c364dc Author: Dave Airlie Date: Tue Sep 3 17:03:35 2019 +1000 Merge branch 'linux-5.3' of git://github.com/skeggsb/linux into drm-fixes Single nouveau firmware fix. Signed-off-by: Dave Airlie From: Ben Skeggs Link: https://patchwork.freedesktop.org/patch/msgid/CACAvsv5uGLgDY8V8pWgEH0-YhkCEgvHE=NZ1W_m0gJaoFPuQ0g@mail.gmail.com commit 5e2d2cc2588bd3307ce3937acbc2ed03c830a861 Author: Liangyan Date: Mon Aug 26 20:16:33 2019 +0800 sched/fair: Don't assign runtime for throttled cfs_rq do_sched_cfs_period_timer() will refill cfs_b runtime and call distribute_cfs_runtime to unthrottle cfs_rq, sometimes cfs_b->runtime will allocate all quota to one cfs_rq incorrectly, then other cfs_rqs attached to this cfs_b can't get runtime and will be throttled. We find that one throttled cfs_rq has non-negative cfs_rq->runtime_remaining and cause an unexpetced cast from s64 to u64 in snippet: distribute_cfs_runtime() { runtime = -cfs_rq->runtime_remaining + 1; } The runtime here will change to a large number and consume all cfs_b->runtime in this cfs_b period. According to Ben Segall, the throttled cfs_rq can have account_cfs_rq_runtime called on it because it is throttled before idle_balance, and the idle_balance calls update_rq_clock to add time that is accounted to the task. This commit prevents cfs_rq to be assgined new runtime if it has been throttled until that distribute_cfs_runtime is called. Signed-off-by: Liangyan Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Valentin Schneider Reviewed-by: Ben Segall Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: shanpeic@linux.alibaba.com Cc: stable@vger.kernel.org Cc: xlpang@linux.alibaba.com Fixes: d3d9dc330236 ("sched: Throttle entities exceeding their allowed bandwidth") Link: https://lkml.kernel.org/r/20190826121633.6538-1-liangyan.peng@linux.alibaba.com Signed-off-by: Ingo Molnar commit 60083f9e94b2f28047d71ed778adf89357c1a8fb Author: Jian-Hong Pan Date: Mon Sep 2 18:00:56 2019 +0800 ALSA: hda/realtek - Enable internal speaker & headset mic of ASUS UX431FL Original pin node values of ASUS UX431FL with ALC294: 0x12 0xb7a60140 0x13 0x40000000 0x14 0x90170110 0x15 0x411111f0 0x16 0x411111f0 0x17 0x90170111 0x18 0x411111f0 0x19 0x411111f0 0x1a 0x411111f0 0x1b 0x411111f0 0x1d 0x4066852d 0x1e 0x411111f0 0x1f 0x411111f0 0x21 0x04211020 1. Has duplicated internal speakers (0x14 & 0x17) which makes the output route become confused. So, the output volume cannot be changed by setting. 2. Misses the headset mic pin node. This patch disables the confusing speaker (NID 0x14) and enables the headset mic (NID 0x19). Link: https://lore.kernel.org/r/20190902100054.6941-1-jian-hong@endlessm.com Signed-off-by: Jian-Hong Pan Cc: Signed-off-by: Takashi Iwai commit 039b1f4f24ecc8493b6bb9d70b4b78750d1b35c2 Author: Fernando Fernandez Mancera Date: Sun Sep 1 11:48:08 2019 +0200 netfilter: nft_socket: fix erroneous socket assignment The socket assignment is wrong, see skb_orphan(): When skb->destructor callback is not set, but skb->sk is set, this hits BUG(). Link: https://bugzilla.redhat.com/show_bug.cgi?id=1651813 Fixes: 554ced0a6e29 ("netfilter: nf_tables: add support for native socket matching") Signed-off-by: Fernando Fernandez Mancera Signed-off-by: Pablo Neira Ayuso commit 48bd0d68cd4b849c0bb99dc1fb01b013ad4aa942 Author: Leonardo Bras Date: Sat Aug 31 01:40:33 2019 -0300 netfilter: bridge: Drops IPv6 packets if IPv6 module is not loaded A kernel panic can happen if a host has disabled IPv6 on boot and have to process guest packets (coming from a bridge) using it's ip6tables. IPv6 packets need to be dropped if the IPv6 module is not loaded, and the host ip6tables will be used. Signed-off-by: Leonardo Bras Acked-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit 47320fbe11a6059ae502c9c16b668022fdb4cf76 Author: Al Viro Date: Sun Aug 25 19:56:13 2019 -0400 configfs: new object reprsenting tree fragments Refcounted, hangs of configfs_dirent, created by operations that add fragments to configfs tree (mkdir and configfs_register_{subsystem,group}). Will be used in the next commit to provide exclusion between fragment removal and ->show/->store calls. Signed-off-by: Al Viro Signed-off-by: Christoph Hellwig commit f19e4ed1e1edbfa3c9ccb9fed17759b7d6db24c6 Author: Al Viro Date: Thu Aug 29 23:13:30 2019 -0400 configfs_register_group() shouldn't be (and isn't) called in rmdirable parts revert cc57c07343bd "configfs: fix registered group removal" It was an attempt to handle something that fundamentally doesn't work - configfs_register_group() should never be done in a part of tree that can be rmdir'ed. And in mainline it never had been, so let's not borrow trouble; the fix was racy anyway, it would take a lot more to make that work and desired semantics is not clear. Signed-off-by: Al Viro Signed-off-by: Christoph Hellwig commit ff4dd081977da56566a848f071aed8fa92d604a1 Author: Al Viro Date: Fri Aug 30 11:30:03 2019 -0400 configfs: stash the data we need into configfs_buffer at open time simplifies the ->read()/->write()/->release() instances nicely Signed-off-by: Al Viro Signed-off-by: Christoph Hellwig commit e33b4325e60e146c2317a8b548cbd633239ff83b Author: Yizhuo Date: Fri Aug 30 19:00:48 2019 -0700 net: stmmac: dwmac-sun8i: Variable "val" in function sun8i_dwmac_set_syscon() could be uninitialized In function sun8i_dwmac_set_syscon(), local variable "val" could be uninitialized if function regmap_field_read() returns -EINVAL. However, it will be used directly in the if statement, which is potentially unsafe. Signed-off-by: Yizhuo Signed-off-by: David S. Miller commit 4030b4c585c41eeefec7bd20ce3d0e100a0f2e4d Author: Tianyu Lan Date: Mon Sep 2 20:41:43 2019 +0800 x86/hyper-v: Fix overflow bug in fill_gva_list() When the 'start' parameter is >= 0xFF000000 on 32-bit systems, or >= 0xFFFFFFFF'FF000000 on 64-bit systems, fill_gva_list() gets into an infinite loop. With such inputs, 'cur' overflows after adding HV_TLB_FLUSH_UNIT and always compares as less than end. Memory is filled with guest virtual addresses until the system crashes. Fix this by never incrementing 'cur' to be larger than 'end'. Reported-by: Jong Hyun Park Signed-off-by: Tianyu Lan Reviewed-by: Michael Kelley Cc: Borislav Petkov Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Thomas Gleixner Fixes: 2ffd9e33ce4a ("x86/hyper-v: Use hypercall for remote TLB flush") Signed-off-by: Ingo Molnar commit eb3d8f42231aec65b64b079dd17bd6c008a3fe29 Author: Trond Myklebust Date: Wed Aug 28 11:26:13 2019 -0400 NFS: Fix inode fileid checks in attribute revalidation code We want to throw out the attrbute if it refers to the mounted on fileid, and not the real fileid. However we do not want to block cache consistency updates from NFSv4 writes. Reported-by: Murphy Zhou Fixes: 7e10cc25bfa0 ("NFS: Don't refresh attributes with mounted-on-file...") Signed-off-by: Trond Myklebust commit 089cf7f6ecb266b6a4164919a2e69bd2f938374a Author: Linus Torvalds Date: Mon Sep 2 09:57:40 2019 -0700 Linux 5.3-rc7 commit 49ffdb4c7c65082cee24a53a7ebd62e00eb2e9e9 Merge: 2c248f92fa4f 8919dfcb3116 Author: Linus Torvalds Date: Mon Sep 2 09:30:34 2019 -0700 Merge tag 'char-misc-5.3-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc Pull char/misc driver fixes from Greg KH: "Here are some small char and misc driver fixes for reported issues for 5.3-rc7 Also included in here is the documentation for how we are handling hardware issues under embargo that everyone has finally agreed on, as well as a MAINTAINERS update for the suckers who agreed to handle the LICENSES/ files. All of these have been in linux-next last week with no reported issues" * tag 'char-misc-5.3-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: fsi: scom: Don't abort operations for minor errors vmw_balloon: Fix offline page marking with compaction VMCI: Release resource if the work is already queued Documentation/process: Embargoed hardware security issues lkdtm/bugs: fix build error in lkdtm_EXHAUST_STACK mei: me: add Tiger Lake point LP device ID intel_th: pci: Add Tiger Lake support intel_th: pci: Add support for another Lewisburg PCH stm class: Fix a double free of stm_source_device MAINTAINERS: add entry for LICENSES and SPDX stuff fpga: altera-ps-spi: Fix getting of optional confd gpio commit 2c248f92fa4fae3036e656da2f9a077020a99f6e Merge: 345464fb760d 1426bd2c9f7e Author: Linus Torvalds Date: Mon Sep 2 09:15:30 2019 -0700 Merge tag 'usb-5.3-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb Pull USB fixes from Greg KH: "Here are some small USB fixes that have been in linux-next this past week for 5.3-rc7 They fix the usual xhci, syzbot reports, and other small issues that have come up last week. All have been in linux-next with no reported issues" * tag 'usb-5.3-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: USB: cdc-wdm: fix race between write and disconnect due to flag abuse usb: host: xhci: rcar: Fix typo in compatible string matching usb: host: xhci-tegra: Set DMA mask correctly USB: storage: ums-realtek: Whitelist auto-delink support USB: storage: ums-realtek: Update module parameter description for auto_delink_en usb: host: ohci: fix a race condition between shutdown and irq usb: hcd: use managed device resources typec: tcpm: fix a typo in the comparison of pdo_max_voltage usb-storage: Add new JMS567 revision to unusual_devs usb: chipidea: udc: don't do hardware access if gadget has stopped usbtmc: more sanity checking for packet size usb: udc: lpc32xx: silence fall-through warning commit d33cd42d86671bed870827aa399aeb9f1da74119 Author: Sam Bazley Date: Sun Sep 1 03:31:30 2019 +0100 ALSA: hda/realtek - Add quirk for HP Pavilion 15 HP Pavilion 15 (AMD Ryzen-based model) with 103c:84e7 needs the same quirk like HP Envy/Spectre x360 for enabling the mute LED over Mic3 pin. [ rearranged in the SSID number order by tiwai ] Signed-off-by: Sam Bazley Cc: Signed-off-by: Takashi Iwai commit 9b8bd476e78e89c9ea26c3b435ad0201c3d7dbf5 Author: Peter Zijlstra Date: Thu Aug 29 10:24:45 2019 +0200 x86/uaccess: Don't leak the AC flags into __get_user() argument evaluation Identical to __put_user(); the __get_user() argument evalution will too leak UBSAN crud into the __uaccess_begin() / __uaccess_end() region. While uncommon this was observed to happen for: drivers/xen/gntdev.c: if (__get_user(old_status, batch->status[i])) where UBSAN added array bound checking. This complements commit: 6ae865615fc4 ("x86/uaccess: Dont leak the AC flag into __put_user() argument evaluation") Tested-by Sedat Dilek Reported-by: Randy Dunlap Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Josh Poimboeuf Reviewed-by: Thomas Gleixner Cc: broonie@kernel.org Cc: sfr@canb.auug.org.au Cc: akpm@linux-foundation.org Cc: Randy Dunlap Cc: mhocko@suse.cz Cc: Josh Poimboeuf Link: https://lkml.kernel.org/r/20190829082445.GM2369@hirez.programming.kicks-ass.net commit 29d9a0b50736768f042752070e5cdf4e4d4c00df Author: John S. Gruber Date: Mon Sep 2 00:00:54 2019 +0200 x86/boot: Preserve boot_params.secure_boot from sanitizing Commit a90118c445cc ("x86/boot: Save fields explicitly, zero out everything else") now zeroes the secure boot setting information (enabled/disabled/...) passed by the boot loader or by the kernel's EFI handover mechanism. The problem manifests itself with signed kernels using the EFI handoff protocol with grub and the kernel loses the information whether secure boot is enabled in the firmware, i.e., the log message "Secure boot enabled" becomes "Secure boot could not be determined". efi_main() arch/x86/boot/compressed/eboot.c sets this field early but it is subsequently zeroed by the above referenced commit. Include boot_params.secure_boot in the preserve field list. [ bp: restructure commit message and massage. ] Fixes: a90118c445cc ("x86/boot: Save fields explicitly, zero out everything else") Signed-off-by: John S. Gruber Signed-off-by: Borislav Petkov Reviewed-by: John Hubbard Cc: "H. Peter Anvin" Cc: Ingo Molnar Cc: Juergen Gross Cc: Mark Brown Cc: stable Cc: Thomas Gleixner Cc: x86-ml Link: https://lkml.kernel.org/r/CAPotdmSPExAuQcy9iAHqX3js_fc4mMLQOTr5RBGvizyCOPcTQQ@mail.gmail.com commit 55f7e5c364dce20e691fda329fb2a6cc3cbb63b6 Author: Ben Skeggs Date: Mon Sep 2 16:33:22 2019 +1000 drm/nouveau/sec2/gp102: add missing MODULE_FIRMWAREs Signed-off-by: Ben Skeggs Cc: stable@vger.kernel.org [v5.2+] commit 345464fb760d1b772e891538b498e111c588b692 Merge: 9f159ae07f07 e1e54ec7fb55 Author: Linus Torvalds Date: Sun Sep 1 18:45:28 2019 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from David Miller: 1) Fix some length checks during OGM processing in batman-adv, from Sven Eckelmann. 2) Fix regression that caused netfilter conntrack sysctls to not be per-netns any more. From Florian Westphal. 3) Use after free in netpoll, from Feng Sun. 4) Guard destruction of pfifo_fast per-cpu qdisc stats with qdisc_is_percpu_stats(), from Davide Caratti. Similar bug is fixed in pfifo_fast_enqueue(). 5) Fix memory leak in mld_del_delrec(), from Eric Dumazet. 6) Handle neigh events on internal ports correctly in nfp, from John Hurley. 7) Clear SKB timestamp in NF flow table code so that it does not confuse fq scheduler. From Florian Westphal. 8) taprio destroy can crash if it is invoked in a failure path of taprio_init(), because the list head isn't setup properly yet and the list del is unconditional. Perform the list add earlier to address this. From Vladimir Oltean. 9) Make sure to reapply vlan filters on device up, in aquantia driver. From Dmitry Bogdanov. 10) sgiseeq driver releases DMA memory using free_page() instead of dma_free_attrs(). From Christophe JAILLET. * git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (58 commits) net: seeq: Fix the function used to release some memory in an error handling path enetc: Add missing call to 'pci_free_irq_vectors()' in probe and remove functions net: bcmgenet: use ethtool_op_get_ts_info() tc-testing: don't hardcode 'ip' in nsPlugin.py net: dsa: microchip: add KSZ8563 compatibility string dt-bindings: net: dsa: document additional Microchip KSZ8563 switch net: aquantia: fix out of memory condition on rx side net: aquantia: linkstate irq should be oneshot net: aquantia: reapply vlan filters on up net: aquantia: fix limit of vlan filters net: aquantia: fix removal of vlan 0 net/sched: cbs: Set default link speed to 10 Mbps in cbs_set_port_rate taprio: Set default link speed to 10 Mbps in taprio_set_picos_per_byte taprio: Fix kernel panic in taprio_destroy net: dsa: microchip: fill regmap_config name rxrpc: Fix lack of conn cleanup when local endpoint is cleaned up [ver #2] net: stmmac: dwmac-rk: Don't fail if phy regulator is absent amd-xgbe: Fix error path in xgbe_mod_init() netfilter: nft_meta_bridge: Fix get NFT_META_BRI_IIFVPROTO in network byteorder mac80211: Correctly set noencrypt for PAE frames ... commit e1e54ec7fb55501c33b117c111cb0a045b8eded2 Author: Christophe JAILLET Date: Sat Aug 31 09:17:51 2019 +0200 net: seeq: Fix the function used to release some memory in an error handling path In commit 99cd149efe82 ("sgiseeq: replace use of dma_cache_wback_inv"), a call to 'get_zeroed_page()' has been turned into a call to 'dma_alloc_coherent()'. Only the remove function has been updated to turn the corresponding 'free_page()' into 'dma_free_attrs()'. The error hndling path of the probe function has not been updated. Fix it now. Rename the corresponding label to something more in line. Fixes: 99cd149efe82 ("sgiseeq: replace use of dma_cache_wback_inv") Signed-off-by: Christophe JAILLET Reviewed-by: Thomas Bogendoerfer Signed-off-by: David S. Miller commit 9f159ae07f07fc540290f21937231034f554bdd7 Merge: 5fb181cba010 7af0145067bc Author: Linus Torvalds Date: Sun Sep 1 11:21:57 2019 -0700 Merge branch 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 fixes from Thomas Gleixner: "A set of fixes for x86: - Fix the bogus detection of 32bit user mode for uretprobes which caused corruption of the user return address resulting in application crashes. In the uprobes handler in_ia32_syscall() is obviously always returning false on a 64bit kernel. Use user_64bit_mode() instead which works correctly. - Prevent large page splitting when ftrace flips RW/RO on the kernel text which caused iTLB performance issues. Ftrace wants to be converted to text_poke() which avoids the problem, but for now allow large page preservation in the static protections check when the change request spawns a full large page. - Prevent arch_dynirq_lower_bound() from returning 0 when the IOAPIC is configured via device tree. In the device tree case the GSI 1:1 mapping is meaningless therefore the lower bound which protects the GSI range on ACPI machines is irrelevant. Return the lower bound which the core hands to the function instead of blindly returning 0 which causes the core to allocate the invalid virtual interupt number 0 which in turn prevents all drivers from allocating and requesting an interrupt. - Remove the bogus initialization of LDR and DFR in the 32bit bigsmp APIC driver. That uses physical destination mode where LDR/DFR are ignored, but the initialization and the missing clear of LDR caused the APIC to be left in a inconsistent state on kexec/reboot. - Clear LDR when clearing the APIC registers so the APIC is in a well defined state. - Initialize variables proper in the find_trampoline_placement() code. - Silence GCC( build warning for the real mode part of the build" * 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/mm/cpa: Prevent large page split when ftrace flips RW on kernel text x86/build: Add -Wnoaddress-of-packed-member to REALMODE_CFLAGS, to silence GCC9 build warning x86/boot/compressed/64: Fix missing initialization in find_trampoline_placement() x86/apic: Include the LDR when clearing out APIC registers x86/apic: Do not initialize LDR and DFR for bigsmp uprobes/x86: Fix detection of 32-bit user mode x86/apic: Fix arch_dynirq_lower_bound() bug for DT enabled machines commit 5fb181cba01088924a68441753843e5acfd012ff Merge: 5358e6e77490 0f4cd769c410 Author: Linus Torvalds Date: Sun Sep 1 11:09:42 2019 -0700 Merge branch 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull perf fixes from Thomas Gleixner: "Two fixes for perf x86 hardware implementations: - Restrict the period on Nehalem machines to prevent perf from hogging the CPU - Prevent the AMD IBS driver from overwriting the hardwre controlled and pre-seeded reserved bits (0-6) in the count register which caused a sample bias for dispatched micro-ops" * 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: perf/x86/amd/ibs: Fix sample bias for dispatched micro-ops perf/x86/intel: Restrict period on Nehalem commit 5358e6e77490024aa13fc4e3ca94d7d1aad330d0 Merge: eea173097dfb 9eb4b5180d33 Author: Linus Torvalds Date: Sun Sep 1 10:39:25 2019 -0700 Merge branch 'turbostat' of git://git.kernel.org/pub/scm/linux/kernel/git/lenb/linux Pull turbostat updates from Len Brown: "User-space turbostat (and x86_energy_perf_policy) patches. They are primarily bug fixes from users" * 'turbostat' of git://git.kernel.org/pub/scm/linux/kernel/git/lenb/linux: tools/power turbostat: update version number tools/power turbostat: Add support for Hygon Fam 18h (Dhyana) RAPL tools/power turbostat: Fix caller parameter of get_tdp_amd() tools/power turbostat: Fix CPU%C1 display value tools/power turbostat: do not enforce 1ms tools/power turbostat: read from pipes too tools/power turbostat: Add Ice Lake NNPI support tools/power turbostat: rename has_hsw_msrs() tools/power turbostat: Fix Haswell Core systems tools/power turbostat: add Jacobsville support tools/power turbostat: fix buffer overrun tools/power turbostat: fix file descriptor leaks tools/power turbostat: fix leak of file descriptor on error return path tools/power turbostat: Make interval calculation per thread to reduce jitter tools/power turbostat: remove duplicate pc10 column tools/power x86_energy_perf_policy: Fix argument parsing tools/power: Fix typo in man page tools/power/x86: Enable compiler optimisations and Fortify by default tools/power x86_energy_perf_policy: Fix "uninitialized variable" warnings at -O2 commit dd7078f05e1b774a9e8c9f117101d97e4ccd0691 Author: Christophe JAILLET Date: Fri Aug 30 22:23:12 2019 +0200 enetc: Add missing call to 'pci_free_irq_vectors()' in probe and remove functions Call to 'pci_free_irq_vectors()' are missing both in the error handling path of the probe function, and in the remove function. Add them. Fixes: 19971f5ea0ab ("enetc: add PTP clock driver") Signed-off-by: Christophe JAILLET Signed-off-by: David S. Miller commit dd1bf47a84fe64edf50f6a83fdc164d0da6fa021 Author: Ryan M. Collins Date: Fri Aug 30 14:49:55 2019 -0400 net: bcmgenet: use ethtool_op_get_ts_info() This change enables the use of SW timestamping on the Raspberry Pi 4. bcmgenet's transmit function bcmgenet_xmit() implements software timestamping. However the SOF_TIMESTAMPING_TX_SOFTWARE capability was missing and only SOF_TIMESTAMPING_RX_SOFTWARE was announced. By using ethtool_ops bcmgenet_ethtool_ops() as get_ts_info(), the SOF_TIMESTAMPING_TX_SOFTWARE capability is announced. Similar to commit a8f5cb9e7991 ("smsc95xx: use ethtool_op_get_ts_info()") Signed-off-by: Ryan M. Collins Acked-by: Florian Fainelli Acked-by: Doug Berger Signed-off-by: David S. Miller commit 02a3f0d5a70a865d55c4b7cb2e327cb30491f7fd Author: Davide Caratti Date: Fri Aug 30 18:51:47 2019 +0200 tc-testing: don't hardcode 'ip' in nsPlugin.py the following tdc test fails on Fedora: # ./tdc.py -e 2638 -- ns/SubPlugin.__init__ Test 2638: Add matchall and try to get it -----> prepare stage *** Could not execute: "$TC qdisc add dev $DEV1 clsact" -----> prepare stage *** Error message: "/bin/sh: ip: command not found" returncode 127; expected [0] -----> prepare stage *** Aborting test run. Let nsPlugin.py use the 'IP' variable introduced with commit 92c1a19e2fb9 ("tc-tests: added path to ip command in tdc"), so that the path to 'ip' is correctly resolved to the value we have in tdc_config.py. # ./tdc.py -e 2638 -- ns/SubPlugin.__init__ Test 2638: Add matchall and try to get it All test results: 1..1 ok 1 2638 - Add matchall and try to get it Fixes: 489ce2f42514 ("tc-testing: Restore original behaviour for namespaces in tdc") Reported-by: Hangbin Liu Signed-off-by: Davide Caratti Acked-by: Nicolas Dichtel Signed-off-by: David S. Miller commit 3daa418392db6f4c6b09b6d62a40936113ff402b Merge: 879c3808a4a1 d9033ae95cf4 Author: David S. Miller Date: Sat Aug 31 23:36:37 2019 -0700 Merge branch 'net-dsa-microchip-add-KSZ8563-support' Razvan Stefanescu says: ==================== net: dsa: microchip: add KSZ8563 support This patchset adds compatibility string for the KSZ8563 switch. ==================== Signed-off-by: David S. Miller commit d9033ae95cf445150fcc5856ccf024f41f0bd0b9 Author: Razvan Stefanescu Date: Fri Aug 30 10:52:02 2019 +0300 net: dsa: microchip: add KSZ8563 compatibility string It is a 3-Port 10/100 Ethernet Switch with 1588v2 PTP. Signed-off-by: Razvan Stefanescu Signed-off-by: David S. Miller commit de5eb9e00eba00783f49da37377bd2a93d38fe42 Author: Razvan Stefanescu Date: Fri Aug 30 10:52:01 2019 +0300 dt-bindings: net: dsa: document additional Microchip KSZ8563 switch It is a 3-Port 10/100 Ethernet Switch with 1588v2 PTP. Signed-off-by: Razvan Stefanescu Signed-off-by: David S. Miller commit 879c3808a4a126d271c4f39cd93f6252c72340bf Merge: 154f4fb7a0b8 be6cef69ba57 Author: David S. Miller Date: Sat Aug 31 19:07:17 2019 -0700 Merge branch 'net-aquantia-fixes-on-vlan-filters-and-other-conditions' Igor Russkikh says: ==================== net: aquantia: fixes on vlan filters and other conditions Here is a set of various bug fixes related to vlan filter offload and two other rare cases. ==================== Signed-off-by: David S. Miller commit be6cef69ba570ebb327eba1ef6438f7af49aaf86 Author: Dmitry Bogdanov Date: Fri Aug 30 12:08:38 2019 +0000 net: aquantia: fix out of memory condition on rx side On embedded environments with hard memory limits it is a normal although rare case when skb can't be allocated on rx part under high traffic. In such OOM cases napi_complete_done() was not called. So the napi object became in an invalid state like it is "scheduled". Kernel do not re-schedules the poll of that napi object. Consequently, kernel can not remove that object the system hangs on `ifconfig down` waiting for a poll. We are fixing this by gracefully closing napi poll routine with correct invocation of napi_complete_done. This was reproduced with artificially failing the allocation of skb to simulate an "out of memory" error case and check that traffic does not get stuck. Fixes: 970a2e9864b0 ("net: ethernet: aquantia: Vector operations") Signed-off-by: Igor Russkikh Signed-off-by: Dmitry Bogdanov Signed-off-by: David S. Miller commit 5c47e3ba6fe52465603cf9d816b3371e6881d649 Author: Igor Russkikh Date: Fri Aug 30 12:08:36 2019 +0000 net: aquantia: linkstate irq should be oneshot Declaring threaded irq handler should also indicate the irq is oneshot. It is oneshot indeed, because HW implements irq automasking on trigger. Not declaring this causes some kernel configurations to fail on interface up, because request_threaded_irq returned an err code. The issue was originally hidden on normal x86_64 configuration with latest kernel, because depending on interrupt controller, irq driver added ONESHOT flag on its own. Issue was observed on older kernels (4.14) where no such logic exists. Fixes: 4c83f170b3ac ("net: aquantia: link status irq handling") Signed-off-by: Igor Russkikh Reported-by: Michael Symolkin Signed-off-by: David S. Miller commit c2ef057ee775e229d3138add59f937d93a3a59d8 Author: Dmitry Bogdanov Date: Fri Aug 30 12:08:35 2019 +0000 net: aquantia: reapply vlan filters on up In case of device reconfiguration the driver may reset the device invisible for other modules, vlan module in particular. So vlans will not be removed&created and vlan filters will not be configured in the device. The patch reapplies the vlan filters at device start. Fixes: 7975d2aff5afb ("net: aquantia: add support of rx-vlan-filter offload") Signed-off-by: Dmitry Bogdanov Signed-off-by: Igor Russkikh Signed-off-by: David S. Miller commit 392349f60110dc2c3daf86464fd926afc53d6143 Author: Dmitry Bogdanov Date: Fri Aug 30 12:08:33 2019 +0000 net: aquantia: fix limit of vlan filters Fix a limit condition of vlans on the interface before setting vlan promiscuous mode Fixes: 48dd73d08d4dd ("net: aquantia: fix vlans not working over bridged network") Signed-off-by: Dmitry Bogdanov Signed-off-by: Igor Russkikh Signed-off-by: David S. Miller commit 6fdc060d7476ef73c8029b652d252c1a7b4de948 Author: Dmitry Bogdanov Date: Fri Aug 30 12:08:30 2019 +0000 net: aquantia: fix removal of vlan 0 Due to absence of checking against the rx flow rule when vlan 0 is being removed, the other rule could be removed instead of the rule with vlan 0 Fixes: 7975d2aff5afb ("net: aquantia: add support of rx-vlan-filter offload") Signed-off-by: Dmitry Bogdanov Signed-off-by: Igor Russkikh Signed-off-by: David S. Miller commit 154f4fb7a0b8b0d8ad655e4dc3063069bcf30f14 Merge: 5f81d5455589 1c6c09a0ae62 Author: David S. Miller Date: Sat Aug 31 18:45:35 2019 -0700 Merge branch 'Fix-issues-in-tc-taprio-and-tc-cbs' Vladimir Oltean says: ==================== Fix issues in tc-taprio and tc-cbs This series fixes one panic and one WARN_ON found in the tc-taprio qdisc, while trying to apply it: - On an interface which is not multi-queue - On an interface which has no carrier The tc-cbs was also visually found to suffer of the same issue as tc-taprio, and the fix was only compile-tested in that case. ==================== Signed-off-by: David S. Miller commit 1c6c09a0ae62fa3ea8f8ead2ac3920e6fff2de64 Author: Vladimir Oltean Date: Fri Aug 30 04:07:23 2019 +0300 net/sched: cbs: Set default link speed to 10 Mbps in cbs_set_port_rate The discussion to be made is absolutely the same as in the case of previous patch ("taprio: Set default link speed to 10 Mbps in taprio_set_picos_per_byte"). Nothing is lost when setting a default. Cc: Leandro Dorileo Fixes: e0a7683d30e9 ("net/sched: cbs: fix port_rate miscalculation") Acked-by: Vinicius Costa Gomes Signed-off-by: Vladimir Oltean Signed-off-by: David S. Miller commit f04b514c0ce2f20aad757ebfb04e07b1a12d2b58 Author: Vladimir Oltean Date: Fri Aug 30 04:07:22 2019 +0300 taprio: Set default link speed to 10 Mbps in taprio_set_picos_per_byte The taprio budget needs to be adapted at runtime according to interface link speed. But that handling is problematic. For one thing, installing a qdisc on an interface that doesn't have carrier is not illegal. But taprio prints the following stack trace: [ 31.851373] ------------[ cut here ]------------ [ 31.856024] WARNING: CPU: 1 PID: 207 at net/sched/sch_taprio.c:481 taprio_dequeue+0x1a8/0x2d4 [ 31.864566] taprio: dequeue() called with unknown picos per byte. [ 31.864570] Modules linked in: [ 31.873701] CPU: 1 PID: 207 Comm: tc Not tainted 5.3.0-rc5-01199-g8838fe023cd6 #1689 [ 31.881398] Hardware name: Freescale LS1021A [ 31.885661] [] (unwind_backtrace) from [] (show_stack+0x10/0x14) [ 31.893368] [] (show_stack) from [] (dump_stack+0xb4/0xc8) [ 31.900555] [] (dump_stack) from [] (__warn+0xe0/0xf8) [ 31.907395] [] (__warn) from [] (warn_slowpath_fmt+0x48/0x6c) [ 31.914841] [] (warn_slowpath_fmt) from [] (taprio_dequeue+0x1a8/0x2d4) [ 31.923150] [] (taprio_dequeue) from [] (__qdisc_run+0x90/0x61c) [ 31.930856] [] (__qdisc_run) from [] (net_tx_action+0x12c/0x2bc) [ 31.938560] [] (net_tx_action) from [] (__do_softirq+0x130/0x3c8) [ 31.946350] [] (__do_softirq) from [] (irq_exit+0xbc/0xd8) [ 31.953536] [] (irq_exit) from [] (__handle_domain_irq+0x60/0xb4) [ 31.961328] [] (__handle_domain_irq) from [] (gic_handle_irq+0x58/0x9c) [ 31.969638] [] (gic_handle_irq) from [] (__irq_svc+0x6c/0x90) [ 31.977076] Exception stack(0xe8167b20 to 0xe8167b68) [ 31.982100] 7b20: e9d4bd80 00000cc0 000000cf 00000000 e9d4bd80 c1f38958 00000cc0 c1f38960 [ 31.990234] 7b40: 00000001 000000cf 00000004 e9dc0800 00000000 e8167b70 c0f478ec c0f46d94 [ 31.998363] 7b60: 60070013 ffffffff [ 32.001833] [] (__irq_svc) from [] (netlink_trim+0x18/0xd8) [ 32.009104] [] (netlink_trim) from [] (netlink_broadcast_filtered+0x34/0x414) [ 32.017930] [] (netlink_broadcast_filtered) from [] (netlink_broadcast+0x20/0x28) [ 32.027102] [] (netlink_broadcast) from [] (rtnetlink_send+0x34/0x88) [ 32.035238] [] (rtnetlink_send) from [] (notify_and_destroy+0x2c/0x44) [ 32.043461] [] (notify_and_destroy) from [] (qdisc_graft+0x398/0x470) [ 32.051595] [] (qdisc_graft) from [] (tc_modify_qdisc+0x3a4/0x724) [ 32.059470] [] (tc_modify_qdisc) from [] (rtnetlink_rcv_msg+0x260/0x2ec) [ 32.067864] [] (rtnetlink_rcv_msg) from [] (netlink_rcv_skb+0xb8/0x110) [ 32.076172] [] (netlink_rcv_skb) from [] (netlink_unicast+0x1b4/0x22c) [ 32.084392] [] (netlink_unicast) from [] (netlink_sendmsg+0x33c/0x380) [ 32.092614] [] (netlink_sendmsg) from [] (sock_sendmsg+0x14/0x24) [ 32.100403] [] (sock_sendmsg) from [] (___sys_sendmsg+0x214/0x228) [ 32.108279] [] (___sys_sendmsg) from [] (__sys_sendmsg+0x50/0x8c) [ 32.116068] [] (__sys_sendmsg) from [] (ret_fast_syscall+0x0/0x54) [ 32.123938] Exception stack(0xe8167fa8 to 0xe8167ff0) [ 32.128960] 7fa0: b6fa68c8 000000f8 00000003 bea142d0 00000000 00000000 [ 32.137093] 7fc0: b6fa68c8 000000f8 0052154c 00000128 5d6468a2 00000000 00000028 00558c9c [ 32.145224] 7fe0: 00000070 bea14278 00530d64 b6e17e64 [ 32.150659] ---[ end trace 2139c9827c3e5177 ]--- This happens because the qdisc ->dequeue callback gets called. Which again is not illegal, the qdisc will dequeue even when the interface is up but doesn't have carrier (and hence SPEED_UNKNOWN), and the frames will be dropped further down the stack in dev_direct_xmit(). And, at the end of the day, for what? For calculating the initial budget of an interface which is non-operational at the moment and where frames will get dropped anyway. So if we can't figure out the link speed, default to SPEED_10 and move along. We can also remove the runtime check now. Cc: Leandro Dorileo Fixes: 7b9eba7ba0c1 ("net/sched: taprio: fix picos_per_byte miscalculation") Acked-by: Vinicius Costa Gomes Signed-off-by: Vladimir Oltean Signed-off-by: David S. Miller commit efb55222d31c8c2af8b4ba42bb56b0b0beedf98e Author: Vladimir Oltean Date: Fri Aug 30 04:07:21 2019 +0300 taprio: Fix kernel panic in taprio_destroy taprio_init may fail earlier than this line: list_add(&q->taprio_list, &taprio_list); i.e. due to the net device not being multi queue. Attempting to remove q from the global taprio_list when it is not part of it will result in a kernel panic. Fix it by matching list_add and list_del better to one another in the order of operations. This way we can keep the deletion unconditional and with lower complexity - O(1). Cc: Leandro Dorileo Fixes: 7b9eba7ba0c1 ("net/sched: taprio: fix picos_per_byte miscalculation") Signed-off-by: Vladimir Oltean Acked-by: Vinicius Costa Gomes Signed-off-by: David S. Miller commit 5f81d5455589df2f580e634c2e9da55b80e63c30 Author: George McCollister Date: Thu Aug 29 09:14:41 2019 -0500 net: dsa: microchip: fill regmap_config name Use the register value width as the regmap_config name to prevent the following error when the second and third regmap_configs are initialized. "debugfs: Directory '${bus-id}' with parent 'regmap' already present!" Signed-off-by: George McCollister Reviewed-by: Marek Vasut Signed-off-by: David S. Miller commit 5b161002bd6d8b3ee4553a697524e61c3b92769c Merge: c3d7a089f945 0ff0f15a32c0 Author: David S. Miller Date: Sat Aug 31 13:16:07 2019 -0700 Merge tag 'batadv-net-for-davem-20190830' of git://git.open-mesh.org/linux-merge Simon Wunderlich says: ==================== Here are two batman-adv bugfixes: - Fix OGM and OGMv2 header read boundary check, by Sven Eckelmann (2 patches) ==================== Signed-off-by: David S. Miller commit 9eb4b5180d33c827f16829644ae0cd7382ecdb82 Author: Len Brown Date: Sat Aug 31 14:40:39 2019 -0400 tools/power turbostat: update version number Today is 19.08.31, at least in some parts of the world. Signed-off-by: Len Brown commit c1c10cc77883932abdb7b103687ecbb01e80bef9 Author: Pu Wen Date: Sat Aug 31 10:20:31 2019 +0800 tools/power turbostat: Add support for Hygon Fam 18h (Dhyana) RAPL Commit 9392bd98bba760be96ee ("tools/power turbostat: Add support for AMD Fam 17h (Zen) RAPL") and the commit 3316f99a9f1b68c578c5 ("tools/power turbostat: Also read package power on AMD F17h (Zen)") add AMD Fam 17h RAPL support. Hygon Family 18h(Dhyana) support RAPL in bit 14 of CPUID 0x80000007 EDX, and has MSRs RAPL_PWR_UNIT/CORE_ENERGY_STAT/PKG_ENERGY_STAT. So add Hygon Dhyana Family 18h support for RAPL. Already tested on Hygon multi-node systems and it shows correct per-core energy usage and the total package power. Signed-off-by: Pu Wen Reviewed-by: Calvin Walton Signed-off-by: Len Brown commit 9cfa8e042f7cbb1994cc5923e46c78b36f6054f4 Author: Pu Wen Date: Sat Aug 31 10:19:58 2019 +0800 tools/power turbostat: Fix caller parameter of get_tdp_amd() Commit 9392bd98bba760be96ee ("tools/power turbostat: Add support for AMD Fam 17h (Zen) RAPL") add a function get_tdp_amd(), the parameter is CPU family. But the rapl_probe_amd() function use wrong model parameter. Fix the wrong caller parameter of get_tdp_amd() to use family. Cc: # v5.1+ Signed-off-by: Pu Wen Reviewed-by: Calvin Walton Signed-off-by: Len Brown commit 1e9042b9c8d46ada9ee7b3339a31f50d12e5d291 Author: Srinivas Pandruvada Date: Tue Aug 27 10:57:14 2019 -0700 tools/power turbostat: Fix CPU%C1 display value In some case C1% will be wrong value, when platform doesn't have MSR for C1 residency. For example: Core CPU CPU%c1 - - 100.00 0 0 100.00 0 2 100.00 1 1 100.00 1 3 100.00 But adding Busy% will fix this Core CPU Busy% CPU%c1 - - 99.77 0.23 0 0 99.77 0.23 0 2 99.77 0.23 1 1 99.77 0.23 1 3 99.77 0.23 This issue can be reproduced on most of the recent systems including Broadwell, Skylake and later. This is because if we don't select Busy% or Avg_MHz or Bzy_MHz then mperf value will not be read from MSR, so it will be 0. But this is required for C1% calculation when MSR for C1 residency is not present. Same is true for C3, C6 and C7 column selection. So add another define DO_BIC_READ(), which doesn't depend on user column selection and use for mperf, C3, C6 and C7 related counters. So when there is no platform support for C1 residency counters, we still read these counters, if the CPU has support and user selected display of CPU%c1. Signed-off-by: Srinivas Pandruvada Signed-off-by: Len Brown commit 6ee9fc63d2e7999f93a466e202ae3b557e9c739c Author: Artem Bityutskiy Date: Wed Aug 14 20:12:56 2019 +0300 tools/power turbostat: do not enforce 1ms Turbostat works by taking a snapshot of counters, sleeping, taking another snapshot, calculating deltas, and printing out the table. The sleep time is controlled via -i option or by user sending a signal or a character to stdin. In the latter case, turbostat always adds 1 ms sleep before it reads the counters, in order to avoid larger imprecisions in the results in prints. While the 1 ms delay may be a good idea for a "dumb" user, it is a problem for an "aware" user. I do thousands and thousands of measurements over a short period of time (like 2ms), and turbostat unconditionally adds a 1ms to my interval, so I cannot get what I really need. This patch removes the unconditional 1ms sleep. This is an expert user tool, after all, and non-experts will unlikely ever use it in the non-fixed interval mode anyway, so I think it is OK to remove the 1ms delay. Signed-off-by: Artem Bityutskiy Signed-off-by: Len Brown commit c026c23629b825100fd4b8223227d9a395f9a56b Author: Artem Bityutskiy Date: Wed Aug 14 20:12:55 2019 +0300 tools/power turbostat: read from pipes too Commit '47936f944e78 tools/power turbostat: fix printing on input' make a valid fix, but it completely disabled piped stdin support, which is a valuable use-case. Indeed, if stdin is a pipe, turbostat won't read anything from it, so it becomes impossible to get turbostat output at user-defined moments, instead of the regular intervals. There is no reason why this should works for terminals, but not for pipes. This patch improves the situation. Instead of ignoring pipes, we read data from them but gracefully handle the EOF case. Signed-off-by: Artem Bityutskiy Signed-off-by: Len Brown commit d93ea567fc4eec2d3581015e23d2c555f8b393ba Author: Rajneesh Bhardwaj Date: Fri Jun 14 13:09:46 2019 +0530 tools/power turbostat: Add Ice Lake NNPI support This enables turbostat utility on Ice Lake NNPI SoC. Link: https://lkml.org/lkml/2019/6/5/1034 Signed-off-by: Rajneesh Bhardwaj Signed-off-by: Len Brown commit 570992fc5733b5e1b00a4bdb9272df1e25d63972 Author: Len Brown Date: Sat Aug 31 14:16:07 2019 -0400 tools/power turbostat: rename has_hsw_msrs() Perhaps if this more descriptive name had been used, then we wouldn't have had the HSW ULT vs HSW CORE bug, fixed by the previous commit. Signed-off-by: Len Brown commit cd188af5282d9f9e65f63915b13239bafc746f8d Author: Len Brown Date: Sat Aug 31 14:09:29 2019 -0400 tools/power turbostat: Fix Haswell Core systems turbostat: cpu0: msr offset 0x630 read failed: Input/output error because Haswell Core does not have C8-C10. Output C8-C10 only on Haswell ULT. Fixes: f5a4c76ad7de ("tools/power turbostat: consolidate duplicate model numbers") Reported-by: Prarit Bhargava Suggested-by: Kosuke Tatsukawa Signed-off-by: Len Brown commit b62b3184576b8f87ca655dd9bfd1ae02fd4e50a5 Author: Zhang Rui Date: Sun Apr 21 16:30:22 2019 +0800 tools/power turbostat: add Jacobsville support Jacobsville behaves like Denverton. Signed-off-by: Zhang Rui Signed-off-by: Len Brown commit eeb71c950bc6eee460f2070643ce137e067b234c Author: Naoya Horiguchi Date: Wed Apr 3 16:02:14 2019 +0900 tools/power turbostat: fix buffer overrun turbostat could be terminated by general protection fault on some latest hardwares which (for example) support 9 levels of C-states and show 18 "tADDED" lines. That bloats the total output and finally causes buffer overrun. So let's extend the buffer to avoid this. Signed-off-by: Naoya Horiguchi Signed-off-by: Len Brown commit 605736c6929d541c78a85dffae4d33a23b6b2149 Author: Gustavo A. R. Silva Date: Mon Apr 8 11:12:40 2019 -0500 tools/power turbostat: fix file descriptor leaks Fix file descriptor leaks by closing fp before return. Addresses-Coverity-ID: 1444591 ("Resource leak") Addresses-Coverity-ID: 1444592 ("Resource leak") Fixes: 5ea7647b333f ("tools/power turbostat: Warn on bad ACPI LPIT data") Signed-off-by: Gustavo A. R. Silva Reviewed-by: Prarit Bhargava Signed-off-by: Len Brown commit 15423b958f33132152e209e98df0dedc7a78f22c Author: Colin Ian King Date: Mon Apr 8 10:00:44 2019 +0100 tools/power turbostat: fix leak of file descriptor on error return path Currently the error return path does not close the file fp and leaks a file descriptor. Fix this by closing the file. Fixes: 5ea7647b333f ("tools/power turbostat: Warn on bad ACPI LPIT data") Signed-off-by: Colin Ian King Signed-off-by: Len Brown commit d4794f25f122aa1a8a073be51112edaa723ffff4 Author: Yazen Ghannam Date: Mon Mar 25 17:32:42 2019 +0000 tools/power turbostat: Make interval calculation per thread to reduce jitter Turbostat currently normalizes TSC and other values by dividing by an interval. This interval is the delta between the start of one global (all counters on all CPUs) sampling and the start of another. However, this introduces a lot of jitter into the data. In order to reduce jitter, the interval calculation should be based on timestamps taken per thread and close to the start of the thread's sampling. Define a per thread time value to hold the delta between samples taken on the thread. Use the timestamp taken at the beginning of sampling to calculate the delta. Move the thread's beginning timestamp to after the CPU migration to avoid jitter due to the migration. Use the global time delta for the average time delta. Signed-off-by: Yazen Ghannam Signed-off-by: Len Brown commit d743dae6d1936160366a32f3400f03db1da9421b Author: Len Brown Date: Sat Aug 31 12:30:24 2019 -0400 tools/power turbostat: remove duplicate pc10 column Remove the duplicate pc10 column. Fixes: be0e54c4ebbf ("turbostat: Build-in "Low Power Idle" counters support") Reported-by: Naoya Horiguchi Signed-off-by: Len Brown commit 03531482402a2bc4ab93cf6dde46833775e035e9 Author: Zephaniah E. Loss-Cutler-Hull Date: Sat Feb 9 05:25:48 2019 -0800 tools/power x86_energy_perf_policy: Fix argument parsing The -w argument in x86_energy_perf_policy currently triggers an unconditional segfault. This is because the argument string reads: "+a:c:dD:E:e:f:m:M:rt:u:vw" and yet the argument handler expects an argument. When parse_optarg_string is called with a null argument, we then proceed to crash in strncmp, not horribly friendly. The man page describes -w as taking an argument, the long form (--hwp-window) is correctly marked as taking a required argument, and the code expects it. As such, this patch simply marks the short form (-w) as requiring an argument. Signed-off-by: Zephaniah E. Loss-Cutler-Hull Signed-off-by: Len Brown commit f3fe116a44fd02bc65dd312969697d06ca86b730 Author: Matt Lupfer Date: Thu Sep 20 10:31:44 2018 -0400 tools/power: Fix typo in man page From context, we mean EPB (Enegry Performance Bias). Signed-off-by: Matt Lupfer Signed-off-by: Len Brown commit 6ac1730f7db86f0a92d4de0f2b4ca9cd124080fe Author: Ben Hutchings Date: Sun Sep 16 16:06:10 2018 +0100 tools/power/x86: Enable compiler optimisations and Fortify by default Compiling without optimisations is silly, especially since some warnings depend on the optimiser. Use -O2. Fortify adds warnings for unchecked I/O (among other things), which seems to be a good idea for user-space code. Enable that too. Signed-off-by: Ben Hutchings Signed-off-by: Len Brown commit adb8049097a9ec4acd09fbd3aa8636199a78df8a Author: Ben Hutchings Date: Sun Sep 16 16:05:53 2018 +0100 tools/power x86_energy_perf_policy: Fix "uninitialized variable" warnings at -O2 x86_energy_perf_policy first uses __get_cpuid() to check the maximum CPUID level and exits if it is too low. It then assumes that later calls will succeed (which I think is architecturally guaranteed). It also assumes that CPUID works at all (which is not guaranteed on x86_32). If optimisations are enabled, gcc warns about potentially uninitialized variables. Fix this by adding an exit-on-error after every call to __get_cpuid() instead of just checking the maximum level. Signed-off-by: Ben Hutchings Signed-off-by: Len Brown commit eea173097dfbb44855e3cf03c09eb5a665c20438 Merge: 95381debd9ee abf4923e97c3 Author: Linus Torvalds Date: Sat Aug 31 10:27:42 2019 -0700 Merge branch 'i2c/for-current' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux Pull i2c fixes from Wolfram Sang: "I2C has a bunch of driver fixes and a core improvement to make the on-going API transition more robust" * 'i2c/for-current' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux: i2c: mediatek: disable zero-length transfers for mt8183 i2c: iproc: Stop advertising support of SMBUS quick cmd MAINTAINERS: i2c mv64xxx: Update documentation path i2c: piix4: Fix port selection for AMD Family 16h Model 30h i2c: designware: Synchronize IRQs when unregistering slave client i2c: i801: Avoid memory leak in check_acpi_smo88xx_device() i2c: make i2c_unregister_device() ERR_PTR safe commit 95381debd9ee8787256c3cdb92d2b167efa4b863 Merge: 7fb86707cc3a c68c9ec1c52e Author: Linus Torvalds Date: Sat Aug 31 09:15:25 2019 -0700 Merge tag 'trace-v5.3-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace Pull tracing fixes from Steven Rostedt: "Small fixes and minor cleanups for tracing: - Make exported ftrace function not static - Fix NULL pointer dereference in reading probes as they are created - Fix NULL pointer dereference in k/uprobe clean up path - Various documentation fixes" * tag 'trace-v5.3-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace: tracing: Correct kdoc formats ftrace/x86: Remove mcount() declaration tracing/probe: Fix null pointer dereference tracing: Make exported ftrace_set_clr_event non-static ftrace: Check for successful allocation of hash ftrace: Check for empty hash and comment the race with registering probes ftrace: Fix NULL pointer dereference in t_probe_next() commit 7fb86707cc3a256e5556ced9c3a3eb96122d4b16 Merge: 834354f642ad a256f2e329df Author: Linus Torvalds Date: Sat Aug 31 09:02:36 2019 -0700 Merge tag 'riscv/for-v5.3-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux Pull RISC-V fix from Paul Walmsley: "One significant fix for 32-bit RISC-V systems: Fix the RV32 memory map to prevent userspace from corrupting the FIXMAP area. Without this patch, the system can crash very early during the boot" * tag 'riscv/for-v5.3-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux: RISC-V: Fix FIXMAP area corruption on RV32 systems commit 834354f642adfe7bb6d5dba5f7de6ecd3150fb2f Merge: 31bb5feb0d28 75ee23b30dc7 Author: Linus Torvalds Date: Sat Aug 31 08:51:48 2019 -0700 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm Pull KVM fixes from Radim Krčmář: "PPC: - Fix bug which could leave locks held in the host on return to a guest. x86: - Prevent infinitely looping emulation of a failing syscall while single stepping. - Do not crash the host when nesting is disabled" * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: KVM: x86: Don't update RIP or do single-step on faulting emulation KVM: x86: hyper-v: don't crash on KVM_GET_SUPPORTED_HV_CPUID when kvm_intel.nested is disabled KVM: PPC: Book3S: Fix incorrect guest-to-user-translation error handling commit 31bb5feb0d2809e60f0f27dc7703417129b814bf Merge: e0f14b8ca388 6c1c280805de Author: Linus Torvalds Date: Sat Aug 31 08:31:48 2019 -0700 Merge branch 'akpm' (patches from Andrew) Merge misc mm fixes from Andrew Morton: "7 fixes" * emailed patches from Andrew Morton : mm: memcontrol: fix percpu vmstats and vmevents flush mm, memcg: do not set reclaim_state on soft limit reclaim mailmap: add aliases for Dmitry Safonov mm/z3fold.c: fix lock/unlock imbalance in z3fold_page_isolate mm, memcg: partially revert "mm/memcontrol.c: keep local VM counters in sync with the hierarchical ones" mm/zsmalloc.c: fix build when CONFIG_COMPACTION=n mm: memcontrol: flush percpu slab vmstats on kmem offlining commit c68c9ec1c52e5bcd221eb09bc5344ad4f407b204 Author: Jakub Kicinski Date: Tue Aug 27 22:25:47 2019 -0700 tracing: Correct kdoc formats Fix the following kdoc warnings: kernel/trace/trace.c:1579: warning: Function parameter or member 'tr' not described in 'update_max_tr_single' kernel/trace/trace.c:1579: warning: Function parameter or member 'tsk' not described in 'update_max_tr_single' kernel/trace/trace.c:1579: warning: Function parameter or member 'cpu' not described in 'update_max_tr_single' kernel/trace/trace.c:1776: warning: Function parameter or member 'type' not described in 'register_tracer' kernel/trace/trace.c:2239: warning: Function parameter or member 'task' not described in 'tracing_record_taskinfo' kernel/trace/trace.c:2239: warning: Function parameter or member 'flags' not described in 'tracing_record_taskinfo' kernel/trace/trace.c:2269: warning: Function parameter or member 'prev' not described in 'tracing_record_taskinfo_sched_switch' kernel/trace/trace.c:2269: warning: Function parameter or member 'next' not described in 'tracing_record_taskinfo_sched_switch' kernel/trace/trace.c:2269: warning: Function parameter or member 'flags' not described in 'tracing_record_taskinfo_sched_switch' kernel/trace/trace.c:3078: warning: Function parameter or member 'ip' not described in 'trace_vbprintk' kernel/trace/trace.c:3078: warning: Function parameter or member 'fmt' not described in 'trace_vbprintk' kernel/trace/trace.c:3078: warning: Function parameter or member 'args' not described in 'trace_vbprintk' Link: http://lkml.kernel.org/r/20190828052549.2472-2-jakub.kicinski@netronome.com Signed-off-by: Jakub Kicinski Signed-off-by: Steven Rostedt (VMware) commit 2e815627318910fb2ab004670a83ba27ac2228b6 Author: Jisheng Zhang Date: Mon Aug 26 09:13:12 2019 +0000 ftrace/x86: Remove mcount() declaration Commit 562e14f72292 ("ftrace/x86: Remove mcount support") removed the support for using mcount, so we could remove the mcount() declaration to clean up. Link: http://lkml.kernel.org/r/20190826170150.10f101ba@xhacker.debian Signed-off-by: Jisheng Zhang Signed-off-by: Steven Rostedt (VMware) commit 19a58ce1dc72264b9d50ff6d86cc36b3c439fb64 Author: Xinpeng Liu Date: Thu Aug 8 07:29:23 2019 +0800 tracing/probe: Fix null pointer dereference BUG: KASAN: null-ptr-deref in trace_probe_cleanup+0x8d/0xd0 Read of size 8 at addr 0000000000000000 by task syz-executor.0/9746 trace_probe_cleanup+0x8d/0xd0 free_trace_kprobe.part.14+0x15/0x50 alloc_trace_kprobe+0x23e/0x250 Link: http://lkml.kernel.org/r/1565220563-980-1-git-send-email-danielliu861@gmail.com Fixes: e3dc9f898ef9c ("tracing/probe: Add trace_event_call accesses APIs") Signed-off-by: Xinpeng Liu Signed-off-by: Steven Rostedt (VMware) commit 595a438c78dbdc43d6c9db4f437267f0bd1548bf Author: Denis Efremov Date: Thu Jul 4 20:21:10 2019 +0300 tracing: Make exported ftrace_set_clr_event non-static The function ftrace_set_clr_event is declared static and marked EXPORT_SYMBOL_GPL(), which is at best an odd combination. Because the function was decided to be a part of API, this commit removes the static attribute and adds the declaration to the header. Link: http://lkml.kernel.org/r/20190704172110.27041-1-efremov@linux.com Fixes: f45d1225adb04 ("tracing: Kernel access to Ftrace instances") Reviewed-by: Joe Jin Signed-off-by: Denis Efremov Signed-off-by: Steven Rostedt (VMware) commit ae688e1720fd387de34f2140a735917411672bf1 Author: Fabrizio Castro Date: Fri Aug 30 14:15:35 2019 +0100 arm64: dts: renesas: hihope-common: Fix eMMC status SDHI3 got accidentally disabled while adding USB 2.0 support, this patch fixes it. Fixes: 734d277f412a ("arm64: dts: renesas: hihope-common: Add USB 2.0 support") Signed-off-by: Fabrizio Castro Reviewed-by: Geert Uytterhoeven Signed-off-by: Simon Horman commit 52d083472e0b64d1da5b6469ed3defb1ddc45929 Author: Miguel Ojeda Date: Sat Aug 31 10:00:11 2019 +0200 clang-format: Update with the latest for_each macro list Re-run the shell fragment that generated the original list. Signed-off-by: Miguel Ojeda commit e0f14b8ca3882988d15f0b1b853ae3c29d8c9a83 Merge: ab9bb6318b09 5871cd93692c Author: Linus Torvalds Date: Fri Aug 30 18:56:08 2019 -0700 Merge branch 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 Pull crypto fix from Herbert Xu: "Fix a potential crash in the ccp driver" * 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6: crypto: ccp - Ignore unconfigured CCP device on suspend/resume commit ab9bb6318b0967671e0c9b6537c1537d51ca4f45 Author: Linus Torvalds Date: Fri Aug 30 18:47:15 2019 -0700 Partially revert "kfifo: fix kfifo_alloc() and kfifo_init()" Commit dfe2a77fd243 ("kfifo: fix kfifo_alloc() and kfifo_init()") made the kfifo code round the number of elements up. That was good for __kfifo_alloc(), but it's actually wrong for __kfifo_init(). The difference? __kfifo_alloc() will allocate the rounded-up number of elements, but __kfifo_init() uses an allocation done by the caller. We can't just say "use more elements than the caller allocated", and have to round down. The good news? All the normal cases will be using power-of-two arrays anyway, and most users of kfifo's don't use kfifo_init() at all, but one of the helper macros to declare a KFIFO that enforce the proper power-of-two behavior. But it looks like at least ibmvscsis might be affected. The bad news? Will Deacon refers to an old thread and points points out that the memory ordering in kfifo's is questionable. See https://lore.kernel.org/lkml/20181211034032.32338-1-yuleixzhang@tencent.com/ for more. Fixes: dfe2a77fd243 ("kfifo: fix kfifo_alloc() and kfifo_init()") Reported-by: laokz Cc: Stefani Seibold Cc: Andrew Morton Cc: Dan Carpenter Cc: Greg KH Cc: Kees Cook Cc: Will Deacon Signed-off-by: Linus Torvalds commit 6c1c280805ded72eceb2afc1a0d431b256608554 Author: Shakeel Butt Date: Fri Aug 30 16:04:53 2019 -0700 mm: memcontrol: fix percpu vmstats and vmevents flush Instead of using raw_cpu_read() use per_cpu() to read the actual data of the corresponding cpu otherwise we will be reading the data of the current cpu for the number of online CPUs. Link: http://lkml.kernel.org/r/20190829203110.129263-1-shakeelb@google.com Fixes: bb65f89b7d3d ("mm: memcontrol: flush percpu vmevents before releasing memcg") Fixes: c350a99ea2b1 ("mm: memcontrol: flush percpu vmstats before releasing memcg") Signed-off-by: Shakeel Butt Acked-by: Roman Gushchin Acked-by: Michal Hocko Cc: Johannes Weiner Cc: Vladimir Davydov Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit d2e5fb927ee7f52c1fe2a98b554881e9dffd8514 Author: Michal Hocko Date: Fri Aug 30 16:04:50 2019 -0700 mm, memcg: do not set reclaim_state on soft limit reclaim Adric Blake has noticed[1] the following warning: WARNING: CPU: 7 PID: 175 at mm/vmscan.c:245 set_task_reclaim_state+0x1e/0x40 [...] Call Trace: mem_cgroup_shrink_node+0x9b/0x1d0 mem_cgroup_soft_limit_reclaim+0x10c/0x3a0 balance_pgdat+0x276/0x540 kswapd+0x200/0x3f0 ? wait_woken+0x80/0x80 kthread+0xfd/0x130 ? balance_pgdat+0x540/0x540 ? kthread_park+0x80/0x80 ret_from_fork+0x35/0x40 ---[ end trace 727343df67b2398a ]--- which tells us that soft limit reclaim is about to overwrite the reclaim_state configured up in the call chain (kswapd in this case but the direct reclaim is equally possible). This means that reclaim stats would get misleading once the soft reclaim returns and another reclaim is done. Fix the warning by dropping set_task_reclaim_state from the soft reclaim which is always called with reclaim_state set up. [1] http://lkml.kernel.org/r/CAE1jjeePxYPvw1mw2B3v803xHVR_BNnz0hQUY_JDMN8ny29M6w@mail.gmail.com Link: http://lkml.kernel.org/r/20190828071808.20410-1-mhocko@kernel.org Signed-off-by: Michal Hocko Reported-by: Adric Blake Acked-by: Yafang Shao Acked-by: Yang Shi Cc: Johannes Weiner Cc: Hillf Danton Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit a6c135bb1a59b5d67c8c45b214d3427d65dd7c00 Author: Dmitry Safonov Date: Fri Aug 30 16:04:46 2019 -0700 mailmap: add aliases for Dmitry Safonov I don't work for Virtuozzo or Samsung anymore and I've noticed that they have started sending annoying html email-replies. And I prioritize my personal emails over work email box, so while at it add an entry for Arista too - so I can reply faster when needed. Link: http://lkml.kernel.org/r/20190827220346.11123-1-dima@arista.com Signed-off-by: Dmitry Safonov Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 14108b9131a47ff18a3c640f583eb2d625c75c0d Author: Gustavo A. R. Silva Date: Fri Aug 30 16:04:43 2019 -0700 mm/z3fold.c: fix lock/unlock imbalance in z3fold_page_isolate Fix lock/unlock imbalance by unlocking *zhdr* before return. Addresses Coverity ID 1452811 ("Missing unlock") Link: http://lkml.kernel.org/r/20190826030634.GA4379@embeddedor Fixes: d776aaa9895e ("mm/z3fold.c: fix race between migration and destruction") Signed-off-by: Gustavo A. R. Silva Reviewed-by: Andrew Morton Cc: Henry Burns Cc: Vitaly Wool Cc: Shakeel Butt Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit b4c46484dc3fa3721d68fdfae85c1d7b1f6b5472 Author: Roman Gushchin Date: Fri Aug 30 16:04:39 2019 -0700 mm, memcg: partially revert "mm/memcontrol.c: keep local VM counters in sync with the hierarchical ones" Commit 766a4c19d880 ("mm/memcontrol.c: keep local VM counters in sync with the hierarchical ones") effectively decreased the precision of per-memcg vmstats_local and per-memcg-per-node lruvec percpu counters. That's good for displaying in memory.stat, but brings a serious regression into the reclaim process. One issue I've discovered and debugged is the following: lruvec_lru_size() can return 0 instead of the actual number of pages in the lru list, preventing the kernel to reclaim last remaining pages. Result is yet another dying memory cgroups flooding. The opposite is also happening: scanning an empty lru list is the waste of cpu time. Also, inactive_list_is_low() can return incorrect values, preventing the active lru from being scanned and freed. It can fail both because the size of active and inactive lists are inaccurate, and because the number of workingset refaults isn't precise. In other words, the result is pretty random. I'm not sure, if using the approximate number of slab pages in count_shadow_number() is acceptable, but issues described above are enough to partially revert the patch. Let's keep per-memcg vmstat_local batched (they are only used for displaying stats to the userspace), but keep lruvec stats precise. This change fixes the dead memcg flooding on my setup. Link: http://lkml.kernel.org/r/20190817004726.2530670-1-guro@fb.com Fixes: 766a4c19d880 ("mm/memcontrol.c: keep local VM counters in sync with the hierarchical ones") Signed-off-by: Roman Gushchin Acked-by: Yafang Shao Cc: Johannes Weiner Cc: Michal Hocko Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 441e254cd40dc03beec3c650ce6ce6074bc6517f Author: Andrew Morton Date: Fri Aug 30 16:04:35 2019 -0700 mm/zsmalloc.c: fix build when CONFIG_COMPACTION=n Fixes: 701d678599d0c1 ("mm/zsmalloc.c: fix race condition in zs_destroy_pool") Link: http://lkml.kernel.org/r/201908251039.5oSbEEUT%25lkp@intel.com Reported-by: kbuild test robot Cc: Sergey Senozhatsky Cc: Henry Burns Cc: Minchan Kim Cc: Shakeel Butt Cc: Jonathan Adams Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit bee07b33db78d4ee7ed6a2fe810b9473d5471fe4 Author: Roman Gushchin Date: Fri Aug 30 16:04:32 2019 -0700 mm: memcontrol: flush percpu slab vmstats on kmem offlining I've noticed that the "slab" value in memory.stat is sometimes 0, even if some children memory cgroups have a non-zero "slab" value. The following investigation showed that this is the result of the kmem_cache reparenting in combination with the per-cpu batching of slab vmstats. At the offlining some vmstat value may leave in the percpu cache, not being propagated upwards by the cgroup hierarchy. It means that stats on ancestor levels are lower than actual. Later when slab pages are released, the precise number of pages is substracted on the parent level, making the value negative. We don't show negative values, 0 is printed instead. To fix this issue, let's flush percpu slab memcg and lruvec stats on memcg offlining. This guarantees that numbers on all ancestor levels are accurate and match the actual number of outstanding slab pages. Link: http://lkml.kernel.org/r/20190819202338.363363-3-guro@fb.com Fixes: fb2f2b0adb98 ("mm: memcg/slab: reparent memcg kmem_caches on cgroup removal") Signed-off-by: Roman Gushchin Cc: Johannes Weiner Cc: Michal Hocko Cc: Vladimir Davydov Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit c3d7a089f945124770748b4eb7d5e2d1b40dadf9 Merge: 94880a5b2e81 daf1de907879 Author: David S. Miller Date: Fri Aug 30 17:50:10 2019 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf Pablo Neira Ayuso says: ==================== Netfilter fixes for net The following patchset contains Netfilter fixes for net: 1) Spurious warning when loading rules using the physdev match, from Todd Seidelmann. 2) Fix FTP conntrack helper debugging output, from Thomas Jarosch. 3) Restore per-netns nf_conntrack_{acct,helper,timeout} sysctl knobs, from Florian Westphal. 4) Clear skbuff timestamp from the flowtable datapath, also from Florian. 5) Fix incorrect byteorder of NFT_META_BRI_IIFVPROTO, from wenxu. ==================== Signed-off-by: David S. Miller commit 94880a5b2e8144e77d2a0a384a68248104837f58 Merge: d12040b6933f ede7c460b1da Author: David S. Miller Date: Fri Aug 30 17:39:37 2019 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf Daniel Borkmann says: ==================== pull-request: bpf 2019-08-31 The following pull-request contains BPF updates for your *net* tree. The main changes are: 1) Fix 32-bit zero-extension during constant blinding which has been causing a regression on ppc64, from Naveen. 2) Fix a latency bug in nfp driver when updating stack index register, from Jiong. ==================== Signed-off-by: David S. Miller commit d12040b6933f684a26773afad46dbba9778608d7 Author: David Howells Date: Thu Aug 29 14:12:11 2019 +0100 rxrpc: Fix lack of conn cleanup when local endpoint is cleaned up [ver #2] When a local endpoint is ceases to be in use, such as when the kafs module is unloaded, the kernel will emit an assertion failure if there are any outstanding client connections: rxrpc: Assertion failed ------------[ cut here ]------------ kernel BUG at net/rxrpc/local_object.c:433! and even beyond that, will evince other oopses if there are service connections still present. Fix this by: (1) Removing the triggering of connection reaping when an rxrpc socket is released. These don't actually clean up the connections anyway - and further, the local endpoint may still be in use through another socket. (2) Mark the local endpoint as dead when we start the process of tearing it down. (3) When destroying a local endpoint, strip all of its client connections from the idle list and discard the ref on each that the list was holding. (4) When destroying a local endpoint, call the service connection reaper directly (rather than through a workqueue) to immediately kill off all outstanding service connections. (5) Make the service connection reaper reap connections for which the local endpoint is marked dead. Only after destroying the connections can we close the socket lest we get an oops in a workqueue that's looking at a connection or a peer. Fixes: 3d18cbb7fd0c ("rxrpc: Fix conn expiry timers") Signed-off-by: David Howells Tested-by: Marc Dionne Signed-off-by: David S. Miller commit a285c1fa39ccc6f04b1af025ec00b1aae52e6814 Merge: 3b25528e1e35 d0d5c0cd1e71 Author: David S. Miller Date: Fri Aug 30 14:54:41 2019 -0700 Merge tag 'rxrpc-fixes-20190827' of git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs David Howells says: ==================== rxrpc: Fix use of skb_cow_data() Here's a series of patches that replaces the use of skb_cow_data() in rxrpc with skb_unshare() early on in the input process. The problem that is being seen is that skb_cow_data() indirectly requires that the maximum usage count on an sk_buff be 1, and it may generate an assertion failure in pskb_expand_head() if not. This can occur because rxrpc_input_data() may be still holding a ref when it has just attached the sk_buff to the rx ring and given that attachment its own ref. If recvmsg happens fast enough, skb_cow_data() can see the ref still held by the softirq handler. Further, a packet may contain multiple subpackets, each of which gets its own attachment to the ring and its own ref - also making skb_cow_data() go bang. Fix this by: (1) The DATA packet is currently parsed for subpackets twice by the input routines. Parse it just once instead and make notes in the sk_buff private data. (2) Use the notes from (1) when attaching the packet to the ring multiple times. Once the packet is attached to the ring, recvmsg can see it and start modifying it, so the softirq handler is not permitted to look inside it from that point. (3) Pass the ref from the input code to the ring rather than getting an extra ref. rxrpc_input_data() uses a ref on the second refcount to prevent the packet from evaporating under it. (4) Call skb_unshare() on secured DATA packets in rxrpc_input_packet() before we take call->input_lock. Other sorts of packets don't get modified and so can be left. A trace is emitted if skb_unshare() eats the skb. Note that skb_share() for our accounting in this regard as we can't see the parameters in the packet to log in a trace line if it releases it. (5) Remove the calls to skb_cow_data(). These are then no longer necessary. There are also patches to improve the rxrpc_skb tracepoint to make sure that Tx-derived buffers are identified separately from Rx-derived buffers in the trace. ==================== Signed-off-by: David S. Miller commit 3b25528e1e355c803e73aa326ce657b5606cda73 Author: Chen-Yu Tsai Date: Thu Aug 29 11:17:24 2019 +0800 net: stmmac: dwmac-rk: Don't fail if phy regulator is absent The devicetree binding lists the phy phy as optional. As such, the driver should not bail out if it can't find a regulator. Instead it should just skip the remaining regulator related code and continue on normally. Skip the remainder of phy_power_on() if a regulator supply isn't available. This also gets rid of the bogus return code. Fixes: 2e12f536635f ("net: stmmac: dwmac-rk: Use standard devicetree property for phy regulator") Signed-off-by: Chen-Yu Tsai Signed-off-by: David S. Miller commit b6b4dc4c1fa7f1c99398e7dc85758049645e9588 Author: YueHaibing Date: Thu Aug 29 10:46:00 2019 +0800 amd-xgbe: Fix error path in xgbe_mod_init() In xgbe_mod_init(), we should do cleanup if some error occurs Reported-by: Hulk Robot Fixes: efbaa828330a ("amd-xgbe: Add support to handle device renaming") Fixes: 47f164deab22 ("amd-xgbe: Add PCI device support") Signed-off-by: YueHaibing Signed-off-by: David S. Miller commit 5b0022dd32b7c2e15edf1827ba80aa1407edf9ff Author: Naveen N. Rao Date: Thu Jul 4 20:04:42 2019 +0530 ftrace: Check for successful allocation of hash In register_ftrace_function_probe(), we are not checking the return value of alloc_and_copy_ftrace_hash(). The subsequent call to ftrace_match_records() may end up dereferencing the same. Add a check to ensure this doesn't happen. Link: http://lkml.kernel.org/r/26e92574f25ad23e7cafa3cf5f7a819de1832cbe.1562249521.git.naveen.n.rao@linux.vnet.ibm.com Cc: stable@vger.kernel.org Fixes: 1ec3a81a0cf42 ("ftrace: Have each function probe use its own ftrace_ops") Signed-off-by: Naveen N. Rao Signed-off-by: Steven Rostedt (VMware) commit 372e0d01da71c84dcecf7028598a33813b0d5256 Author: Steven Rostedt (VMware) Date: Fri Aug 30 16:30:01 2019 -0400 ftrace: Check for empty hash and comment the race with registering probes The race between adding a function probe and reading the probes that exist is very subtle. It needs a comment. Also, the issue can also happen if the probe has has the EMPTY_HASH as its func_hash. Cc: stable@vger.kernel.org Fixes: 7b60f3d876156 ("ftrace: Dynamically create the probe ftrace_ops for the trace_array") Signed-off-by: Steven Rostedt (VMware) commit 7bd46644ea0f6021dc396a39a8bfd3a58f6f1f9f Author: Naveen N. Rao Date: Thu Jul 4 20:04:41 2019 +0530 ftrace: Fix NULL pointer dereference in t_probe_next() LTP testsuite on powerpc results in the below crash: Unable to handle kernel paging request for data at address 0x00000000 Faulting instruction address: 0xc00000000029d800 Oops: Kernel access of bad area, sig: 11 [#1] LE SMP NR_CPUS=2048 NUMA PowerNV ... CPU: 68 PID: 96584 Comm: cat Kdump: loaded Tainted: G W NIP: c00000000029d800 LR: c00000000029dac4 CTR: c0000000001e6ad0 REGS: c0002017fae8ba10 TRAP: 0300 Tainted: G W MSR: 9000000000009033 CR: 28022422 XER: 20040000 CFAR: c00000000029d90c DAR: 0000000000000000 DSISR: 40000000 IRQMASK: 0 ... NIP [c00000000029d800] t_probe_next+0x60/0x180 LR [c00000000029dac4] t_mod_start+0x1a4/0x1f0 Call Trace: [c0002017fae8bc90] [c000000000cdbc40] _cond_resched+0x10/0xb0 (unreliable) [c0002017fae8bce0] [c0000000002a15b0] t_start+0xf0/0x1c0 [c0002017fae8bd30] [c0000000004ec2b4] seq_read+0x184/0x640 [c0002017fae8bdd0] [c0000000004a57bc] sys_read+0x10c/0x300 [c0002017fae8be30] [c00000000000b388] system_call+0x5c/0x70 The test (ftrace_set_ftrace_filter.sh) is part of ftrace stress tests and the crash happens when the test does 'cat $TRACING_PATH/set_ftrace_filter'. The address points to the second line below, in t_probe_next(), where filter_hash is dereferenced: hash = iter->probe->ops.func_hash->filter_hash; size = 1 << hash->size_bits; This happens due to a race with register_ftrace_function_probe(). A new ftrace_func_probe is created and added into the func_probes list in trace_array under ftrace_lock. However, before initializing the filter, we drop ftrace_lock, and re-acquire it after acquiring regex_lock. If another process is trying to read set_ftrace_filter, it will be able to acquire ftrace_lock during this window and it will end up seeing a NULL filter_hash. Fix this by just checking for a NULL filter_hash in t_probe_next(). If the filter_hash is NULL, then this probe is just being added and we can simply return from here. Link: http://lkml.kernel.org/r/05e021f757625cbbb006fad41380323dbe4e3b43.1562249521.git.naveen.n.rao@linux.vnet.ibm.com Cc: stable@vger.kernel.org Fixes: 7b60f3d876156 ("ftrace: Dynamically create the probe ftrace_ops for the trace_array") Signed-off-by: Naveen N. Rao Signed-off-by: Steven Rostedt (VMware) commit 0a51b08fb3b4528e0915c4a4dd2ab0effa232359 Merge: 846d2db3e000 5b3efa4f1479 Author: Linus Torvalds Date: Fri Aug 30 11:58:02 2019 -0700 Merge tag 'for-linus' of git://git.armlinux.org.uk/~rmk/linux-arm Pull ARM fixes from Russell King: "Three fixes for ARM this time around: - A fix for update_sections_early() to cope with NULL ->mm pointers. - A correction to the backtrace code to allow proper backtraces. - Reinforcement of pfn_valid() with PFNs >= 4GiB" * tag 'for-linus' of git://git.armlinux.org.uk/~rmk/linux-arm: ARM: 8901/1: add a criteria for pfn_valid of arm ARM: 8897/1: check stmfd instruction using right shift ARM: 8874/1: mm: only adjust sections of valid mm structures commit 846d2db3e00048da3f650e0cfb0b8d67669cec3e Author: Eric Biggers Date: Fri Aug 30 16:52:26 2019 +0100 keys: ensure that ->match_free() is called in request_key_and_link() If check_cached_key() returns a non-NULL value, we still need to call key_type::match_free() to undo key_type::match_preparse(). Fixes: 7743c48e54ee ("keys: Cache result of request_key*() temporarily in task_struct") Signed-off-by: Eric Biggers Signed-off-by: David Howells Signed-off-by: Linus Torvalds commit e8d6766f3cc8318e8fcaa5ef2d1af4d2d9903af3 Merge: 8fb8e9e46261 7a6c9dbb36a4 Author: Linus Torvalds Date: Fri Aug 30 10:53:12 2019 -0700 Merge tag 'armsoc-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc Pull ARM SoC fixes from Arnd Bergmann: "The majority of the fixes this time are for OMAP hardware, here is a breakdown of the significant changes: Various device tree bug fixes: - TI am57xx boards need a voltage level fix to avoid damaging SD cards - vf610-bk4 fails to detect its flash due to an incorrect description - meson-g12a USB phy configuration fails - meson-g12b reboot should not power off the SD card - Some corrections for apparently harmless differences from the documentation. Regression fixes: - ams-delta FIQ interrupts broke in 5.3 - TI am3/am4 mmc controllers broke in 5.2 The logic_pio driver (used on some Huawei ARM servers) got a few bug fixes for reliability. And a couple of compile-time warning fixes" * tag 'armsoc-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (26 commits) soc: ixp4xx: Protect IXP4xx SoC drivers by ARCH_IXP4XX || COMPILE_TEST soc: ti: pm33xx: Make two symbols static soc: ti: pm33xx: Fix static checker warnings ARM: OMAP: dma: Mark expected switch fall-throughs ARM: dts: Fix incomplete dts data for am3 and am4 mmc bus: ti-sysc: Simplify cleanup upon failures in sysc_probe() ARM: OMAP1: ams-delta-fiq: Fix missing irq_ack ARM: dts: dra74x: Fix iodelay configuration for mmc3 ARM: dts: am335x: Fix UARTs length ARM: OMAP2+: Fix omap4 errata warning on other SoCs bus: hisi_lpc: Add .remove method to avoid driver unbind crash bus: hisi_lpc: Unregister logical PIO range to avoid potential use-after-free lib: logic_pio: Add logic_pio_unregister_range() lib: logic_pio: Avoid possible overlap for unregistering regions lib: logic_pio: Fix RCU usage arm64: dts: amlogic: odroid-n2: keep SD card regulator always on arm64: dts: meson-g12a-sei510: enable IR controller arm64: dts: meson-g12a: add missing dwc2 phy-names ARM: dts: vf610-bk4: Fix qspi node description ARM: dts: Fix incorrect dcan register mapping for am3, am4 and dra7 ... commit 8fb8e9e46261e0117cb3cffb6dd8bb7e08f8649b Merge: fbcb0b4feb5c 531a64e4c35b Author: Linus Torvalds Date: Fri Aug 30 09:23:45 2019 -0700 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma Pull rdma fix from Doug Ledford: "Much calmer week this week. Just one patch queued up: The way the siw driver was locking around the traversal of the list of ipv6 addresses on a device was causing a scheduling while atomic issue. Bernard straightened it out by using the rtnl_lock" * tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma: RDMA/siw: Fix IPv6 addr_list locking commit fbcb0b4feb5c3f5431a2ed9f0211653864cf2104 Merge: 0d70787b6594 d435c9a7b85b Author: Linus Torvalds Date: Fri Aug 30 09:09:54 2019 -0700 Merge tag 'ceph-for-5.3-rc7' of git://github.com/ceph/ceph-client Pull two ceph fixes from Ilya Dryomov: "A fix for a -rc1 regression in rbd and a trivial static checker fix" * tag 'ceph-for-5.3-rc7' of git://github.com/ceph/ceph-client: rbd: restore zeroing past the overlap when reading from parent libceph: don't call crypto_free_sync_skcipher() on a NULL tfm commit 0d70787b65941a8db36fd2c35d25c93178f8b545 Merge: f69f199271ec e73a3896eaca Author: Linus Torvalds Date: Fri Aug 30 08:32:10 2019 -0700 Merge tag 'mmc-v5.3-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc Pull MMC fixes from Ulf Hansson: "MMC core: - Fix init of SD cards reporting an invalid VDD range MMC host: - sprd: Fixes for clocks, card-detect, write-protect etc - cadence: Fix ADMA 64-bit addressing - tegra: Re-allow writing to SD card when GPIO pin is absent - at91: Fix eMMC init by clearing HS200 cap as it's not supported" * tag 'mmc-v5.3-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc: mmc: sdhci-cadence: enable v4_mode to fix ADMA 64-bit addressing mmc: sdhci-sprd: clear the UHS-I modes read from registers mms: sdhci-sprd: add SDHCI_QUIRK_BROKEN_CARD_DETECTION mmc: sdhci-sprd: add SDHCI_QUIRK2_PRESET_VALUE_BROKEN mmc: sdhci-sprd: add get_ro hook function mmc: sdhci-sprd: fixed incorrect clock divider mmc: core: Fix init of SD cards reporting an invalid VDD range mmc: sdhci-of-at91: add quirk for broken HS200 Revert "mmc: sdhci-tegra: drop ->get_ro() implementation" commit f69f199271ec5f765b056dfca703587d6d2b7aae Merge: 265381004994 1c0d63eb0e82 Author: Linus Torvalds Date: Fri Aug 30 08:21:24 2019 -0700 Merge tag 'drm-fixes-2019-08-30' of git://anongit.freedesktop.org/drm/drm Pull drm fixes from Dave Airlie: "Nothing too crazy, there's probably more patches than I'd like at this stage, but they are all pretty self contained: amdgpu: - Fix GFXOFF regression for PCO and RV2 - Fix missing fence reference - Fix VG20 power readings on certain SMU firmware versions - Fix dpm level setup for VG20 - Add an ATPX laptop quirk i915: - Fix DP MST max BPC property creation after DRM register - Fix unused ggtt deballooning and NULL dereference in guest - Fix DSC eDP transcoder identification - Fix WARN from DMA API debug by setting DMA max segment size qxl: - Make qxl reservel the vga ports using vgaargb to prevent switching to vga compatibility mode. omap: - Fix omap port lookup for SDI output virtio: - Use virtio_max_dma_size to fix an issue with swiotlb. komeda: - Compiler fixes to komeda. - Add missing of_node_get() call in komeda. - Reorder the komeda de-init functions" * tag 'drm-fixes-2019-08-30' of git://anongit.freedesktop.org/drm/drm: drm/komeda: Reordered the komeda's de-init functions drm/amdgpu: fix GFXOFF on Picasso and Raven2 drm/amdgpu: Add APTX quirk for Dell Latitude 5495 drm/amd/powerplay: correct Vega20 dpm level related settings drm/i915: Call dma_set_max_seg_size() in i915_driver_hw_probe() drm/i915/dp: Fix DSC enable code to use cpu_transcoder instead of encoder->type drm/i915: Don't deballoon unused ggtt drm_mm_node in linux guest drm/i915: Do not create a new max_bpc prop for MST connectors drm/powerplay: Fix Vega20 power reading again drm/powerplay: Fix Vega20 Average Power value v4 drm/amdgpu: fix dma_fence_wait without reference drm/komeda: Add missing of_node_get() call drm/komeda: Clean warning 'komeda_component_add' might be a candidate for 'gnu_printf' drm/komeda: Fix warning -Wunused-but-set-variable drm/komeda: Fix error: not allocating enough data 1592 vs 1584 drm/virtio: use virtio_max_dma_size drm/omap: Fix port lookup for SDI output drm/qxl: get vga ioports commit 0ce4a85f4f015d13a6a6b4954f4e8e63cd83f7b1 Author: Lu Baolu Date: Mon Aug 26 16:50:56 2019 +0800 Revert "iommu/vt-d: Avoid duplicated pci dma alias consideration" This reverts commit 557529494d79f3f1fadd486dd18d2de0b19be4da. Commit 557529494d79f ("iommu/vt-d: Avoid duplicated pci dma alias consideration") aimed to address a NULL pointer deference issue happened when a thunderbolt device driver returned unexpectedly. Unfortunately, this change breaks a previous pci quirk added by commit cc346a4714a59 ("PCI: Add function 1 DMA alias quirk for Marvell devices"), as the result, devices like Marvell 88SE9128 SATA controller doesn't work anymore. We will continue to try to find the real culprit mentioned in 557529494d79f, but for now we should revert it to fix current breakage. Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=204627 Cc: Stijn Tintel Cc: Petr Vandrovec Reported-by: Stijn Tintel Reported-by: Petr Vandrovec Signed-off-by: Lu Baolu Signed-off-by: Joerg Roedel commit 89f2c0425cb51e38d6b39795c08d55421bec680c Merge: a55aa89aab90 438b6c20e616 Author: Linus Walleij Date: Fri Aug 30 15:28:04 2019 +0200 Merge tag 'gpio-v5.3-rc7-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux into fixes gpio fixes for v5.3-rc7 - two patches fixing a regression in the pca953x driver commit abf4923e97c3abbbd1e59f0e13c7c214c93c6aaa Author: Hsin-Yi Wang Date: Thu Aug 22 17:45:17 2019 +0800 i2c: mediatek: disable zero-length transfers for mt8183 Quoting from mt8183 datasheet, the number of transfers to be transferred in one transaction should be set to bigger than 1, so we should forbid zero-length transfer and update functionality. Reported-by: Alexandru M Stan Signed-off-by: Hsin-Yi Wang Reviewed-by: Qii Wang [wsa: shortened commit message a little] Signed-off-by: Wolfram Sang commit b3d604d405166edfd4e1e6053409b85008f4f56d Author: Lori Hikichi Date: Thu Aug 8 09:07:52 2019 +0530 i2c: iproc: Stop advertising support of SMBUS quick cmd The driver does not support the SMBUS Quick command so remove the flag that indicates that level of support. By default the i2c_detect tool uses the quick command to try and detect devices at some bus addresses. If the quick command is used then we will not detect the device, even though it is present. Fixes: e6e5dd3566e0 (i2c: iproc: Add Broadcom iProc I2C Driver) Signed-off-by: Lori Hikichi Signed-off-by: Rayagonda Kokatanur Reviewed-by: Ray Jui Signed-off-by: Wolfram Sang commit f08b2080e36057c9833596df8348c33daeb04d56 Author: Denis Efremov Date: Tue Aug 13 09:09:13 2019 +0300 MAINTAINERS: i2c mv64xxx: Update documentation path Update MAINTAINERS record to reflect the file move from i2c-mv64xxx.txt to marvell,mv64xxx-i2c.yaml. Fixes: f8bbde72ef44 ("dt-bindings: i2c: mv64xxx: Add YAML schemas") Signed-off-by: Denis Efremov Acked-by: Maxime Ripard Acked-by: Gregory CLEMENT Signed-off-by: Wolfram Sang commit 0f4cd769c410e2285a4e9873a684d90423f03090 Author: Kim Phillips Date: Mon Aug 26 14:57:30 2019 -0500 perf/x86/amd/ibs: Fix sample bias for dispatched micro-ops When counting dispatched micro-ops with cnt_ctl=1, in order to prevent sample bias, IBS hardware preloads the least significant 7 bits of current count (IbsOpCurCnt) with random values, such that, after the interrupt is handled and counting resumes, the next sample taken will be slightly perturbed. The current count bitfield is in the IBS execution control h/w register, alongside the maximum count field. Currently, the IBS driver writes that register with the maximum count, leaving zeroes to fill the current count field, thereby overwriting the random bits the hardware preloaded for itself. Fix the driver to actually retain and carry those random bits from the read of the IBS control register, through to its write, instead of overwriting the lower current count bits with zeroes. Tested with: perf record -c 100001 -e ibs_op/cnt_ctl=1/pp -a -C 0 taskset -c 0 'perf annotate' output before: 15.70 65: addsd %xmm0,%xmm1 17.30 add $0x1,%rax 15.88 cmp %rdx,%rax je 82 17.32 72: test $0x1,%al jne 7c 7.52 movapd %xmm1,%xmm0 5.90 jmp 65 8.23 7c: sqrtsd %xmm1,%xmm0 12.15 jmp 65 'perf annotate' output after: 16.63 65: addsd %xmm0,%xmm1 16.82 add $0x1,%rax 16.81 cmp %rdx,%rax je 82 16.69 72: test $0x1,%al jne 7c 8.30 movapd %xmm1,%xmm0 8.13 jmp 65 8.24 7c: sqrtsd %xmm1,%xmm0 8.39 jmp 65 Tested on Family 15h and 17h machines. Machines prior to family 10h Rev. C don't have the RDWROPCNT capability, and have the IbsOpCurCnt bitfield reserved, so this patch shouldn't affect their operation. It is unknown why commit db98c5faf8cb ("perf/x86: Implement 64-bit counter support for IBS") ignored the lower 4 bits of the IbsOpCurCnt field; the number of preloaded random bits has always been 7, AFAICT. Signed-off-by: Kim Phillips Signed-off-by: Peter Zijlstra (Intel) Cc: "Arnaldo Carvalho de Melo" Cc: Cc: Ingo Molnar Cc: Ingo Molnar Cc: Jiri Olsa Cc: Thomas Gleixner Cc: "Borislav Petkov" Cc: Stephane Eranian Cc: Alexander Shishkin Cc: "Namhyung Kim" Cc: "H. Peter Anvin" Link: https://lkml.kernel.org/r/20190826195730.30614-1-kim.phillips@amd.com commit 44d3bbb6f5e501b873218142fe08cdf62a4ac1f3 Author: Josh Hunt Date: Mon Aug 19 19:13:31 2019 -0400 perf/x86/intel: Restrict period on Nehalem We see our Nehalem machines reporting 'perfevents: irq loop stuck!' in some cases when using perf: perfevents: irq loop stuck! WARNING: CPU: 0 PID: 3485 at arch/x86/events/intel/core.c:2282 intel_pmu_handle_irq+0x37b/0x530 ... RIP: 0010:intel_pmu_handle_irq+0x37b/0x530 ... Call Trace: ? perf_event_nmi_handler+0x2e/0x50 ? intel_pmu_save_and_restart+0x50/0x50 perf_event_nmi_handler+0x2e/0x50 nmi_handle+0x6e/0x120 default_do_nmi+0x3e/0x100 do_nmi+0x102/0x160 end_repeat_nmi+0x16/0x50 ... ? native_write_msr+0x6/0x20 ? native_write_msr+0x6/0x20 intel_pmu_enable_event+0x1ce/0x1f0 x86_pmu_start+0x78/0xa0 x86_pmu_enable+0x252/0x310 __perf_event_task_sched_in+0x181/0x190 ? __switch_to_asm+0x41/0x70 ? __switch_to_asm+0x35/0x70 ? __switch_to_asm+0x41/0x70 ? __switch_to_asm+0x35/0x70 finish_task_switch+0x158/0x260 __schedule+0x2f6/0x840 ? hrtimer_start_range_ns+0x153/0x210 schedule+0x32/0x80 schedule_hrtimeout_range_clock+0x8a/0x100 ? hrtimer_init+0x120/0x120 ep_poll+0x2f7/0x3a0 ? wake_up_q+0x60/0x60 do_epoll_wait+0xa9/0xc0 __x64_sys_epoll_wait+0x1a/0x20 do_syscall_64+0x4e/0x110 entry_SYSCALL_64_after_hwframe+0x44/0xa9 RIP: 0033:0x7fdeb1e96c03 ... Signed-off-by: Peter Zijlstra (Intel) Cc: acme@kernel.org Cc: Josh Hunt Cc: bpuranda@akamai.com Cc: mingo@redhat.com Cc: jolsa@redhat.com Cc: tglx@linutronix.de Cc: namhyung@kernel.org Cc: alexander.shishkin@linux.intel.com Link: https://lkml.kernel.org/r/1566256411-18820-1-git-send-email-johunt@akamai.com commit 89781d0806c2c4f29072d3f00cb2dd4274aabc3d Author: Takashi Iwai Date: Fri Aug 30 12:03:38 2019 +0200 ALSA: hda/realtek - Fix overridden device-specific initialization The recent change to shuffle the codec initialization procedure for Realtek via commit 607ca3bd220f ("ALSA: hda/realtek - EAPD turn on later") caused the silent output on some machines. This change was supposed to be safe, but it isn't actually; some devices have quirk setups to override the EAPD via COEF or BTL in the additional verb table, which is applied at the beginning of snd_hda_gen_init(). And this EAPD setup is again overridden in alc_auto_init_amp(). For recovering from the regression, tell snd_hda_gen_init() not to apply the verbs there by a new flag, then apply the verbs in alc_init(). BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=204727 Fixes: 607ca3bd220f ("ALSA: hda/realtek - EAPD turn on later") Cc: Signed-off-by: Takashi Iwai commit 424c38a4e32509ae82dc9d7300432295806cb911 Author: Maxime Ripard Date: Tue Aug 27 13:58:50 2019 +0200 drm/selftests: modes: Add more unit tests for the cmdline parser Let's add some unit tests for the recent bugs we just fixed. Signed-off-by: Maxime Ripard Tested-by: Thomas Graichen Reviewed-by: Jernej Skrabec Signed-off-by: Maxime Ripard Link: https://patchwork.freedesktop.org/patch/msgid/20190827115850.25731-4-mripard@kernel.org commit 3764137906a5acece8b5546873a70b1e6263a1a6 Author: Maxime Ripard Date: Tue Aug 27 13:58:49 2019 +0200 drm/modes: Introduce a whitelist for the named modes The named modes support has introduced a number of glitches that were in part due to the fact that the parser will take any string as a named mode. Since we shouldn't have a lot of options there (and they should be pretty standard), let's introduce a whitelist of the available named modes so that the kernel can differentiate between a poorly formed command line and a named mode. Signed-off-by: Maxime Ripard Tested-by: Thomas Graichen Reviewed-by: Jernej Skrabec Signed-off-by: Maxime Ripard Link: https://patchwork.freedesktop.org/patch/msgid/20190827115850.25731-3-mripard@kernel.org commit 728a257f652aee5dd03ecde90b11f414a255e08b Author: Maxime Ripard Date: Tue Aug 27 13:58:48 2019 +0200 drm/modes: Fix the command line parser to take force options into account The command line parser when it has been rewritten introduced a regression when the only thing on the command line is an option to force the detection of a connector (such as video=HDMI-A-1:d), which are completely valid. It's been further broken by the support for the named modes which take anything that is not a resolution as a named mode. Let's fix this by running the extra command line option parser on the named modes if they only take a single character. Fixes: e08ab74bd4c7 ("drm/modes: Rewrite the command line parser") Reported-by: Jernej Škrabec Reported-by: Thomas Graichen Signed-off-by: Maxime Ripard Tested-by: Thomas Graichen Reviewed-by: Jernej Skrabec Signed-off-by: Maxime Ripard Link: https://patchwork.freedesktop.org/patch/msgid/20190827115850.25731-2-mripard@kernel.org commit 325d0ab3a1d1ad8b8c4f9f03fd866e55b0e24254 Author: Maxime Ripard Date: Tue Aug 27 13:58:47 2019 +0200 drm/modes: Add a switch to differentiate free standing options Some extra command line options can be either specified without anything else on the command line (basically all the force connection options), but some other are only relevant when matched with a resolution (margin and interlace). Let's add a switch to restrict if needed the available option set. Fixes: e08ab74bd4c7 ("drm/modes: Rewrite the command line parser") Signed-off-by: Maxime Ripard Tested-by: Thomas Graichen Reviewed-by: Jernej Skrabec Signed-off-by: Maxime Ripard Link: https://patchwork.freedesktop.org/patch/msgid/20190827115850.25731-1-mripard@kernel.org commit 1ffdb51f28e8ec6be0a2b812c1765b5cf5c44a8f Author: Mario Limonciello Date: Mon Aug 19 12:04:08 2019 -0500 Revert "Bluetooth: btusb: driver to enable the usb-wakeup feature" This reverts commit a0085f2510e8976614ad8f766b209448b385492f. This commit has caused regressions in notebooks that support suspend to idle such as the XPS 9360, XPS 9370 and XPS 9380. These notebooks will wakeup from suspend to idle from an unsolicited advertising packet from an unpaired BLE device. In a bug report it was sugggested that this is caused by a generic lack of LE privacy support. Revert this commit until that behavior can be avoided by the kernel. Fixes: a0085f2510e8 ("Bluetooth: btusb: driver to enable the usb-wakeup feature") BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=200039 Link: https://marc.info/?l=linux-bluetooth&m=156441081612627&w=2 Link: https://chromium-review.googlesource.com/c/chromiumos/third_party/kernel/+/750073/ CC: Bastien Nocera CC: Christian Kellner CC: Sukumar Ghorai Signed-off-by: Mario Limonciello Signed-off-by: Marcel Holtmann commit e73a3896eaca95ea5fc895720502a3f040eb4b39 Author: Masahiro Yamada Date: Thu Aug 29 19:49:26 2019 +0900 mmc: sdhci-cadence: enable v4_mode to fix ADMA 64-bit addressing The IP datasheet says this controller is compatible with SD Host Specification Version v4.00. As it turned out, the ADMA of this IP does not work with 64-bit mode when it is in the Version 3.00 compatible mode; it understands the old 64-bit descriptor table (as defined in SDHCI v2), but the ADMA System Address Register (SDHCI_ADMA_ADDRESS) cannot point to the 64-bit address. I noticed this issue only after commit bd2e75633c80 ("dma-contiguous: use fallback alloc_pages for single pages"). Prior to that commit, dma_set_mask_and_coherent() returned the dma address that fits in 32-bit range, at least for the default arm64 configuration (arch/arm64/configs/defconfig). Now the host->adma_addr exceeds the 32-bit limit, causing the real problem for the Socionext SoCs. (As a side-note, I was also able to reproduce the issue for older kernels by turning off CONFIG_DMA_CMA.) Call sdhci_enable_v4_mode() to fix this. Cc: # v4.20+ Signed-off-by: Masahiro Yamada Signed-off-by: Ulf Hansson commit 2f765c175e1d1acae911f889e71e5933c6488929 Author: Chunyan Zhang Date: Wed Aug 28 10:17:36 2019 +0800 mmc: sdhci-sprd: clear the UHS-I modes read from registers sprd's sd host controller supports SDR50/SDR104/DDR50 though, the UHS-I mode used by the specific card can be selected via devicetree only. Fixes: fb8bd90f83c4 ("mmc: sdhci-sprd: Add Spreadtrum's initial host controller") Signed-off-by: Chunyan Zhang Signed-off-by: Chunyan Zhang Reviewed-by: Baolin Wang Tested-by: Baolin Wang Cc: stable@vger.kernel.org Signed-off-by: Ulf Hansson commit 4324e54bbea0107b054336f20075a26939b2bd51 Author: Chunyan Zhang Date: Wed Aug 28 10:17:35 2019 +0800 mms: sdhci-sprd: add SDHCI_QUIRK_BROKEN_CARD_DETECTION sprd's sd host controller doesn't support detection to card insert or remove. Fixes: fb8bd90f83c4 ("mmc: sdhci-sprd: Add Spreadtrum's initial host controller") Signed-off-by: Chunyan Zhang Signed-off-by: Chunyan Zhang Reviewed-by: Baolin Wang Tested-by: Baolin Wang Cc: stable@vger.kernel.org Signed-off-by: Ulf Hansson commit 6a526f66ab1494b63c71cd6639d9d96fd7216add Author: Chunyan Zhang Date: Wed Aug 28 10:17:34 2019 +0800 mmc: sdhci-sprd: add SDHCI_QUIRK2_PRESET_VALUE_BROKEN The bit of PRESET_VAL_ENABLE in HOST_CONTROL2 register is reserved on sprd's sd host controller, set quirk2 to disable configuring this. Fixes: fb8bd90f83c4 ("mmc: sdhci-sprd: Add Spreadtrum's initial host controller") Signed-off-by: Chunyan Zhang Signed-off-by: Chunyan Zhang Reviewed-by: Baolin Wang Tested-by: Baolin Wang Cc: stable@vger.kernel.org Signed-off-by: Ulf Hansson commit 4eae8cbdff942a423926486be4e781a77d619966 Author: Chunyan Zhang Date: Wed Aug 28 10:17:33 2019 +0800 mmc: sdhci-sprd: add get_ro hook function sprd's sd host controller doesn't support write protect to sd card. Fixes: fb8bd90f83c4 ("mmc: sdhci-sprd: Add Spreadtrum's initial host controller") Signed-off-by: Chunyan Zhang Signed-off-by: Chunyan Zhang Reviewed-by: Baolin Wang Tested-by: Baolin Wang Cc: stable@vger.kernel.org Signed-off-by: Ulf Hansson commit efdaf27517a892238e0dfa046cd91184b039d681 Author: Chunyan Zhang Date: Wed Aug 28 10:17:32 2019 +0800 mmc: sdhci-sprd: fixed incorrect clock divider The register SDHCI_CLOCK_CONTROL should be cleared before config clock divider, otherwise the frequency configured maybe lower than we expected. Fixes: fb8bd90f83c4 ("mmc: sdhci-sprd: Add Spreadtrum's initial host controller") Signed-off-by: Chunyan Zhang Signed-off-by: Chunyan Zhang Reviewed-by: Baolin Wang Tested-by: Baolin Wang Cc: stable@vger.kernel.org Signed-off-by: Ulf Hansson commit 72741084d903e65e121c27bd29494d941729d4a1 Author: Ulf Hansson Date: Tue Aug 27 10:10:43 2019 +0200 mmc: core: Fix init of SD cards reporting an invalid VDD range The OCR register defines the supported range of VDD voltages for SD cards. However, it has turned out that some SD cards reports an invalid voltage range, for example having bit7 set. When a host supports MMC_CAP2_FULL_PWR_CYCLE and some of the voltages from the invalid VDD range, this triggers the core to run a power cycle of the card to try to initialize it at the lowest common supported voltage. Obviously this fails, since the card can't support it. Let's fix this problem, by clearing invalid bits from the read OCR register for SD cards, before proceeding with the VDD voltage negotiation. Cc: stable@vger.kernel.org Reported-by: Philip Langdale Signed-off-by: Ulf Hansson Reviewed-by: Philip Langdale Tested-by: Philip Langdale Tested-by: Manuel Presnitz commit 1c0d63eb0e824cb2916a77523ec7a4fa0e9753c8 Merge: c3dd029cc001 32f0a982650b Author: Dave Airlie Date: Fri Aug 30 10:53:53 2019 +1000 Merge tag 'drm-intel-fixes-2019-08-29' of git://anongit.freedesktop.org/drm/drm-intel into drm-fixes drm/i915 fixes for v5.3-rc7: - Fix DP MST max BPC property creation after DRM register - Fix unused ggtt deballooning and NULL dereference in guest - Fix DSC eDP transcoder identification - Fix WARN from DMA API debug by setting DMA max segment size Signed-off-by: Dave Airlie From: Jani Nikula Link: https://patchwork.freedesktop.org/patch/msgid/87a7bseati.fsf@intel.com commit c3dd029cc001b0a81242a07a8ab1a47bda5402b5 Merge: db26d53c7d6a 41940ff50f6c Author: Dave Airlie Date: Fri Aug 30 10:52:06 2019 +1000 Merge tag 'drm-fixes-5.3-2019-08-28' of git://people.freedesktop.org/~agd5f/linux into drm-fixes drm-fixes-5.3-2019-08-28: amdgpu: - Fix GFXOFF regression for PCO and RV2 - Fix missing fence reference - Fix VG20 power readings on certain SMU firmware versions - Fix dpm level setup for VG20 - Add an ATPX laptop quirk Signed-off-by: Dave Airlie From: Alex Deucher Link: https://patchwork.freedesktop.org/patch/msgid/20190829022925.32678-1-alexander.deucher@amd.com commit 26538100499460ee81546a0dc8d6f14f5151d427 Merge: 4a64489cf8e2 36e337744c0d Author: Linus Torvalds Date: Thu Aug 29 17:51:23 2019 -0700 Merge tag '5.3-rc6-smb3-fixes' of git://git.samba.org/sfrench/cifs-2.6 Pull cifs fixes from Steve French: "A few small SMB3 fixes, and a larger one to fix various older string handling functions" * tag '5.3-rc6-smb3-fixes' of git://git.samba.org/sfrench/cifs-2.6: cifs: update internal module number cifs: replace various strncpy with strscpy and similar cifs: Use kzfree() to zero out the password cifs: set domainName when a domain-key is used in multiuser commit daf1de9078792a4d60e36aa7ecf3aadca65277c2 Author: wenxu Date: Wed Aug 28 23:02:33 2019 +0800 netfilter: nft_meta_bridge: Fix get NFT_META_BRI_IIFVPROTO in network byteorder Get the vlan_proto of ingress bridge in network byteorder as userspace expects. Otherwise this is inconsistent with NFT_META_PROTOCOL. Fixes: 2a3a93ef0ba5 ("netfilter: nft_meta_bridge: Add NFT_META_BRI_IIFVPROTO support") Signed-off-by: wenxu Signed-off-by: Pablo Neira Ayuso commit db26d53c7d6a7cf468e4605a1e5b948dfa52d441 Merge: a55aa89aab90 6978bce05424 Author: Dave Airlie Date: Fri Aug 30 10:40:54 2019 +1000 Merge tag 'drm-misc-fixes-2019-08-28' of git://anongit.freedesktop.org/drm/drm-misc into drm-fixes drm-misc-fixes for v5.3 (rc7?): - Make qxl reservel the vga ports using vgaargb to prevent switching to vga compatibility mode. - Fix omap port lookup for SDI output - Use virtio_max_dma_size to fix an issue with swiotlb. - Compiler fixes to komeda. - Add missing of_node_get() call in komeda. - Reorder the komeda de-init functions. Signed-off-by: Dave Airlie From: Maarten Lankhorst Link: https://patchwork.freedesktop.org/patch/msgid/f187c28b-6279-2c4f-3e53-296ee899133b@linux.intel.com commit 8693265329560af4d1190aaa195ad767a05ceeab Merge: 189308d5823a f8b43c5cf4b6 Author: David S. Miller Date: Thu Aug 29 16:44:15 2019 -0700 Merge tag 'mac80211-for-davem-2019-08-29' of git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211 Johannes Berg says: ==================== We have * one fix for a driver as I'm covering for Kalle while he's on vacation * two fixes for eapol-over-nl80211 work ==================== Signed-off-by: David S. Miller commit 0622800d2ebccead42b3a85e255f7d473a36ec99 Author: James Smart Date: Tue Aug 27 14:28:23 2019 -0700 scsi: lpfc: Raise config max for lpfc_fcp_mq_threshold variable Raise the config max for lpfc_fcp_mq_threshold variable to 256. Signed-off-by: Dick Kennedy Signed-off-by: James Smart CC: Hannes Reinecke Reviewed-by: Hannes Reinecke Signed-off-by: Martin K. Petersen commit c7c06a1532f3fe106687ac82a13492c6a619ff1c Author: Andrew Cooks Date: Fri Aug 2 14:52:46 2019 +0200 i2c: piix4: Fix port selection for AMD Family 16h Model 30h Family 16h Model 30h SMBus controller needs the same port selection fix as described and fixed in commit 0fe16195f891 ("i2c: piix4: Fix SMBus port selection for AMD Family 17h chips") commit 6befa3fde65f ("i2c: piix4: Support alternative port selection register") also fixed the port selection for Hudson2, but unfortunately this is not the exact same device and the AMD naming and PCI Device IDs aren't particularly helpful here. The SMBus port selection register is common to the following Families and models, as documented in AMD's publicly available BIOS and Kernel Developer Guides: 50742 - Family 15h Model 60h-6Fh (PCI_DEVICE_ID_AMD_KERNCZ_SMBUS) 55072 - Family 15h Model 70h-7Fh (PCI_DEVICE_ID_AMD_KERNCZ_SMBUS) 52740 - Family 16h Model 30h-3Fh (PCI_DEVICE_ID_AMD_HUDSON2_SMBUS) The Hudson2 PCI Device ID (PCI_DEVICE_ID_AMD_HUDSON2_SMBUS) is shared between Bolton FCH and Family 16h Model 30h, but the location of the SmBus0Sel port selection bits are different: 51192 - Bolton Register Reference Guide We distinguish between Bolton and Family 16h Model 30h using the PCI Revision ID: Bolton is device 0x780b, revision 0x15 Family 16h Model 30h is device 0x780b, revision 0x1F Family 15h Model 60h and 70h are both device 0x790b, revision 0x4A. The following additional public AMD BKDG documents were checked and do not share the same port selection register: 42301 - Family 15h Model 00h-0Fh doesn't mention any 42300 - Family 15h Model 10h-1Fh doesn't mention any 49125 - Family 15h Model 30h-3Fh doesn't mention any 48751 - Family 16h Model 00h-0Fh uses the previously supported index register SB800_PIIX4_PORT_IDX_ALT at 0x2e Signed-off-by: Andrew Cooks Signed-off-by: Jean Delvare Cc: stable@vger.kernel.org [v4.6+] Signed-off-by: Wolfram Sang commit 7af0145067bc429a09ac4047b167c0971c9f0dc7 Author: Thomas Gleixner Date: Thu Aug 29 00:31:34 2019 +0200 x86/mm/cpa: Prevent large page split when ftrace flips RW on kernel text ftrace does not use text_poke() for enabling trace functionality. It uses its own mechanism and flips the whole kernel text to RW and back to RO. The CPA rework removed a loop based check of 4k pages which tried to preserve a large page by checking each 4k page whether the change would actually cover all pages in the large page. This resulted in endless loops for nothing as in testing it turned out that it actually never preserved anything. Of course testing missed to include ftrace, which is the one and only case which benefitted from the 4k loop. As a consequence enabling function tracing or ftrace based kprobes results in a full 4k split of the kernel text, which affects iTLB performance. The kernel RO protection is the only valid case where this can actually preserve large pages. All other static protections (RO data, data NX, PCI, BIOS) are truly static. So a conflict with those protections which results in a split should only ever happen when a change of memory next to a protected region is attempted. But these conflicts are rightfully splitting the large page to preserve the protected regions. In fact a change to the protected regions itself is a bug and is warned about. Add an exception for the static protection check for kernel text RO when the to be changed region spawns a full large page which allows to preserve the large mappings. This also prevents the syslog to be spammed about CPA violations when ftrace is used. The exception needs to be removed once ftrace switched over to text_poke() which avoids the whole issue. Fixes: 585948f4f695 ("x86/mm/cpa: Avoid the 4k pages check completely") Reported-by: Song Liu Signed-off-by: Thomas Gleixner Tested-by: Song Liu Reviewed-by: Song Liu Acked-by: Peter Zijlstra (Intel) Cc: stable@vger.kernel.org Link: https://lkml.kernel.org/r/alpine.DEB.2.21.1908282355340.1938@nanos.tec.linutronix.de commit c486dcd2f1bbdd524a1e0149734b79e4ae329650 Author: Jarkko Nikula Date: Thu Aug 15 16:52:11 2019 +0300 i2c: designware: Synchronize IRQs when unregistering slave client Make sure interrupt handler i2c_dw_irq_handler_slave() has finished before clearing the the dev->slave pointer in i2c_dw_unreg_slave(). There is possibility for a race if i2c_dw_irq_handler_slave() is running on another CPU while clearing the dev->slave pointer. Reported-by: Krzysztof Adamski Reported-by: Wolfram Sang Signed-off-by: Jarkko Nikula Signed-off-by: Wolfram Sang commit 01641b266da33e2cc57b4ea1767ba3e24ce0846b Author: Andy Shevchenko Date: Fri Aug 16 16:17:05 2019 +0300 i2c: i801: Avoid memory leak in check_acpi_smo88xx_device() check_acpi_smo88xx_device() utilizes acpi_get_object_info() which in its turn allocates a buffer. User is responsible to clean allocated resources. The last has been missed in the original code. Fix it here. While here, replace !ACPI_SUCCESS() with ACPI_FAILURE(). Fixes: 19b07cb4a187 ("i2c: i801: Register optional lis3lv02d I2C device on Dell machines") Signed-off-by: Andy Shevchenko Reviewed-by: Pali Rohár Reviewed-by: Jean Delvare Signed-off-by: Wolfram Sang commit 689f535843ac2633b395cfc494446326d03efab6 Author: Wolfram Sang Date: Mon Aug 19 22:48:25 2019 +0200 i2c: make i2c_unregister_device() ERR_PTR safe We are moving towards returning ERR_PTRs when i2c_new_*_device() calls fail. Make sure its counterpart for unregistering handles ERR_PTRs as well. Signed-off-by: Wolfram Sang Reviewed-by: Geert Uytterhoeven Signed-off-by: Wolfram Sang commit 4a64489cf8e21a17fd6dd88935818ba7307ba996 Merge: 4e73079d39f6 7c9eb2dbd770 Author: Linus Torvalds Date: Thu Aug 29 09:28:25 2019 -0700 Merge tag 'Wimplicit-fallthrough-5.3-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gustavoars/linux Pull fallthrough fixes from Gustavo A. R. Silva: "Fix fall-through warnings on arc and nds32 for multiple configurations" * tag 'Wimplicit-fallthrough-5.3-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gustavoars/linux: nds32: Mark expected switch fall-throughs ARC: unwind: Mark expected switch fall-through commit 4e73079d39f62a5a46fbc30260acb0bd890c28df Merge: 9cf6b756cdf2 dc9cfd269222 Author: Linus Torvalds Date: Thu Aug 29 09:09:44 2019 -0700 Merge tag 'mtd/fixes-for-5.3-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux Pull mtd fix from Miquel Raynal: "Add a 'depends on' in the core Hyperbus Kconfig entry to avoid build errors" * tag 'mtd/fixes-for-5.3-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux: mtd: hyperbus: fix dependency and build error commit 7c9eb2dbd770b7c9980d5839dd305a70fbc5df67 Author: Gustavo A. R. Silva Date: Tue Aug 27 11:57:07 2019 -0500 nds32: Mark expected switch fall-throughs Mark switch cases where we are expecting to fall through. This patch fixes the following warnings (Building: allmodconfig nds32): include/math-emu/soft-fp.h:124:8: warning: this statement may fall through [-Wimplicit-fallthrough=] arch/nds32/kernel/signal.c:362:20: warning: this statement may fall through [-Wimplicit-fallthrough=] arch/nds32/kernel/signal.c:315:7: warning: this statement may fall through [-Wimplicit-fallthrough=] include/math-emu/op-common.h:417:11: warning: this statement may fall through [-Wimplicit-fallthrough=] include/math-emu/op-common.h:430:11: warning: this statement may fall through [-Wimplicit-fallthrough=] include/math-emu/op-common.h:310:11: warning: this statement may fall through [-Wimplicit-fallthrough=] include/math-emu/op-common.h:320:11: warning: this statement may fall through [-Wimplicit-fallthrough=] include/math-emu/op-common.h:310:11: warning: this statement may fall through [-Wimplicit-fallthrough=] include/math-emu/op-common.h:320:11: warning: this statement may fall through [-Wimplicit-fallthrough=] include/math-emu/soft-fp.h:124:8: warning: this statement may fall through [-Wimplicit-fallthrough=] include/math-emu/op-common.h:417:11: warning: this statement may fall through [-Wimplicit-fallthrough=] include/math-emu/op-common.h:430:11: warning: this statement may fall through [-Wimplicit-fallthrough=] include/math-emu/op-common.h:310:11: warning: this statement may fall through [-Wimplicit-fallthrough=] include/math-emu/op-common.h:320:11: warning: this statement may fall through [-Wimplicit-fallthrough=] include/math-emu/op-common.h:310:11: warning: this statement may fall through [-Wimplicit-fallthrough=] include/math-emu/op-common.h:320:11: warning: this statement may fall through [-Wimplicit-fallthrough=] Reported-by: Michael Ellerman Signed-off-by: Gustavo A. R. Silva commit 00a0c8451abcea98a7ea4abf583a308a6513d8ba Author: Gustavo A. R. Silva Date: Tue Aug 20 20:26:44 2019 -0500 ARC: unwind: Mark expected switch fall-through Mark switch cases where we are expecting to fall through. This patch fixes the following warnings (Building: haps_hs_defconfig arc): arch/arc/kernel/unwind.c: In function ‘read_pointer’: ./include/linux/compiler.h:328:5: warning: this statement may fall through [-Wimplicit-fallthrough=] do { \ ^ ./include/linux/compiler.h:338:2: note: in expansion of macro ‘__compiletime_assert’ __compiletime_assert(condition, msg, prefix, suffix) ^~~~~~~~~~~~~~~~~~~~ ./include/linux/compiler.h:350:2: note: in expansion of macro ‘_compiletime_assert’ _compiletime_assert(condition, msg, __compiletime_assert_, __LINE__) ^~~~~~~~~~~~~~~~~~~ ./include/linux/build_bug.h:39:37: note: in expansion of macro ‘compiletime_assert’ #define BUILD_BUG_ON_MSG(cond, msg) compiletime_assert(!(cond), msg) ^~~~~~~~~~~~~~~~~~ ./include/linux/build_bug.h:50:2: note: in expansion of macro ‘BUILD_BUG_ON_MSG’ BUILD_BUG_ON_MSG(condition, "BUILD_BUG_ON failed: " #condition) ^~~~~~~~~~~~~~~~ arch/arc/kernel/unwind.c:573:3: note: in expansion of macro ‘BUILD_BUG_ON’ BUILD_BUG_ON(sizeof(u32) != sizeof(value)); ^~~~~~~~~~~~ arch/arc/kernel/unwind.c:575:2: note: here case DW_EH_PE_native: ^~~~ Signed-off-by: Gustavo A. R. Silva commit 7a6c9dbb36a415c5901313fc89871fd19f533656 Author: Geert Uytterhoeven Date: Fri Aug 23 11:03:52 2019 +0200 soc: ixp4xx: Protect IXP4xx SoC drivers by ARCH_IXP4XX || COMPILE_TEST The move of the IXP4xx SoC drivers exposed their config options on all platforms. Fix this by wrapping them inside an ARCH_IXP4XX or COMPILE_TEST block. Link: https://lore.kernel.org/r/20190823090352.12243-1-linus.walleij@linaro.org Fixes: fcf2d8978cd538a5 ("ARM: ixp4xx: Move NPE and QMGR to drivers/soc") Signed-off-by: Geert Uytterhoeven Signed-off-by: Linus Walleij Signed-off-by: Arnd Bergmann commit 48402892f2ea31376d50d972213b41f2e12f5e6f Merge: 34614c30bf16 e32db73c5aca Author: Arnd Bergmann Date: Thu Aug 29 17:29:08 2019 +0200 Merge tag 'sunxi-fixes-for-5.3-3' of git://git.kernel.org/pub/scm/linux/kernel/git/sunxi/linux into arm/fixes A single patch to change my MAINTAINERS address * tag 'sunxi-fixes-for-5.3-3' of git://git.kernel.org/pub/scm/linux/kernel/git/sunxi/linux: MAINTAINERS: Update my email address Link: https://lore.kernel.org/r/8c04a96b-4a75-4e1f-b3ac-05fe091f251e.lettre@localhost Signed-off-by: Arnd Bergmann commit 34614c30bf16d84392f8cc0173461b99e95a7b75 Merge: 305cd70ec311 10e62b47973b Author: Arnd Bergmann Date: Thu Aug 29 17:23:51 2019 +0200 Merge tag 'hisi-fixes-for-5.3' of git://github.com/hisilicon/linux-hisi into arm/fixes Hisilicon fixes for v5.3-rc - Fixed RCU usage in logical PIO - Added a function to unregister a logical PIO range in logical PIO to support the fixes in the hisi-lpc driver - Fixed and optimized hisi-lpc driver to avoid potential use-after-free and driver unbind crash * tag 'hisi-fixes-for-5.3' of git://github.com/hisilicon/linux-hisi: bus: hisi_lpc: Add .remove method to avoid driver unbind crash bus: hisi_lpc: Unregister logical PIO range to avoid potential use-after-free lib: logic_pio: Add logic_pio_unregister_range() lib: logic_pio: Avoid possible overlap for unregistering regions lib: logic_pio: Fix RCU usage Link: https://lore.kernel.org/r/5D562335.7000902@hisilicon.com Signed-off-by: Arnd Bergmann commit f8b43c5cf4b62a19f2210a0f5367b84e1eff1ab9 Author: Denis Kenzior Date: Tue Aug 27 17:41:20 2019 -0500 mac80211: Correctly set noencrypt for PAE frames The noencrypt flag was intended to be set if the "frame was received unencrypted" according to include/uapi/linux/nl80211.h. However, the current behavior is opposite of this. Cc: stable@vger.kernel.org Fixes: 018f6fbf540d ("mac80211: Send control port frames over nl80211") Signed-off-by: Denis Kenzior Link: https://lore.kernel.org/r/20190827224120.14545-3-denkenz@gmail.com Signed-off-by: Johannes Berg commit c8a41c6afa27b8c3f61622dfd882b912da9d6721 Author: Denis Kenzior Date: Tue Aug 27 17:41:19 2019 -0500 mac80211: Don't memset RXCB prior to PAE intercept In ieee80211_deliver_skb_to_local_stack intercepts EAPoL frames if mac80211 is configured to do so and forwards the contents over nl80211. During this process some additional data is also forwarded, including whether the frame was received encrypted or not. Unfortunately just prior to the call to ieee80211_deliver_skb_to_local_stack, skb->cb is cleared, resulting in incorrect data being exposed over nl80211. Fixes: 018f6fbf540d ("mac80211: Send control port frames over nl80211") Cc: stable@vger.kernel.org Signed-off-by: Denis Kenzior Link: https://lore.kernel.org/r/20190827224120.14545-2-denkenz@gmail.com Signed-off-by: Johannes Berg commit b9500577d361522a3d9f14da8cf41dc1d824904e Author: Luca Coelho Date: Wed Aug 21 20:17:32 2019 +0300 iwlwifi: pcie: handle switching killer Qu B0 NICs to C0 We need to use a different firmware for C0 versions of killer Qu NICs. Add structures for them and handle them in the if block that detects C0 revisions. Additionally, instead of having an inclusive check for QnJ devices, make the selection exclusive, so that switching to QnJ is the exception, not the default. This prevents us from having to add all the non-QnJ cards to an exclusion list. To do so, only go into the QnJ block if the device has an RF ID type HR and HW revision QnJ. Cc: stable@vger.kernel.org # 5.2 Signed-off-by: Luca Coelho Link: https://lore.kernel.org/r/20190821171732.2266-1-luca@coelho.fi Signed-off-by: Johannes Berg commit de20900fbe1c4fd36de25a7a5a43223254ecf0d0 Author: Florian Westphal Date: Tue Aug 27 21:23:45 2019 +0200 netfilter: nf_flow_table: clear skb tstamp before xmit If 'fq' qdisc is used and a program has requested timestamps, skb->tstamp needs to be cleared, else fq will treat these as 'transmit time'. Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit 333f31436d3db19f4286f8862a00ea1d8d8420a1 Author: Takashi Iwai Date: Thu Aug 29 09:52:02 2019 +0200 ALSA: hda - Fix potential endless loop at applying quirks Since the chained quirks via chained_before flag is applied before the depth check, it may lead to the endless recursive calls, when the chain were set up incorrectly. Fix it by moving the depth check at the beginning of the loop. Fixes: 1f57825077dc ("ALSA: hda - Add chained_before flag to the fixup entry") Cc: Signed-off-by: Takashi Iwai commit dc9cfd2692225a2164f4f20b7deaf38ca8645de3 Author: Randy Dunlap Date: Tue Aug 13 16:03:13 2019 -0700 mtd: hyperbus: fix dependency and build error lib/devres.c, which implements devm_ioremap_resource(), is only built when CONFIG_HAS_IOMEM is set/enabled, so MTD_HYPERBUS should depend on HAS_IOMEM. Fixes a build error and a Kconfig warning (as seen on UML builds): WARNING: unmet direct dependencies detected for MTD_COMPLEX_MAPPINGS Depends on [n]: MTD [=m] && HAS_IOMEM [=n] Selected by [m]: - MTD_HYPERBUS [=m] && MTD [=m] ERROR: "devm_ioremap_resource" [drivers/mtd/hyperbus/hyperbus-core.ko] undefined! Fixes: dcc7d3446a0f ("mtd: Add support for HyperBus memory devices") Signed-off-by: Randy Dunlap Cc: Vignesh Raghavendra Cc: Miquel Raynal Cc: Geert Uytterhoeven Cc: linux-mtd@lists.infradead.org Acked-by: Vignesh Raghavendra Signed-off-by: Miquel Raynal commit 807f6c8472da716e29744e1fa35480b08af3e4bc Author: Laurent Pinchart Date: Sat Aug 24 00:23:53 2019 +0300 drm/ingenic: Hardcode panel type to DPI The ingenic driver supports DPI panels only at the moment, so hardcode their type to DPI instead of Unknown. Signed-off-by: Laurent Pinchart Signed-off-by: Paul Cercueil Link: https://patchwork.freedesktop.org/patch/msgid/20190823212353.29369-1-laurent.pinchart@ideasonboard.com # *** extracted tags *** Reviewed-by: Sam Ravnborg commit 189308d5823a089b56e2299cd96589507dac7319 Author: Takashi Iwai Date: Wed Aug 28 08:31:19 2019 +0200 sky2: Disable MSI on yet another ASUS boards (P6Xxxx) A similar workaround for the suspend/resume problem is needed for yet another ASUS machines, P6X models. Like the previous fix, the BIOS doesn't provide the standard DMI_SYS_* entry, so again DMI_BOARD_* entries are used instead. Reported-and-tested-by: SteveM Signed-off-by: Takashi Iwai Signed-off-by: David S. Miller commit 807e32999567ed0e96e7fbc21a60c863d9718e0d Merge: 80a6a5d62da9 e8024cb483ab Author: David S. Miller Date: Wed Aug 28 16:06:49 2019 -0700 Merge branch 'nfp-flower-fix-bugs-in-merge-tunnel-encap-code' Jakub Kicinski says: ==================== nfp: flower: fix bugs in merge tunnel encap code John says: There are few bugs in the merge encap code that have come to light with recent driver changes. Effectively, flow bind callbacks were being registered twice when using internal ports (new 'busy' code triggers this). There was also an issue with neighbour notifier messages being ignored for internal ports. ==================== Signed-off-by: David S. Miller commit e8024cb483abb2b0290b3ef5e34c736e9de2492f Author: John Hurley Date: Tue Aug 27 22:56:30 2019 -0700 nfp: flower: handle neighbour events on internal ports Recent code changes to NFP allowed the offload of neighbour entries to FW when the next hop device was an internal port. This allows for offload of tunnel encap when the end-point IP address is applied to such a port. Unfortunately, the neighbour event handler still rejects events that are not associated with a repr dev and so the firmware neighbour table may get out of sync for internal ports. Fix this by allowing internal port neighbour events to be correctly processed. Fixes: 45756dfedab5 ("nfp: flower: allow tunnels to output to internal port") Signed-off-by: John Hurley Reviewed-by: Simon Horman Reviewed-by: Jakub Kicinski Signed-off-by: Jakub Kicinski Signed-off-by: David S. Miller commit 739d7c5752b255e89ddbb1b0474f3b88ef5cd343 Author: John Hurley Date: Tue Aug 27 22:56:29 2019 -0700 nfp: flower: prevent ingress block binds on internal ports Internal port TC offload is implemented through user-space applications (such as OvS) by adding filters at egress via TC clsact qdiscs. Indirect block offload support in the NFP driver accepts both ingress qdisc binds and egress binds if the device is an internal port. However, clsact sends bind notification for both ingress and egress block binds which can lead to the driver registering multiple callbacks and receiving multiple notifications of new filters. Fix this by rejecting ingress block bind callbacks when the port is internal and only adding filter callbacks for egress binds. Fixes: 4d12ba42787b ("nfp: flower: allow offloading of matches on 'internal' ports") Signed-off-by: John Hurley Reviewed-by: Jakub Kicinski Signed-off-by: Jakub Kicinski Signed-off-by: David S. Miller commit 80a6a5d62da9ec1a4a949c0f95baa80d7efbfef5 Merge: 092e22e58623 973dc6cfc0e2 Author: David S. Miller Date: Wed Aug 28 16:02:32 2019 -0700 Merge branch 'r8152-fix-side-effect' Hayes Wang says: ==================== r8152: fix side effect v3: Update the commit message for patch #1. v2: Replace patch #2 with "r8152: remove calling netif_napi_del". v1: The commit 0ee1f4734967 ("r8152: napi hangup fix after disconnect") add a check to avoid using napi_disable after netif_napi_del. However, the commit ffa9fec30ca0 ("r8152: set RTL8152_UNPLUG only for real disconnection") let the check useless. Therefore, I revert commit 0ee1f4734967 ("r8152: napi hangup fix after disconnect") first, and add another patch to fix it. ==================== Signed-off-by: David S. Miller commit 973dc6cfc0e2c43ff29ca5645ceaf1ae694ea110 Author: Hayes Wang Date: Wed Aug 28 09:51:42 2019 +0800 r8152: remove calling netif_napi_del Remove unnecessary use of netif_napi_del. This also avoids to call napi_disable() after netif_napi_del(). Signed-off-by: Hayes Wang Signed-off-by: David S. Miller commit 49d4b14113cae1410eb4654ada5b9583bad971c4 Author: Hayes Wang Date: Wed Aug 28 09:51:41 2019 +0800 Revert "r8152: napi hangup fix after disconnect" This reverts commit 0ee1f4734967af8321ecebaf9c74221ace34f2d5. The commit 0ee1f4734967 ("r8152: napi hangup fix after disconnect") adds a check about RTL8152_UNPLUG to determine if calling napi_disable() is invalid in rtl8152_close(), when rtl8152_disconnect() is called. This avoids to use napi_disable() after calling netif_napi_del(). Howver, commit ffa9fec30ca0 ("r8152: set RTL8152_UNPLUG only for real disconnection") causes that RTL8152_UNPLUG is not always set when calling rtl8152_disconnect(). Therefore, I have to revert commit 0ee1f4734967 ("r8152: napi hangup fix after disconnect"), first. And submit another patch to fix it. Signed-off-by: Hayes Wang Signed-off-by: David S. Miller commit 092e22e586236bba106a82113826a68080a03506 Author: Davide Caratti Date: Tue Aug 27 23:18:53 2019 +0200 net/sched: pfifo_fast: fix wrong dereference in pfifo_fast_enqueue Now that 'TCQ_F_CPUSTATS' bit can be cleared, depending on the value of 'TCQ_F_NOLOCK' bit in the parent qdisc, we can't assume anymore that per-cpu counters are there in the error path of skb_array_produce(). Otherwise, the following splat can be seen: Unable to handle kernel paging request at virtual address 0000600dea430008 Mem abort info: ESR = 0x96000005 Exception class = DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 Data abort info: ISV = 0, ISS = 0x00000005 CM = 0, WnR = 0 user pgtable: 64k pages, 48-bit VAs, pgdp = 000000007b97530e [0000600dea430008] pgd=0000000000000000, pud=0000000000000000 Internal error: Oops: 96000005 [#1] SMP [...] pstate: 10000005 (nzcV daif -PAN -UAO) pc : pfifo_fast_enqueue+0x524/0x6e8 lr : pfifo_fast_enqueue+0x46c/0x6e8 sp : ffff800d39376fe0 x29: ffff800d39376fe0 x28: 1ffff001a07d1e40 x27: ffff800d03e8f188 x26: ffff800d03e8f200 x25: 0000000000000062 x24: ffff800d393772f0 x23: 0000000000000000 x22: 0000000000000403 x21: ffff800cca569a00 x20: ffff800d03e8ee00 x19: ffff800cca569a10 x18: 00000000000000bf x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000 x14: ffff1001a726edd0 x13: 1fffe4000276a9a4 x12: 0000000000000000 x11: dfff200000000000 x10: ffff800d03e8f1a0 x9 : 0000000000000003 x8 : 0000000000000000 x7 : 00000000f1f1f1f1 x6 : ffff1001a726edea x5 : ffff800cca56a53c x4 : 1ffff001bf9a8003 x3 : 1ffff001bf9a8003 x2 : 1ffff001a07d1dcb x1 : 0000600dea430000 x0 : 0000600dea430008 Process ping (pid: 6067, stack limit = 0x00000000dc0aa557) Call trace: pfifo_fast_enqueue+0x524/0x6e8 htb_enqueue+0x660/0x10e0 [sch_htb] __dev_queue_xmit+0x123c/0x2de0 dev_queue_xmit+0x24/0x30 ip_finish_output2+0xc48/0x1720 ip_finish_output+0x548/0x9d8 ip_output+0x334/0x788 ip_local_out+0x90/0x138 ip_send_skb+0x44/0x1d0 ip_push_pending_frames+0x5c/0x78 raw_sendmsg+0xed8/0x28d0 inet_sendmsg+0xc4/0x5c0 sock_sendmsg+0xac/0x108 __sys_sendto+0x1ac/0x2a0 __arm64_sys_sendto+0xc4/0x138 el0_svc_handler+0x13c/0x298 el0_svc+0x8/0xc Code: f9402e80 d538d081 91002000 8b010000 (885f7c03) Fix this by testing the value of 'TCQ_F_CPUSTATS' bit in 'qdisc->flags', before dereferencing 'qdisc->cpu_qstats'. Fixes: 8a53e616de29 ("net: sched: when clearing NOLOCK, clear TCQ_F_CPUSTATS, too") CC: Paolo Abeni CC: Stefano Brivio Reported-by: Li Shuang Signed-off-by: Davide Caratti Acked-by: Paolo Abeni Signed-off-by: David S. Miller commit 888a5c53c0d8be6e98bc85b677f179f77a647873 Author: Willem de Bruijn Date: Tue Aug 27 15:09:33 2019 -0400 tcp: inherit timestamp on mtu probe TCP associates tx timestamp requests with a byte in the bytestream. If merging skbs in tcp_mtu_probe, migrate the tstamp request. Similar to MSG_EOR, do not allow moving a timestamp from any segment in the probe but the last. This to avoid merging multiple timestamps. Tested with the packetdrill script at https://github.com/wdebruij/packetdrill/commits/mtu_probe-1 Link: http://patchwork.ozlabs.org/patch/1143278/#2232897 Fixes: 4ed2d765dfac ("net-timestamp: TCP timestamping") Signed-off-by: Willem de Bruijn Signed-off-by: Eric Dumazet Signed-off-by: David S. Miller commit dbf47a2a094edf58983265e323ca4bdcdb58b5ee Author: Vlad Buslov Date: Tue Aug 27 21:49:38 2019 +0300 net: sched: act_sample: fix psample group handling on overwrite Action sample doesn't properly handle psample_group pointer in overwrite case. Following issues need to be fixed: - In tcf_sample_init() function RCU_INIT_POINTER() is used to set s->psample_group, even though we neither setting the pointer to NULL, nor preventing concurrent readers from accessing the pointer in some way. Use rcu_swap_protected() instead to safely reset the pointer. - Old value of s->psample_group is not released or deallocated in any way, which results resource leak. Use psample_group_put() on non-NULL value obtained with rcu_swap_protected(). - The function psample_group_put() that released reference to struct psample_group pointed by rcu-pointer s->psample_group doesn't respect rcu grace period when deallocating it. Extend struct psample_group with rcu head and use kfree_rcu when freeing it. Fixes: 5c5670fae430 ("net/sched: Introduce sample tc action") Signed-off-by: Vlad Buslov Signed-off-by: David S. Miller commit 36f1031c51a2538e5558fb44c6d6b88f98d3c0f2 Author: Thomas Falcon Date: Tue Aug 27 11:10:04 2019 -0500 ibmvnic: Do not process reset during or after device removal Currently, the ibmvnic driver will not schedule device resets if the device is being removed, but does not check the device state before the reset is actually processed. This leads to a race where a reset is scheduled with a valid device state but is processed after the driver has been removed, resulting in an oops. Fix this by checking the device state before processing a queued reset event. Reported-by: Abdul Haleem Tested-by: Abdul Haleem Signed-off-by: Thomas Falcon Signed-off-by: David S. Miller commit 5b3efa4f1479c91cb8361acef55f9c6662feba57 Author: zhaoyang Date: Mon Aug 26 04:07:37 2019 +0100 ARM: 8901/1: add a criteria for pfn_valid of arm pfn_valid can be wrong when parsing a invalid pfn whose phys address exceeds BITS_PER_LONG as the MSB will be trimed when shifted. The issue originally arise from bellowing call stack, which corresponding to an access of the /proc/kpageflags from userspace with a invalid pfn parameter and leads to kernel panic. [46886.723249] c7 [] (stable_page_flags) from [] [46886.723264] c7 [] (kpageflags_read) from [] [46886.723280] c7 [] (proc_reg_read) from [] [46886.723290] c7 [] (__vfs_read) from [] [46886.723301] c7 [] (vfs_read) from [] [46886.723315] c7 [] (SyS_pread64) from [] (ret_fast_syscall+0x0/0x28) Signed-off-by: Zhaoyang Huang Signed-off-by: Russell King commit a256f2e329df0773022d28df2c3d206b9aaf1e61 Author: Anup Patel Date: Mon Aug 19 05:14:23 2019 +0000 RISC-V: Fix FIXMAP area corruption on RV32 systems Currently, various virtual memory areas of Linux RISC-V are organized in increasing order of their virtual addresses is as follows: 1. User space area (This is lowest area and starts at 0x0) 2. FIXMAP area 3. VMALLOC area 4. Kernel area (This is highest area and starts at PAGE_OFFSET) The maximum size of user space aread is represented by TASK_SIZE. On RV32 systems, TASK_SIZE is defined as VMALLOC_START which causes the user space area to overlap the FIXMAP area. This allows user space apps to potentially corrupt the FIXMAP area and kernel OF APIs will crash whenever they access corrupted FDT in the FIXMAP area. On RV64 systems, TASK_SIZE is set to fixed 256GB and no other areas happen to overlap so we don't see any FIXMAP area corruptions. This patch fixes FIXMAP area corruption on RV32 systems by setting TASK_SIZE to FIXADDR_START. We also move FIXADDR_TOP, FIXADDR_SIZE, and FIXADDR_START defines to asm/pgtable.h so that we can avoid cyclic header includes. Signed-off-by: Anup Patel Tested-by: Alistair Francis Reviewed-by: Christoph Hellwig Signed-off-by: Paul Walmsley commit 0754b4e8cdf3eec6e4122e79af26ed9bab20f8f8 Author: Justin Pettit Date: Tue Aug 27 07:58:10 2019 -0700 openvswitch: Clear the L4 portion of the key for "later" fragments. Only the first fragment in a datagram contains the L4 headers. When the Open vSwitch module parses a packet, it always sets the IP protocol field in the key, but can only set the L4 fields on the first fragment. The original behavior would not clear the L4 portion of the key, so garbage values would be sent in the key for "later" fragments. This patch clears the L4 fields in that circumstance to prevent sending those garbage values as part of the upcall. Signed-off-by: Justin Pettit Acked-by: Pravin B Shelar Signed-off-by: David S. Miller commit ad06a566e118e57b852cab5933dbbbaebb141de3 Author: Greg Rose Date: Tue Aug 27 07:58:09 2019 -0700 openvswitch: Properly set L4 keys on "later" IP fragments When IP fragments are reassembled before being sent to conntrack, the key from the last fragment is used. Unless there are reordering issues, the last fragment received will not contain the L4 ports, so the key for the reassembled datagram won't contain them. This patch updates the key once we have a reassembled datagram. The handle_fragments() function works on L3 headers so we pull the L3/L4 flow key update code from key_extract into a new function 'key_extract_l3l4'. Then we add a another new function ovs_flow_key_update_l3l4() and export it so that it is accessible by handle_fragments() for conntrack packet reassembly. Co-authored-by: Justin Pettit Signed-off-by: Greg Rose Acked-by: Pravin B Shelar Signed-off-by: David S. Miller commit a84d016479896b5526a2cc54784e6ffc41c9d6f6 Author: Eric Dumazet Date: Tue Aug 27 03:33:12 2019 -0700 mld: fix memory leak in mld_del_delrec() Similar to the fix done for IPv4 in commit e5b1c6c6277d ("igmp: fix memory leak in igmpv3_del_delrec()"), we need to make sure mca_tomb and mca_sources are not blindly overwritten. Using swap() then a call to ip6_mc_clear_src() will take care of the missing free. BUG: memory leak unreferenced object 0xffff888117d9db00 (size 64): comm "syz-executor247", pid 6918, jiffies 4294943989 (age 25.350s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 fe 88 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<000000005b463030>] kmemleak_alloc_recursive include/linux/kmemleak.h:43 [inline] [<000000005b463030>] slab_post_alloc_hook mm/slab.h:522 [inline] [<000000005b463030>] slab_alloc mm/slab.c:3319 [inline] [<000000005b463030>] kmem_cache_alloc_trace+0x145/0x2c0 mm/slab.c:3548 [<00000000939cbf94>] kmalloc include/linux/slab.h:552 [inline] [<00000000939cbf94>] kzalloc include/linux/slab.h:748 [inline] [<00000000939cbf94>] ip6_mc_add1_src net/ipv6/mcast.c:2236 [inline] [<00000000939cbf94>] ip6_mc_add_src+0x31f/0x420 net/ipv6/mcast.c:2356 [<00000000d8972221>] ip6_mc_source+0x4a8/0x600 net/ipv6/mcast.c:449 [<000000002b203d0d>] do_ipv6_setsockopt.isra.0+0x1b92/0x1dd0 net/ipv6/ipv6_sockglue.c:748 [<000000001f1e2d54>] ipv6_setsockopt+0x89/0xd0 net/ipv6/ipv6_sockglue.c:944 [<00000000c8f7bdf9>] udpv6_setsockopt+0x4e/0x90 net/ipv6/udp.c:1558 [<000000005a9a0c5e>] sock_common_setsockopt+0x38/0x50 net/core/sock.c:3139 [<00000000910b37b2>] __sys_setsockopt+0x10f/0x220 net/socket.c:2084 [<00000000e9108023>] __do_sys_setsockopt net/socket.c:2100 [inline] [<00000000e9108023>] __se_sys_setsockopt net/socket.c:2097 [inline] [<00000000e9108023>] __x64_sys_setsockopt+0x26/0x30 net/socket.c:2097 [<00000000f4818160>] do_syscall_64+0x76/0x1a0 arch/x86/entry/common.c:296 [<000000008d367e8f>] entry_SYSCALL_64_after_hwframe+0x44/0xa9 Fixes: 1666d49e1d41 ("mld: do not remove mld souce list info when set link down") Fixes: 9c8bb163ae78 ("igmp, mld: Fix memory leak in igmpv3/mld_del_delrec()") Signed-off-by: Eric Dumazet Reported-by: syzbot Signed-off-by: David S. Miller commit 04d37cf46a773910f75fefaa9f9488f42bfe1fe2 Author: Davide Caratti Date: Tue Aug 27 12:29:09 2019 +0200 net/sched: pfifo_fast: fix wrong dereference when qdisc is reset Now that 'TCQ_F_CPUSTATS' bit can be cleared, depending on the value of 'TCQ_F_NOLOCK' bit in the parent qdisc, we need to be sure that per-cpu counters are present when 'reset()' is called for pfifo_fast qdiscs. Otherwise, the following script: # tc q a dev lo handle 1: root htb default 100 # tc c a dev lo parent 1: classid 1:100 htb \ > rate 95Mbit ceil 100Mbit burst 64k [...] # tc f a dev lo parent 1: protocol arp basic classid 1:100 [...] # tc q a dev lo parent 1:100 handle 100: pfifo_fast [...] # tc q d dev lo root can generate the following splat: Unable to handle kernel paging request at virtual address dfff2c01bd148000 Mem abort info: ESR = 0x96000004 Exception class = DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 Data abort info: ISV = 0, ISS = 0x00000004 CM = 0, WnR = 0 [dfff2c01bd148000] address between user and kernel address ranges Internal error: Oops: 96000004 [#1] SMP [...] pstate: 80000005 (Nzcv daif -PAN -UAO) pc : pfifo_fast_reset+0x280/0x4d8 lr : pfifo_fast_reset+0x21c/0x4d8 sp : ffff800d09676fa0 x29: ffff800d09676fa0 x28: ffff200012ee22e4 x27: dfff200000000000 x26: 0000000000000000 x25: ffff800ca0799958 x24: ffff1001940f332b x23: 0000000000000007 x22: ffff200012ee1ab8 x21: 0000600de8a40000 x20: 0000000000000000 x19: ffff800ca0799900 x18: 0000000000000000 x17: 0000000000000002 x16: 0000000000000000 x15: 0000000000000000 x14: 0000000000000000 x13: 0000000000000000 x12: ffff1001b922e6e2 x11: 1ffff001b922e6e1 x10: 0000000000000000 x9 : 1ffff001b922e6e1 x8 : dfff200000000000 x7 : 0000000000000000 x6 : 0000000000000000 x5 : 1fffe400025dc45c x4 : 1fffe400025dc357 x3 : 00000c01bd148000 x2 : 0000600de8a40000 x1 : 0000000000000007 x0 : 0000600de8a40004 Call trace: pfifo_fast_reset+0x280/0x4d8 qdisc_reset+0x6c/0x370 htb_reset+0x150/0x3b8 [sch_htb] qdisc_reset+0x6c/0x370 dev_deactivate_queue.constprop.5+0xe0/0x1a8 dev_deactivate_many+0xd8/0x908 dev_deactivate+0xe4/0x190 qdisc_graft+0x88c/0xbd0 tc_get_qdisc+0x418/0x8a8 rtnetlink_rcv_msg+0x3a8/0xa78 netlink_rcv_skb+0x18c/0x328 rtnetlink_rcv+0x28/0x38 netlink_unicast+0x3c4/0x538 netlink_sendmsg+0x538/0x9a0 sock_sendmsg+0xac/0xf8 ___sys_sendmsg+0x53c/0x658 __sys_sendmsg+0xc8/0x140 __arm64_sys_sendmsg+0x74/0xa8 el0_svc_handler+0x164/0x468 el0_svc+0x10/0x14 Code: 910012a0 92400801 d343fc03 11000c21 (38fb6863) Fix this by testing the value of 'TCQ_F_CPUSTATS' bit in 'qdisc->flags', before dereferencing 'qdisc->cpu_qstats'. Changes since v1: - coding style improvements, thanks to Stefano Brivio Fixes: 8a53e616de29 ("net: sched: when clearing NOLOCK, clear TCQ_F_CPUSTATS, too") CC: Paolo Abeni Reported-by: Li Shuang Signed-off-by: Davide Caratti Acked-by: Paolo Abeni Reviewed-by: Stefano Brivio Signed-off-by: David S. Miller commit 2965daa3342cf1e170969c6423efff370f11dfa1 Merge: fdfc5c8594c2 6342ea886771 Author: David S. Miller Date: Wed Aug 28 14:05:48 2019 -0700 Merge branch 'macb-Update-ethernet-compatible-string-for-SiFive-FU540' Yash Shah says: ==================== macb: Update ethernet compatible string for SiFive FU540 This patch series renames the compatible property to a more appropriate string. The patchset is based on Linux-5.3-rc6 and tested on SiFive Unleashed board Change history: Since v1: - Dropped PATCH3 because it's already merged - Change the reference url in the patch descriptions to point to a 'lore.kernel.org' link instead of 'lkml.org' ==================== Signed-off-by: David S. Miller commit 6342ea886771d65d718d07049c75b25b27e60cfd Author: Yash Shah Date: Tue Aug 27 10:36:04 2019 +0530 macb: Update compatibility string for SiFive FU540-C000 Update the compatibility string for SiFive FU540-C000 as per the new string updated in the binding doc. Reference: https://lore.kernel.org/netdev/CAJ2_jOFEVZQat0Yprg4hem4jRrqkB72FKSeQj4p8P5KA-+rgww@mail.gmail.com/ Signed-off-by: Yash Shah Acked-by: Nicolas Ferre Reviewed-by: Paul Walmsley Tested-by: Paul Walmsley Signed-off-by: David S. Miller commit abecec415dc2b5a5d11fe1b17963564b13f2ff20 Author: Yash Shah Date: Tue Aug 27 10:36:03 2019 +0530 macb: bindings doc: update sifive fu540-c000 binding As per the discussion with Nicolas Ferre[0], rename the compatible property to a more appropriate and specific string. [0] https://lore.kernel.org/netdev/CAJ2_jOFEVZQat0Yprg4hem4jRrqkB72FKSeQj4p8P5KA-+rgww@mail.gmail.com/ Signed-off-by: Yash Shah Acked-by: Nicolas Ferre Reviewed-by: Paul Walmsley Reviewed-by: Rob Herring Signed-off-by: David S. Miller commit 8919dfcb31161fae7d607bbef5247e5e82fd6457 Author: Eddie James Date: Tue Aug 27 12:12:49 2019 +0800 fsi: scom: Don't abort operations for minor errors The scom driver currently fails out of operations if certain system errors are flagged in the status register; system checkstop, special attention, or recoverable error. These errors won't impact the ability of the scom engine to perform operations, so the driver should continue under these conditions. Also, don't do a PIB reset for these conditions, since it won't help. Fixes: 6b293258cded ("fsi: scom: Major overhaul") Signed-off-by: Eddie James Cc: stable Acked-by: Jeremy Kerr Acked-by: Benjamin Herrenschmidt Signed-off-by: Joel Stanley Link: https://lore.kernel.org/r/20190827041249.13381-1-jk@ozlabs.org Signed-off-by: Greg Kroah-Hartman commit 468e0ffac803f5557a62a33b72ef8844d1bfdc08 Author: Nadav Amit Date: Tue Aug 20 09:01:21 2019 -0700 vmw_balloon: Fix offline page marking with compaction The compaction code already marks pages as offline when it enqueues pages in the ballooned page list, and removes the mapping when the pages are removed from the list. VMware balloon also updates the flags, instead of letting the balloon-compaction logic handle it, which causes the assertion VM_BUG_ON_PAGE(!PageOffline(page)) to fire, when __ClearPageOffline is called the second time. This causes the following crash. [ 487.104520] kernel BUG at include/linux/page-flags.h:749! [ 487.106364] invalid opcode: 0000 [#1] SMP DEBUG_PAGEALLOC PTI [ 487.107681] CPU: 7 PID: 1106 Comm: kworker/7:3 Not tainted 5.3.0-rc5balloon #227 [ 487.109196] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 12/12/2018 [ 487.111452] Workqueue: events_freezable vmballoon_work [vmw_balloon] [ 487.112779] RIP: 0010:vmballoon_release_page_list+0xaa/0x100 [vmw_balloon] [ 487.114200] Code: fe 48 c1 e7 06 4c 01 c7 8b 47 30 41 89 c1 41 81 e1 00 01 00 f0 41 81 f9 00 00 00 f0 74 d3 48 c7 c6 08 a1 a1 c0 e8 06 0d e7 ea <0f> 0b 44 89 f6 4c 89 c7 e8 49 9c e9 ea 49 8d 75 08 49 8b 45 08 4d [ 487.118033] RSP: 0018:ffffb82f012bbc98 EFLAGS: 00010246 [ 487.119135] RAX: 0000000000000037 RBX: 0000000000000001 RCX: 0000000000000006 [ 487.120601] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff9a85b6bd7620 [ 487.122071] RBP: ffffb82f012bbcc0 R08: 0000000000000001 R09: 0000000000000000 [ 487.123536] R10: 0000000000000000 R11: 0000000000000000 R12: ffffb82f012bbd00 [ 487.125002] R13: ffffe97f4598d9c0 R14: 0000000000000000 R15: ffffb82f012bbd34 [ 487.126463] FS: 0000000000000000(0000) GS:ffff9a85b6bc0000(0000) knlGS:0000000000000000 [ 487.128110] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 487.129316] CR2: 00007ffe6e413ea0 CR3: 0000000230b18001 CR4: 00000000003606e0 [ 487.130812] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 487.132283] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 487.133749] Call Trace: [ 487.134333] vmballoon_deflate+0x22c/0x390 [vmw_balloon] [ 487.135468] vmballoon_work+0x6e7/0x913 [vmw_balloon] [ 487.136711] ? process_one_work+0x21a/0x5e0 [ 487.138581] process_one_work+0x298/0x5e0 [ 487.139926] ? vmballoon_migratepage+0x310/0x310 [vmw_balloon] [ 487.141610] ? process_one_work+0x298/0x5e0 [ 487.143053] worker_thread+0x41/0x400 [ 487.144389] kthread+0x12b/0x150 [ 487.145582] ? process_one_work+0x5e0/0x5e0 [ 487.146937] ? kthread_create_on_node+0x60/0x60 [ 487.148637] ret_from_fork+0x3a/0x50 Fix it by updating the PageOffline indication only when a 2MB page is enqueued and dequeued. The 4KB pages will be handled correctly by the balloon compaction logic. Fixes: 83a8afa72e9c ("vmw_balloon: Compaction support") Cc: David Hildenbrand Reported-by: Thomas Hellstrom Signed-off-by: Nadav Amit Link: https://lore.kernel.org/r/20190820160121.452-1-namit@vmware.com Signed-off-by: Greg Kroah-Hartman commit ba03a9bbd17b149c373c0ea44017f35fc2cd0f28 Author: Nadav Amit Date: Tue Aug 20 13:26:38 2019 -0700 VMCI: Release resource if the work is already queued Francois reported that VMware balloon gets stuck after a balloon reset, when the VMCI doorbell is removed. A similar error can occur when the balloon driver is removed with the following splat: [ 1088.622000] INFO: task modprobe:3565 blocked for more than 120 seconds. [ 1088.622035] Tainted: G W 5.2.0 #4 [ 1088.622087] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 1088.622205] modprobe D 0 3565 1450 0x00000000 [ 1088.622210] Call Trace: [ 1088.622246] __schedule+0x2a8/0x690 [ 1088.622248] schedule+0x2d/0x90 [ 1088.622250] schedule_timeout+0x1d3/0x2f0 [ 1088.622252] wait_for_completion+0xba/0x140 [ 1088.622320] ? wake_up_q+0x80/0x80 [ 1088.622370] vmci_resource_remove+0xb9/0xc0 [vmw_vmci] [ 1088.622373] vmci_doorbell_destroy+0x9e/0xd0 [vmw_vmci] [ 1088.622379] vmballoon_vmci_cleanup+0x6e/0xf0 [vmw_balloon] [ 1088.622381] vmballoon_exit+0x18/0xcc8 [vmw_balloon] [ 1088.622394] __x64_sys_delete_module+0x146/0x280 [ 1088.622408] do_syscall_64+0x5a/0x130 [ 1088.622410] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 1088.622415] RIP: 0033:0x7f54f62791b7 [ 1088.622421] Code: Bad RIP value. [ 1088.622421] RSP: 002b:00007fff2a949008 EFLAGS: 00000206 ORIG_RAX: 00000000000000b0 [ 1088.622426] RAX: ffffffffffffffda RBX: 000055dff8b55d00 RCX: 00007f54f62791b7 [ 1088.622426] RDX: 0000000000000000 RSI: 0000000000000800 RDI: 000055dff8b55d68 [ 1088.622427] RBP: 000055dff8b55d00 R08: 00007fff2a947fb1 R09: 0000000000000000 [ 1088.622427] R10: 00007f54f62f5cc0 R11: 0000000000000206 R12: 000055dff8b55d68 [ 1088.622428] R13: 0000000000000001 R14: 000055dff8b55d68 R15: 00007fff2a94a3f0 The cause for the bug is that when the "delayed" doorbell is invoked, it takes a reference on the doorbell entry and schedules work that is supposed to run the appropriate code and drop the doorbell entry reference. The code ignores the fact that if the work is already queued, it will not be scheduled to run one more time. As a result one of the references would not be dropped. When the code waits for the reference to get to zero, during balloon reset or module removal, it gets stuck. Fix it. Drop the reference if schedule_work() indicates that the work is already queued. Note that this bug got more apparent (or apparent at all) due to commit ce664331b248 ("vmw_balloon: VMCI_DOORBELL_SET does not check status"). Fixes: 83e2ec765be03 ("VMCI: doorbell implementation.") Reported-by: Francois Rigault Cc: Jorgen Hansen Cc: Adit Ranadive Cc: Alexios Zavras Cc: Vishnu DASA Cc: stable@vger.kernel.org Signed-off-by: Nadav Amit Reviewed-by: Vishnu Dasa Link: https://lore.kernel.org/r/20190820202638.49003-1-namit@vmware.com Signed-off-by: Greg Kroah-Hartman commit 1426bd2c9f7e3126e2678e7469dca9fd9fc6dd3e Author: Oliver Neukum Date: Tue Aug 27 12:34:36 2019 +0200 USB: cdc-wdm: fix race between write and disconnect due to flag abuse In case of a disconnect an ongoing flush() has to be made fail. Nevertheless we cannot be sure that any pending URB has already finished, so although they will never succeed, they still must not be touched. The clean solution for this is to check for WDM_IN_USE and WDM_DISCONNECTED in flush(). There is no point in ever clearing WDM_IN_USE, as no further writes make sense. The issue is as old as the driver. Fixes: afba937e540c9 ("USB: CDC WDM driver") Reported-by: syzbot+d232cca6ec42c2edb3fc@syzkaller.appspotmail.com Signed-off-by: Oliver Neukum Cc: stable Link: https://lore.kernel.org/r/20190827103436.21143-1-oneukum@suse.com Signed-off-by: Greg Kroah-Hartman commit 636bd02a7ba9025ff851d0cfb92768c8fa865859 Author: Geert Uytterhoeven Date: Tue Aug 27 14:51:12 2019 +0200 usb: host: xhci: rcar: Fix typo in compatible string matching It's spelled "renesas", not "renensas". Due to this typo, RZ/G1M and RZ/G1N were not covered by the check. Fixes: 2dc240a3308b ("usb: host: xhci: rcar: retire use of xhci_plat_type_is()") Signed-off-by: Geert Uytterhoeven Cc: stable Reviewed-by: Yoshihiro Shimoda Link: https://lore.kernel.org/r/20190827125112.12192-1-geert+renesas@glider.be Signed-off-by: Greg Kroah-Hartman commit 993cc8753453fccfe060a535bbe21fcf1001b626 Author: Nagarjuna Kristam Date: Wed Aug 28 16:24:57 2019 +0530 usb: host: xhci-tegra: Set DMA mask correctly The Falcon microcontroller that runs the XUSB firmware and which is responsible for exposing the XHCI interface can address only 40 bits of memory. Typically that's not a problem because Tegra devices don't have enough system memory to exceed those 40 bits. However, if the ARM SMMU is enable on Tegra186 and later, the addresses passed to the XUSB controller can be anywhere in the 48-bit IOV address space of the ARM SMMU. Since the DMA/IOMMU API starts allocating from the top of the IOVA space, the Falcon microcontroller is not able to load the firmware successfully. Fix this by setting the DMA mask to 40 bits, which will force the DMA API to map the buffer for the firmware to an IOVA that is addressable by the Falcon. Signed-off-by: Nagarjuna Kristam Signed-off-by: Thierry Reding Link: https://lore.kernel.org/r/1566989697-13049-1-git-send-email-nkristam@nvidia.com Signed-off-by: Greg Kroah-Hartman commit 1902a01e2bcc3abd7c9a18dc05e78c7ab4a53c54 Author: Kai-Heng Feng Date: Wed Aug 28 01:34:50 2019 +0800 USB: storage: ums-realtek: Whitelist auto-delink support Auto-delink requires writing special registers to ums-realtek devices. Unconditionally enable auto-delink may break newer devices. So only enable auto-delink by default for the original three IDs, 0x0138, 0x0158 and 0x0159. Realtek is working on a patch to properly support auto-delink for other IDs. BugLink: https://bugs.launchpad.net/bugs/1838886 Signed-off-by: Kai-Heng Feng Acked-by: Alan Stern Cc: stable Link: https://lore.kernel.org/r/20190827173450.13572-2-kai.heng.feng@canonical.com Signed-off-by: Greg Kroah-Hartman commit f6445b6b2f2bb1745080af4a0926049e8bca2617 Author: Kai-Heng Feng Date: Wed Aug 28 01:34:49 2019 +0800 USB: storage: ums-realtek: Update module parameter description for auto_delink_en The option named "auto_delink_en" is a bit misleading, as setting it to false doesn't really disable auto-delink but let auto-delink be firmware controlled. Update the description to reflect the real usage of this parameter. Signed-off-by: Kai-Heng Feng Cc: stable Link: https://lore.kernel.org/r/20190827173450.13572-1-kai.heng.feng@canonical.com Signed-off-by: Greg Kroah-Hartman commit a349b95d7ca0cea71be4a7dac29830703de7eb62 Author: Yoshihiro Shimoda Date: Tue Aug 27 12:51:50 2019 +0900 usb: host: ohci: fix a race condition between shutdown and irq This patch fixes an issue that the following error is possible to happen when ohci hardware causes an interruption and the system is shutting down at the same time. [ 34.851754] usb 2-1: USB disconnect, device number 2 [ 35.166658] irq 156: nobody cared (try booting with the "irqpoll" option) [ 35.173445] CPU: 0 PID: 22 Comm: kworker/0:1 Not tainted 5.3.0-rc5 #85 [ 35.179964] Hardware name: Renesas Salvator-X 2nd version board based on r8a77965 (DT) [ 35.187886] Workqueue: usb_hub_wq hub_event [ 35.192063] Call trace: [ 35.194509] dump_backtrace+0x0/0x150 [ 35.198165] show_stack+0x14/0x20 [ 35.201475] dump_stack+0xa0/0xc4 [ 35.204785] __report_bad_irq+0x34/0xe8 [ 35.208614] note_interrupt+0x2cc/0x318 [ 35.212446] handle_irq_event_percpu+0x5c/0x88 [ 35.216883] handle_irq_event+0x48/0x78 [ 35.220712] handle_fasteoi_irq+0xb4/0x188 [ 35.224802] generic_handle_irq+0x24/0x38 [ 35.228804] __handle_domain_irq+0x5c/0xb0 [ 35.232893] gic_handle_irq+0x58/0xa8 [ 35.236548] el1_irq+0xb8/0x180 [ 35.239681] __do_softirq+0x94/0x23c [ 35.243253] irq_exit+0xd0/0xd8 [ 35.246387] __handle_domain_irq+0x60/0xb0 [ 35.250475] gic_handle_irq+0x58/0xa8 [ 35.254130] el1_irq+0xb8/0x180 [ 35.257268] kernfs_find_ns+0x5c/0x120 [ 35.261010] kernfs_find_and_get_ns+0x3c/0x60 [ 35.265361] sysfs_unmerge_group+0x20/0x68 [ 35.269454] dpm_sysfs_remove+0x2c/0x68 [ 35.273284] device_del+0x80/0x370 [ 35.276683] hid_destroy_device+0x28/0x60 [ 35.280686] usbhid_disconnect+0x4c/0x80 [ 35.284602] usb_unbind_interface+0x6c/0x268 [ 35.288867] device_release_driver_internal+0xe4/0x1b0 [ 35.293998] device_release_driver+0x14/0x20 [ 35.298261] bus_remove_device+0x110/0x128 [ 35.302350] device_del+0x148/0x370 [ 35.305832] usb_disable_device+0x8c/0x1d0 [ 35.309921] usb_disconnect+0xc8/0x2d0 [ 35.313663] hub_event+0x6e0/0x1128 [ 35.317146] process_one_work+0x1e0/0x320 [ 35.321148] worker_thread+0x40/0x450 [ 35.324805] kthread+0x124/0x128 [ 35.328027] ret_from_fork+0x10/0x18 [ 35.331594] handlers: [ 35.333862] [<0000000079300c1d>] usb_hcd_irq [ 35.338126] [<0000000079300c1d>] usb_hcd_irq [ 35.342389] Disabling IRQ #156 ohci_shutdown() disables all the interrupt and rh_state is set to OHCI_RH_HALTED. In other hand, ohci_irq() is possible to enable OHCI_INTR_SF and OHCI_INTR_MIE on ohci_irq(). Note that OHCI_INTR_SF is possible to be set by start_ed_unlink() which is called: ohci_irq() -> process_done_list() -> takeback_td() -> start_ed_unlink() So, ohci_irq() has the following condition, the issue happens by &ohci->regs->intrenable = OHCI_INTR_MIE | OHCI_INTR_SF and ohci->rh_state = OHCI_RH_HALTED: /* interrupt for some other device? */ if (ints == 0 || unlikely(ohci->rh_state == OHCI_RH_HALTED)) return IRQ_NOTMINE; To fix the issue, ohci_shutdown() holds the spin lock while disabling the interruption and changing the rh_state flag to prevent reenable the OHCI_INTR_MIE unexpectedly. Note that io_watchdog_func() also calls the ohci_shutdown() and it already held the spin lock, so that the patch makes a new function as _ohci_shutdown(). This patch is inspired by a Renesas R-Car Gen3 BSP patch from Tho Vu. Signed-off-by: Yoshihiro Shimoda Cc: stable Acked-by: Alan Stern Link: https://lore.kernel.org/r/1566877910-6020-1-git-send-email-yoshihiro.shimoda.uh@renesas.com Signed-off-by: Greg Kroah-Hartman commit 76da906ad727048a74bb8067031ee99fc070c7da Author: Schmid, Carsten Date: Fri Aug 23 14:11:28 2019 +0000 usb: hcd: use managed device resources Using managed device resources in usb_hcd_pci_probe() allows devm usage for resource subranges, such as the mmio resource for the platform device created to control host/device mode mux, which is a xhci extended capability, and sits inside the xhci mmio region. If managed device resources are not used then "parent" resource is released before subrange at driver removal as .remove callback is called before the devres list of resources for this device is walked and released. This has been observed with the xhci extended capability driver causing a use-after-free which is now fixed. An additional nice benefit is that error handling on driver initialisation is simplified much. Signed-off-by: Carsten Schmid Tested-by: Carsten Schmid Reviewed-by: Mathias Nyman Fixes: fa31b3cb2ae1 ("xhci: Add Intel extended cap / otg phy mux handling") Cc: # v4.19+ Link: https://lore.kernel.org/r/1566569488679.31808@mentor.com Signed-off-by: Greg Kroah-Hartman commit a684d8fd87182090ee96e34519ecdf009cef093a Author: Colin Ian King Date: Thu Aug 22 14:52:12 2019 +0100 typec: tcpm: fix a typo in the comparison of pdo_max_voltage There appears to be a typo in the comparison of pdo_max_voltage[i] with the previous value, currently it is checking against the array pdo_min_voltage rather than pdo_max_voltage. I believe this is a typo. Fix this. Addresses-Coverity: ("Copy-paste error") Fixes: 5007e1b5db73 ("typec: tcpm: Validate source and sink caps") Cc: stable Signed-off-by: Colin Ian King Reviewed-by: Guenter Roeck Reviewed-by: Heikki Krogerus Link: https://lore.kernel.org/r/20190822135212.10195-1-colin.king@canonical.com Signed-off-by: Greg Kroah-Hartman commit ddaedbbece90add970faeac87f7d7d40341936ce Author: Thomas Gleixner Date: Thu Aug 15 23:25:05 2019 +0200 Documentation/process: Embargoed hardware security issues To address the requirements of embargoed hardware issues, like Meltdown, Spectre, L1TF etc. it is necessary to define and document a process for handling embargoed hardware security issues. Following the discussion at the maintainer summit 2018 in Edinburgh (https://lwn.net/Articles/769417/) the volunteered people have worked out a process and a Memorandum of Understanding. The latter addresses the fact that the Linux kernel community cannot sign NDAs for various reasons. The initial contact point for hardware security issues is different from the regular kernel security contact to provide a known and neutral interface for hardware vendors and researchers. The initial primary contact team is proposed to be staffed by Linux Foundation Fellows, who are not associated to a vendor or a distribution and are well connected in the industry as a whole. The process is designed with the experience of the past incidents in mind and tries to address the remaining gaps, so future (hopefully rare) incidents can be handled more efficiently. It won't remove the fact, that most of this has to be done behind closed doors, but it is set up to avoid big bureaucratic hurdles for individual developers. The process is solely for handling hardware security issues and cannot be used for regular kernel (software only) security bugs. This memo can help with hardware companies who, and I quote, "[my manager] doesn't want to bet his job on the list keeping things secret." This despite numerous leaks directly from that company over the years, and none ever so far from the kernel security team. Cognitive dissidence seems to be a requirement to be a good manager. To accelerate the adoption of this process, we introduce the concept of ambassadors in participating companies. The ambassadors are there to guide people to comply with the process, but are not automatically involved in the disclosure of a particular incident. Signed-off-by: Thomas Gleixner Reviewed-by: Greg Kroah-Hartman Reviewed-by: Josh Poimboeuf Acked-by: Laura Abbott Acked-by: Ben Hutchings Reviewed-by: Tyler Hicks Reviewed-by: Konrad Rzeszutek Wilk Reviewed-by: Jiri Kosina Link: https://lore.kernel.org/r/20190815212505.GC12041@kroah.com Signed-off-by: Greg Kroah-Hartman commit b9bc7b8b1e9e815b231c1ca0b566ee723f480987 Author: Raul E Rangel Date: Tue Aug 27 11:36:19 2019 -0600 lkdtm/bugs: fix build error in lkdtm_EXHAUST_STACK lkdtm/bugs.c:94:2: error: format '%d' expects argument of type 'int', but argument 2 has type 'long unsigned int' [-Werror=format=] pr_info("Calling function with %d frame size to depth %d ...\n", ^ THREAD_SIZE is defined as a unsigned long, cast CONFIG_FRAME_WARN to unsigned long as well. Fixes: 24cccab42c419 ("lkdtm/bugs: Adjust recursion test to avoid elision") Cc: stable Signed-off-by: Raul E Rangel Acked-by: Kees Cook Link: https://lore.kernel.org/r/20190827173619.170065-1-rrangel@chromium.org Signed-off-by: Greg Kroah-Hartman commit 587f17407741a5be07f8a2d1809ec946c8120962 Author: Tomas Winkler Date: Mon Aug 19 13:32:10 2019 +0300 mei: me: add Tiger Lake point LP device ID Add Tiger Lake Point device ID for TGP LP. Signed-off-by: Tomas Winkler Cc: stable Link: https://lore.kernel.org/r/20190819103210.32748-1-tomas.winkler@intel.com Signed-off-by: Greg Kroah-Hartman commit 9c78255fdde45c6b9a1ee30f652f7b34c727f5c7 Author: Alexander Shishkin Date: Wed Aug 21 10:49:55 2019 +0300 intel_th: pci: Add Tiger Lake support This adds support for the Trace Hub in Tiger Lake PCH. Signed-off-by: Alexander Shishkin Cc: stable@vger.kernel.org # v4.14+ Link: https://lore.kernel.org/r/20190821074955.3925-5-alexander.shishkin@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit 164eb56e3b64f3a816238d410c9efec7567a82ef Author: Alexander Shishkin Date: Wed Aug 21 10:49:54 2019 +0300 intel_th: pci: Add support for another Lewisburg PCH Add support for the Trace Hub in another Lewisburg PCH. Signed-off-by: Alexander Shishkin Cc: stable@vger.kernel.org # v4.14+ Link: https://lore.kernel.org/r/20190821074955.3925-4-alexander.shishkin@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit 961b6ffe0e2c403b09a8efe4a2e986b3c415391a Author: Ding Xiang Date: Wed Aug 21 10:49:52 2019 +0300 stm class: Fix a double free of stm_source_device In the error path of stm_source_register_device(), the kfree is unnecessary, as the put_device() before it ends up calling stm_source_device_release() to free stm_source_device, leading to a double free at the outer kfree() call. Remove it. Signed-off-by: Ding Xiang Signed-off-by: Alexander Shishkin Fixes: 7bd1d4093c2fa ("stm class: Introduce an abstraction for System Trace Module devices") Link: https://lore.kernel.org/linux-arm-kernel/1563354988-23826-1-git-send-email-dingxiang@cmss.chinamobile.com/ Cc: stable@vger.kernel.org # v4.4+ Link: https://lore.kernel.org/r/20190821074955.3925-2-alexander.shishkin@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit c78439f8b97e9719ca3baea4e1a0eef310e4065c Merge: a642a0b33343 dec43da46f63 Author: Greg Kroah-Hartman Date: Wed Aug 28 22:26:47 2019 +0200 Merge tag 'fpga-fixes-for-5.3' of git://git.kernel.org/pub/scm/linux/kernel/git/mdf/linux-fpga into char-misc-linus Moritz writes: FPGA Manager fixes for 5.3 A single fix for the altera-ps-spi driver that fixes the behavior when the driver receives -EPROBE_DEFER when trying to obtain a GPIO desc. Signed-off-by: Moritz Fischer * tag 'fpga-fixes-for-5.3' of git://git.kernel.org/pub/scm/linux/kernel/git/mdf/linux-fpga: fpga: altera-ps-spi: Fix getting of optional confd gpio commit a642a0b33343add9b771ce88a6c5ff6cf92f22d2 Author: Greg Kroah-Hartman Date: Tue Aug 27 21:53:10 2019 +0200 MAINTAINERS: add entry for LICENSES and SPDX stuff Thomas and I seem to have become the "unofficial" maintainers for these files and questions about SPDX things. So let's make it official. Reported-by: "Darrick J. Wong" Grumpily-acked-by: Thomas Gleixner Acked-by: Darrick J. Wong Link: https://lore.kernel.org/r/20190827195310.GA30618@kroah.com Signed-off-by: Greg Kroah-Hartman commit 9cf6b756cdf2cd38b8b0dac2567f7c6daf5e79d5 Merge: 9e8312f5e160 82e40f558de5 Author: Linus Torvalds Date: Wed Aug 28 10:37:21 2019 -0700 Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux Pull arm64 fixes from Will Deacon: "Hot on the heels of our last set of fixes are a few more for -rc7. Two of them are fixing issues with our virtual interrupt controller implementation in KVM/arm, while the other is a longstanding but straightforward kallsyms fix which was been acked by Masami and resolves an initialisation failure in kprobes observed on arm64. - Fix GICv2 emulation bug (KVM) - Fix deadlock in virtual GIC interrupt injection code (KVM) - Fix kprobes blacklist init failure due to broken kallsyms lookup" * tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux: KVM: arm/arm64: vgic-v2: Handle SGI bits in GICD_I{S,C}PENDR0 as WI KVM: arm/arm64: vgic: Fix potential deadlock when ap_list is long kallsyms: Don't let kallsyms_lookup_size_offset() fail on retrieving the first symbol commit 274b924088e93593c76fb122d24bc0ef18d0ddf4 Author: Jeff Moyer Date: Wed Aug 28 11:49:46 2019 -0400 libnvdimm/pfn: Fix namespace creation on misaligned addresses Yi reported[1] that after commit a3619190d62e ("libnvdimm/pfn: stop padding pmem namespaces to section alignment"), it was no longer possible to create a device dax namespace with a 1G alignment. The reason was that the pmem region was not itself 1G-aligned. The code happily skips past the first 512M, but fails to account for a now misaligned end offset (since space was allocated starting at that misaligned address, and extending for size GBs). Reintroduce end_trunc, so that the code correctly handles the misaligned end address. This results in the same behavior as before the introduction of the offending commit. [1] https://lists.01.org/pipermail/linux-nvdimm/2019-July/022813.html Fixes: a3619190d62e ("libnvdimm/pfn: stop padding pmem namespaces ...") Reported-and-tested-by: Yi Zhang Signed-off-by: Jeff Moyer Link: https://lore.kernel.org/r/x49ftll8f39.fsf@segfault.boston.devel.redhat.com Signed-off-by: Dan Williams commit 6978bce054247e4cfccdf689ce263e076499f905 Author: Ayan Kumar Halder Date: Wed Aug 28 15:00:19 2019 +0000 drm/komeda: Reordered the komeda's de-init functions The de-init routine should be doing the following in order:- 1. Unregister the drm device 2. Shut down the crtcs - failing to do this might cause a connector leakage See the 'commit 109c4d18e574 ("drm/arm/malidp: Ensure that the crtcs are shutdown before removing any encoder/connector")' 3. Disable the interrupts 4. Unbind the components 5. Free up DRM mode_config info Changes from v1:- 1. Re-ordered the header files inclusion 2. Rebased on top of the latest drm-misc-fixes Signed-off-by:. Ayan Kumar Halder Reviewed-by: Mihail Atanassov Reviewed-by: James Qian Wang (Arm Technology China) Link: https://patchwork.freedesktop.org/patch/327606/ commit 42e0e95474fc6076b5cd68cab8fa0340a1797a72 Author: Linus Torvalds Date: Wed Aug 28 10:56:48 2019 +0200 x86/build: Add -Wnoaddress-of-packed-member to REALMODE_CFLAGS, to silence GCC9 build warning One of the very few warnings I have in the current build comes from arch/x86/boot/edd.c, where I get the following with a gcc9 build: arch/x86/boot/edd.c: In function ‘query_edd’: arch/x86/boot/edd.c:148:11: warning: taking address of packed member of ‘struct boot_params’ may result in an unaligned pointer value [-Waddress-of-packed-member] 148 | mbrptr = boot_params.edd_mbr_sig_buffer; | ^~~~~~~~~~~ This warning triggers because we throw away all the CFLAGS and then make a new set for REALMODE_CFLAGS, so the -Wno-address-of-packed-member we added in the following commit is not present: 6f303d60534c ("gcc-9: silence 'address-of-packed-member' warning") The simplest solution for now is to adjust the warning for this version of CFLAGS as well, but it would definitely make sense to examine whether REALMODE_CFLAGS could be derived from CFLAGS, so that it picks up changes in the compiler flags environment automatically. Signed-off-by: Linus Torvalds Acked-by: Borislav Petkov Cc: Peter Zijlstra Cc: Thomas Gleixner Signed-off-by: Ingo Molnar commit 531a64e4c35bb9844b0cf813a6c9a87e00be05ff Author: Bernard Metzler Date: Wed Aug 28 15:03:55 2019 +0200 RDMA/siw: Fix IPv6 addr_list locking Walking the address list of an inet6_dev requires appropriate locking. Since the called function siw_listen_address() may sleep, we have to use rtnl_lock() instead of read_lock_bh(). Also introduces sanity checks if we got a device from in_dev_get() or in6_dev_get(). Reported-by: Bart Van Assche Fixes: 6c52fdc244b5 ("rdma/siw: connection management") Signed-off-by: Bernard Metzler Link: https://lore.kernel.org/r/20190828130355.22830-1-bmt@zurich.ibm.com Signed-off-by: Doug Ledford commit 438b6c20e6161a1a7542490baa093c86732f77d6 Author: David Jander Date: Tue Aug 27 06:46:29 2019 +0000 gpio: pca953x: use pca953x_read_regs instead of regmap_bulk_read The register number needs to be translated for chips with more than 8 ports. This patch fixes a bug causing all chips with more than 8 GPIO pins to not work correctly. Fixes: 0f25fda840a9 ("gpio: pca953x: Zap ad-hoc reg_direction cache") Cc: Cc: Signed-off-by: David Jander Signed-off-by: Bartosz Golaszewski commit bc624a06f0c5190bc37fec7d22cd82b43a579698 Author: David Jander Date: Tue Aug 27 06:46:28 2019 +0000 gpio: pca953x: correct type of reg_direction The type of reg_direction needs to match the type of the regmap, which is u8. Fixes: 0f25fda840a9 ("gpio: pca953x: Zap ad-hoc reg_direction cache") Cc: Cc: Signed-off-by: David Jander Signed-off-by: Bartosz Golaszewski commit d435c9a7b85be1e820668d2f3718c2d9f24d5548 Author: Ilya Dryomov Date: Tue Aug 27 16:45:10 2019 +0200 rbd: restore zeroing past the overlap when reading from parent The parent image is read only up to the overlap point, the rest of the buffer should be zeroed. This snuck in because as it turns out the overlap test case has not been triggering this code path for a while now. Fixes: a9b67e69949d ("rbd: replace obj_req->tried_parent with obj_req->read_state") Signed-off-by: Ilya Dryomov Reviewed-by: Jason Dillaman commit e8c99200b4d117c340c392ebd5e62d85dfeed027 Author: Jia-Ju Bai Date: Wed Jul 24 17:43:06 2019 +0800 libceph: don't call crypto_free_sync_skcipher() on a NULL tfm In set_secret(), key->tfm is assigned to NULL on line 55, and then ceph_crypto_key_destroy(key) is executed. ceph_crypto_key_destroy(key) crypto_free_sync_skcipher(key->tfm) crypto_free_skcipher(&tfm->base); This happens to work because crypto_sync_skcipher is a trivial wrapper around crypto_skcipher: &tfm->base is still 0 and crypto_free_skcipher() handles that. Let's not rely on the layout of crypto_sync_skcipher. This bug is found by a static analysis tool STCheck written by us. Fixes: 69d6302b65a8 ("libceph: Remove VLA usage of skcipher"). Signed-off-by: Jia-Ju Bai Reviewed-by: Ilya Dryomov Signed-off-by: Ilya Dryomov commit 82e40f558de566fdee214bec68096bbd5e64a6a4 Author: Marc Zyngier Date: Wed Aug 28 11:10:16 2019 +0100 KVM: arm/arm64: vgic-v2: Handle SGI bits in GICD_I{S,C}PENDR0 as WI A guest is not allowed to inject a SGI (or clear its pending state) by writing to GICD_ISPENDR0 (resp. GICD_ICPENDR0), as these bits are defined as WI (as per ARM IHI 0048B 4.3.7 and 4.3.8). Make sure we correctly emulate the architecture. Fixes: 96b298000db4 ("KVM: arm/arm64: vgic-new: Add PENDING registers handlers") Cc: stable@vger.kernel.org # 4.7+ Reported-by: Andre Przywara Signed-off-by: Marc Zyngier Signed-off-by: Will Deacon commit fdfc5c8594c24c5df883583ebd286321a80e0a67 Author: Eric Dumazet Date: Mon Aug 26 09:19:15 2019 -0700 tcp: remove empty skb from write queue in error cases Vladimir Rutsky reported stuck TCP sessions after memory pressure events. Edge Trigger epoll() user would never receive an EPOLLOUT notification allowing them to retry a sendmsg(). Jason tested the case of sk_stream_alloc_skb() returning NULL, but there are other paths that could lead both sendmsg() and sendpage() to return -1 (EAGAIN), with an empty skb queued on the write queue. This patch makes sure we remove this empty skb so that Jason code can detect that the queue is empty, and call sk->sk_write_space(sk) accordingly. Fixes: ce5ec440994b ("tcp: ensure epoll edge trigger wakeup when write queue is empty") Signed-off-by: Eric Dumazet Cc: Jason Baron Reported-by: Vladimir Rutsky Cc: Soheil Hassas Yeganeh Cc: Neal Cardwell Acked-by: Soheil Hassas Yeganeh Acked-by: Neal Cardwell Signed-off-by: David S. Miller commit 7d0a06586b2686ba80c4a2da5f91cb10ffbea736 Author: Ka-Cheong Poon Date: Mon Aug 26 02:39:12 2019 -0700 net/rds: Fix info leak in rds6_inc_info_copy() The rds6_inc_info_copy() function has a couple struct members which are leaking stack information. The ->tos field should hold actual information and the ->flags field needs to be zeroed out. Fixes: 3eb450367d08 ("rds: add type of service(tos) infrastructure") Fixes: b7ff8b1036f0 ("rds: Extend RDS API for IPv6 support") Reported-by: 黄ID蝴蝶 Signed-off-by: Dan Carpenter Signed-off-by: Ka-Cheong Poon Acked-by: Santosh Shilimkar Signed-off-by: David S. Miller commit 2c1644cf6d46a8267d79ed95cb9b563839346562 Author: Feng Sun Date: Mon Aug 26 14:46:04 2019 +0800 net: fix skb use after free in netpoll After commit baeababb5b85d5c4e6c917efe2a1504179438d3b ("tun: return NET_XMIT_DROP for dropped packets"), when tun_net_xmit drop packets, it will free skb and return NET_XMIT_DROP, netpoll_send_skb_on_dev will run into following use after free cases: 1. retry netpoll_start_xmit with freed skb; 2. queue freed skb in npinfo->txq. queue_process will also run into use after free case. hit netpoll_send_skb_on_dev first case with following kernel log: [ 117.864773] kernel BUG at mm/slub.c:306! [ 117.864773] invalid opcode: 0000 [#1] SMP PTI [ 117.864774] CPU: 3 PID: 2627 Comm: loop_printmsg Kdump: loaded Tainted: P OE 5.3.0-050300rc5-generic #201908182231 [ 117.864775] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu1 04/01/2014 [ 117.864775] RIP: 0010:kmem_cache_free+0x28d/0x2b0 [ 117.864781] Call Trace: [ 117.864781] ? tun_net_xmit+0x21c/0x460 [ 117.864781] kfree_skbmem+0x4e/0x60 [ 117.864782] kfree_skb+0x3a/0xa0 [ 117.864782] tun_net_xmit+0x21c/0x460 [ 117.864782] netpoll_start_xmit+0x11d/0x1b0 [ 117.864788] netpoll_send_skb_on_dev+0x1b8/0x200 [ 117.864789] __br_forward+0x1b9/0x1e0 [bridge] [ 117.864789] ? skb_clone+0x53/0xd0 [ 117.864790] ? __skb_clone+0x2e/0x120 [ 117.864790] deliver_clone+0x37/0x50 [bridge] [ 117.864790] maybe_deliver+0x89/0xc0 [bridge] [ 117.864791] br_flood+0x6c/0x130 [bridge] [ 117.864791] br_dev_xmit+0x315/0x3c0 [bridge] [ 117.864792] netpoll_start_xmit+0x11d/0x1b0 [ 117.864792] netpoll_send_skb_on_dev+0x1b8/0x200 [ 117.864792] netpoll_send_udp+0x2c6/0x3e8 [ 117.864793] write_msg+0xd9/0xf0 [netconsole] [ 117.864793] console_unlock+0x386/0x4e0 [ 117.864793] vprintk_emit+0x17e/0x280 [ 117.864794] vprintk_default+0x29/0x50 [ 117.864794] vprintk_func+0x4c/0xbc [ 117.864794] printk+0x58/0x6f [ 117.864795] loop_fun+0x24/0x41 [printmsg_loop] [ 117.864795] kthread+0x104/0x140 [ 117.864795] ? 0xffffffffc05b1000 [ 117.864796] ? kthread_park+0x80/0x80 [ 117.864796] ret_from_fork+0x35/0x40 Signed-off-by: Feng Sun Signed-off-by: Xiaojun Zhao Signed-off-by: David S. Miller commit bcccb0a535bb99616e4b992568371efab1ab14e8 Author: Vladimir Oltean Date: Sun Aug 25 21:32:12 2019 +0300 net: dsa: tag_8021q: Future-proof the reserved fields in the custom VID After witnessing the discussion in https://lkml.org/lkml/2019/8/14/151 w.r.t. ioctl extensibility, it became clear that such an issue might prevent that the 3 RSV bits inside the DSA 802.1Q tag might also suffer the same fate and be useless for further extension. So clearly specify that the reserved bits should currently be transmitted as zero and ignored on receive. The DSA tagger already does this (and has always did), and is the only known user so far (no Wireshark dissection plugin, etc). So there should be no incompatibility to speak of. Fixes: 0471dd429cea ("net: dsa: tag_8021q: Create a stable binary format") Signed-off-by: Vladimir Oltean Reviewed-by: Florian Fainelli Signed-off-by: David S. Miller commit 94acaeb50ced653bfe2c4d8037c70b107af14124 Author: Marco Hartmann Date: Wed Aug 21 11:00:46 2019 +0000 Add genphy_c45_config_aneg() function to phy-c45.c Commit 34786005eca3 ("net: phy: prevent PHYs w/o Clause 22 regs from calling genphy_config_aneg") introduced a check that aborts phy_config_aneg() if the phy is a C45 phy. This causes phy_state_machine() to call phy_error() so that the phy ends up in PHY_HALTED state. Instead of returning -EOPNOTSUPP, call genphy_c45_config_aneg() (analogous to the C22 case) so that the state machine can run correctly. genphy_c45_config_aneg() closely resembles mv3310_config_aneg() in drivers/net/phy/marvell10g.c, excluding vendor specific configurations for 1000BaseT. Fixes: 22b56e827093 ("net: phy: replace genphy_10g_driver with genphy_c45_driver") Signed-off-by: Marco Hartmann Reviewed-by: Andrew Lunn Signed-off-by: David S. Miller commit 36e337744c0d9ea23a64a8b62bddec6173e93975 Author: Steve French Date: Tue Aug 27 17:29:56 2019 -0500 cifs: update internal module number To 2.22 Signed-off-by: Steve French commit 340625e618e1b37a72a02f07aa7144ae0ab0b19e Author: Ronnie Sahlberg Date: Tue Aug 27 09:30:14 2019 +1000 cifs: replace various strncpy with strscpy and similar Using strscpy is cleaner, and avoids some problems with handling maximum length strings. Linus noticed the original problem and Aurelien pointed out some additional problems. Fortunately most of this is SMB1 code (and in particular the ASCII string handling older, which is less common). Reported-by: Linus Torvalds Reviewed-by: Aurelien Aptel Signed-off-by: Ronnie Sahlberg Signed-off-by: Steve French commit 981471bd3abf4d572097645d765391533aac327d Author: Cong Wang Date: Sun Aug 25 10:01:32 2019 -0700 net_sched: fix a NULL pointer deref in ipt action The net pointer in struct xt_tgdtor_param is not explicitly initialized therefore is still NULL when dereferencing it. So we have to find a way to pass the correct net pointer to ipt_destroy_target(). The best way I find is just saving the net pointer inside the per netns struct tcf_idrinfo, which could make this patch smaller. Fixes: 0c66dc1ea3f0 ("netfilter: conntrack: register hooks in netns when needed by ruleset") Reported-and-tested-by: itugrok@yahoo.com Cc: Jamal Hadi Salim Cc: Jiri Pirko Signed-off-by: Cong Wang Signed-off-by: David S. Miller commit 478228e57f81f6cb60798d54fc02a74ea7dd267e Author: Dan Carpenter Date: Tue Aug 27 13:59:17 2019 +0300 cifs: Use kzfree() to zero out the password It's safer to zero out the password so that it can never be disclosed. Fixes: 0c219f5799c7 ("cifs: set domainName when a domain-key is used in multiuser") Signed-off-by: Dan Carpenter Signed-off-by: Steve French commit f2aee329a68f5a907bcff11a109dfe17c0b41aeb Author: Ronnie Sahlberg Date: Thu Aug 22 08:09:50 2019 +1000 cifs: set domainName when a domain-key is used in multiuser RHBZ: 1710429 When we use a domain-key to authenticate using multiuser we must also set the domainnmame for the new volume as it will be used and passed to the server in the NTLMSSP Domain-name. Signed-off-by: Ronnie Sahlberg Signed-off-by: Steve French commit 9e8312f5e160ade069e131d54ab8652cf0e86e1a Merge: 6525771f58cb 99300a85260c Author: Linus Torvalds Date: Tue Aug 27 13:22:57 2019 -0700 Merge tag 'nfs-for-5.3-3' of git://git.linux-nfs.org/projects/trondmy/linux-nfs Pull NFS client bugfixes from Trond Myklebust: "Highlights include: Stable fixes: - Fix a page lock leak in nfs_pageio_resend() - Ensure O_DIRECT reports an error if the bytes read/written is 0 - Don't handle errors if the bind/connect succeeded - Revert "NFSv4/flexfiles: Abort I/O early if the layout segment was invalidat ed" Bugfixes: - Don't refresh attributes with mounted-on-file information - Fix return values for nfs4_file_open() and nfs_finish_open() - Fix pnfs layoutstats reporting of I/O errors - Don't use soft RPC calls for pNFS/flexfiles I/O, and don't abort for soft I/O errors when the user specifies a hard mount. - Various fixes to the error handling in sunrpc - Don't report writepage()/writepages() errors twice" * tag 'nfs-for-5.3-3' of git://git.linux-nfs.org/projects/trondmy/linux-nfs: NFS: remove set but not used variable 'mapping' NFSv2: Fix write regression NFSv2: Fix eof handling NFS: Fix writepage(s) error handling to not report errors twice NFS: Fix spurious EIO read errors pNFS/flexfiles: Don't time out requests on hard mounts SUNRPC: Handle connection breakages correctly in call_status() Revert "NFSv4/flexfiles: Abort I/O early if the layout segment was invalidated" SUNRPC: Handle EADDRINUSE and ENOBUFS correctly pNFS/flexfiles: Turn off soft RPC calls SUNRPC: Don't handle errors if the bind/connect succeeded NFS: On fatal writeback errors, we need to call nfs_inode_remove_request() NFS: Fix initialisation of I/O result struct in nfs_pgio_rpcsetup NFS: Ensure O_DIRECT reports an error if the bytes read/written is 0 NFSv4/pnfs: Fix a page lock leak in nfs_pageio_resend() NFSv4: Fix return value in nfs_finish_open() NFSv4: Fix return values for nfs4_file_open() NFS: Don't refresh attributes with mounted-on-file information commit 75ee23b30dc712d80d2421a9a547e7ab6e379b44 Author: Sean Christopherson Date: Fri Aug 23 13:55:44 2019 -0700 KVM: x86: Don't update RIP or do single-step on faulting emulation Don't advance RIP or inject a single-step #DB if emulation signals a fault. This logic applies to all state updates that are conditional on clean retirement of the emulation instruction, e.g. updating RFLAGS was previously handled by commit 38827dbd3fb85 ("KVM: x86: Do not update EFLAGS on faulting emulation"). Not advancing RIP is likely a nop, i.e. ctxt->eip isn't updated with ctxt->_eip until emulation "retires" anyways. Skipping #DB injection fixes a bug reported by Andy Lutomirski where a #UD on SYSCALL due to invalid state with EFLAGS.TF=1 would loop indefinitely due to emulation overwriting the #UD with #DB and thus restarting the bad SYSCALL over and over. Cc: Nadav Amit Cc: stable@vger.kernel.org Reported-by: Andy Lutomirski Fixes: 663f4c61b803 ("KVM: x86: handle singlestep during emulation") Signed-off-by: Sean Christopherson Signed-off-by: Radim Krčmář commit ea1529873ab18c204688cf31746df851c098cbea Author: Vitaly Kuznetsov Date: Tue Aug 27 18:04:02 2019 +0200 KVM: x86: hyper-v: don't crash on KVM_GET_SUPPORTED_HV_CPUID when kvm_intel.nested is disabled If kvm_intel is loaded with nested=0 parameter an attempt to perform KVM_GET_SUPPORTED_HV_CPUID results in OOPS as nested_get_evmcs_version hook in kvm_x86_ops is NULL (we assign it in nested_vmx_hardware_setup() and this only happens in case nested is enabled). Check that kvm_x86_ops->nested_get_evmcs_version is not NULL before calling it. With this, we can remove the stub from svm as it is no longer needed. Cc: Fixes: e2e871ab2f02 ("x86/kvm/hyper-v: Introduce nested_get_evmcs_version() helper") Signed-off-by: Vitaly Kuznetsov Reviewed-by: Jim Mattson Signed-off-by: Radim Krčmář commit 6525771f58cbc6ab97b5cff9069865cde8283346 Merge: 8d6454083d46 2f029413cbfb Author: Linus Torvalds Date: Tue Aug 27 10:50:27 2019 -0700 Merge tag 'arc-5.3-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/vgupta/arc Pull ARC updates from Vineet Gupta: - support for Edge Triggered IRQs in ARC IDU intc - other fixes here and there * tag 'arc-5.3-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/vgupta/arc: arc: prefer __section from compiler_attributes.h dt-bindings: IDU-intc: Add support for edge-triggered interrupts dt-bindings: IDU-intc: Clean up documentation ARCv2: IDU-intc: Add support for edge-triggered interrupts ARC: unwind: Mark expected switch fall-throughs ARC: [plat-hsdk]: allow to switch between AXI DMAC port configurations ARC: fix typo in setup_dma_ops log message ARCv2: entry: early return from exception need not clear U & DE bits commit 8d6454083d463a44097566616b473c7e6d4bdf02 Merge: 0004654fb148 4d82fa67dd6b Author: Linus Torvalds Date: Tue Aug 27 10:47:01 2019 -0700 Merge tag 'mfd-fixes-5.3' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/mfd Pull MFD fix from Lee Jones: "Identify potentially unused functions in rk808 driver when !PM" * tag 'mfd-fixes-5.3' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/mfd: mfd: rk808: Make PM function declaration static mfd: rk808: Mark pm functions __maybe_unused commit 0004654fb14859e49bab66aba881d64f605682a4 Merge: 452a04441b4d 2fd232939365 Author: Linus Torvalds Date: Tue Aug 27 10:42:03 2019 -0700 Merge tag 'sound-5.3-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "A collection of small fixes as usual: - More coverage of USB-audio descriptor sanity checks - A fix for mute LED regression on Conexant HD-audio codecs - A few device-specific fixes and quirks for USB-audio and HD-audio - A fix for (die-hard remaining) possible race in sequencer core - FireWire oxfw regression fix that was introduced in 5.3-rc1" * tag 'sound-5.3-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: ALSA: oxfw: fix to handle correct stream for PCM playback ALSA: seq: Fix potential concurrent access to the deleted pool ALSA: usb-audio: Check mixer unit bitmap yet more strictly ALSA: line6: Fix memory leak at line6_init_pcm() error path ALSA: usb-audio: Fix invalid NULL check in snd_emuusb_set_samplerate() ALSA: hda/ca0132 - Add new SBZ quirk ALSA: usb-audio: Add implicit fb quirk for Behringer UFX1604 ALSA: hda - Fixes inverted Conexant GPIO mic mute led commit 41940ff50f6c347f3541163702566cd526200d98 Author: Aaron Liu Date: Tue Aug 27 22:59:45 2019 +0800 drm/amdgpu: fix GFXOFF on Picasso and Raven2 For picasso(adev->pdev->device == 0x15d8)&raven2(adev->rev_id >= 0x8), firmware is sufficient to support gfxoff. In commit 98f58ada2d37e, for picasso&raven2, return directly and cause gfxoff disabled. Fixes: 98f58ada2d37 ("drm/amdgpu/gfx9: update pg_flags after determining if gfx off is possible") Reviewed-by: Huang Rui Reviewed-by: Alex Deucher Signed-off-by: Aaron Liu Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit 317a3aaef94d73ba6be88aea11b41bb631b2d581 Author: Kai-Heng Feng Date: Tue Aug 27 17:33:32 2019 +0800 drm/amdgpu: Add APTX quirk for Dell Latitude 5495 Needs ATPX rather than _PR3 to really turn off the dGPU. This can save ~5W when dGPU is runtime-suspended. Signed-off-by: Kai-Heng Feng Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit 83e09d5bddbee749fc83063890244397896a1971 Author: Evan Quan Date: Mon Aug 19 13:17:53 2019 +0800 drm/amd/powerplay: correct Vega20 dpm level related settings Correct the settings for auto mode and skip the unnecessary settings for dcefclk and fclk. Signed-off-by: Evan Quan Acked-by: Alex Deucher Signed-off-by: Alex Deucher commit 452a04441b4d0d2d567e4128af58867739002640 Merge: a55aa89aab90 f53a7ad18959 Author: Linus Torvalds Date: Tue Aug 27 10:12:48 2019 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from David Miller: 1) Use 32-bit index for tails calls in s390 bpf JIT, from Ilya Leoshkevich. 2) Fix missed EPOLLOUT events in TCP, from Eric Dumazet. Same fix for SMC from Jason Baron. 3) ipv6_mc_may_pull() should return 0 for malformed packets, not -EINVAL. From Stefano Brivio. 4) Don't forget to unpin umem xdp pages in error path of xdp_umem_reg(). From Ivan Khoronzhuk. 5) Fix sta object leak in mac80211, from Johannes Berg. 6) Fix regression by not configuring PHYLINK on CPU port of bcm_sf2 switches. From Florian Fainelli. 7) Revert DMA sync removal from r8169 which was causing regressions on some MIPS Loongson platforms. From Heiner Kallweit. 8) Use after free in flow dissector, from Jakub Sitnicki. 9) Fix NULL derefs of net devices during ICMP processing across collect_md tunnels, from Hangbin Liu. 10) proto_register() memory leaks, from Zhang Lin. 11) Set NLM_F_MULTI flag in multipart netlink messages consistently, from John Fastabend. * git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (66 commits) r8152: Set memory to all 0xFFs on failed reg reads openvswitch: Fix conntrack cache with timeout ipv4: mpls: fix mpls_xmit for iptunnel nexthop: Fix nexthop_num_path for blackhole nexthops net: rds: add service level support in rds-info net: route dump netlink NLM_F_MULTI flag missing s390/qeth: reject oversized SNMP requests sock: fix potential memory leak in proto_register() MAINTAINERS: Add phylink keyword to SFF/SFP/SFP+ MODULE SUPPORT xfrm/xfrm_policy: fix dst dev null pointer dereference in collect_md mode ipv4/icmp: fix rt dst dev null pointer dereference openvswitch: Fix log message in ovs conntrack bpf: allow narrow loads of some sk_reuseport_md fields with offset > 0 bpf: fix use after free in prog symbol exposure bpf: fix precision tracking in presence of bpf2bpf calls flow_dissector: Fix potential use-after-free on BPF_PROG_DETACH Revert "r8169: remove not needed call to dma_sync_single_for_device" ipv6: propagate ipv6_add_dev's error returns out of ipv6_find_idev net/ncsi: Fix the payload copying for the request coming from Netlink qed: Add cleanup in qed_slowpath_start() ... commit 478553fd1b6f819390b64a2e13ac756c4d1a2836 Author: Florian Westphal Date: Tue Aug 27 13:24:52 2019 +0200 netfilter: conntrack: make sysctls per-namespace again When I merged the extension sysctl tables with the main one I forgot to reset them on netns creation. They currently read/write init_net settings. Fixes: d912dec12428 ("netfilter: conntrack: merge acct and helper sysctl table with main one") Fixes: cb2833ed0044 ("netfilter: conntrack: merge ecache and timestamp sysctl tables with main one") Reported-by: Shmulik Ladkani Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit d4a8061a7c5f7c27a2dc002ee4cb89b3e6637e44 Author: Heyi Guo Date: Tue Aug 27 12:26:50 2019 +0100 KVM: arm/arm64: vgic: Fix potential deadlock when ap_list is long If the ap_list is longer than 256 entries, merge_final() in list_sort() will call the comparison callback with the same element twice, causing a deadlock in vgic_irq_cmp(). Fix it by returning early when irqa == irqb. Cc: stable@vger.kernel.org # 4.7+ Fixes: 8e4447457965 ("KVM: arm/arm64: vgic-new: Add IRQ sorting") Signed-off-by: Zenghui Yu Signed-off-by: Heyi Guo [maz: massaged commit log and patch, added Fixes and Cc-stable] Signed-off-by: Marc Zyngier Signed-off-by: Will Deacon commit 2a1a3fa0f29270583f0e6e3100d609e09697add1 Author: Marc Zyngier Date: Sat Aug 24 14:12:31 2019 +0100 kallsyms: Don't let kallsyms_lookup_size_offset() fail on retrieving the first symbol An arm64 kernel configured with CONFIG_KPROBES=y CONFIG_KALLSYMS=y # CONFIG_KALLSYMS_ALL is not set CONFIG_KALLSYMS_BASE_RELATIVE=y reports the following kprobe failure: [ 0.032677] kprobes: failed to populate blacklist: -22 [ 0.033376] Please take care of using kprobes. It appears that kprobe fails to retrieve the symbol at address 0xffff000010081000, despite this symbol being in System.map: ffff000010081000 T __exception_text_start This symbol is part of the first group of aliases in the kallsyms_offsets array (symbol names generated using ugly hacks in scripts/kallsyms.c): kallsyms_offsets: .long 0x1000 // do_undefinstr .long 0x1000 // efi_header_end .long 0x1000 // _stext .long 0x1000 // __exception_text_start .long 0x12b0 // do_cp15instr Looking at the implementation of get_symbol_pos(), it returns the lowest index for aliasing symbols. In this case, it return 0. But kallsyms_lookup_size_offset() considers 0 as a failure, which is obviously wrong (there is definitely a valid symbol living there). In turn, the kprobe blacklisting stops abruptly, hence the original error. A CONFIG_KALLSYMS_ALL kernel wouldn't fail as there is always some random symbols at the beginning of this array, which are never looked up via kallsyms_lookup_size_offset. Fix it by considering that get_symbol_pos() is always successful (which is consistent with the other uses of this function). Fixes: ffc5089196446 ("[PATCH] Create kallsyms_lookup_size_offset()") Reviewed-by: Masami Hiramatsu Cc: Arnaldo Carvalho de Melo Cc: Peter Zijlstra Cc: Will Deacon Cc: Catalin Marinas Signed-off-by: Marc Zyngier Signed-off-by: Will Deacon commit 99300a85260c2b7febd57082a617d1062532067e Author: YueHaibing Date: Tue Aug 27 15:16:36 2019 +0800 NFS: remove set but not used variable 'mapping' Fixes gcc '-Wunused-but-set-variable' warning: fs/nfs/write.c: In function nfs_page_async_flush: fs/nfs/write.c:609:24: warning: variable mapping set but not used [-Wunused-but-set-variable] It is not use since commit aefb623c422e ("NFS: Fix writepage(s) error handling to not report errors twice") Reported-by: Hulk Robot Signed-off-by: YueHaibing Signed-off-by: Trond Myklebust commit d33d4beb522987d1c305c12500796f9be3687dee Author: Trond Myklebust Date: Tue Aug 27 07:03:28 2019 -0400 NFSv2: Fix write regression Ensure we update the write result count on success, since the RPC call itself does not do so. Reported-by: Jan Stancek Reported-by: Naresh Kamboju Signed-off-by: Trond Myklebust Tested-by: Jan Stancek commit 71affe9be45a5c60b9772e1b2701710712637274 Author: Trond Myklebust Date: Mon Aug 26 20:41:16 2019 -0400 NFSv2: Fix eof handling If we received a reply from the server with a zero length read and no error, then that implies we are at eof. Signed-off-by: Trond Myklebust commit c91ff72142b0500a3835b18a3ed9c8dd7490e5c6 Merge: a55aa89aab90 ddfd151f3def Author: Radim Krčmář Date: Tue Aug 27 14:46:17 2019 +0200 Merge tag 'kvm-ppc-fixes-5.3-1' of git://git.kernel.org/pub/scm/linux/kernel/git/paulus/powerpc KVM/PPC fix for 5.3 - Fix bug which could leave locks locked in the host on return to a guest. commit 4d82fa67dd6b0e2635ae9dad44fbf3d747eca9ed Author: Lee Jones Date: Tue Aug 27 07:39:50 2019 +0100 mfd: rk808: Make PM function declaration static Avoids: ../drivers/mfd/rk808.c:771:1: warning: symbol 'rk8xx_pm_ops' \ was not declared. Should it be static? Fixes: 5752bc4373b2 ("mfd: rk808: Mark pm functions __maybe_unused") Reviewed-by: Arnd Bergmann Signed-off-by: Lee Jones commit 3a069024d371125227de3ac8fa74223fcf473520 Author: Thomas Jarosch Date: Wed Aug 21 16:14:28 2019 +0200 netfilter: nf_conntrack_ftp: Fix debug output The find_pattern() debug output was printing the 'skip' character. This can be a NULL-byte and messes up further pr_debug() output. Output without the fix: kernel: nf_conntrack_ftp: Pattern matches! kernel: nf_conntrack_ftp: Skipped up to `<7>nf_conntrack_ftp: find_pattern `PORT': dlen = 8 kernel: nf_conntrack_ftp: find_pattern `EPRT': dlen = 8 Output with the fix: kernel: nf_conntrack_ftp: Pattern matches! kernel: nf_conntrack_ftp: Skipped up to 0x0 delimiter! kernel: nf_conntrack_ftp: Match succeeded! kernel: nf_conntrack_ftp: conntrack_ftp: match `172,17,0,100,200,207' (20 bytes at 4150681645) kernel: nf_conntrack_ftp: find_pattern `PORT': dlen = 8 Signed-off-by: Thomas Jarosch Signed-off-by: Pablo Neira Ayuso commit 3cf2f450fff304be9cf4868bf0df17f253bc5b1c Author: Todd Seidelmann Date: Wed Aug 21 11:47:53 2019 -0400 netfilter: xt_physdev: Fix spurious error message in physdev_mt_check Simplify the check in physdev_mt_check() to emit an error message only when passed an invalid chain (ie, NF_INET_LOCAL_OUT). This avoids cluttering up the log with errors against valid rules. For large/heavily modified rulesets, current behavior can quickly overwhelm the ring buffer, because this function gets called on every change, regardless of the rule that was changed. Signed-off-by: Todd Seidelmann Acked-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit d0d5c0cd1e711c98703f3544c1e6fc1372898de5 Author: David Howells Date: Tue Aug 27 10:13:46 2019 +0100 rxrpc: Use skb_unshare() rather than skb_cow_data() The in-place decryption routines in AF_RXRPC's rxkad security module currently call skb_cow_data() to make sure the data isn't shared and that the skb can be written over. This has a problem, however, as the softirq handler may be still holding a ref or the Rx ring may be holding multiple refs when skb_cow_data() is called in rxkad_verify_packet() - and so skb_shared() returns true and __pskb_pull_tail() dislikes that. If this occurs, something like the following report will be generated. kernel BUG at net/core/skbuff.c:1463! ... RIP: 0010:pskb_expand_head+0x253/0x2b0 ... Call Trace: __pskb_pull_tail+0x49/0x460 skb_cow_data+0x6f/0x300 rxkad_verify_packet+0x18b/0xb10 [rxrpc] rxrpc_recvmsg_data.isra.11+0x4a8/0xa10 [rxrpc] rxrpc_kernel_recv_data+0x126/0x240 [rxrpc] afs_extract_data+0x51/0x2d0 [kafs] afs_deliver_fs_fetch_data+0x188/0x400 [kafs] afs_deliver_to_call+0xac/0x430 [kafs] afs_wait_for_call_to_complete+0x22f/0x3d0 [kafs] afs_make_call+0x282/0x3f0 [kafs] afs_fs_fetch_data+0x164/0x300 [kafs] afs_fetch_data+0x54/0x130 [kafs] afs_readpages+0x20d/0x340 [kafs] read_pages+0x66/0x180 __do_page_cache_readahead+0x188/0x1a0 ondemand_readahead+0x17d/0x2e0 generic_file_read_iter+0x740/0xc10 __vfs_read+0x145/0x1a0 vfs_read+0x8c/0x140 ksys_read+0x4a/0xb0 do_syscall_64+0x43/0xf0 entry_SYSCALL_64_after_hwframe+0x44/0xa9 Fix this by using skb_unshare() instead in the input path for DATA packets that have a security index != 0. Non-DATA packets don't need in-place encryption and neither do unencrypted DATA packets. Fixes: 248f219cb8bc ("rxrpc: Rewrite the data and ack handling code") Reported-by: Julian Wollrath Signed-off-by: David Howells commit 987db9f7cd1e77e611b770a569068c43949aa6fd Author: David Howells Date: Mon Aug 19 09:25:38 2019 +0100 rxrpc: Use the tx-phase skb flag to simplify tracing Use the previously-added transmit-phase skbuff private flag to simplify the socket buffer tracing a bit. Which phase the skbuff comes from can now be divined from the skb rather than having to be guessed from the call state. We can also reduce the number of rxrpc_skb_trace values by eliminating the difference between Tx and Rx in the symbols. Signed-off-by: David Howells commit b311e68420aa52098591988d0d6868b0b7463c0f Author: David Howells Date: Mon Aug 19 09:25:37 2019 +0100 rxrpc: Add a private skb flag to indicate transmission-phase skbs Add a flag in the private data on an skbuff to indicate that this is a transmission-phase buffer rather than a receive-phase buffer. Signed-off-by: David Howells commit a641fd00d05a5ae38c5a3d50d4da10283b15287b Author: David Howells Date: Mon Aug 19 09:25:37 2019 +0100 rxrpc: Abstract out rxtx ring cleanup Abstract out rxtx ring cleanup into its own function from its two callers. This makes it easier to apply the same changes to both. Signed-off-by: David Howells commit 4858e40303fba12e7506bf4354f20fdf550b3cd5 Author: David Howells Date: Mon Aug 19 09:25:36 2019 +0100 rxrpc: Pass the input handler's data skb reference to the Rx ring Pass the reference held on a DATA skb in the rxrpc input handler into the Rx ring rather than getting an additional ref for this and then dropping the original ref at the end. Signed-off-by: David Howells commit e2de6c4048989007b353164b19d6b7d5be4fa9e3 Author: David Howells Date: Tue Aug 27 09:51:30 2019 +0100 rxrpc: Use info in skbuff instead of reparsing a jumbo packet Use the information now cached in the skbuff private data to avoid the need to reparse a jumbo packet. We can find all the subpackets by dead reckoning, so it's only necessary to note how many there are, whether the last one is flagged as LAST_PACKET and whether any have the REQUEST_ACK flag set. This is necessary as once recvmsg() can see the packet, it can start modifying it, such as doing in-place decryption. Fixes: 248f219cb8bc ("rxrpc: Rewrite the data and ack handling code") Signed-off-by: David Howells commit c3c9e3df49f8d83db09d1f61c8bed54e7fed8662 Author: David Howells Date: Mon Aug 19 09:25:37 2019 +0100 rxrpc: Improve jumbo packet counting Improve the information stored about jumbo packets so that we don't need to reparse them so much later. Signed-off-by: David Howells Reviewed-by: Jeffrey Altman commit c96e8483cb2da6695c8b8d0896fe7ae272a07b54 Author: Kirill A. Shutemov Date: Mon Aug 26 16:26:01 2019 +0300 x86/boot/compressed/64: Fix missing initialization in find_trampoline_placement() Gustavo noticed that 'new' can be left uninitialized if 'bios_start' happens to be less or equal to 'entry->addr + entry->size'. Initialize the variable at the begin of the iteration to the current value of 'bios_start'. Fixes: 0a46fff2f910 ("x86/boot/compressed/64: Fix boot on machines with broken E820 table") Reported-by: "Gustavo A. R. Silva" Signed-off-by: Kirill A. Shutemov Signed-off-by: Thomas Gleixner Link: https://lkml.kernel.org/r/20190826133326.7cxb4vbmiawffv2r@box commit 32f0a982650b123bdab36865617d3e03ebcacf3b Author: Lyude Paul Date: Fri Aug 23 16:52:51 2019 -0400 drm/i915: Call dma_set_max_seg_size() in i915_driver_hw_probe() Currently, we don't call dma_set_max_seg_size() for i915 because we intentionally do not limit the segment length that the device supports. However, this results in a warning being emitted if we try to map anything larger than SZ_64K on a kernel with CONFIG_DMA_API_DEBUG_SG enabled: [ 7.751926] DMA-API: i915 0000:00:02.0: mapping sg segment longer than device claims to support [len=98304] [max=65536] [ 7.751934] WARNING: CPU: 5 PID: 474 at kernel/dma/debug.c:1220 debug_dma_map_sg+0x20f/0x340 This was originally brought up on https://bugs.freedesktop.org/show_bug.cgi?id=108517 , and the consensus there was it wasn't really useful to set a limit (and that dma-debug isn't really all that useful for i915 in the first place). Unfortunately though, CONFIG_DMA_API_DEBUG_SG is enabled in the debug configs for various distro kernels. Since a WARN_ON() will disable automatic problem reporting (and cause any CI with said option enabled to start complaining), we really should just fix the problem. Note that as me and Chris Wilson discussed, the other solution for this would be to make DMA-API not make such assumptions when a driver hasn't explicitly set a maximum segment size. But, taking a look at the commit which originally introduced this behavior, commit 78c47830a5cb ("dma-debug: check scatterlist segments"), there is an explicit mention of this assumption and how it applies to devices with no segment size: Conversely, devices which are less limited than the rather conservative defaults, or indeed have no limitations at all (e.g. GPUs with their own internal MMU), should be encouraged to set appropriate dma_parms, as they may get more efficient DMA mapping performance out of it. So unless there's any concerns (I'm open to discussion!), let's just follow suite and call dma_set_max_seg_size() with UINT_MAX as our limit to silence any warnings. Changes since v3: * Drop patch for enabling CONFIG_DMA_API_DEBUG_SG in CI. It looks like just turning it on causes the kernel to spit out bogus WARN_ONs() during some igt tests which would otherwise require teaching igt to disable the various DMA-API debugging options causing this. This is too much work to be worth it, since DMA-API debugging is useless for us. So, we'll just settle with this single patch to squelch WARN_ONs() during driver load for users that have CONFIG_DMA_API_DEBUG_SG turned on for some reason. * Move dma_set_max_seg_size() call into i915_driver_hw_probe() - Chris Wilson Signed-off-by: Lyude Paul Reviewed-by: Chris Wilson Cc: # v4.18+ Link: https://patchwork.freedesktop.org/patch/msgid/20190823205251.14298-1-lyude@redhat.com (cherry picked from commit acd674af95d3f627062007429b9c195c6b32361d) Signed-off-by: Jani Nikula commit 5b6eefd667847ca6bd6925f7bd1afcecc457c889 Author: Manasi Navare Date: Wed Aug 21 14:59:50 2019 -0700 drm/i915/dp: Fix DSC enable code to use cpu_transcoder instead of encoder->type This patch fixes the intel_configure_pps_for_dsc_encoder() function to use cpu_transcoder instead of encoder->type to select the correct DSC registers that was wrongly used in the original patch for one DSC register isntance. Fixes: 7182414e2530 ("drm/i915/dp: Configure i915 Picture parameter Set registers during DSC enabling") Cc: Ville Syrjala Cc: Maarten Lankhorst Cc: Jani Nikula Cc: # v5.0+ Signed-off-by: Manasi Navare Reviewed-by: Maarten Lankhorst Link: https://patchwork.freedesktop.org/patch/msgid/20190821215950.24223-1-manasi.d.navare@intel.com (cherry picked from commit d4c61c4a16decd8ace8660f22c81609a539fccba) Signed-off-by: Jani Nikula commit 0a3dfbb5cd9033752639ef33e319c2f2863c713a Author: Xiong Zhang Date: Tue Aug 20 13:46:17 2019 +0800 drm/i915: Don't deballoon unused ggtt drm_mm_node in linux guest The following call trace may exist in linux guest dmesg when guest i915 driver is unloaded. [ 90.776610] [drm:vgt_deballoon_space.isra.0 [i915]] deballoon space: range [0x0 - 0x0] 0 KiB. [ 90.776621] BUG: unable to handle kernel NULL pointer dereference at 00000000000000c0 [ 90.776691] IP: drm_mm_remove_node+0x4d/0x320 [drm] [ 90.776718] PGD 800000012c7d0067 P4D 800000012c7d0067 PUD 138e4c067 PMD 0 [ 90.777091] task: ffff9adab60f2f00 task.stack: ffffaf39c0fe0000 [ 90.777142] RIP: 0010:drm_mm_remove_node+0x4d/0x320 [drm] [ 90.777573] Call Trace: [ 90.777653] intel_vgt_deballoon+0x4c/0x60 [i915] [ 90.777729] i915_ggtt_cleanup_hw+0x121/0x190 [i915] [ 90.777792] i915_driver_unload+0x145/0x180 [i915] [ 90.777856] i915_pci_remove+0x15/0x20 [i915] [ 90.777890] pci_device_remove+0x3b/0xc0 [ 90.777916] device_release_driver_internal+0x157/0x220 [ 90.777945] driver_detach+0x39/0x70 [ 90.777967] bus_remove_driver+0x51/0xd0 [ 90.777990] pci_unregister_driver+0x23/0x90 [ 90.778019] SyS_delete_module+0x1da/0x240 [ 90.778045] entry_SYSCALL_64_fastpath+0x24/0x87 [ 90.778072] RIP: 0033:0x7f34312af067 [ 90.778092] RSP: 002b:00007ffdea3da0d8 EFLAGS: 00000206 [ 90.778297] RIP: drm_mm_remove_node+0x4d/0x320 [drm] RSP: ffffaf39c0fe3dc0 [ 90.778344] ---[ end trace f4b1bc8305fc59dd ]--- Four drm_mm_node are used to reserve guest ggtt space, but some of them may be skipped and not initialised due to space constraints in intel_vgt_balloon(). If drm_mm_remove_node() is called with uninitialized drm_mm_node, the above call trace occurs. This patch check drm_mm_node's validity before calling drm_mm_remove_node(). Fixes: ff8f797557c7("drm/i915: return the correct usable aperture size under gvt environment") Cc: stable@vger.kernel.org Signed-off-by: Xiong Zhang Acked-by: Zhenyu Wang Reviewed-by: Chris Wilson Signed-off-by: Chris Wilson Link: https://patchwork.freedesktop.org/patch/msgid/1566279978-9659-1-git-send-email-xiong.y.zhang@intel.com (cherry picked from commit 4776f3529d6b1e47f02904ad1d264d25ea22b27b) Signed-off-by: Jani Nikula commit ed5fa90660d63bcec4c3a62b03fed9427418b53d Author: Ville Syrjälä Date: Tue Aug 20 19:16:57 2019 +0300 drm/i915: Do not create a new max_bpc prop for MST connectors We're not allowed to create new properties after device registration so for MST connectors we need to either create the max_bpc property earlier, or we reuse one we already have. Let's do the latter apporach since the corresponding SST connector already has the prop and its min/max are correct also for the MST connector. The problem was highlighted by commit 4f5368b5541a ("drm/kms: Catch mode_object lifetime errors") which results in the following spew: [ 1330.878941] WARNING: CPU: 2 PID: 1554 at drivers/gpu/drm/drm_mode_object.c:45 __drm_mode_object_add+0xa0/0xb0 [drm] ... [ 1330.879008] Call Trace: [ 1330.879023] drm_property_create+0xba/0x180 [drm] [ 1330.879036] drm_property_create_range+0x15/0x30 [drm] [ 1330.879048] drm_connector_attach_max_bpc_property+0x62/0x80 [drm] [ 1330.879086] intel_dp_add_mst_connector+0x11f/0x140 [i915] [ 1330.879094] drm_dp_add_port.isra.20+0x20b/0x440 [drm_kms_helper] ... Cc: stable@vger.kernel.org Cc: Lyude Paul Cc: sunpeng.li@amd.com Cc: Daniel Vetter Cc: Sean Paul Fixes: 5ca0ef8a56b8 ("drm/i915: Add max_bpc property for DP MST") Signed-off-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20190820161657.9658-1-ville.syrjala@linux.intel.com Reviewed-by: José Roberto de Souza Reviewed-by: Lyude Paul (cherry picked from commit 1b9bd09630d4db4827cc04d358a41a16a6bc2cb0) Signed-off-by: Jani Nikula commit 5752bc4373b21c3fb1dd6db4dcdd569fae391a1d Author: Arnd Bergmann Date: Mon Jul 8 14:53:02 2019 +0200 mfd: rk808: Mark pm functions __maybe_unused The newly added suspend/resume functions are only used if CONFIG_PM is enabled: drivers/mfd/rk808.c:752:12: error: 'rk8xx_resume' defined but not used [-Werror=unused-function] drivers/mfd/rk808.c:732:12: error: 'rk8xx_suspend' defined but not used [-Werror=unused-function] Mark them as __maybe_unused so the compiler can silently drop them when they are not needed. Fixes: 586c1b4125b3 ("mfd: rk808: Add RK817 and RK809 support") Signed-off-by: Arnd Bergmann Signed-off-by: Lee Jones commit ddfd151f3def9258397fcde7a372205a2d661903 Author: Alexey Kardashevskiy Date: Mon Aug 26 14:55:20 2019 +1000 KVM: PPC: Book3S: Fix incorrect guest-to-user-translation error handling H_PUT_TCE_INDIRECT handlers receive a page with up to 512 TCEs from a guest. Although we verify correctness of TCEs before we do anything with the existing tables, there is a small window when a check in kvmppc_tce_validate might pass and right after that the guest alters the page of TCEs, causing an early exit from the handler and leaving srcu_read_lock(&vcpu->kvm->srcu) (virtual mode) or lock_rmap(rmap) (real mode) locked. This fixes the bug by jumping to the common exit code with an appropriate unlock. Cc: stable@vger.kernel.org # v4.11+ Fixes: 121f80ba68f1 ("KVM: PPC: VFIO: Add in-kernel acceleration for VFIO") Signed-off-by: Alexey Kardashevskiy Signed-off-by: Paul Mackerras commit 23b7f6c41d4717b1638eca47e09d7e99fc7b9fd9 Author: Kent Russell Date: Fri Aug 23 09:13:18 2019 -0400 drm/powerplay: Fix Vega20 power reading again For the 40.46 SMU release, they changed CurrSocketPower to AverageSocketPower, but this was changed back in 40.47 so just check if it's 40.46 and make the appropriate change Tested with 40.45, 40.46 and 40.47 successfully Signed-off-by: Kent Russell Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher commit 21649c0b6b7899f4fa3099c46d3d027f60b107ec Author: Kent Russell Date: Thu Aug 22 08:17:40 2019 -0400 drm/powerplay: Fix Vega20 Average Power value v4 The SMU changed reading from CurrSocketPower to AverageSocketPower, so reflect this accordingly. This fixes the issue where Average Power Consumption was being reported as 0 from SMU 40.46-onward v2: Fixed headline prefix v3: Add check for SMU version for proper compatibility v4: Style fix Signed-off-by: Kent Russell Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher commit ede7c460b1da5be7b8ef4efe47f1687babf06408 Author: Naveen N. Rao Date: Thu Aug 22 00:53:58 2019 +0530 bpf: handle 32-bit zext during constant blinding Since BPF constant blinding is performed after the verifier pass, the ALU32 instructions inserted for doubleword immediate loads don't have a corresponding zext instruction. This is causing a kernel oops on powerpc and can be reproduced by running 'test_cgroup_storage' with bpf_jit_harden=2. Fix this by emitting BPF_ZEXT during constant blinding if prog->aux->verifier_zext is set. Fixes: a4b1d3c1ddf6cb ("bpf: verifier: insert zero extension according to analysis result") Reported-by: Michael Ellerman Signed-off-by: Naveen N. Rao Reviewed-by: Jiong Wang Signed-off-by: Daniel Borkmann commit 86c28b2d69f93a218a9a5cef146ed0097a98687f Author: Jiong Wang Date: Fri Aug 23 19:00:28 2019 -0700 nfp: bpf: fix latency bug when updating stack index register NFP is using Local Memory to model stack. LM_addr could be used as base of a 16 32-bit word region of Local Memory. Then, if the stack offset is beyond the current region, the local index needs to be updated. The update needs at least three cycles to take effect, therefore the sequence normally looks like: local_csr_wr[ActLMAddr3, gprB_5] nop nop nop If the local index switch happens on a narrow loads, then the instruction preparing value to zero high 32-bit of the destination register could be counted as one cycle, the sequence then could be something like: local_csr_wr[ActLMAddr3, gprB_5] nop nop immed[gprB_5, 0] However, we have zero extension optimization that zeroing high 32-bit could be eliminated, therefore above IMMED insn won't be available for which case the first sequence needs to be generated. Fixes: 0b4de1ff19bf ("nfp: bpf: eliminate zero extension code-gen") Signed-off-by: Jiong Wang Reviewed-by: Jakub Kicinski Signed-off-by: Jakub Kicinski Signed-off-by: Daniel Borkmann commit 42068e1ef961c719f967dbbb4ddcb394a0ba7917 Author: Christian König Date: Fri Aug 16 14:56:35 2019 +0200 drm/amdgpu: fix dma_fence_wait without reference We need to grab a reference to the fence we wait for. Signed-off-by: Christian König Reviewed-by: Chunming Zhou Signed-off-by: Alex Deucher commit 96c4145599b30c0eb6cbeaa24207802452dd1872 Author: Trond Myklebust Date: Sat Aug 24 10:39:00 2019 -0400 NFS: Fix writepage(s) error handling to not report errors twice If writepage()/writepages() saw an error, but handled it without reporting it, we should not be re-reporting that error on exit. Signed-off-by: Trond Myklebust commit 8f54c7a4babf58bbaf849e126f7ae9664bdc9e04 Author: Trond Myklebust Date: Thu Aug 15 12:26:05 2019 -0400 NFS: Fix spurious EIO read errors If the client attempts to read a page, but the read fails due to some spurious error (e.g. an ACCESS error or a timeout, ...) then we need to allow other processes to retry. Also try to report errors correctly when doing a synchronous readpage. Signed-off-by: Trond Myklebust commit 7af46292dadcf8870946916f79fdddf79bd7267f Author: Trond Myklebust Date: Fri Aug 23 08:37:50 2019 -0400 pNFS/flexfiles: Don't time out requests on hard mounts If the mount is hard, we should ignore the 'io_maxretrans' module parameter so that we always keep retrying. Signed-off-by: Trond Myklebust commit c82e5472c9980e0e483f4b689044150eefaca408 Author: Trond Myklebust Date: Fri Aug 16 08:58:48 2019 -0400 SUNRPC: Handle connection breakages correctly in call_status() If the connection breaks while we're waiting for a reply from the server, then we want to immediately try to reconnect. Fixes: ec6017d90359 ("SUNRPC fix regression in umount of a secure mount") Signed-off-by: Trond Myklebust commit d5711920ec6e578f51db95caa6f185f5090b865e Author: Trond Myklebust Date: Fri Aug 16 08:37:26 2019 -0400 Revert "NFSv4/flexfiles: Abort I/O early if the layout segment was invalidated" This reverts commit a79f194aa4879e9baad118c3f8bb2ca24dbef765. The mechanism for aborting I/O is racy, since we are not guaranteed that the request is asleep while we're changing both task->tk_status and task->tk_action. Signed-off-by: Trond Myklebust Cc: stable@vger.kernel.org # v5.1 commit 80f455da6cd0998a5be30a8af24ea2a22815c212 Author: Trond Myklebust Date: Thu Aug 15 22:55:19 2019 -0400 SUNRPC: Handle EADDRINUSE and ENOBUFS correctly If a connect or bind attempt returns EADDRINUSE, that means we want to retry with a different port. It is not a fatal connection error. Similarly, ENOBUFS is not fatal, but just indicates a memory allocation issue. Retry after a short delay. Signed-off-by: Trond Myklebust commit bf2bf9b80e0cd3568ddc85a241abe0dd8b46ebdc Author: Trond Myklebust Date: Thu Aug 15 20:18:48 2019 -0400 pNFS/flexfiles: Turn off soft RPC calls The pNFS/flexfiles I/O requests are sent with the SOFTCONN flag set, so they automatically time out if the connection breaks. It should therefore not be necessary to have the soft flag set in addition. Fixes: 5f01d9539496 ("nfs41: create NFSv3 DS connection if specified") Signed-off-by: Trond Myklebust commit bd736ed3e2d1088d9b4050f727342e1e619c3841 Author: Trond Myklebust Date: Thu Aug 15 17:26:17 2019 -0400 SUNRPC: Don't handle errors if the bind/connect succeeded Don't handle errors in call_bind_status()/call_connect_status() if it turns out that a previous call caused it to succeed. Signed-off-by: Trond Myklebust Cc: stable@vger.kernel.org # v5.1+ commit 558682b5291937a70748d36fd9ba757fb25b99ae Author: Bandan Das Date: Mon Aug 26 06:15:13 2019 -0400 x86/apic: Include the LDR when clearing out APIC registers Although APIC initialization will typically clear out the LDR before setting it, the APIC cleanup code should reset the LDR. This was discovered with a 32-bit KVM guest jumping into a kdump kernel. The stale bits in the LDR triggered a bug in the KVM APIC implementation which caused the destination mapping for VCPUs to be corrupted. Note that this isn't intended to paper over the KVM APIC bug. The kernel has to clear the LDR when resetting the APIC registers except when X2APIC is enabled. This lacks a Fixes tag because missing to clear LDR goes way back into pre git history. [ tglx: Made x2apic_enabled a function call as required ] Signed-off-by: Bandan Das Signed-off-by: Thomas Gleixner Cc: stable@vger.kernel.org Link: https://lkml.kernel.org/r/20190826101513.5080-3-bsd@redhat.com commit bae3a8d3308ee69a7dbdf145911b18dfda8ade0d Author: Bandan Das Date: Mon Aug 26 06:15:12 2019 -0400 x86/apic: Do not initialize LDR and DFR for bigsmp Legacy apic init uses bigsmp for smp systems with 8 and more CPUs. The bigsmp APIC implementation uses physical destination mode, but it nevertheless initializes LDR and DFR. The LDR even ends up incorrectly with multiple bit being set. This does not cause a functional problem because LDR and DFR are ignored when physical destination mode is active, but it triggered a problem on a 32-bit KVM guest which jumps into a kdump kernel. The multiple bits set unearthed a bug in the KVM APIC implementation. The code which creates the logical destination map for VCPUs ignores the disabled state of the APIC and ends up overwriting an existing valid entry and as a result, APIC calibration hangs in the guest during kdump initialization. Remove the bogus LDR/DFR initialization. This is not intended to work around the KVM APIC bug. The LDR/DFR ininitalization is wrong on its own. The issue goes back into the pre git history. The fixes tag is the commit in the bitkeeper import which introduced bigsmp support in 2003. git://git.kernel.org/pub/scm/linux/kernel/git/tglx/history.git Fixes: db7b9e9f26b8 ("[PATCH] Clustered APIC setup for >8 CPU systems") Suggested-by: Thomas Gleixner Signed-off-by: Bandan Das Signed-off-by: Thomas Gleixner Cc: stable@vger.kernel.org Link: https://lkml.kernel.org/r/20190826101513.5080-2-bsd@redhat.com commit 2f029413cbfbfe519d294c6ac83a0c00e2a48a97 Author: Nick Desaulniers Date: Mon Aug 12 14:50:35 2019 -0700 arc: prefer __section from compiler_attributes.h Reported-by: Sedat Dilek Suggested-by: Josh Poimboeuf Signed-off-by: Nick Desaulniers Signed-off-by: Vineet Gupta commit d85f6b93a76e74f1cbd0c14fb685cc1bc8df9044 Author: Mischa Jonker Date: Wed Jul 24 14:04:36 2019 +0200 dt-bindings: IDU-intc: Add support for edge-triggered interrupts This updates the documentation for supporting an optional extra interrupt cell to specify edge vs level triggered. Signed-off-by: Mischa Jonker Reviewed-by: Rob Herring Signed-off-by: Vineet Gupta commit 01449985e644329e1fd5c269fff07b9a539eeebf Author: Mischa Jonker Date: Wed Jul 24 14:04:35 2019 +0200 dt-bindings: IDU-intc: Clean up documentation * Some lines exceeded 80 characters. * Clarified statement about AUX register interface Signed-off-by: Mischa Jonker Reviewed-by: Rob Herring Signed-off-by: Vineet Gupta commit 174ae4e96e0f54958cbe3fd3090a3cefeb63af4d Author: Mischa Jonker Date: Wed Jul 24 14:04:34 2019 +0200 ARCv2: IDU-intc: Add support for edge-triggered interrupts This adds support for an optional extra interrupt cell to specify edge vs level triggered. It is backward compatible with dts files with only one cell, and will default to level-triggered in such a case. Note that I had to make a change to idu_irq_set_affinity as well, as this function was setting the interrupt type to "level" unconditionally, since this was the only type supported previously. Signed-off-by: Mischa Jonker Reviewed-by: Vineet Gupta Signed-off-by: Vineet Gupta commit 2fd2329393658514db074abd4f7dea8da1c20f81 Author: Takashi Sakamoto Date: Mon Aug 26 22:55:15 2019 +0900 ALSA: oxfw: fix to handle correct stream for PCM playback When userspace application calls ioctl(2) to configure hardware for PCM playback substream, ALSA OXFW driver handles incoming AMDTP stream. In this case, outgoing AMDTP stream should be handled. This commit fixes the bug for v5.3-rc kernel. Fixes: 4f380d007052 ("ALSA: oxfw: configure packet format in pcm.hw_params callback") Signed-off-by: Takashi Sakamoto Signed-off-by: Takashi Iwai commit 9212ec7d8357ea630031e89d0d399c761421c83b Author: Sebastian Mayr Date: Sun Jul 28 17:26:17 2019 +0200 uprobes/x86: Fix detection of 32-bit user mode 32-bit processes running on a 64-bit kernel are not always detected correctly, causing the process to crash when uretprobes are installed. The reason for the crash is that in_ia32_syscall() is used to determine the process's mode, which only works correctly when called from a syscall. In the case of uretprobes, however, the function is called from a exception and always returns 'false' on a 64-bit kernel. In consequence this leads to corruption of the process's return address. Fix this by using user_64bit_mode() instead of in_ia32_syscall(), which is correct in any situation. [ tglx: Add a comment and the following historical info ] This should have been detected by the rename which happened in commit abfb9498ee13 ("x86/entry: Rename is_{ia32,x32}_task() to in_{ia32,x32}_syscall()") which states in the changelog: The is_ia32_task()/is_x32_task() function names are a big misnomer: they suggests that the compat-ness of a system call is a task property, which is not true, the compatness of a system call purely depends on how it was invoked through the system call layer. ..... and then it went and blindly renamed every call site. Sadly enough this was already mentioned here: 8faaed1b9f50 ("uprobes/x86: Introduce sizeof_long(), cleanup adjust_ret_addr() and arch_uretprobe_hijack_return_addr()") where the changelog says: TODO: is_ia32_task() is not what we actually want, TS_COMPAT does not necessarily mean 32bit. Fortunately syscall-like insns can't be probed so it actually works, but it would be better to rename and use is_ia32_frame(). and goes all the way back to: 0326f5a94dde ("uprobes/core: Handle breakpoint and singlestep exceptions") Oh well. 7+ years until someone actually tried a uretprobe on a 32bit process on a 64bit kernel.... Fixes: 0326f5a94dde ("uprobes/core: Handle breakpoint and singlestep exceptions") Signed-off-by: Sebastian Mayr Signed-off-by: Thomas Gleixner Cc: Masami Hiramatsu Cc: Dmitry Safonov Cc: Oleg Nesterov Cc: Srikar Dronamraju Cc: stable@vger.kernel.org Link: https://lkml.kernel.org/r/20190728152617.7308-1-me@sam.st commit 3e5bedc2c258341702ddffbd7688c5e6eb01eafa Author: Thomas Gleixner Date: Wed Aug 21 15:16:31 2019 +0200 x86/apic: Fix arch_dynirq_lower_bound() bug for DT enabled machines Rahul Tanwar reported the following bug on DT systems: > 'ioapic_dynirq_base' contains the virtual IRQ base number. Presently, it is > updated to the end of hardware IRQ numbers but this is done only when IOAPIC > configuration type is IOAPIC_DOMAIN_LEGACY or IOAPIC_DOMAIN_STRICT. There is > a third type IOAPIC_DOMAIN_DYNAMIC which applies when IOAPIC configuration > comes from devicetree. > > See dtb_add_ioapic() in arch/x86/kernel/devicetree.c > > In case of IOAPIC_DOMAIN_DYNAMIC (DT/OF based system), 'ioapic_dynirq_base' > remains to zero initialized value. This means that for OF based systems, > virtual IRQ base will get set to zero. Such systems will very likely not even boot. For DT enabled machines ioapic_dynirq_base is irrelevant and not updated, so simply map the IRQ base 1:1 instead. Reported-by: Rahul Tanwar Tested-by: Rahul Tanwar Tested-by: Andy Shevchenko Signed-off-by: Thomas Gleixner Cc: Alexander Shishkin Cc: Linus Torvalds Cc: Peter Zijlstra Cc: alan@linux.intel.com Cc: bp@alien8.de Cc: cheol.yong.kim@intel.com Cc: qi-ming.wu@intel.com Cc: rahul.tanwar@intel.com Cc: rppt@linux.ibm.com Cc: tony.luck@intel.com Link: http://lkml.kernel.org/r/20190821081330.1187-1-rahul.tanwar@linux.intel.com Signed-off-by: Ingo Molnar commit f53a7ad189594a112167efaf17ea8d0242b5ac00 Author: Prashant Malani Date: Sat Aug 24 01:36:19 2019 -0700 r8152: Set memory to all 0xFFs on failed reg reads get_registers() blindly copies the memory written to by the usb_control_msg() call even if the underlying urb failed. This could lead to junk register values being read by the driver, since some indirect callers of get_registers() ignore the return values. One example is: ocp_read_dword() ignores the return value of generic_ocp_read(), which calls get_registers(). So, emulate PCI "Master Abort" behavior by setting the buffer to all 0xFFs when usb_control_msg() fails. This patch is copied from the r8152 driver (v2.12.0) published by Realtek (www.realtek.com). Signed-off-by: Prashant Malani Acked-by: Hayes Wang Signed-off-by: David S. Miller commit 7177895154e6a35179d332f4a584d396c50d0612 Author: Yi-Hung Wei Date: Thu Aug 22 13:17:50 2019 -0700 openvswitch: Fix conntrack cache with timeout This patch addresses a conntrack cache issue with timeout policy. Currently, we do not check if the timeout extension is set properly in the cached conntrack entry. Thus, after packet recirculate from conntrack action, the timeout policy is not applied properly. This patch fixes the aforementioned issue. Fixes: 06bd2bdf19d2 ("openvswitch: Add timeout support to ct action") Reported-by: kbuild test robot Signed-off-by: Yi-Hung Wei Acked-by: Pravin B Shelar Signed-off-by: David S. Miller commit 803f3e22ae10003a83c781498c0ac34cfe3463ff Author: Alexey Kodanev Date: Fri Aug 23 20:51:43 2019 +0300 ipv4: mpls: fix mpls_xmit for iptunnel When using mpls over gre/gre6 setup, rt->rt_gw4 address is not set, the same for rt->rt_gw_family. Therefore, when rt->rt_gw_family is checked in mpls_xmit(), neigh_xmit() call is skipped. As a result, such setup doesn't work anymore. This issue was found with LTP mpls03 tests. Fixes: 1550c171935d ("ipv4: Prepare rtable for IPv6 gateway") Signed-off-by: Alexey Kodanev Reviewed-by: David Ahern Signed-off-by: David S. Miller commit 9b5f684182403f2b338f797c44eca0061c797dc8 Author: David Ahern Date: Sun Aug 25 07:47:30 2019 -0700 nexthop: Fix nexthop_num_path for blackhole nexthops Donald reported this sequence: ip next add id 1 blackhole ip next add id 2 blackhole ip ro add 1.1.1.1/32 nhid 1 ip ro add 1.1.1.2/32 nhid 2 would cause a crash. Backtrace is: [ 151.302790] general protection fault: 0000 [#1] SMP DEBUG_PAGEALLOC KASAN PTI [ 151.304043] CPU: 1 PID: 277 Comm: ip Not tainted 5.3.0-rc5+ #37 [ 151.305078] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.11.1-1 04/01/2014 [ 151.306526] RIP: 0010:fib_add_nexthop+0x8b/0x2aa [ 151.307343] Code: 35 f7 81 48 8d 14 01 c7 02 f1 f1 f1 f1 c7 42 04 01 f4 f4 f4 48 89 f2 48 c1 ea 03 65 48 8b 0c 25 28 00 00 00 48 89 4d d0 31 c9 <80> 3c 02 00 74 08 48 89 f7 e8 1a e8 53 ff be 08 00 00 00 4c 89 e7 [ 151.310549] RSP: 0018:ffff888116c27340 EFLAGS: 00010246 [ 151.311469] RAX: dffffc0000000000 RBX: ffff8881154ece00 RCX: 0000000000000000 [ 151.312713] RDX: 0000000000000004 RSI: 0000000000000020 RDI: ffff888115649b40 [ 151.313968] RBP: ffff888116c273d8 R08: ffffed10221e3757 R09: ffff888110f1bab8 [ 151.315212] R10: 0000000000000001 R11: ffff888110f1bab3 R12: ffff888115649b40 [ 151.316456] R13: 0000000000000020 R14: ffff888116c273b0 R15: ffff888115649b40 [ 151.317707] FS: 00007f60b4d8d800(0000) GS:ffff88811ac00000(0000) knlGS:0000000000000000 [ 151.319113] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 151.320119] CR2: 0000555671ffdc00 CR3: 00000001136ba005 CR4: 0000000000020ee0 [ 151.321367] Call Trace: [ 151.321820] ? fib_nexthop_info+0x635/0x635 [ 151.322572] fib_dump_info+0xaa4/0xde0 [ 151.323247] ? fib_create_info+0x2431/0x2431 [ 151.324008] ? napi_alloc_frag+0x2a/0x2a [ 151.324711] rtmsg_fib+0x2c4/0x3be [ 151.325339] fib_table_insert+0xe2f/0xeee ... fib_dump_info incorrectly has nhs = 0 for blackhole nexthops, so it believes the nexthop object is a multipath group (nhs != 1) and ends up down the nexthop_mpath_fill_node() path which is wrong for a blackhole. The blackhole check in nexthop_num_path is leftover from early days of the blackhole implementation which did not initialize the device. In the end the design was simpler (fewer special case checks) to set the device to loopback in nh_info, so the check in nexthop_num_path should have been removed. Fixes: 430a049190de ("nexthop: Add support for nexthop groups") Reported-by: Donald Sharp Signed-off-by: David Ahern Signed-off-by: David S. Miller commit a55aa89aab90fae7c815b0551b07be37db359d76 Author: Linus Torvalds Date: Sun Aug 25 12:01:23 2019 -0700 Linux 5.3-rc6 commit c749088f254303c57cb3eaed2b29beaae145cef3 Merge: 32ae83ffec63 a180d023ec7b Author: Linus Torvalds Date: Sun Aug 25 11:43:17 2019 -0700 Merge tag 'auxdisplay-for-linus-v5.3-rc7' of git://github.com/ojeda/linux Pull auxdisplay cleanup from Miguel Ojeda: "Make ht16k33_fb_fix and ht16k33_fb_var constant (Nishka Dasgupta)" * tag 'auxdisplay-for-linus-v5.3-rc7' of git://github.com/ojeda/linux: auxdisplay: ht16k33: Make ht16k33_fb_fix and ht16k33_fb_var constant commit 32ae83ffec6373c226d177bdbbbb156962cc638e Merge: 94a76d9b525c e0917f879536 Author: Linus Torvalds Date: Sun Aug 25 11:40:24 2019 -0700 Merge tag 'for-linus-5.3-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/rw/uml Pull UML fix from Richard Weinberger: "Fix time travel mode" * tag 'for-linus-5.3-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/rw/uml: um: fix time travel mode commit 94a76d9b525c2dd81af2a98e26fe01f99b20727d Merge: 146c3d3220e0 0af83abbd4a6 Author: Linus Torvalds Date: Sun Aug 25 11:29:27 2019 -0700 Merge tag 'for-linus-5.3-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/rw/ubifs Pull UBIFS and JFFS2 fixes from Richard Weinberger: "UBIFS: - Don't block too long in writeback_inodes_sb() - Fix for a possible overrun of the log head - Fix double unlock in orphan_delete() JFFS2: - Remove C++ style from UAPI header and unbreak picky toolchains" * tag 'for-linus-5.3-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/rw/ubifs: ubifs: Limit the number of pages in shrink_liability ubifs: Correctly initialize c->min_log_bytes ubifs: Fix double unlock around orphan_delete() jffs2: Remove C++ style comments from uapi header commit 146c3d3220e039b5d61bf810e0b42218eb020f39 Merge: 5a13fc3d8ba0 b63f20a778c8 Author: Linus Torvalds Date: Sun Aug 25 10:10:15 2019 -0700 Merge branch 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 fixes from Thomas Gleixner: "A few fixes for x86: - Fix a boot regression caused by the recent bootparam sanitizing change, which escaped the attention of all people who reviewed that code. - Address a boot problem on machines with broken E820 tables caused by an underflow which ended up placing the trampoline start at physical address 0. - Handle machines which do not advertise a legacy timer of any form, but need calibration of the local APIC timer gracefully by making the calibration routine independent from the tick interrupt. Marked for stable as well as there seems to be quite some new laptops rolled out which expose this. - Clear the RDRAND CPUID bit on AMD family 15h and 16h CPUs which are affected by broken firmware which does not initialize RDRAND correctly after resume. Add a command line parameter to override this for machine which either do not use suspend/resume or have a fixed BIOS. Unfortunately there is no way to detect this on boot, so the only safe decision is to turn it off by default. - Prevent RFLAGS from being clobbers in CALL_NOSPEC on 32bit which caused fast KVM instruction emulation to break. - Explain the Intel CPU model naming convention so that the repeating discussions come to an end" * 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/retpoline: Don't clobber RFLAGS during CALL_NOSPEC on i386 x86/boot: Fix boot regression caused by bootparam sanitizing x86/CPU/AMD: Clear RDRAND CPUID bit on AMD family 15h/16h x86/boot/compressed/64: Fix boot on machines with broken E820 table x86/apic: Handle missing global clockevent gracefully x86/cpu: Explain Intel model naming convention commit 5a13fc3d8ba00b786056e6fd3612b5102590992f Merge: 8a04c2ee62a4 b99328a60a48 Author: Linus Torvalds Date: Sun Aug 25 10:08:01 2019 -0700 Merge branch 'timers-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull timekeeping fix from Thomas Gleixner: "A single fix for a regression caused by the generic VDSO implementation where a math overflow causes CLOCK_BOOTTIME to become a random number generator" * 'timers-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: timekeeping/vsyscall: Prevent math overflow in BOOTTIME update commit 8a04c2ee62a4020cf1b7818c300626819d62ff5e Merge: 05bbb9360a00 b0fdc01354f4 Author: Linus Torvalds Date: Sun Aug 25 10:06:12 2019 -0700 Merge branch 'sched-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull scheduler fix from Thomas Gleixner: "Handle the worker management in situations where a task is scheduled out on a PI lock contention correctly and schedule a new worker if possible" * 'sched-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: sched/core: Schedule new worker even if PI-blocked commit 05bbb9360a000f509537a84554d69fb891fa7332 Merge: 44c471e43698 f1c6ece23729 Author: Linus Torvalds Date: Sun Aug 25 10:03:32 2019 -0700 Merge branch 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull perf fixes from Thomas Gleixner: "Two small fixes for kprobes and perf: - Prevent a deadlock in kprobe_optimizer() causes by reverse lock ordering - Fix a comment typo" * 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: kprobes: Fix potential deadlock in kprobe_optimizer() perf/x86: Fix typo in comment commit 44c471e43698d966d2bf291a9631f7d22a861bbd Merge: f47edb59bb48 d0ff14fdc987 Author: Linus Torvalds Date: Sun Aug 25 10:00:21 2019 -0700 Merge branch 'irq-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull irq fix from Thomas Gleixner: "A single fix for a imbalanced kobject operation in the irq decriptor code which was unearthed by the new warnings in the kobject code" * 'irq-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: genirq: Properly pair kobject_del() with kobject_add() commit f47edb59bb4897a5d495139bb12e93cd3f0cbded Merge: e67095fd2f72 00fb24a42a68 Author: Linus Torvalds Date: Sun Aug 25 09:56:27 2019 -0700 Merge branch 'akpm' (patches from Andrew) Mergr misc fixes from Andrew Morton: "11 fixes" Mostly VM fixes, one psi polling fix, and one parisc build fix. * emailed patches from Andrew Morton : mm/kasan: fix false positive invalid-free reports with CONFIG_KASAN_SW_TAGS=y mm/zsmalloc.c: fix race condition in zs_destroy_pool mm/zsmalloc.c: migration can leave pages in ZS_EMPTY indefinitely mm, page_owner: handle THP splits correctly userfaultfd_release: always remove uffd flags and clear vm_userfaultfd_ctx psi: get poll_work to run when calling poll syscall next time mm: memcontrol: flush percpu vmevents before releasing memcg mm: memcontrol: flush percpu vmstats before releasing memcg parisc: fix compilation errrors mm, page_alloc: move_freepages should not examine struct page of reserved memory mm/z3fold.c: fix race between migration and destruction commit 75545304eba6a3d282f923b96a466dc25a81e359 Author: Takashi Iwai Date: Sun Aug 25 09:21:44 2019 +0200 ALSA: seq: Fix potential concurrent access to the deleted pool The input pool of a client might be deleted via the resize ioctl, the the access to it should be covered by the proper locks. Currently the only missing place is the call in snd_seq_ioctl_get_client_pool(), and this patch papers over it. Reported-by: syzbot+4a75454b9ca2777f35c7@syzkaller.appspotmail.com Cc: Signed-off-by: Takashi Iwai commit e67095fd2f727c35e510d831c588696f2138a1bb Merge: 083f0f2cd402 90ae409f9eb3 Author: Linus Torvalds Date: Sat Aug 24 20:00:11 2019 -0700 Merge tag 'dma-mapping-5.3-5' of git://git.infradead.org/users/hch/dma-mapping Pull dma-mapping fixes from Christoph Hellwig: "Two fixes for regressions in this merge window: - select the Kconfig symbols for the noncoherent dma arch helpers on arm if swiotlb is selected, not just for LPAE to not break then Xen build, that uses swiotlb indirectly through swiotlb-xen - fix the page allocator fallback in dma_alloc_contiguous if the CMA allocation fails" * tag 'dma-mapping-5.3-5' of git://git.infradead.org/users/hch/dma-mapping: dma-direct: fix zone selection after an unaddressable CMA allocation arm: select the dma-noncoherent symbols for all swiotlb builds commit 00fb24a42a68b1ee0f6495993fe1be7124433dfb Author: Andrey Ryabinin Date: Sat Aug 24 17:55:09 2019 -0700 mm/kasan: fix false positive invalid-free reports with CONFIG_KASAN_SW_TAGS=y The code like this: ptr = kmalloc(size, GFP_KERNEL); page = virt_to_page(ptr); offset = offset_in_page(ptr); kfree(page_address(page) + offset); may produce false-positive invalid-free reports on the kernel with CONFIG_KASAN_SW_TAGS=y. In the example above we lose the original tag assigned to 'ptr', so kfree() gets the pointer with 0xFF tag. In kfree() we check that 0xFF tag is different from the tag in shadow hence print false report. Instead of just comparing tags, do the following: 1) Check that shadow doesn't contain KASAN_TAG_INVALID. Otherwise it's double-free and it doesn't matter what tag the pointer have. 2) If pointer tag is different from 0xFF, make sure that tag in the shadow is the same as in the pointer. Link: http://lkml.kernel.org/r/20190819172540.19581-1-aryabinin@virtuozzo.com Fixes: 7f94ffbc4c6a ("kasan: add hooks implementation for tag-based mode") Signed-off-by: Andrey Ryabinin Reported-by: Walter Wu Reported-by: Mark Rutland Reviewed-by: Andrey Konovalov Cc: Alexander Potapenko Cc: Dmitry Vyukov Cc: Catalin Marinas Cc: Will Deacon Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 701d678599d0c1623aaf4139c03eea260a75b027 Author: Henry Burns Date: Sat Aug 24 17:55:06 2019 -0700 mm/zsmalloc.c: fix race condition in zs_destroy_pool In zs_destroy_pool() we call flush_work(&pool->free_work). However, we have no guarantee that migration isn't happening in the background at that time. Since migration can't directly free pages, it relies on free_work being scheduled to free the pages. But there's nothing preventing an in-progress migrate from queuing the work *after* zs_unregister_migration() has called flush_work(). Which would mean pages still pointing at the inode when we free it. Since we know at destroy time all objects should be free, no new migrations can come in (since zs_page_isolate() fails for fully-free zspages). This means it is sufficient to track a "# isolated zspages" count by class, and have the destroy logic ensure all such pages have drained before proceeding. Keeping that state under the class spinlock keeps the logic straightforward. In this case a memory leak could lead to an eventual crash if compaction hits the leaked page. This crash would only occur if people are changing their zswap backend at runtime (which eventually starts destruction). Link: http://lkml.kernel.org/r/20190809181751.219326-2-henryburns@google.com Fixes: 48b4800a1c6a ("zsmalloc: page migration support") Signed-off-by: Henry Burns Reviewed-by: Sergey Senozhatsky Cc: Henry Burns Cc: Minchan Kim Cc: Shakeel Butt Cc: Jonathan Adams Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 1a87aa03597efa9641e92875b883c94c7f872ccb Author: Henry Burns Date: Sat Aug 24 17:55:03 2019 -0700 mm/zsmalloc.c: migration can leave pages in ZS_EMPTY indefinitely In zs_page_migrate() we call putback_zspage() after we have finished migrating all pages in this zspage. However, the return value is ignored. If a zs_free() races in between zs_page_isolate() and zs_page_migrate(), freeing the last object in the zspage, putback_zspage() will leave the page in ZS_EMPTY for potentially an unbounded amount of time. To fix this, we need to do the same thing as zs_page_putback() does: schedule free_work to occur. To avoid duplicated code, move the sequence to a new putback_zspage_deferred() function which both zs_page_migrate() and zs_page_putback() call. Link: http://lkml.kernel.org/r/20190809181751.219326-1-henryburns@google.com Fixes: 48b4800a1c6a ("zsmalloc: page migration support") Signed-off-by: Henry Burns Reviewed-by: Sergey Senozhatsky Cc: Henry Burns Cc: Minchan Kim Cc: Shakeel Butt Cc: Jonathan Adams Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit f7da677bc6e72033f0981b9d58b5c5d409fa641e Author: Vlastimil Babka Date: Sat Aug 24 17:54:59 2019 -0700 mm, page_owner: handle THP splits correctly THP splitting path is missing the split_page_owner() call that split_page() has. As a result, split THP pages are wrongly reported in the page_owner file as order-9 pages. Furthermore when the former head page is freed, the remaining former tail pages are not listed in the page_owner file at all. This patch fixes that by adding the split_page_owner() call into __split_huge_page(). Link: http://lkml.kernel.org/r/20190820131828.22684-2-vbabka@suse.cz Fixes: a9627bc5e34e ("mm/page_owner: introduce split_page_owner and replace manual handling") Reported-by: Kirill A. Shutemov Signed-off-by: Vlastimil Babka Cc: Michal Hocko Cc: Mel Gorman Cc: Matthew Wilcox Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 46d0b24c5ee10a15dfb25e20642f5a5ed59c5003 Author: Oleg Nesterov Date: Sat Aug 24 17:54:56 2019 -0700 userfaultfd_release: always remove uffd flags and clear vm_userfaultfd_ctx userfaultfd_release() should clear vm_flags/vm_userfaultfd_ctx even if mm->core_state != NULL. Otherwise a page fault can see userfaultfd_missing() == T and use an already freed userfaultfd_ctx. Link: http://lkml.kernel.org/r/20190820160237.GB4983@redhat.com Fixes: 04f5866e41fb ("coredump: fix race condition between mmget_not_zero()/get_task_mm() and core dumping") Signed-off-by: Oleg Nesterov Reported-by: Kefeng Wang Reviewed-by: Andrea Arcangeli Tested-by: Kefeng Wang Cc: Peter Xu Cc: Mike Rapoport Cc: Jann Horn Cc: Jason Gunthorpe Cc: Michal Hocko Cc: Tetsuo Handa Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 7b2b55da1db10a5525460633ae4b6fb0be060c41 Author: Jason Xing Date: Sat Aug 24 17:54:53 2019 -0700 psi: get poll_work to run when calling poll syscall next time Only when calling the poll syscall the first time can user receive POLLPRI correctly. After that, user always fails to acquire the event signal. Reproduce case: 1. Get the monitor code in Documentation/accounting/psi.txt 2. Run it, and wait for the event triggered. 3. Kill and restart the process. The question is why we can end up with poll_scheduled = 1 but the work not running (which would reset it to 0). And the answer is because the scheduling side sees group->poll_kworker under RCU protection and then schedules it, but here we cancel the work and destroy the worker. The cancel needs to pair with resetting the poll_scheduled flag. Link: http://lkml.kernel.org/r/1566357985-97781-1-git-send-email-joseph.qi@linux.alibaba.com Signed-off-by: Jason Xing Signed-off-by: Joseph Qi Reviewed-by: Caspar Zhang Reviewed-by: Suren Baghdasaryan Acked-by: Johannes Weiner Cc: Ingo Molnar Cc: Peter Zijlstra Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit bb65f89b7d3d305c14951f49860711fbcae70692 Author: Roman Gushchin Date: Sat Aug 24 17:54:50 2019 -0700 mm: memcontrol: flush percpu vmevents before releasing memcg Similar to vmstats, percpu caching of local vmevents leads to an accumulation of errors on non-leaf levels. This happens because some leftovers may remain in percpu caches, so that they are never propagated up by the cgroup tree and just disappear into nonexistence with on releasing of the memory cgroup. To fix this issue let's accumulate and propagate percpu vmevents values before releasing the memory cgroup similar to what we're doing with vmstats. Since on cpu hotplug we do flush percpu vmstats anyway, we can iterate only over online cpus. Link: http://lkml.kernel.org/r/20190819202338.363363-4-guro@fb.com Fixes: 42a300353577 ("mm: memcontrol: fix recursive statistics correctness & scalabilty") Signed-off-by: Roman Gushchin Acked-by: Michal Hocko Cc: Johannes Weiner Cc: Vladimir Davydov Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit c350a99ea2b1b666c28948d74ab46c16913c28a7 Author: Roman Gushchin Date: Sat Aug 24 17:54:47 2019 -0700 mm: memcontrol: flush percpu vmstats before releasing memcg Percpu caching of local vmstats with the conditional propagation by the cgroup tree leads to an accumulation of errors on non-leaf levels. Let's imagine two nested memory cgroups A and A/B. Say, a process belonging to A/B allocates 100 pagecache pages on the CPU 0. The percpu cache will spill 3 times, so that 32*3=96 pages will be accounted to A/B and A atomic vmstat counters, 4 pages will remain in the percpu cache. Imagine A/B is nearby memory.max, so that every following allocation triggers a direct reclaim on the local CPU. Say, each such attempt will free 16 pages on a new cpu. That means every percpu cache will have -16 pages, except the first one, which will have 4 - 16 = -12. A/B and A atomic counters will not be touched at all. Now a user removes A/B. All percpu caches are freed and corresponding vmstat numbers are forgotten. A has 96 pages more than expected. As memory cgroups are created and destroyed, errors do accumulate. Even 1-2 pages differences can accumulate into large numbers. To fix this issue let's accumulate and propagate percpu vmstat values before releasing the memory cgroup. At this point these numbers are stable and cannot be changed. Since on cpu hotplug we do flush percpu vmstats anyway, we can iterate only over online cpus. Link: http://lkml.kernel.org/r/20190819202338.363363-2-guro@fb.com Fixes: 42a300353577 ("mm: memcontrol: fix recursive statistics correctness & scalabilty") Signed-off-by: Roman Gushchin Acked-by: Michal Hocko Cc: Johannes Weiner Cc: Vladimir Davydov Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit bbcb03a97ffe49169f02d34eff2ced56ddaafb4f Author: Qian Cai Date: Sat Aug 24 17:54:43 2019 -0700 parisc: fix compilation errrors Commit 0cfaee2af3a0 ("include/asm-generic/5level-fixup.h: fix variable 'p4d' set but not used") converted a few functions from macros to static inline, which causes parisc to complain, In file included from include/asm-generic/4level-fixup.h:38:0, from arch/parisc/include/asm/pgtable.h:5, from arch/parisc/include/asm/io.h:6, from include/linux/io.h:13, from sound/core/memory.c:9: include/asm-generic/5level-fixup.h:14:18: error: unknown type name 'pgd_t'; did you mean 'pid_t'? #define p4d_t pgd_t ^ include/asm-generic/5level-fixup.h:24:28: note: in expansion of macro 'p4d_t' static inline int p4d_none(p4d_t p4d) ^~~~~ It is because "4level-fixup.h" is included before "asm/page.h" where "pgd_t" is defined. Link: http://lkml.kernel.org/r/20190815205305.1382-1-cai@lca.pw Fixes: 0cfaee2af3a0 ("include/asm-generic/5level-fixup.h: fix variable 'p4d' set but not used") Signed-off-by: Qian Cai Reported-by: Guenter Roeck Tested-by: Guenter Roeck Cc: Stephen Rothwell Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit cd961038381f392b364a7c4a040f4576ca415b1a Author: David Rientjes Date: Sat Aug 24 17:54:40 2019 -0700 mm, page_alloc: move_freepages should not examine struct page of reserved memory After commit 907ec5fca3dc ("mm: zero remaining unavailable struct pages"), struct page of reserved memory is zeroed. This causes page->flags to be 0 and fixes issues related to reading /proc/kpageflags, for example, of reserved memory. The VM_BUG_ON() in move_freepages_block(), however, assumes that page_zone() is meaningful even for reserved memory. That assumption is no longer true after the aforementioned commit. There's no reason why move_freepages_block() should be testing the legitimacy of page_zone() for reserved memory; its scope is limited only to pages on the zone's freelist. Note that pfn_valid() can be true for reserved memory: there is a backing struct page. The check for page_to_nid(page) is also buggy but reserved memory normally only appears on node 0 so the zeroing doesn't affect this. Move the debug checks to after verifying PageBuddy is true. This isolates the scope of the checks to only be for buddy pages which are on the zone's freelist which move_freepages_block() is operating on. In this case, an incorrect node or zone is a bug worthy of being warned about (and the examination of struct page is acceptable bcause this memory is not reserved). Why does move_freepages_block() gets called on reserved memory? It's simply math after finding a valid free page from the per-zone free area to use as fallback. We find the beginning and end of the pageblock of the valid page and that can bring us into memory that was reserved per the e820. pfn_valid() is still true (it's backed by a struct page), but since it's zero'd we shouldn't make any inferences here about comparing its node or zone. The current node check just happens to succeed most of the time by luck because reserved memory typically appears on node 0. The fix here is to validate that we actually have buddy pages before testing if there's any type of zone or node strangeness going on. We noticed it almost immediately after bringing 907ec5fca3dc in on CONFIG_DEBUG_VM builds. It depends on finding specific free pages in the per-zone free area where the math in move_freepages() will bring the start or end pfn into reserved memory and wanting to claim that entire pageblock as a new migratetype. So the path will be rare, require CONFIG_DEBUG_VM, and require fallback to a different migratetype. Some struct pages were already zeroed from reserve pages before 907ec5fca3c so it theoretically could trigger before this commit. I think it's rare enough under a config option that most people don't run that others may not have noticed. I wouldn't argue against a stable tag and the backport should be easy enough, but probably wouldn't single out a commit that this is fixing. Mel said: : The overhead of the debugging check is higher with this patch although : it'll only affect debug builds and the path is not particularly hot. : If this was a concern, I think it would be reasonable to simply remove : the debugging check as the zone boundaries are checked in : move_freepages_block and we never expect a zone/node to be smaller than : a pageblock and stuck in the middle of another zone. Link: http://lkml.kernel.org/r/alpine.DEB.2.21.1908122036560.10779@chino.kir.corp.google.com Signed-off-by: David Rientjes Acked-by: Mel Gorman Cc: Naoya Horiguchi Cc: Masayoshi Mizuma Cc: Oscar Salvador Cc: Pavel Tatashin Cc: Vlastimil Babka Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit d776aaa9895eb6eb770908e899cb7f5bd5025b3c Author: Henry Burns Date: Sat Aug 24 17:54:37 2019 -0700 mm/z3fold.c: fix race between migration and destruction In z3fold_destroy_pool() we call destroy_workqueue(&pool->compact_wq). However, we have no guarantee that migration isn't happening in the background at that time. Migration directly calls queue_work_on(pool->compact_wq), if destruction wins that race we are using a destroyed workqueue. Link: http://lkml.kernel.org/r/20190809213828.202833-1-henryburns@google.com Signed-off-by: Henry Burns Cc: Vitaly Wool Cc: Shakeel Butt Cc: Jonathan Adams Cc: Henry Burns Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit e0e6d062822529dbe9be21939359b0d1e065bb0f Author: Zhu Yanjun Date: Fri Aug 23 21:04:16 2019 -0400 net: rds: add service level support in rds-info >From IB specific 7.6.5 SERVICE LEVEL, Service Level (SL) is used to identify different flows within an IBA subnet. It is carried in the local route header of the packet. Before this commit, run "rds-info -I". The outputs are as below: " RDS IB Connections: LocalAddr RemoteAddr Tos SL LocalDev RemoteDev 192.2.95.3 192.2.95.1 2 0 fe80::21:28:1a:39 fe80::21:28:10:b9 192.2.95.3 192.2.95.1 1 0 fe80::21:28:1a:39 fe80::21:28:10:b9 192.2.95.3 192.2.95.1 0 0 fe80::21:28:1a:39 fe80::21:28:10:b9 " After this commit, the output is as below: " RDS IB Connections: LocalAddr RemoteAddr Tos SL LocalDev RemoteDev 192.2.95.3 192.2.95.1 2 2 fe80::21:28:1a:39 fe80::21:28:10:b9 192.2.95.3 192.2.95.1 1 1 fe80::21:28:1a:39 fe80::21:28:10:b9 192.2.95.3 192.2.95.1 0 0 fe80::21:28:1a:39 fe80::21:28:10:b9 " The commit fe3475af3bdf ("net: rds: add per rds connection cache statistics") adds cache_allocs in struct rds_info_rdma_connection as below: struct rds_info_rdma_connection { ... __u32 rdma_mr_max; __u32 rdma_mr_size; __u8 tos; __u32 cache_allocs; }; The peer struct in rds-tools of struct rds_info_rdma_connection is as below: struct rds_info_rdma_connection { ... uint32_t rdma_mr_max; uint32_t rdma_mr_size; uint8_t tos; uint8_t sl; uint32_t cache_allocs; }; The difference between userspace and kernel is the member variable sl. In the kernel struct, the member variable sl is missing. This will introduce risks. So it is necessary to use this commit to avoid this risk. Fixes: fe3475af3bdf ("net: rds: add per rds connection cache statistics") CC: Joe Jin CC: JUNXIAO_BI Suggested-by: Gerd Rausch Signed-off-by: Zhu Yanjun Acked-by: Santosh Shilimkar Signed-off-by: David S. Miller commit e93fb3e9521abffadb8f965c591a290cdd92b56c Author: John Fastabend Date: Fri Aug 23 17:11:38 2019 -0700 net: route dump netlink NLM_F_MULTI flag missing An excerpt from netlink(7) man page, In multipart messages (multiple nlmsghdr headers with associated payload in one byte stream) the first and all following headers have the NLM_F_MULTI flag set, except for the last header which has the type NLMSG_DONE. but, after (ee28906) there is a missing NLM_F_MULTI flag in the middle of a FIB dump. The result is user space applications following above man page excerpt may get confused and may stop parsing msg believing something went wrong. In the golang netlink lib [0] the library logic stops parsing believing the message is not a multipart message. Found this running Cilium[1] against net-next while adding a feature to auto-detect routes. I noticed with multiple route tables we no longer could detect the default routes on net tree kernels because the library logic was not returning them. Fix this by handling the fib_dump_info_fnhe() case the same way the fib_dump_info() handles it by passing the flags argument through the call chain and adding a flags argument to rt_fill_info(). Tested with Cilium stack and auto-detection of routes works again. Also annotated libs to dump netlink msgs and inspected NLM_F_MULTI and NLMSG_DONE flags look correct after this. Note: In inet_rtm_getroute() pass rt_fill_info() '0' for flags the same as is done for fib_dump_info() so this looks correct to me. [0] https://github.com/vishvananda/netlink/ [1] https://github.com/cilium/ Fixes: ee28906fd7a14 ("ipv4: Dump route exceptions if requested") Signed-off-by: John Fastabend Reviewed-by: Stefano Brivio Signed-off-by: David S. Miller commit 292a50e3fc2cf699587ea282e6253e0d6ae3cdc1 Author: Julian Wiedmann Date: Fri Aug 23 11:29:23 2019 +0200 s390/qeth: reject oversized SNMP requests Commit d4c08afafa04 ("s390/qeth: streamline SNMP cmd code") removed the bounds checking for req_len, under the assumption that the check in qeth_alloc_cmd() would suffice. But that code path isn't sufficiently robust to handle a user-provided data_length, which could overflow (when adding the cmd header overhead) before being checked against QETH_BUFSIZE. We end up allocating just a tiny iob, and the subsequent copy_from_user() writes past the end of that iob. Special-case this path and add a coarse bounds check, to protect against maliciuous requests. This let's the subsequent code flow do its normal job and precise checking, without risk of overflow. Fixes: d4c08afafa04 ("s390/qeth: streamline SNMP cmd code") Reported-by: Dan Carpenter Signed-off-by: Julian Wiedmann Reviewed-by: Ursula Braun Signed-off-by: David S. Miller commit b45ce32135d1c82a5bf12aa56957c3fd27956057 Author: zhanglin Date: Fri Aug 23 09:14:11 2019 +0800 sock: fix potential memory leak in proto_register() If protocols registered exceeded PROTO_INUSE_NR, prot will be added to proto_list, but no available bit left for prot in proto_inuse_idx. Changes since v2: * Propagate the error code properly Signed-off-by: zhanglin Signed-off-by: David S. Miller commit d37fb9758f76316a9dd9aaafffad726eb2bc020a Merge: 0c69b19f92df a195784c105b Author: David S. Miller Date: Sat Aug 24 16:27:09 2019 -0700 Merge tag 'mlx5-fixes-2019-08-22' of git://git.kernel.org/pub/scm/linux/kernel/git/saeed/linux Saeed Mahameed says: ==================== Mellanox, mlx5 fixes 2019-08-22 This series introduces some fixes to mlx5 driver. 1) Form Moshe, two fixes for firmware health reporter 2) From Eran, two ktls fixes. ==================== Signed-off-by: David S. Miller commit 0c69b19f92dfcc0962bbc09741677f658bc55452 Author: Andrew Lunn Date: Sun Aug 25 00:34:54 2019 +0200 MAINTAINERS: Add phylink keyword to SFF/SFP/SFP+ MODULE SUPPORT Russell king maintains phylink, as part of the SFP module support. However, much of the review work is about drivers swapping from phylib to phylink. Such changes don't make changes to the phylink core, and so the F: rules in MAINTAINERS don't match. Add a K:, keywork rule, which hopefully get_maintainers will match against for patches to MAC drivers swapping to phylink. Signed-off-by: Andrew Lunn Signed-off-by: David S. Miller commit 9b45ff9106740d7f6a1cba31d53c4045d0724792 Merge: 12c6bc38f99b c3b4c3a47e05 Author: David S. Miller Date: Sat Aug 24 14:49:36 2019 -0700 Merge branch 'collect_md-mode-dev-null' Hangbin Liu says: ==================== fix dev null pointer dereference when send packets larger than mtu in collect_md mode When we send a packet larger than PMTU, we need to reply with icmp_send(ICMP_FRAG_NEEDED) or icmpv6_send(ICMPV6_PKT_TOOBIG). But with collect_md mode, kernel will crash while accessing the dst dev as __metadata_dst_init() init dst->dev to NULL by default. Here is what the code path looks like, for GRE: - ip6gre_tunnel_xmit - ip6gre_xmit_ipv4 - __gre6_xmit - ip6_tnl_xmit - if skb->len - t->tun_hlen - eth_hlen > mtu; return -EMSGSIZE - icmp_send - net = dev_net(rt->dst.dev); <-- here - ip6gre_xmit_ipv6 - __gre6_xmit - ip6_tnl_xmit - if skb->len - t->tun_hlen - eth_hlen > mtu; return -EMSGSIZE - icmpv6_send ... - decode_session4 - oif = skb_dst(skb)->dev->ifindex; <-- here - decode_session6 - oif = skb_dst(skb)->dev->ifindex; <-- here We could not fix it in __metadata_dst_init() as there is no dev supplied. Look in to the __icmp_send()/decode_session{4,6} code we could find the dst dev is actually not needed. In __icmp_send(), we could get the net by skb->dev. For decode_session{4,6}, as it was called by xfrm_decode_session_reverse() in this scenario, the oif is not used by fl4->flowi4_oif = reverse ? skb->skb_iif : oif; The reproducer is easy: ovs-vsctl add-br br0 ip link set br0 up ovs-vsctl add-port br0 gre0 -- set interface gre0 type=gre options:remote_ip=$dst_addr ip link set gre0 up ip addr add ${local_gre6}/64 dev br0 ping6 $remote_gre6 -s 1500 The kernel will crash like [40595.821651] BUG: kernel NULL pointer dereference, address: 0000000000000108 [40595.822411] #PF: supervisor read access in kernel mode [40595.822949] #PF: error_code(0x0000) - not-present page [40595.823492] PGD 0 P4D 0 [40595.823767] Oops: 0000 [#1] SMP PTI [40595.824139] CPU: 0 PID: 2831 Comm: handler12 Not tainted 5.2.0 #57 [40595.824788] Hardware name: Red Hat KVM, BIOS 1.11.1-3.module+el8.1.0+2983+b2ae9c0a 04/01/2014 [40595.825680] RIP: 0010:__xfrm_decode_session+0x6b/0x930 [40595.826219] Code: b7 c0 00 00 00 b8 06 00 00 00 66 85 d2 0f b7 ca 48 0f 45 c1 44 0f b6 2c 06 48 8b 47 58 48 83 e0 fe 0f 84 f4 04 00 00 48 8b 00 <44> 8b 80 08 01 00 00 41 f6 c4 01 4c 89 e7 ba 58 00 00 00 0f 85 47 [40595.828155] RSP: 0018:ffffc90000a73438 EFLAGS: 00010286 [40595.828705] RAX: 0000000000000000 RBX: ffff8881329d7100 RCX: 0000000000000000 [40595.829450] RDX: 0000000000000000 RSI: ffff8881339e70ce RDI: ffff8881329d7100 [40595.830191] RBP: ffffc90000a73470 R08: 0000000000000000 R09: 000000000000000a [40595.830936] R10: 0000000000000000 R11: 0000000000000000 R12: ffffc90000a73490 [40595.831682] R13: 000000000000002c R14: ffff888132ff1301 R15: ffff8881329d7100 [40595.832427] FS: 00007f5bfcfd6700(0000) GS:ffff88813ba00000(0000) knlGS:0000000000000000 [40595.833266] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [40595.833883] CR2: 0000000000000108 CR3: 000000013a368000 CR4: 00000000000006f0 [40595.834633] Call Trace: [40595.835392] ? rt6_multipath_hash+0x4c/0x390 [40595.835853] icmpv6_route_lookup+0xcb/0x1d0 [40595.836296] ? icmpv6_xrlim_allow+0x3e/0x140 [40595.836751] icmp6_send+0x537/0x840 [40595.837125] icmpv6_send+0x20/0x30 [40595.837494] tnl_update_pmtu.isra.27+0x19d/0x2a0 [ip_tunnel] [40595.838088] ip_md_tunnel_xmit+0x1b6/0x510 [ip_tunnel] [40595.838633] gre_tap_xmit+0x10c/0x160 [ip_gre] [40595.839103] dev_hard_start_xmit+0x93/0x200 [40595.839551] sch_direct_xmit+0x101/0x2d0 [40595.839967] __dev_queue_xmit+0x69f/0x9c0 [40595.840399] do_execute_actions+0x1717/0x1910 [openvswitch] [40595.840987] ? validate_set.isra.12+0x2f5/0x3d0 [openvswitch] [40595.841596] ? reserve_sfa_size+0x31/0x130 [openvswitch] [40595.842154] ? __ovs_nla_copy_actions+0x1b4/0xad0 [openvswitch] [40595.842778] ? __kmalloc_reserve.isra.50+0x2e/0x80 [40595.843285] ? should_failslab+0xa/0x20 [40595.843696] ? __kmalloc+0x188/0x220 [40595.844078] ? __alloc_skb+0x97/0x270 [40595.844472] ovs_execute_actions+0x47/0x120 [openvswitch] [40595.845041] ovs_packet_cmd_execute+0x27d/0x2b0 [openvswitch] [40595.845648] genl_family_rcv_msg+0x3a8/0x430 [40595.846101] genl_rcv_msg+0x47/0x90 [40595.846476] ? __alloc_skb+0x83/0x270 [40595.846866] ? genl_family_rcv_msg+0x430/0x430 [40595.847335] netlink_rcv_skb+0xcb/0x100 [40595.847777] genl_rcv+0x24/0x40 [40595.848113] netlink_unicast+0x17f/0x230 [40595.848535] netlink_sendmsg+0x2ed/0x3e0 [40595.848951] sock_sendmsg+0x4f/0x60 [40595.849323] ___sys_sendmsg+0x2bd/0x2e0 [40595.849733] ? sock_poll+0x6f/0xb0 [40595.850098] ? ep_scan_ready_list.isra.14+0x20b/0x240 [40595.850634] ? _cond_resched+0x15/0x30 [40595.851032] ? ep_poll+0x11b/0x440 [40595.851401] ? _copy_to_user+0x22/0x30 [40595.851799] __sys_sendmsg+0x58/0xa0 [40595.852180] do_syscall_64+0x5b/0x190 [40595.852574] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [40595.853105] RIP: 0033:0x7f5c00038c7d [40595.853489] Code: c7 20 00 00 75 10 b8 2e 00 00 00 0f 05 48 3d 01 f0 ff ff 73 31 c3 48 83 ec 08 e8 8e f7 ff ff 48 89 04 24 b8 2e 00 00 00 0f 05 <48> 8b 3c 24 48 89 c2 e8 d7 f7 ff ff 48 89 d0 48 83 c4 08 48 3d 01 [40595.855443] RSP: 002b:00007f5bfcf73c00 EFLAGS: 00003293 ORIG_RAX: 000000000000002e [40595.856244] RAX: ffffffffffffffda RBX: 00007f5bfcf74a60 RCX: 00007f5c00038c7d [40595.856990] RDX: 0000000000000000 RSI: 00007f5bfcf73c60 RDI: 0000000000000015 [40595.857736] RBP: 0000000000000004 R08: 0000000000000b7c R09: 0000000000000110 [40595.858613] R10: 0001000800050004 R11: 0000000000003293 R12: 000055c2d8329da0 [40595.859401] R13: 00007f5bfcf74120 R14: 0000000000000347 R15: 00007f5bfcf73c60 [40595.860185] Modules linked in: ip_gre ip_tunnel gre openvswitch nsh nf_conncount nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 sunrpc bochs_drm ttm drm_kms_helper drm pcspkr joydev i2c_piix4 qemu_fw_cfg xfs libcrc32c virtio_net net_failover serio_raw failover ata_generic virtio_blk pata_acpi floppy [40595.863155] CR2: 0000000000000108 [40595.863551] ---[ end trace 22209bbcacb4addd ]--- v4: Julian Anastasov remind skb->dev also could be NULL in icmp_send. We'd better still use dst.dev and do a check to avoid crash. v3: only replace pkg to packets in cover letter. So I didn't update the version info in the follow up patches. v2: fix it in __icmp_send() and decode_session{4,6} separately instead of updating shared dst dev in {ip_md, ip6}_tunnel_xmit. ==================== Signed-off-by: David S. Miller commit c3b4c3a47e05d5fecf7354d75824a9d1b37f3e84 Author: Hangbin Liu Date: Thu Aug 22 22:19:49 2019 +0800 xfrm/xfrm_policy: fix dst dev null pointer dereference in collect_md mode In decode_session{4,6} there is a possibility that the skb dst dev is NULL, e,g, with tunnel collect_md mode, which will cause kernel crash. Here is what the code path looks like, for GRE: - ip6gre_tunnel_xmit - ip6gre_xmit_ipv6 - __gre6_xmit - ip6_tnl_xmit - if skb->len - t->tun_hlen - eth_hlen > mtu; return -EMSGSIZE - icmpv6_send - icmpv6_route_lookup - xfrm_decode_session_reverse - decode_session4 - oif = skb_dst(skb)->dev->ifindex; <-- here - decode_session6 - oif = skb_dst(skb)->dev->ifindex; <-- here The reason is __metadata_dst_init() init dst->dev to NULL by default. We could not fix it in __metadata_dst_init() as there is no dev supplied. On the other hand, the skb_dst(skb)->dev is actually not needed as we called decode_session{4,6} via xfrm_decode_session_reverse(), so oif is not used by: fl4->flowi4_oif = reverse ? skb->skb_iif : oif; So make a dst dev check here should be clean and safe. v4: No changes. v3: No changes. v2: fix the issue in decode_session{4,6} instead of updating shared dst dev in {ip_md, ip6}_tunnel_xmit. Fixes: 8d79266bc48c ("ip6_tunnel: add collect_md mode to IPv6 tunnels") Signed-off-by: Hangbin Liu Tested-by: Jonathan Lemon Signed-off-by: David S. Miller commit e2c693934194fd3b4e795635934883354c06ebc9 Author: Hangbin Liu Date: Thu Aug 22 22:19:48 2019 +0800 ipv4/icmp: fix rt dst dev null pointer dereference In __icmp_send() there is a possibility that the rt->dst.dev is NULL, e,g, with tunnel collect_md mode, which will cause kernel crash. Here is what the code path looks like, for GRE: - ip6gre_tunnel_xmit - ip6gre_xmit_ipv4 - __gre6_xmit - ip6_tnl_xmit - if skb->len - t->tun_hlen - eth_hlen > mtu; return -EMSGSIZE - icmp_send - net = dev_net(rt->dst.dev); <-- here The reason is __metadata_dst_init() init dst->dev to NULL by default. We could not fix it in __metadata_dst_init() as there is no dev supplied. On the other hand, the reason we need rt->dst.dev is to get the net. So we can just try get it from skb->dev when rt->dst.dev is NULL. v4: Julian Anastasov remind skb->dev also could be NULL. We'd better still use dst.dev and do a check to avoid crash. v3: No changes. v2: fix the issue in __icmp_send() instead of updating shared dst dev in {ip_md, ip6}_tunnel_xmit. Fixes: c8b34e680a09 ("ip_tunnel: Add tnl_update_pmtu in ip_md_tunnel_xmit") Signed-off-by: Hangbin Liu Reviewed-by: Julian Anastasov Acked-by: Jonathan Lemon Signed-off-by: David S. Miller commit 083f0f2cd402df40f62e16b1e4208e6033f52aba Merge: 361469211f87 48057ed1840f Author: Linus Torvalds Date: Sat Aug 24 14:45:33 2019 -0700 Merge tag 'gpio-v5.3-4' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio Pull GPIO fixes from Linus Walleij: "Here is a (hopefully last) set of GPIO fixes for the v5.3 kernel cycle. Two are pretty core: - Fix not reporting open drain/source lines to userspace as "input" - Fix a minor build error found in randconfigs - Fix a chip select quirk on the Freescale SPI - Fix the irqchip initialization semantic order to reflect what it was using the old API" * tag 'gpio-v5.3-4' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio: gpio: Fix irqchip initialization order gpio: of: fix Freescale SPI CS quirk handling gpio: Fix build error of function redefinition gpiolib: never report open-drain/source lines as 'input' to user-space commit 12c6bc38f99bb168b7f16bdb5e855a51a23ee9ec Author: Yi-Hung Wei Date: Wed Aug 21 17:16:10 2019 -0700 openvswitch: Fix log message in ovs conntrack Fixes: 06bd2bdf19d2 ("openvswitch: Add timeout support to ct action") Signed-off-by: Yi-Hung Wei Signed-off-by: David S. Miller commit 12e2e15d837fd7d621d92fc81e3727304a2a2201 Merge: 211c46245215 074014abdf2b Author: David S. Miller Date: Sat Aug 24 13:46:57 2019 -0700 Merge branch 'ieee802154-for-davem-2019-08-24' of git://git.kernel.org/pub/scm/linux/kernel/git/sschmidt/wpan Stefan Schmidt says: ==================== pull-request: ieee802154 for net 2019-08-24 An update from ieee802154 for your *net* tree. Yue Haibing fixed two bugs discovered by KASAN in the hwsim driver for ieee802154 and Colin Ian King cleaned up a redundant variable assignment. ==================== Signed-off-by: David S. Miller commit 361469211f876e67d7ca3d3d29e6d1c3e313d0f1 Merge: 0a022eccf7c4 a9fc4340aee0 Author: Linus Torvalds Date: Sat Aug 24 11:42:06 2019 -0700 Merge tag 'hyperv-fixes-signed' of git://git.kernel.org/pub/scm/linux/kernel/git/hyperv/linux Pull Hyper-V fixes from Sasha Levin: - Fix for panics and network failures on PAE guests by Dexuan Cui. - Fix of a memory leak (and related cleanups) in the hyper-v keyboard driver by Dexuan Cui. - Code cleanups for hyper-v clocksource driver during the merge window by Dexuan Cui. - Fix for a false positive warning in the userspace hyper-v KVP store by Vitaly Kuznetsov. * tag 'hyperv-fixes-signed' of git://git.kernel.org/pub/scm/linux/kernel/git/hyperv/linux: Drivers: hv: vmbus: Fix virt_to_hvpfn() for X86_PAE Tools: hv: kvp: eliminate 'may be used uninitialized' warning Input: hyperv-keyboard: Use in-place iterator API in the channel callback Drivers: hv: vmbus: Remove the unused "tsc_page" from struct hv_context commit 0a022eccf7c468efcb8aa5192b8d13e20127bbac Merge: 17d0fbf47eb1 087eeea9adcb Author: Linus Torvalds Date: Sat Aug 24 11:35:25 2019 -0700 Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux Pull arm64 fixes from Will Deacon: "Two KVM/arm fixes for MMIO emulation and UBSAN. Unusually, we're routing them via the arm64 tree as per Paolo's request on the list: https://lore.kernel.org/kvm/21ae69a2-2546-29d0-bff6-2ea825e3d968@redhat.com/ We don't actually have any other arm64 fixes pending at the moment (touch wood), so I've pulled from Marc, written a merge commit, tagged the result and run it through my build/boot/bisect scripts" * tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux: KVM: arm/arm64: VGIC: Properly initialise private IRQ affinity KVM: arm/arm64: Only skip MMIO insn once commit 17d0fbf47eb15ab7780cc77b28de070ec37e15c5 Merge: 8942230a7e1c 77ffd3465ba8 Author: Linus Torvalds Date: Sat Aug 24 11:26:51 2019 -0700 Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull SCSI fixes from James Bottomley: "Four fixes, three for edge conditions which don't occur very often. The lpfc fix mitigates memory exhaustion for some high CPU systems" * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: scsi: lpfc: Mitigate high memory pre-allocation by SCSI-MQ scsi: ufs: Fix NULL pointer dereference in ufshcd_config_vreg_hpm() scsi: target: tcmu: avoid use-after-free after command timeout scsi: qla2xxx: Fix gnl.l memory leak on adapter init failure commit 8942230a7e1c5277969adb0fbaad50dec9b4651b Merge: bc67b17eb91e 1fb254aa983b Author: Linus Torvalds Date: Sat Aug 24 11:21:26 2019 -0700 Merge tag 'xfs-5.3-fixes-6' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux Pull xfs fix from Darrick Wong: "A single patch that fixes a xfs lockup problem when a chown/chgrp operation fails due to running out of quota. It has survived the usual xfstests runs and merges cleanly with this morning's master: - Fix a forgotten inode unlock when chown/chgrp fail due to quota" * tag 'xfs-5.3-fixes-6' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux: xfs: fix missing ILOCK unlock when xfs_setattr_nonsize fails due to EDQUOT commit bc67b17eb91ea6a2b6d943bb64cde8d1438a11ec Merge: 9140d8bdd4c5 7837951a12fd Author: Linus Torvalds Date: Sat Aug 24 11:16:04 2019 -0700 Merge tag 'drm-fixes-2019-08-24' of git://anongit.freedesktop.org/drm/drm Pull more drm fixes from Dave Airlie: "Although the tree built for me fine on arm here, it appears either header cleanups in next or some kconfig combo it breaks, so this contains a fix to mediatek to include dma-mapping.h explicitly. There was also one nouveau fix that came in late that I was going to leave until next week, but since I was sending this I thought it may as well be in here: mediatek: - fix build in some cases nouveau: - fix hang with i2c and mst docks" * tag 'drm-fixes-2019-08-24' of git://anongit.freedesktop.org/drm/drm: drm/mediatek: include dma-mapping header drm/nouveau: Don't retry infinitely when receiving no data on i2c over AUX commit 087eeea9adcbaef55ae8d68335dcd3820c5b344b Merge: d1abaeb3be7b 2e16f3e926ed Author: Will Deacon Date: Sat Aug 24 12:45:20 2019 +0100 Merge tag 'kvmarm-fixes-for-5.3-3' of git://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm into kvm/fixes Pull KVM/arm fixes from Marc Zyngier as per Paulo's request at: https://lkml.kernel.org/r/21ae69a2-2546-29d0-bff6-2ea825e3d968@redhat.com "One (hopefully last) set of fixes for KVM/arm for 5.3: an embarassing MMIO emulation regression, and a UBSAN splat. Oh well... - Don't overskip instructions on MMIO emulation - Fix UBSAN splat when initializing PPI priorities" * tag 'kvmarm-fixes-for-5.3-3' of git://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm: KVM: arm/arm64: VGIC: Properly initialise private IRQ affinity KVM: arm/arm64: Only skip MMIO insn once commit 7837951a12fdaf88d2c51ff0757980c00072790c Author: Dave Airlie Date: Sat Aug 24 15:07:07 2019 +1000 drm/mediatek: include dma-mapping header Although it builds fine here in my arm cross compile, it seems either via some other patches in -next or some Kconfig combination, this fails to build for everyone. Include linux/dma-mapping.h should fix it. Signed-off-by: Dave Airlie commit 211c4624521527b19cb82ffd53fb34ae320059aa Merge: 345b93265b3a 2c238177bd7f Author: David S. Miller Date: Fri Aug 23 17:34:11 2019 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf Daniel Borkmann says: ==================== pull-request: bpf 2019-08-24 The following pull-request contains BPF updates for your *net* tree. The main changes are: 1) Fix verifier precision tracking with BPF-to-BPF calls, from Alexei. 2) Fix a use-after-free in prog symbol exposure, from Daniel. 3) Several s390x JIT fixes plus BE related fixes in BPF kselftests, from Ilya. 4) Fix memory leak by unpinning XDP umem pages in error path, from Ivan. 5) Fix a potential use-after-free on flow dissector detach, from Jakub. 6) Fix bpftool to close prog fd after showing metadata, from Quentin. 7) BPF kselftest config and TEST_PROGS_EXTENDED fixes, from Anders. ==================== Signed-off-by: David S. Miller commit 2c238177bd7f4b14bdf7447cc1cd9bb791f147e6 Author: Ilya Leoshkevich Date: Tue Aug 20 17:50:25 2019 +0200 bpf: allow narrow loads of some sk_reuseport_md fields with offset > 0 test_select_reuseport fails on s390 due to verifier rejecting test_select_reuseport_kern.o with the following message: ; data_check.eth_protocol = reuse_md->eth_protocol; 18: (69) r1 = *(u16 *)(r6 +22) invalid bpf_context access off=22 size=2 This is because on big-endian machines casts from __u32 to __u16 are generated by referencing the respective variable as __u16 with an offset of 2 (as opposed to 0 on little-endian machines). The verifier already has all the infrastructure in place to allow such accesses, it's just that they are not explicitly enabled for eth_protocol field. Enable them for eth_protocol field by using bpf_ctx_range instead of offsetof. Ditto for ip_protocol, bind_inany and len, since they already allow narrowing, and the same problem can arise when working with them. Fixes: 2dbb9b9e6df6 ("bpf: Introduce BPF_PROG_TYPE_SK_REUSEPORT") Signed-off-by: Ilya Leoshkevich Signed-off-by: Daniel Borkmann commit c751798aa224fadc5124b49eeb38fb468c0fa039 Author: Daniel Borkmann Date: Fri Aug 23 22:14:23 2019 +0200 bpf: fix use after free in prog symbol exposure syzkaller managed to trigger the warning in bpf_jit_free() which checks via bpf_prog_kallsyms_verify_off() for potentially unlinked JITed BPF progs in kallsyms, and subsequently trips over GPF when walking kallsyms entries: [...] 8021q: adding VLAN 0 to HW filter on device batadv0 8021q: adding VLAN 0 to HW filter on device batadv0 WARNING: CPU: 0 PID: 9869 at kernel/bpf/core.c:810 bpf_jit_free+0x1e8/0x2a0 Kernel panic - not syncing: panic_on_warn set ... CPU: 0 PID: 9869 Comm: kworker/0:7 Not tainted 5.0.0-rc8+ #1 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: events bpf_prog_free_deferred Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x113/0x167 lib/dump_stack.c:113 panic+0x212/0x40b kernel/panic.c:214 __warn.cold.8+0x1b/0x38 kernel/panic.c:571 report_bug+0x1a4/0x200 lib/bug.c:186 fixup_bug arch/x86/kernel/traps.c:178 [inline] do_error_trap+0x11b/0x200 arch/x86/kernel/traps.c:271 do_invalid_op+0x36/0x40 arch/x86/kernel/traps.c:290 invalid_op+0x14/0x20 arch/x86/entry/entry_64.S:973 RIP: 0010:bpf_jit_free+0x1e8/0x2a0 Code: 02 4c 89 e2 83 e2 07 38 d0 7f 08 84 c0 0f 85 86 00 00 00 48 ba 00 02 00 00 00 00 ad de 0f b6 43 02 49 39 d6 0f 84 5f fe ff ff <0f> 0b e9 58 fe ff ff 48 b8 00 00 00 00 00 fc ff df 4c 89 e2 48 c1 RSP: 0018:ffff888092f67cd8 EFLAGS: 00010202 RAX: 0000000000000007 RBX: ffffc90001947000 RCX: ffffffff816e9d88 RDX: dead000000000200 RSI: 0000000000000008 RDI: ffff88808769f7f0 RBP: ffff888092f67d00 R08: fffffbfff1394059 R09: fffffbfff1394058 R10: fffffbfff1394058 R11: ffffffff89ca02c7 R12: ffffc90001947002 R13: ffffc90001947020 R14: ffffffff881eca80 R15: ffff88808769f7e8 BUG: unable to handle kernel paging request at fffffbfff400d000 #PF error: [normal kernel read fault] PGD 21ffee067 P4D 21ffee067 PUD 21ffed067 PMD 9f942067 PTE 0 Oops: 0000 [#1] PREEMPT SMP KASAN CPU: 0 PID: 9869 Comm: kworker/0:7 Not tainted 5.0.0-rc8+ #1 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: events bpf_prog_free_deferred RIP: 0010:bpf_get_prog_addr_region kernel/bpf/core.c:495 [inline] RIP: 0010:bpf_tree_comp kernel/bpf/core.c:558 [inline] RIP: 0010:__lt_find include/linux/rbtree_latch.h:115 [inline] RIP: 0010:latch_tree_find include/linux/rbtree_latch.h:208 [inline] RIP: 0010:bpf_prog_kallsyms_find+0x107/0x2e0 kernel/bpf/core.c:632 Code: 00 f0 ff ff 44 38 c8 7f 08 84 c0 0f 85 fa 00 00 00 41 f6 45 02 01 75 02 0f 0b 48 39 da 0f 82 92 00 00 00 48 89 d8 48 c1 e8 03 <42> 0f b6 04 30 84 c0 74 08 3c 03 0f 8e 45 01 00 00 8b 03 48 c1 e0 [...] Upon further debugging, it turns out that whenever we trigger this issue, the kallsyms removal in bpf_prog_ksym_node_del() was /skipped/ but yet bpf_jit_free() reported that the entry is /in use/. Problem is that symbol exposure via bpf_prog_kallsyms_add() but also perf_event_bpf_event() were done /after/ bpf_prog_new_fd(). Once the fd is exposed to the public, a parallel close request came in right before we attempted to do the bpf_prog_kallsyms_add(). Given at this time the prog reference count is one, we start to rip everything underneath us via bpf_prog_release() -> bpf_prog_put(). The memory is eventually released via deferred free, so we're seeing that bpf_jit_free() has a kallsym entry because we added it from bpf_prog_load() but /after/ bpf_prog_put() from the remote CPU. Therefore, move both notifications /before/ we install the fd. The issue was never seen between bpf_prog_alloc_id() and bpf_prog_new_fd() because upon bpf_prog_get_fd_by_id() we'll take another reference to the BPF prog, so we're still holding the original reference from the bpf_prog_load(). Fixes: 6ee52e2a3fe4 ("perf, bpf: Introduce PERF_RECORD_BPF_EVENT") Fixes: 74451e66d516 ("bpf: make jited programs visible in traces") Reported-by: syzbot+bd3bba6ff3fcea7a6ec6@syzkaller.appspotmail.com Signed-off-by: Daniel Borkmann Cc: Song Liu commit 6754172c208d9d3dae208c6494611ac167d56688 Author: Alexei Starovoitov Date: Wed Aug 21 14:07:10 2019 -0700 bpf: fix precision tracking in presence of bpf2bpf calls While adding extra tests for precision tracking and extra infra to adjust verifier heuristics the existing test "calls: cross frame pruning - liveness propagation" started to fail. The root cause is the same as described in verifer.c comment: * Also if parent's curframe > frame where backtracking started, * the verifier need to mark registers in both frames, otherwise callees * may incorrectly prune callers. This is similar to * commit 7640ead93924 ("bpf: verifier: make sure callees don't prune with caller differences") * For now backtracking falls back into conservative marking. Turned out though that returning -ENOTSUPP from backtrack_insn() and doing mark_all_scalars_precise() in the current parentage chain is not enough. Depending on how is_state_visited() heuristic is creating parentage chain it's possible that callee will incorrectly prune caller. Fix the issue by setting precise=true earlier and more aggressively. Before this fix the precision tracking _within_ functions that don't do bpf2bpf calls would still work. Whereas now precision tracking is completely disabled when bpf2bpf calls are present anywhere in the program. No difference in cilium tests (they don't have bpf2bpf calls). No difference in test_progs though some of them have bpf2bpf calls, but precision tracking wasn't effective there. Fixes: b5dc0163d8fd ("bpf: precise scalar_value tracking") Signed-off-by: Alexei Starovoitov Signed-off-by: Daniel Borkmann commit db38de39684dda2bf307f41797db2831deba64e9 Author: Jakub Sitnicki Date: Wed Aug 21 14:17:20 2019 +0200 flow_dissector: Fix potential use-after-free on BPF_PROG_DETACH Call to bpf_prog_put(), with help of call_rcu(), queues an RCU-callback to free the program once a grace period has elapsed. The callback can run together with new RCU readers that started after the last grace period. New RCU readers can potentially see the "old" to-be-freed or already-freed pointer to the program object before the RCU update-side NULLs it. Reorder the operations so that the RCU update-side resets the protected pointer before the end of the grace period after which the program will be freed. Fixes: d58e468b1112 ("flow_dissector: implements flow dissector BPF hook") Reported-by: Lorenz Bauer Signed-off-by: Jakub Sitnicki Acked-by: Petar Penkov Signed-off-by: Daniel Borkmann commit 345b93265b3a3d001ec23b696b66059395238d16 Author: Heiner Kallweit Date: Fri Aug 23 19:57:49 2019 +0200 Revert "r8169: remove not needed call to dma_sync_single_for_device" This reverts commit f072218cca5b076dd99f3dfa3aaafedfd0023a51. As reported by Aaro this patch causes network problems on MIPS Loongson platform. Therefore revert it. Fixes: f072218cca5b ("r8169: remove not needed call to dma_sync_single_for_device") Signed-off-by: Heiner Kallweit Reported-by: Aaro Koskinen Signed-off-by: David S. Miller commit 9140d8bdd4c5a04abe181bb300378355d56990a4 Merge: b9bd6806d014 c536277e0db1 Author: Linus Torvalds Date: Fri Aug 23 14:53:09 2019 -0700 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma Pull rdma fixes from Doug Ledford: "No beating around the bush: this is a monster pull request for an -rc5 kernel. Intel hit me with a series of fixes for TID processing. Mellanox hit me with a series for their UMR memory support. And we had one fix for siw that fixes the 32bit build warnings and because of the number of casts that had to be changed to properly silence the warnings, that one patch alone is a full 40% of the LOC of this entire pull request. Given that this is the initial release kernel for siw, I'm trying to fix anything in it that we can, so that adds to the impetus to take fixes for it like this one. I had to do a rebase early in the week. Jason had thought he put a patch on the rc queue that he needed to be there so he could base some work off of it, and it had actually not been placed there. So he asked me (on Tuesday) to fix that up before pushing my wip branch to the official rc branch. I did, and that's why the early patches look like they were all committed at the same time on Tuesday. That bunch had been in my queue prior. The various patches all pass my test for being legitimate fixes and not attempts to slide new features or development into a late rc. Well, they were all fixes with the exception of a couple clean up patches people wrote for making the fixes they also wrote better (like a cleanup patch to move UMR checking into a function so that the remaining UMR fix patches can reference that function), so I left those in place too. My apologies for the LOC count and the number of patches here, it's just how the cards fell this cycle. Summary: - Fix siw buffer mapping issue - Fix siw 32/64 casting issues - Fix a KASAN access issue in bnxt_re - Fix several memory leaks (hfi1, mlx4) - Fix a NULL deref in cma_cleanup - Fixes for UMR memory support in mlx5 (4 patch series) - Fix namespace check for restrack - Fixes for counter support - Fixes for hfi1 TID processing (5 patch series) - Fix potential NULL deref in siw - Fix memory page calculations in mlx5" * tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma: (21 commits) RDMA/siw: Fix 64/32bit pointer inconsistency RDMA/siw: Fix SGL mapping issues RDMA/bnxt_re: Fix stack-out-of-bounds in bnxt_qplib_rcfw_send_message infiniband: hfi1: fix memory leaks infiniband: hfi1: fix a memory leak bug IB/mlx4: Fix memory leaks RDMA/cma: fix null-ptr-deref Read in cma_cleanup IB/mlx5: Block MR WR if UMR is not possible IB/mlx5: Fix MR re-registration flow to use UMR properly IB/mlx5: Report and handle ODP support properly IB/mlx5: Consolidate use_umr checks into single function RDMA/restrack: Rewrite PID namespace check to be reliable RDMA/counters: Properly implement PID checks IB/core: Fix NULL pointer dereference when bind QP to counter IB/hfi1: Drop stale TID RDMA packets that cause TIDErr IB/hfi1: Add additional checks when handling TID RDMA WRITE DATA packet IB/hfi1: Add additional checks when handling TID RDMA READ RESP packet IB/hfi1: Unsafe PSN checking for TID RDMA READ Resp packet IB/hfi1: Drop stale TID RDMA packets RDMA/siw: Fix potential NULL de-ref ... commit db0b99f59ae4d934a0af1a5670706d7c2a4b58ea Author: Sabrina Dubroca Date: Fri Aug 23 15:44:36 2019 +0200 ipv6: propagate ipv6_add_dev's error returns out of ipv6_find_idev Currently, ipv6_find_idev returns NULL when ipv6_add_dev fails, ignoring the specific error value. This results in addrconf_add_dev returning ENOBUFS in all cases, which is unfortunate in cases such as: # ip link add dummyX type dummy # ip link set dummyX mtu 1200 up # ip addr add 2000::/64 dev dummyX RTNETLINK answers: No buffer space available Commit a317a2f19da7 ("ipv6: fail early when creating netdev named all or default") introduced error returns in ipv6_add_dev. Before that, that function would simply return NULL for all failures. Signed-off-by: Sabrina Dubroca Signed-off-by: David S. Miller commit b9bd6806d014f7d3647caa66ea245329a3ee0253 Merge: dd469a456047 08f5439f1df2 Author: Linus Torvalds Date: Fri Aug 23 14:45:45 2019 -0700 Merge tag 'for-linus-20190823' of git://git.kernel.dk/linux-block Pull block fixes from Jens Axboe: "Here's a set of fixes that should go into this release. This contains: - Three minor fixes for NVMe. - Three minor tweaks for the io_uring polling logic. - Officially mark Song as the MD maintainer, after he's been filling that role sucessfully for the last 6 months or so" * tag 'for-linus-20190823' of git://git.kernel.dk/linux-block: io_uring: add need_resched() check in inner poll loop md: update MAINTAINERS info io_uring: don't enter poll loop if we have CQEs pending nvme: Add quirk for LiteON CL1 devices running FW 22301111 nvme: Fix cntlid validation when not using NVMEoF nvme-multipath: fix possible I/O hang when paths are updated io_uring: fix potential hang with polled IO commit dd469a456047af5eb1ee0bcfc8fe61f5940ef0e0 Merge: f576518c9ab5 1cfd5d3399e8 Author: Linus Torvalds Date: Fri Aug 23 10:53:34 2019 -0700 Merge tag 'for-5.3/dm-fixes-2' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm Pull device mapper fixes from Mike Snitzer: - Revert a DM bufio change from during the 5.3 merge window now that a proper fix has been made to the block loopback driver. - Fix DM kcopyd to wakeup so failed subjobs get completed. - Various fixes to DM zoned target to address error handling, and other small tweaks (SPDX license identifiers and fix typos). - Fix DM integrity range locking race by tracking whether journal has changed. - Fix DM dust target to detect reads of badblocks beyond the first 512b sector (applicable if blocksize is larger than 512b). - Fix DM persistent-data issue in both the DM btree and DM space-map-metadata interfaces. - Fix out of bounds memory access with certain DM table configurations. * tag 'for-5.3/dm-fixes-2' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm: dm table: fix invalid memory accesses with too high sector number dm space map metadata: fix missing store of apply_bops() return value dm btree: fix order of block initialization in btree_split_beneath dm raid: add missing cleanup in raid_ctr() dm zoned: fix potential NULL dereference in dmz_do_reclaim() dm dust: use dust block size for badblocklist index dm integrity: fix a crash due to BUG_ON in __journal_read_write() dm zoned: fix a few typos dm zoned: add SPDX license identifiers dm zoned: properly handle backing device failure dm zoned: improve error handling in i/o map code dm zoned: improve error handling in reclaim dm kcopyd: always complete failed jobs Revert "dm bufio: fix deadlock with loop device" commit f576518c9ab5a6fbc7a4b9bbfc9be31aa18a1cc7 Merge: e3fb13b7e47c b68271609c4f Author: Linus Torvalds Date: Fri Aug 23 10:49:44 2019 -0700 Merge tag 'xfs-5.3-fixes-4' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux Pull xfs fixes from Darrick Wong: "Here are a few more bug fixes that trickled in since the last pull. They've survived the usual xfstests runs and merge cleanly with this morning's master. I expect there to be one more pull request tomorrow for the fix to that quota related inode unlock bug that we were reviewing last night, but it will continue to soak in the testing machine for several more hours. - Fix missing compat ioctl handling for get/setlabel - Fix missing ioctl pointer sanitization on s390 - Fix a page locking deadlock in the dedupe comparison code - Fix inadequate locking in reflink code w.r.t. concurrent directio - Fix broken error detection when breaking layouts" * tag 'xfs-5.3-fixes-4' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux: fs/xfs: Fix return code of xfs_break_leased_layouts() xfs: fix reflink source file racing with directio writes vfs: fix page locking deadlocks when deduping files xfs: compat_ioctl: use compat_ptr() xfs: fall back to native ioctls for unhandled compat ones commit 2e16f3e926ed48373c98edea85c6ad0ef69425d1 Author: Andre Przywara Date: Fri Aug 23 11:34:16 2019 +0100 KVM: arm/arm64: VGIC: Properly initialise private IRQ affinity At the moment we initialise the target *mask* of a virtual IRQ to the VCPU it belongs to, even though this mask is only defined for GICv2 and quickly runs out of bits for many GICv3 guests. This behaviour triggers an UBSAN complaint for more than 32 VCPUs: ------ [ 5659.462377] UBSAN: Undefined behaviour in virt/kvm/arm/vgic/vgic-init.c:223:21 [ 5659.471689] shift exponent 32 is too large for 32-bit type 'unsigned int' ------ Also for GICv3 guests the reporting of TARGET in the "vgic-state" debugfs dump is wrong, due to this very same problem. Because there is no requirement to create the VGIC device before the VCPUs (and QEMU actually does it the other way round), we can't safely initialise mpidr or targets in kvm_vgic_vcpu_init(). But since we touch every private IRQ for each VCPU anyway later (in vgic_init()), we can just move the initialisation of those fields into there, where we definitely know the VGIC type. On the way make sure we really have either a VGICv2 or a VGICv3 device, since the existing code is just checking for "VGICv3 or not", silently ignoring the uninitialised case. Signed-off-by: Andre Przywara Reported-by: Dave Martin Tested-by: Julien Grall Signed-off-by: Marc Zyngier commit e3fb13b7e47cd18b2bd067ea8a491020b4644baf Merge: 4e5639449069 3b5be16c7e90 Author: Linus Torvalds Date: Fri Aug 23 09:22:00 2019 -0700 Merge tag 'modules-for-v5.3-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/jeyu/linux Pull modules fixes from Jessica Yu: "Fix BUG_ON() being triggered in frob_text() due to non-page-aligned module sections" * tag 'modules-for-v5.3-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/jeyu/linux: modules: page-align module section allocations only for arches supporting strict module rwx modules: always page-align module section allocations commit 0ff0f15a32c093381ad1abc06abe85afb561ab28 Author: Sven Eckelmann Date: Thu Aug 22 08:55:36 2019 +0200 batman-adv: Only read OGM2 tvlv_len after buffer len check Multiple batadv_ogm2_packet can be stored in an skbuff. The functions batadv_v_ogm_send_to_if() uses batadv_v_ogm_aggr_packet() to check if there is another additional batadv_ogm2_packet in the skb or not before they continue processing the packet. The length for such an OGM2 is BATADV_OGM2_HLEN + batadv_ogm2_packet->tvlv_len. The check must first check that at least BATADV_OGM2_HLEN bytes are available before it accesses tvlv_len (which is part of the header. Otherwise it might try read outside of the currently available skbuff to get the content of tvlv_len. Fixes: 9323158ef9f4 ("batman-adv: OGMv2 - implement originators logic") Signed-off-by: Sven Eckelmann Signed-off-by: Simon Wunderlich commit a15d56a60760aa9dbe26343b9a0ac5228f35d445 Author: Sven Eckelmann Date: Thu Aug 22 08:55:36 2019 +0200 batman-adv: Only read OGM tvlv_len after buffer len check Multiple batadv_ogm_packet can be stored in an skbuff. The functions batadv_iv_ogm_send_to_if()/batadv_iv_ogm_receive() use batadv_iv_ogm_aggr_packet() to check if there is another additional batadv_ogm_packet in the skb or not before they continue processing the packet. The length for such an OGM is BATADV_OGM_HLEN + batadv_ogm_packet->tvlv_len. The check must first check that at least BATADV_OGM_HLEN bytes are available before it accesses tvlv_len (which is part of the header. Otherwise it might try read outside of the currently available skbuff to get the content of tvlv_len. Fixes: ef26157747d4 ("batman-adv: tvlv - basic infrastructure") Reported-by: syzbot+355cab184197dbbfa384@syzkaller.appspotmail.com Signed-off-by: Sven Eckelmann Acked-by: Antonio Quartulli Signed-off-by: Simon Wunderlich commit 4e5639449069d12e95edc10b63acf170843e1706 Merge: 1374a22e0641 a561372405cf Author: Linus Torvalds Date: Fri Aug 23 09:19:38 2019 -0700 Merge tag 'ceph-for-5.3-rc6' of git://github.com/ceph/ceph-client Pull ceph fixes from Ilya Dryomov: "Three important fixes tagged for stable (an indefinite hang, a crash on an assert and a NULL pointer dereference) plus a small series from Luis fixing instances of vfree() under spinlock" * tag 'ceph-for-5.3-rc6' of git://github.com/ceph/ceph-client: libceph: fix PG split vs OSD (re)connect race ceph: don't try fill file_lock on unsuccessful GETFILELOCK reply ceph: clear page dirty before invalidate page ceph: fix buffer free while holding i_ceph_lock in fill_inode() ceph: fix buffer free while holding i_ceph_lock in __ceph_build_xattrs_blob() ceph: fix buffer free while holding i_ceph_lock in __ceph_setxattr() libceph: allow ceph_buffer_put() to receive a NULL ceph_buffer commit c536277e0db1ad2e9fbb9dfd940c3565a14d9c52 Author: Bernard Metzler Date: Thu Aug 22 19:37:38 2019 +0200 RDMA/siw: Fix 64/32bit pointer inconsistency Fixes improper casting between addresses and unsigned types. Changes siw_pbl_get_buffer() function to return appropriate dma_addr_t, and not u64. Also fixes debug prints. Now any potentially kernel private pointers are printed formatted as '%pK', to allow keeping that information secret. Fixes: d941bfe500be ("RDMA/siw: Change CQ flags from 64->32 bits") Fixes: b0fff7317bb4 ("rdma/siw: completion queue methods") Fixes: 8b6a361b8c48 ("rdma/siw: receive path") Fixes: b9be6f18cf9e ("rdma/siw: transmit path") Fixes: f29dd55b0236 ("rdma/siw: queue pair methods") Fixes: 2251334dcac9 ("rdma/siw: application buffer management") Fixes: 303ae1cdfdf7 ("rdma/siw: application interface") Fixes: 6c52fdc244b5 ("rdma/siw: connection management") Fixes: a531975279f3 ("rdma/siw: main include file") Reported-by: Geert Uytterhoeven Reported-by: Jason Gunthorpe Reported-by: Leon Romanovsky Signed-off-by: Bernard Metzler Link: https://lore.kernel.org/r/20190822173738.26817-1-bmt@zurich.ibm.com Signed-off-by: Doug Ledford commit 1374a22e0641783a5fa25a18f23d9d7a91c38add Merge: 59c36bc8d377 75710f08ea7e Author: Linus Torvalds Date: Fri Aug 23 09:03:06 2019 -0700 Merge tag 'drm-fixes-2019-08-23' of git://anongit.freedesktop.org/drm/drm Pull drm fixes from Dave Airlie: "Live from the laundromat after my washing machine broke down, we have the 5.3-rc6 fixes. Changelog is in the tag below, but nothing too noteworthy in here: rcar-du: - LVDS dual-link mode fix mediatek: - of node refcount fix - prime buffer import fix - dma max seg fix komeda: - output polling fix - abfc format fix - memory-region DT fix amdgpu: - bpc display fix - ioctl memory leak fix - gfxoff fix - smu warnings fix i915: - HDMI mode readout fix" * tag 'drm-fixes-2019-08-23' of git://anongit.freedesktop.org/drm/drm: drm/amdgpu/powerplay: silence a warning in smu_v11_0_setup_pptable drm/amd/display: Calculate bpc based on max_requested_bpc drm/amdgpu: prevent memory leaks in AMDGPU_CS ioctl drm/amd/amdgpu: disable MMHUB PG for navi10 drm/amd/powerplay: remove duplicate macro smu_get_uclk_dpm_states in amdgpu_smu.h drm/amd/powerplay: fix variable type errors in smu_v11_0_setup_pptable drm/amdgpu/gfx9: update pg_flags after determining if gfx off is possible drm/i915: Fix HW readout for crtc_clock in HDMI mode drm/mediatek: mtk_drm_drv.c: Add of_node_put() before goto drm: rcar_lvds: Fix dual link mode operations drm/mediatek: set DMA max segment size drm/mediatek: use correct device to import PRIME buffers drm/omap: ensure we have a valid dma_mask drm/komeda: Add support for 'memory-region' DT node property drm/komeda: Adds internal bpp computing for arm afbc only format YU08 YU10 drm/komeda: Initialize and enable output polling on Komeda commit b63f20a778c88b6a04458ed6ffc69da953d3a109 Author: Sean Christopherson Date: Thu Aug 22 14:11:22 2019 -0700 x86/retpoline: Don't clobber RFLAGS during CALL_NOSPEC on i386 Use 'lea' instead of 'add' when adjusting %rsp in CALL_NOSPEC so as to avoid clobbering flags. KVM's emulator makes indirect calls into a jump table of sorts, where the destination of the CALL_NOSPEC is a small blob of code that performs fast emulation by executing the target instruction with fixed operands. adcb_al_dl: 0x000339f8 <+0>: adc %dl,%al 0x000339fa <+2>: ret A major motiviation for doing fast emulation is to leverage the CPU to handle consumption and manipulation of arithmetic flags, i.e. RFLAGS is both an input and output to the target of CALL_NOSPEC. Clobbering flags results in all sorts of incorrect emulation, e.g. Jcc instructions often take the wrong path. Sans the nops... asm("push %[flags]; popf; " CALL_NOSPEC " ; pushf; pop %[flags]\n" 0x0003595a <+58>: mov 0xc0(%ebx),%eax 0x00035960 <+64>: mov 0x60(%ebx),%edx 0x00035963 <+67>: mov 0x90(%ebx),%ecx 0x00035969 <+73>: push %edi 0x0003596a <+74>: popf 0x0003596b <+75>: call *%esi 0x000359a0 <+128>: pushf 0x000359a1 <+129>: pop %edi 0x000359a2 <+130>: mov %eax,0xc0(%ebx) 0x000359b1 <+145>: mov %edx,0x60(%ebx) ctxt->eflags = (ctxt->eflags & ~EFLAGS_MASK) | (flags & EFLAGS_MASK); 0x000359a8 <+136>: mov -0x10(%ebp),%eax 0x000359ab <+139>: and $0x8d5,%edi 0x000359b4 <+148>: and $0xfffff72a,%eax 0x000359b9 <+153>: or %eax,%edi 0x000359bd <+157>: mov %edi,0x4(%ebx) For the most part this has gone unnoticed as emulation of guest code that can trigger fast emulation is effectively limited to MMIO when running on modern hardware, and MMIO is rarely, if ever, accessed by instructions that affect or consume flags. Breakage is almost instantaneous when running with unrestricted guest disabled, in which case KVM must emulate all instructions when the guest has invalid state, e.g. when the guest is in Big Real Mode during early BIOS. Fixes: 776b043848fd2 ("x86/retpoline: Add initial retpoline support") Fixes: 1a29b5b7f347a ("KVM: x86: Make indirect calls in emulator speculation safe") Signed-off-by: Sean Christopherson Signed-off-by: Thomas Gleixner Acked-by: Peter Zijlstra (Intel) Cc: stable@vger.kernel.org Link: https://lkml.kernel.org/r/20190822211122.27579-1-sean.j.christopherson@intel.com commit 1cfd5d3399e87167b7f9157ef99daa0e959f395d Author: Mikulas Patocka Date: Fri Aug 23 09:54:09 2019 -0400 dm table: fix invalid memory accesses with too high sector number If the sector number is too high, dm_table_find_target() should return a pointer to a zeroed dm_target structure (the caller should test it with dm_target_is_valid). However, for some table sizes, the code in dm_table_find_target() that performs btree lookup will access out of bound memory structures. Fix this bug by testing the sector number at the beginning of dm_table_find_target(). Also, add an "inline" keyword to the function dm_table_get_size() because this is a hot path. Fixes: 512875bd9661 ("dm: table detect io beyond device") Cc: stable@vger.kernel.org Reported-by: Zhang Tao Signed-off-by: Mikulas Patocka Signed-off-by: Mike Snitzer commit 51a44a28eefd0d4c1addeb23fc5a599ff1787dfd Author: Mihail Atanassov Date: Tue Aug 20 15:16:58 2019 +0000 drm/komeda: Add missing of_node_get() call komeda_pipeline_destroy has the matching of_node_put(). Fixes: 29e56aec911dd ("drm/komeda: Add DT parsing") Signed-off-by: Mihail Atanassov Reviewed-by: Ayan Kumar Halder [Rebased on the latest drm-misc-fixes] Signed-off-by: Ayan Kumar Halder Link: https://patchwork.freedesktop.org/patch/325278/ Change-Id: I5fa2479d6cb3a77182f1a92833c1c0bca8668cb4 commit 95abcd33ad513faf9cf3f54a28fb4982407e5a92 Author: james qian wang (Arm Technology China) Date: Tue Aug 13 11:08:20 2019 +0000 drm/komeda: Clean warning 'komeda_component_add' might be a candidate for 'gnu_printf' komeda/komeda_pipeline.c: In function 'komeda_component_add': komeda/komeda_pipeline.c:212:3: warning: function 'komeda_component_add' might be a candidate for 'gnu_printf' format attribute [-Wsuggest-attribute=format] vsnprintf(c->name, sizeof(c->name), name_fmt, args); ^~~~~~~~~ Signed-off-by: james qian wang (Arm Technology China) Reviewed-by: Ayan Kumar Halder Link: https://patchwork.freedesktop.org/patch/msgid/20190813110759.10425-1-james.qian.wang@arm.com commit 61d05b184963523e50729af8466b72e9c8a4f8be Author: james qian wang (Arm Technology China) Date: Mon Aug 12 11:23:41 2019 +0000 drm/komeda: Fix warning -Wunused-but-set-variable Fixed two -Wunused-but-set-variable warnings: /arm/linux/display/aosp-4.14-drm-next/drivers/gpu/drm/arm/display/komeda/komeda_kms.c: In function ‘komeda_crtc_normalize_zpos’: /arm/linux/display/aosp-4.14-drm-next/drivers/gpu/drm/arm/display/komeda/komeda_kms.c:150:26: warning: variable ‘fb’ set but not used [-Wunused-but-set-variable] struct drm_framebuffer *fb; ^~ /arm/linux/display/aosp-4.14-drm-next/drivers/gpu/drm/arm/display/komeda/komeda_kms.c: In function ‘komeda_kms_check’: /arm/linux/display/aosp-4.14-drm-next/drivers/gpu/drm/arm/display/komeda/komeda_kms.c:209:25: warning: variable ‘old_crtc_st’ set but not used [-Wunused-but-set-variable] struct drm_crtc_state *old_crtc_st, *new_crtc_st; ^~~~~~~~~~~ Signed-off-by: james qian wang (Arm Technology China) Reviewed-by: Ayan Kumar Halder Link: https://patchwork.freedesktop.org/patch/msgid/20190812112322.15990-1-james.qian.wang@arm.com commit 8f6a79112a360ff05b8aa4a9be081d3eb9057077 Author: james qian wang (Arm Technology China) Date: Mon Aug 19 08:01:57 2019 +0000 drm/komeda: Fix error: not allocating enough data 1592 vs 1584 The patch 5d51f6c0da1b: "drm/komeda: Add writeback support" from May 23, 2019, leads to the following static checker warning: drivers/gpu/drm/arm/display/komeda/komeda_wb_connector.c:151 komeda_wb_connector_add() error: not allocating enough data 1592 vs 1584 This is a typo which misuse "wb_conn" but which should be "kwb_conn" to allocate the memory. Reported-by: Dan Carpenter Signed-off-by: james qian wang (Arm Technology China) Reviewed-by: Ayan Kumar Halder Link: https://patchwork.freedesktop.org/patch/msgid/20190819080136.10190-1-james.qian.wang@arm.com commit 69389837171140e2a94c5b8683c08dceaa8c9c8c Author: Lvqiang Huang Date: Thu Aug 1 08:15:23 2019 +0100 ARM: 8897/1: check stmfd instruction using right shift In the commit ef41b5c92498 ("ARM: make kernel oops easier to read"), - .word 0xe92d0000 >> 10 @ stmfd sp!, {} + .word 0xe92d0000 >> 11 @ stmfd sp!, {} then the shift need to change to 11. Signed-off-by: Lvqiang Huang Signed-off-by: Chunyan Zhang Signed-off-by: Russell King commit c51bc12d06b3a5494fbfcbd788a8e307932a06e9 Author: Doug Berger Date: Mon Jul 1 18:50:11 2019 +0100 ARM: 8874/1: mm: only adjust sections of valid mm structures A timing hazard exists when an early fork/exec thread begins exiting and sets its mm pointer to NULL while a separate core tries to update the section information. This commit ensures that the mm pointer is not NULL before setting its section parameters. The arguments provided by commit 11ce4b33aedc ("ARM: 8672/1: mm: remove tasklist locking from update_sections_early()") are equally valid for not requiring grabbing the task_lock around this check. Fixes: 08925c2f124f ("ARM: 8464/1: Update all mm structures with section adjustments") Signed-off-by: Doug Berger Acked-by: Laura Abbott Cc: Mike Rapoport Cc: Andrew Morton Cc: Florian Fainelli Cc: Rob Herring Cc: "Steven Rostedt (VMware)" Cc: Peng Fan Cc: Geert Uytterhoeven Signed-off-by: Russell King commit 48057ed1840fde9239b1e000bea1a0a1f07c5e99 Author: Linus Walleij Date: Tue Aug 20 10:05:27 2019 +0200 gpio: Fix irqchip initialization order The new API for registering a gpio_irq_chip along with a gpio_chip has a different semantic ordering than the old API which added the irqchip explicitly after registering the gpio_chip. Move the calls to add the gpio_irq_chip *last* in the function, so that the different hooks setting up OF and ACPI and machine gpio_chips are called *before* we try to register the interrupts, preserving the elder semantic order. This cropped up in the PL061 driver which used to work fine with no special ACPI quirks, but started to misbehave using the new API. Fixes: e0d897289813 ("gpio: Implement tighter IRQ chip integration") Cc: Thierry Reding Cc: Grygorii Strashko Cc: Andy Shevchenko Reported-by: Wei Xu Tested-by: Wei Xu Reported-by: Andy Shevchenko Signed-off-by: Linus Walleij Link: https://lore.kernel.org/r/20190820080527.11796-1-linus.walleij@linaro.org commit 9b2a0a1ef66f96bf34921a3865581eca32ff05ec Author: Gerd Hoffmann Date: Wed Aug 21 13:12:09 2019 +0200 drm/virtio: use virtio_max_dma_size We must make sure our scatterlist segments are not too big, otherwise we might see swiotlb failures (happens with sev, also reproducable with swiotlb=force). Suggested-by: Laszlo Ersek Signed-off-by: Gerd Hoffmann Reviewed-by: Laszlo Ersek Link: http://patchwork.freedesktop.org/patch/msgid/20190821111210.27165-1-kraxel@redhat.com commit 8090f7eb318d4241625449252db2741e7703e027 Author: Laurent Pinchart Date: Wed Aug 21 21:32:26 2019 +0300 drm/omap: Fix port lookup for SDI output When refactoring port lookup for DSS outputs, commit d17eb4537a7e ("drm/omap: Factor out common init/cleanup code for output devices") incorrectly hardcoded usage of DT port 0. This breaks operation for SDI (which uses the DT port 1) and DPI outputs other than DPI0 (which are not used in mainline DT sources). Fix this by using the port number from the output omap_dss_device of_ports field. Fixes: d17eb4537a7e ("drm/omap: Factor out common init/cleanup code for output devices") Signed-off-by: Laurent Pinchart Signed-off-by: Tomi Valkeinen Link: https://patchwork.freedesktop.org/patch/msgid/20190821183226.13784-1-laurent.pinchart@ideasonboard.com Tested-by: Aaro Koskinen commit fbf0a7f44cdd4041b5a3e2b14deaa0adebaf40da Author: Gerd Hoffmann Date: Mon Aug 5 12:54:01 2019 +0200 drm/qxl: get vga ioports qxl has two modes: "native" (used by the drm driver) and "vga" (vga compatibility mode, typically used for boot display and firmware framebuffers). Accessing any vga ioport will switch the qxl device into vga mode. The qxl driver never does that, but other drivers accessing vga ports can trigger that too and therefore disturb qxl operation. So aquire the legacy vga ioports from vgaarb to avoid that. Reproducer: Boot kvm guest with both qxl and i915 vgpu, with qxl being first in pci scan order. v2: Skip this for secondary qxl cards which don't have vga mode in the first place (Frediano). Cc: Frediano Ziglio Signed-off-by: Gerd Hoffmann Reviewed-by: Dave Airlie Link: http://patchwork.freedesktop.org/patch/msgid/20190805105401.29874-1-kraxel@redhat.com commit 1fb254aa983bf190cfd685d40c64a480a9bafaee Author: Darrick J. Wong Date: Thu Aug 22 20:55:54 2019 -0700 xfs: fix missing ILOCK unlock when xfs_setattr_nonsize fails due to EDQUOT Benjamin Moody reported to Debian that XFS partially wedges when a chgrp fails on account of being out of disk quota. I ran his reproducer script: # adduser dummy # adduser dummy plugdev # dd if=/dev/zero bs=1M count=100 of=test.img # mkfs.xfs test.img # mount -t xfs -o gquota test.img /mnt # mkdir -p /mnt/dummy # chown -c dummy /mnt/dummy # xfs_quota -xc 'limit -g bsoft=100k bhard=100k plugdev' /mnt (and then as user dummy) $ dd if=/dev/urandom bs=1M count=50 of=/mnt/dummy/foo $ chgrp plugdev /mnt/dummy/foo and saw: ================================================ WARNING: lock held when returning to user space! 5.3.0-rc5 #rc5 Tainted: G W ------------------------------------------------ chgrp/47006 is leaving the kernel with locks still held! 1 lock held by chgrp/47006: #0: 000000006664ea2d (&xfs_nondir_ilock_class){++++}, at: xfs_ilock+0xd2/0x290 [xfs] ...which is clearly caused by xfs_setattr_nonsize failing to unlock the ILOCK after the xfs_qm_vop_chown_reserve call fails. Add the missing unlock. Reported-by: benjamin.moody@gmail.com Fixes: 253f4911f297 ("xfs: better xfs_trans_alloc interface") Signed-off-by: Darrick J. Wong Reviewed-by: Dave Chinner Tested-by: Salvatore Bonaccorso commit a4a759b2797ba9eff0dcfcdc532e886440da4e01 Merge: 75710f08ea7e c358ebf59634 Author: Dave Airlie Date: Fri Aug 23 13:53:59 2019 +1000 Merge branch 'linux-5.3' of git://github.com/skeggsb/linux into drm-fixes Fixes i2c on DP with some docks. Signed-off-by: Dave Airlie From: Ben Skeggs Link: https://patchwork.freedesktop.org/patch/msgid/CACAvsv713t2_BQ44gVV7Lqic6Vwmhq0r4FB5v-t0kD1jzFrbmQ@mail.gmail.com commit c358ebf59634f06d8ed176da651ec150df3c8686 Author: Lyude Paul Date: Thu Jul 25 15:40:01 2019 -0400 drm/nouveau: Don't retry infinitely when receiving no data on i2c over AUX While I had thought I had fixed this issue in: commit 342406e4fbba ("drm/nouveau/i2c: Disable i2c bus access after ->fini()") It turns out that while I did fix the error messages I was seeing on my P50 when trying to access i2c busses with the GPU in runtime suspend, I accidentally had missed one important detail that was mentioned on the bug report this commit was supposed to fix: that the CPU would only lock up when trying to access i2c busses _on connected devices_ _while the GPU is not in runtime suspend_. Whoops. That definitely explains why I was not able to get my machine to hang with i2c bus interactions until now, as plugging my P50 into it's dock with an HDMI monitor connected allowed me to finally reproduce this locally. Now that I have managed to reproduce this issue properly, it looks like the problem is much simpler then it looks. It turns out that some connected devices, such as MST laptop docks, will actually ACK i2c reads even if no data was actually read: [ 275.063043] nouveau 0000:01:00.0: i2c: aux 000a: 1: 0000004c 1 [ 275.063447] nouveau 0000:01:00.0: i2c: aux 000a: 00 01101000 10040000 [ 275.063759] nouveau 0000:01:00.0: i2c: aux 000a: rd 00000001 [ 275.064024] nouveau 0000:01:00.0: i2c: aux 000a: rd 00000000 [ 275.064285] nouveau 0000:01:00.0: i2c: aux 000a: rd 00000000 [ 275.064594] nouveau 0000:01:00.0: i2c: aux 000a: rd 00000000 Because we don't handle the situation of i2c ack without any data, we end up entering an infinite loop in nvkm_i2c_aux_i2c_xfer() since the value of cnt always remains at 0. This finally properly explains how this could result in a CPU hang like the ones observed in the aforementioned commit. So, fix this by retrying transactions if no data is written or received, and give up and fail the transaction if we continue to not write or receive any data after 32 retries. Signed-off-by: Lyude Paul Cc: stable@vger.kernel.org Signed-off-by: Ben Skeggs commit f6edbf2d616435cda7823942c20005ce198e97c8 Author: Justin.Lee1@Dell.com Date: Wed Aug 21 21:24:52 2019 +0000 net/ncsi: Fix the payload copying for the request coming from Netlink The request coming from Netlink should use the OEM generic handler. The standard command handler expects payload in bytes/words/dwords but the actual payload is stored in data if the request is coming from Netlink. Signed-off-by: Justin Lee Reviewed-by: Vijay Khemka Signed-off-by: David S. Miller commit 75710f08ea7e41b2f7010da3f6deab061f7a853b Author: Alex Deucher Date: Wed Aug 21 22:25:27 2019 -0500 drm/amdgpu/powerplay: silence a warning in smu_v11_0_setup_pptable I think gcc is confused as I don't see how size could be used unitialized, but go ahead and silence the warning. Signed-off-by: Alex Deucher Reviewed-by: Evan Quan Signed-off-by: Dave Airlie Link: https://patchwork.freedesktop.org/patch/msgid/20190822032527.1376-1-alexander.deucher@amd.com commit cf3627fb1af183dc385022029c4b5232f6eb715c Merge: dd89c1127f80 63daf4e16654 Author: Dave Airlie Date: Fri Aug 23 11:43:47 2019 +1000 Merge tag 'drm-misc-fixes-2019-08-22' of git://anongit.freedesktop.org/drm/drm-misc into drm-fixes Fixes for v5.3-rc6: - dma fix for omap. - Make output polling work on komeda. - Fix bpp computing for AFBC formats in komeda. - Support the memory-region property in komeda. Signed-off-by: Dave Airlie From: Maarten Lankhorst Link: https://patchwork.freedesktop.org/patch/msgid/5f1fdfe3-814e-fad1-663c-7279217fc085@linux.intel.com commit dd89c1127f808eff5b09f971758b1095d839b1a4 Merge: 1e85e6cad2d1 ed19e3035c5a Author: Dave Airlie Date: Fri Aug 23 11:41:58 2019 +1000 Merge tag 'drm-intel-fixes-2019-08-22' of git://anongit.freedesktop.org/drm/drm-intel into drm-fixes drm/i915 fixes for v5.3-rc6: - fix hardware state readout for 10 bpc HDMI Signed-off-by: Dave Airlie From: Jani Nikula Link: https://patchwork.freedesktop.org/patch/msgid/87sgptd114.fsf@intel.com commit b99328a60a482108f5195b4d611f90992ca016ba Author: Thomas Gleixner Date: Thu Aug 22 13:00:15 2019 +0200 timekeeping/vsyscall: Prevent math overflow in BOOTTIME update The VDSO update for CLOCK_BOOTTIME has a overflow issue as it shifts the nanoseconds based boot time offset left by the clocksource shift. That overflows once the boot time offset becomes large enough. As a consequence CLOCK_BOOTTIME in the VDSO becomes a random number causing applications to misbehave. Fix it by storing a timespec64 representation of the offset when boot time is adjusted and add that to the MONOTONIC base time value in the vdso data page. Using the timespec64 representation avoids a 64bit division in the update code. Fixes: 44f57d788e7d ("timekeeping: Provide a generic update_vsyscall() implementation") Reported-by: Chris Clayton Signed-off-by: Thomas Gleixner Tested-by: Chris Clayton Tested-by: Vincenzo Frascino Link: https://lkml.kernel.org/r/alpine.DEB.2.21.1908221257580.1983@nanos.tec.linutronix.de commit 4df0d839babdcd2a17cae52f112afa148d48289f Merge: de0e4fd2f07c 5a8c31aa6357 Author: David S. Miller Date: Thu Aug 22 16:12:16 2019 -0700 Merge tag 'wireless-drivers-for-davem-2019-08-21' of git://git.kernel.org/pub/scm/linux/kernel/git/kvalo/wireless-drivers Kalle Valo says: ==================== wireless-drivers fixes for 5.3 Third set of fixes for 5.3, and most likely the last one. The rt2x00 regression has been reported multiple times, others are of lower priority. mt76 * fix hang on resume on certain machines rt2x00 * fix AP mode regression related to encryption iwlwifi * avoid unnecessary error messages due to multicast frames when not associated * fix configuration for ax201 devices * fix recognition of QuZ devices ==================== Signed-off-by: David S. Miller commit de0e4fd2f07ce3bbdb69dfb8d9426b7227451b69 Author: Wenwen Wang Date: Tue Aug 20 23:46:36 2019 -0500 qed: Add cleanup in qed_slowpath_start() If qed_mcp_send_drv_version() fails, no cleanup is executed, leading to memory leaks. To fix this issue, introduce the label 'err4' to perform the cleanup work before returning the error. Signed-off-by: Wenwen Wang Acked-by: Sudarsana Reddy Kalluru Signed-off-by: David S. Miller commit a71d9eff9394d24f05cbe115309152fb4543cd6c Author: Yangbo Lu Date: Wed Aug 21 09:59:12 2019 +0800 ocelot_ace: fix action of trap The trap action should be copying the frame to CPU and dropping it for forwarding, but current setting was just copying frame to CPU. Fixes: b596229448dd ("net: mscc: ocelot: Add support for tcam") Signed-off-by: Yangbo Lu Acked-by: Allan W. Nielsen Signed-off-by: David S. Miller commit e0917f879536cbf57367429d084775d8224c986c Author: Johannes Berg Date: Mon Jul 22 09:12:56 2019 +0200 um: fix time travel mode Unfortunately, my build fix for when time travel mode isn't enabled broke time travel mode, because I forgot that we need to use the timer time after the timer has been marked disabled, and thus need to leave the time stored instead of zeroing it. Fix that by splitting the inline into two, so we can call only the _mode() one in the relevant code path. Fixes: b482e48d29f1 ("um: fix build without CONFIG_UML_TIME_TRAVEL_SUPPORT") Signed-off-by: Johannes Berg Signed-off-by: Richard Weinberger commit 08f5439f1df25a6cf6cf4c72cf6c13025599ce67 Author: Jens Axboe Date: Wed Aug 21 22:19:11 2019 -0600 io_uring: add need_resched() check in inner poll loop The outer poll loop checks for whether we need to reschedule, and returns to userspace if we do. However, it's possible to get stuck in the inner loop as well, if the CPU we are running on needs to reschedule to finish the IO work. Add the need_resched() check in the inner loop as well. This fixes a potential hang if the kernel is configured with CONFIG_PREEMPT_VOLUNTARY=y. Reported-by: Sagi Grimberg Reviewed-by: Sagi Grimberg Tested-by: Sagi Grimberg Signed-off-by: Jens Axboe commit 59c36bc8d377c8764eb617a92211e0fc2f1318da Merge: 20eabc8966f5 7bafda88de20 Author: Linus Torvalds Date: Thu Aug 22 14:04:47 2019 -0700 Merge tag 'pci-v5.3-fixes-1' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci Pull PCI fixes from Bjorn Helgaas: - Reset both NVIDIA GPU and HDA in ThinkPad P50 quirk, which was broken by another quirk that enabled the HDA device (Lyude Paul) - Fix pciebus-howto.rst documentation filename typo (Bjorn Helgaas) * tag 'pci-v5.3-fixes-1' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci: Documentation PCI: Fix pciebus-howto.rst filename typo PCI: Reset both NVIDIA GPU and HDA in ThinkPad P50 workaround commit a195784c105b2907b45fd62307d9ce821da9dc20 Author: Eran Ben Elisha Date: Wed Aug 21 15:47:29 2019 +0300 net/mlx5e: Remove ethernet segment from dump WQE Dump WQE shall not include Ethernet segment. Define mlx5e_dump_wqe to be used for "Dump WQEs" instead of sharing it with the general mlx5e_tx_wqe layout. Fixes: d2ead1f360e8 ("net/mlx5e: Add kTLS TX HW offload support") Signed-off-by: Eran Ben Elisha Signed-off-by: Saeed Mahameed commit 5c6f40c61777e059ac3692c4505dff5eb880a12d Author: Eran Ben Elisha Date: Thu Aug 22 15:03:27 2019 +0300 net/mlx5e: Add num bytes metadata to WQE info For TLS WQEs, metadata info did not include num_bytes. Due to this issue, tx_tls_dump_bytes counter did not increment. Modify tx_fill_wi() to fill num bytes. When it is called for non-traffic WQE, zero is expected. Fixes: d2ead1f360e8 ("net/mlx5e: Add kTLS TX HW offload support") Signed-off-by: Eran Ben Elisha Signed-off-by: Saeed Mahameed commit a6633e11e8732b9c000774746a2c1827a7e3c316 Author: Moshe Shemesh Date: Tue Aug 13 12:49:13 2019 +0300 net/mlx5: Fix delay in fw fatal report handling due to fw report When fw fatal error occurs, poll health() first detects and reports on a fw error. Afterwards, it detects and reports on the fw fatal error itself. That can cause a long delay in fw fatal error handling which waits in a queue for the fw error handling to be finished. The fw error handle will try asking for fw core dump command while fw in fatal state may not respond and driver will wait for command timeout. Changing the flow to detect and handle first fw fatal errors and only if no fatal error detected look for a fw error to handle. Fixes: d1bf0e2cc4a6 ("net/mlx5: Report devlink health on FW issues") Signed-off-by: Moshe Shemesh Reviewed-by: Eran Ben Elisha Signed-off-by: Saeed Mahameed commit 8465df4025dd4ab84fc24dad6a91cc2b9ec1604d Author: Moshe Shemesh Date: Sun Jul 14 14:06:40 2019 +0300 net/mlx5: Fix crdump chunks print Crdump repeats itself every chunk of 256bytes. That is due to bug of missing progressing offset while copying the data from buffer to devlink_fmsg. Fixes: 9b1f29823605 ("net/mlx5: Add support for FW fatal reporter dump") Signed-off-by: Moshe Shemesh Reviewed-by: Eran Ben Elisha Signed-off-by: Saeed Mahameed commit ae148243d3f0816b37477106c05a2ec7d5f32614 Author: ZhangXiaoxu Date: Mon Aug 19 11:31:21 2019 +0800 dm space map metadata: fix missing store of apply_bops() return value In commit 6096d91af0b6 ("dm space map metadata: fix occasional leak of a metadata block on resize"), we refactor the commit logic to a new function 'apply_bops'. But when that logic was replaced in out() the return value was not stored. This may lead out() returning a wrong value to the caller. Fixes: 6096d91af0b6 ("dm space map metadata: fix occasional leak of a metadata block on resize") Cc: stable@vger.kernel.org Signed-off-by: ZhangXiaoxu Signed-off-by: Mike Snitzer commit e4f9d6013820d1eba1432d51dd1c5795759aa77f Author: ZhangXiaoxu Date: Sat Aug 17 13:32:40 2019 +0800 dm btree: fix order of block initialization in btree_split_beneath When btree_split_beneath() splits a node to two new children, it will allocate two blocks: left and right. If right block's allocation failed, the left block will be unlocked and marked dirty. If this happened, the left block'ss content is zero, because it wasn't initialized with the btree struct before the attempot to allocate the right block. Upon return, when flushing the left block to disk, the validator will fail when check this block. Then a BUG_ON is raised. Fix this by completely initializing the left block before allocating and initializing the right block. Fixes: 4dcb8b57df359 ("dm btree: fix leak of bufio-backed block in btree_split_beneath error path") Cc: stable@vger.kernel.org Signed-off-by: ZhangXiaoxu Signed-off-by: Mike Snitzer commit 20eabc8966f5c1973c2dd2450060f4511389a19c Merge: e5b7c167e46f c3cb6674df4c Author: Linus Torvalds Date: Thu Aug 22 11:26:10 2019 -0700 Merge tag 'Wimplicit-fallthrough-5.3-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gustavoars/linux Pull more fallthrough fixes from Gustavo A. R. Silva: "Fix fall-through warnings on arm and mips for multiple configurations" * tag 'Wimplicit-fallthrough-5.3-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gustavoars/linux: video: fbdev: acornfb: Mark expected switch fall-through scsi: libsas: sas_discover: Mark expected switch fall-through MIPS: Octeon: Mark expected switch fall-through power: supply: ab8500_charger: Mark expected switch fall-through watchdog: wdt285: Mark expected switch fall-through mtd: sa1100: Mark expected switch fall-through drm/sun4i: tcon: Mark expected switch fall-through drm/sun4i: sun6i_mipi_dsi: Mark expected switch fall-through ARM: riscpc: Mark expected switch fall-through dmaengine: fsldma: Mark expected switch fall-through commit e5b7c167e46f7b412aeafc91c22805eb76b91ad4 Merge: e8c3fa9f4d3b 9cdde8580483 Author: Linus Torvalds Date: Thu Aug 22 11:17:20 2019 -0700 Merge tag 'tag-chrome-platform-fixes-for-v5.3-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/chrome-platform/linux Pull chrome platform fix from Benson Leung: "Fix a kernel crash during suspend/resume of cros_ec_ishtp" * tag 'tag-chrome-platform-fixes-for-v5.3-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/chrome-platform/linux: platform/chrome: cros_ec_ishtp: fix crash during suspend commit e8c3fa9f4d3b9c56ee9436c310318a8165d695c1 Merge: bb7ba8069de9 7533be858f5b Author: Linus Torvalds Date: Thu Aug 22 11:12:33 2019 -0700 Merge tag 'afs-fixes-20190822' of git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs Pull AFS fixes from David Howells: - Fix a cell record leak due to the default error not being cleared. - Fix an oops in tracepoint due to a pointer that may contain an error. - Fix the ACL storage op for YFS where the wrong op definition is being used. By luck, this only actually affects the information appearing in traces. * tag 'afs-fixes-20190822' of git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs: afs: use correct afs_call_type in yfs_fs_store_opaque_acl2 afs: Fix possible oops in afs_lookup trace event afs: Fix leak in afs_lookup_cell_rcu() commit 0af83abbd4a6e36a4b209d8c57c26143e40eeec1 Author: Liu Song Date: Tue Aug 6 22:21:40 2019 +0800 ubifs: Limit the number of pages in shrink_liability If the number of dirty pages to be written back is large, then writeback_inodes_sb will block waiting for a long time, causing hung task detection alarm. Therefore, we should limit the maximum number of pages written back this time, which let the budget be completed faster. The remaining dirty pages tend to rely on the writeback mechanism to complete the synchronization. Fixes: b6e51316daed ("writeback: separate starting of sync vs opportunistic writeback") Signed-off-by: Liu Song Signed-off-by: Richard Weinberger commit 377e208f44784174f3002d9892d553715a3ab71b Author: Richard Weinberger Date: Tue Aug 13 23:55:48 2019 +0200 ubifs: Correctly initialize c->min_log_bytes Currently on a freshly mounted UBIFS, c->min_log_bytes is 0. This can lead to a log overrun and make commits fail. Recent kernels will report the following assert: UBIFS assert failed: c->lhead_lnum != c->ltail_lnum, in fs/ubifs/log.c:412 c->min_log_bytes can have two states, 0 and c->leb_size. It controls how much bytes of the log area are reserved for non-bud nodes such as commit nodes. After a commit it has to be set to c->leb_size such that we have always enough space for a commit. While a commit runs it can be 0 to make the remaining bytes of the log available to writers. Having it set to 0 right after mount is wrong since no space for commits is reserved. Fixes: 1e51764a3c2ac ("UBIFS: add new flash file system") Reported-and-tested-by: Uwe Kleine-König Signed-off-by: Richard Weinberger commit 4dd75b335bc1f10fb1a01b5cd58870d47c13c4e7 Author: Richard Weinberger Date: Tue Aug 13 23:50:51 2019 +0200 ubifs: Fix double unlock around orphan_delete() We unlock after orphan_delete(), so no need to unlock in the function too. Reported-by: Han Xu Fixes: 8009ce956c3d ("ubifs: Don't leak orphans on memory during commit") Signed-off-by: Richard Weinberger commit 7542c6dedbc1caa284ca4cbd6b64f99023ff1b97 Author: Masahiro Yamada Date: Tue Jun 18 12:09:26 2019 +0900 jffs2: Remove C++ style comments from uapi header Linux kernel tolerates C++ style comments these days. Actually, the SPDX License tags for .c files start with //. On the other hand, uapi headers are written in more strict C, where the C++ comment style is forbidden. I simply dropped these lines instead of fixing the comment style. This code has been always commented out since it was added around Linux 2.4.9 (i.e. commented out for more than 17 years). 'Maybe later...' will never happen. Signed-off-by: Masahiro Yamada Acked-by: Richard Weinberger Signed-off-by: Richard Weinberger commit fab4f97e1fe33cf08e58c09cf9eee334857d9fe7 Author: Bernard Metzler Date: Thu Aug 22 17:07:41 2019 +0200 RDMA/siw: Fix SGL mapping issues All user level and most in-kernel applications submit WQEs where the SG list entries are all of a single type. iSER in particular, however, will send us WQEs with mixed SG types: sge[0] = kernel buffer, sge[1] = PBL region. Check and set is_kva on each SG entry individually instead of assuming the first SGE type carries through to the last. This fixes iSER over siw. Fixes: b9be6f18cf9e ("rdma/siw: transmit path") Reported-by: Krishnamraju Eraparaju Tested-by: Krishnamraju Eraparaju Signed-off-by: Bernard Metzler Link: https://lore.kernel.org/r/20190822150741.21871-1-bmt@zurich.ibm.com Signed-off-by: Doug Ledford commit d37b1e534071ab1983e7c85273234b132c77591a Author: Selvin Xavier Date: Thu Aug 22 03:02:50 2019 -0700 RDMA/bnxt_re: Fix stack-out-of-bounds in bnxt_qplib_rcfw_send_message Driver copies FW commands to the HW queue as units of 16 bytes. Some of the command structures are not exact multiple of 16. So while copying the data from those structures, the stack out of bounds messages are reported by KASAN. The following error is reported. [ 1337.530155] ================================================================== [ 1337.530277] BUG: KASAN: stack-out-of-bounds in bnxt_qplib_rcfw_send_message+0x40a/0x850 [bnxt_re] [ 1337.530413] Read of size 16 at addr ffff888725477a48 by task rmmod/2785 [ 1337.530540] CPU: 5 PID: 2785 Comm: rmmod Tainted: G OE 5.2.0-rc6+ #75 [ 1337.530541] Hardware name: Dell Inc. PowerEdge R730/0599V5, BIOS 1.0.4 08/28/2014 [ 1337.530542] Call Trace: [ 1337.530548] dump_stack+0x5b/0x90 [ 1337.530556] ? bnxt_qplib_rcfw_send_message+0x40a/0x850 [bnxt_re] [ 1337.530560] print_address_description+0x65/0x22e [ 1337.530568] ? bnxt_qplib_rcfw_send_message+0x40a/0x850 [bnxt_re] [ 1337.530575] ? bnxt_qplib_rcfw_send_message+0x40a/0x850 [bnxt_re] [ 1337.530577] __kasan_report.cold.3+0x37/0x77 [ 1337.530581] ? _raw_write_trylock+0x10/0xe0 [ 1337.530588] ? bnxt_qplib_rcfw_send_message+0x40a/0x850 [bnxt_re] [ 1337.530590] kasan_report+0xe/0x20 [ 1337.530592] memcpy+0x1f/0x50 [ 1337.530600] bnxt_qplib_rcfw_send_message+0x40a/0x850 [bnxt_re] [ 1337.530608] ? bnxt_qplib_creq_irq+0xa0/0xa0 [bnxt_re] [ 1337.530611] ? xas_create+0x3aa/0x5f0 [ 1337.530613] ? xas_start+0x77/0x110 [ 1337.530615] ? xas_clear_mark+0x34/0xd0 [ 1337.530623] bnxt_qplib_free_mrw+0x104/0x1a0 [bnxt_re] [ 1337.530631] ? bnxt_qplib_destroy_ah+0x110/0x110 [bnxt_re] [ 1337.530633] ? bit_wait_io_timeout+0xc0/0xc0 [ 1337.530641] bnxt_re_dealloc_mw+0x2c/0x60 [bnxt_re] [ 1337.530648] bnxt_re_destroy_fence_mr+0x77/0x1d0 [bnxt_re] [ 1337.530655] bnxt_re_dealloc_pd+0x25/0x60 [bnxt_re] [ 1337.530677] ib_dealloc_pd_user+0xbe/0xe0 [ib_core] [ 1337.530683] srpt_remove_one+0x5de/0x690 [ib_srpt] [ 1337.530689] ? __srpt_close_all_ch+0xc0/0xc0 [ib_srpt] [ 1337.530692] ? xa_load+0x87/0xe0 ... [ 1337.530840] do_syscall_64+0x6d/0x1f0 [ 1337.530843] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 1337.530845] RIP: 0033:0x7ff5b389035b [ 1337.530848] Code: 73 01 c3 48 8b 0d 2d 0b 2c 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa b8 b0 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d fd 0a 2c 00 f7 d8 64 89 01 48 [ 1337.530849] RSP: 002b:00007fff83425c28 EFLAGS: 00000206 ORIG_RAX: 00000000000000b0 [ 1337.530852] RAX: ffffffffffffffda RBX: 00005596443e6750 RCX: 00007ff5b389035b [ 1337.530853] RDX: 000000000000000a RSI: 0000000000000800 RDI: 00005596443e67b8 [ 1337.530854] RBP: 0000000000000000 R08: 00007fff83424ba1 R09: 0000000000000000 [ 1337.530856] R10: 00007ff5b3902960 R11: 0000000000000206 R12: 00007fff83425e50 [ 1337.530857] R13: 00007fff8342673c R14: 00005596443e6260 R15: 00005596443e6750 [ 1337.530885] The buggy address belongs to the page: [ 1337.530962] page:ffffea001c951dc0 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 [ 1337.530964] flags: 0x57ffffc0000000() [ 1337.530967] raw: 0057ffffc0000000 0000000000000000 ffffffff1c950101 0000000000000000 [ 1337.530970] raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 [ 1337.530970] page dumped because: kasan: bad access detected [ 1337.530996] Memory state around the buggy address: [ 1337.531072] ffff888725477900: 00 00 00 00 f1 f1 f1 f1 00 00 00 00 00 f2 f2 f2 [ 1337.531180] ffff888725477980: 00 00 00 00 00 00 00 00 00 00 00 f1 f1 f1 f1 00 [ 1337.531288] >ffff888725477a00: 00 f2 f2 f2 f2 f2 f2 00 00 00 f2 00 00 00 00 00 [ 1337.531393] ^ [ 1337.531478] ffff888725477a80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 1337.531585] ffff888725477b00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 1337.531691] ================================================================== Fix this by passing the exact size of each FW command to bnxt_qplib_rcfw_send_message as req->cmd_size. Before sending the command to HW, modify the req->cmd_size to number of 16 byte units. Fixes: 1ac5a4047975 ("RDMA/bnxt_re: Add bnxt_re RoCE driver") Signed-off-by: Selvin Xavier Link: https://lore.kernel.org/r/1566468170-489-1-git-send-email-selvin.xavier@broadcom.com Signed-off-by: Doug Ledford commit 7533be858f5b9a036b9f91556a3ed70786abca8e Author: YueHaibing Date: Mon Aug 19 16:05:31 2019 +0100 afs: use correct afs_call_type in yfs_fs_store_opaque_acl2 It seems that 'yfs_RXYFSStoreOpaqueACL2' should be use in yfs_fs_store_opaque_acl2(). Fixes: f5e4546347bc ("afs: Implement YFS ACL setting") Signed-off-by: YueHaibing Signed-off-by: David Howells commit c4c613ff08d92e72bf64a65ec35a2c3aa1cfcd06 Author: Marc Dionne Date: Thu Aug 22 13:28:43 2019 +0100 afs: Fix possible oops in afs_lookup trace event The afs_lookup trace event can cause the following: [ 216.576777] BUG: kernel NULL pointer dereference, address: 000000000000023b [ 216.576803] #PF: supervisor read access in kernel mode [ 216.576813] #PF: error_code(0x0000) - not-present page ... [ 216.576913] RIP: 0010:trace_event_raw_event_afs_lookup+0x9e/0x1c0 [kafs] If the inode from afs_do_lookup() is an error other than ENOENT, or if it is ENOENT and afs_try_auto_mntpt() returns an error, the trace event will try to dereference the error pointer as a valid pointer. Use IS_ERR_OR_NULL to only pass a valid pointer for the trace, or NULL. Ideally the trace would include the error value, but for now just avoid the oops. Fixes: 80548b03991f ("afs: Add more tracepoints") Signed-off-by: Marc Dionne Signed-off-by: David Howells commit a5fb8e6c02d6a518fb2b1a2b8c2471fa77b69436 Author: David Howells Date: Thu Aug 22 13:28:43 2019 +0100 afs: Fix leak in afs_lookup_cell_rcu() Fix a leak on the cell refcount in afs_lookup_cell_rcu() due to non-clearance of the default error in the case a NULL cell name is passed and the workstation default cell is used. Also put a bit at the end to make sure we don't leak a cell ref if we're going to be returning an error. This leak results in an assertion like the following when the kafs module is unloaded: AFS: Assertion failed 2 == 1 is false 0x2 == 0x1 is false ------------[ cut here ]------------ kernel BUG at fs/afs/cell.c:770! ... RIP: 0010:afs_manage_cells+0x220/0x42f [kafs] ... process_one_work+0x4c2/0x82c ? pool_mayday_timeout+0x1e1/0x1e1 ? do_raw_spin_lock+0x134/0x175 worker_thread+0x336/0x4a6 ? rescuer_thread+0x4af/0x4af kthread+0x1de/0x1ee ? kthread_park+0xd4/0xd4 ret_from_fork+0x24/0x30 Fixes: 989782dcdc91 ("afs: Overhaul cell database management") Signed-off-by: David Howells commit 2113c5f62b7423e4a72b890bd479704aa85c81ba Author: Andrew Jones Date: Thu Aug 22 13:03:05 2019 +0200 KVM: arm/arm64: Only skip MMIO insn once If after an MMIO exit to userspace a VCPU is immediately run with an immediate_exit request, such as when a signal is delivered or an MMIO emulation completion is needed, then the VCPU completes the MMIO emulation and immediately returns to userspace. As the exit_reason does not get changed from KVM_EXIT_MMIO in these cases we have to be careful not to complete the MMIO emulation again, when the VCPU is eventually run again, because the emulation does an instruction skip (and doing too many skips would be a waste of guest code :-) We need to use additional VCPU state to track if the emulation is complete. As luck would have it, we already have 'mmio_needed', which even appears to be used in this way by other architectures already. Fixes: 0d640732dbeb ("arm64: KVM: Skip MMIO insn after emulation") Acked-by: Mark Rutland Signed-off-by: Andrew Jones Signed-off-by: Marc Zyngier commit 7871aa60ae0086fe4626abdf5ed13eeddf306c61 Author: Eugen Hristev Date: Thu Aug 8 08:35:40 2019 +0000 mmc: sdhci-of-at91: add quirk for broken HS200 HS200 is not implemented in the driver, but the controller claims it through caps. Remove it via a quirk, to make sure the mmc core do not try to enable HS200, as it causes the eMMC initialization to fail. Signed-off-by: Eugen Hristev Acked-by: Ludovic Desroches Acked-by: Adrian Hunter Fixes: bb5f8ea4d514 ("mmc: sdhci-of-at91: introduce driver for the Atmel SDMMC") Cc: stable@vger.kernel.org # v4.4+ Signed-off-by: Ulf Hansson commit a561372405cf6bc6f14239b3a9e57bb39f2788b0 Author: Ilya Dryomov Date: Tue Aug 20 16:40:33 2019 +0200 libceph: fix PG split vs OSD (re)connect race We can't rely on ->peer_features in calc_target() because it may be called both when the OSD session is established and open and when it's not. ->peer_features is not valid unless the OSD session is open. If this happens on a PG split (pg_num increase), that could mean we don't resend a request that should have been resent, hanging the client indefinitely. In userspace this was fixed by looking at require_osd_release and get_xinfo[osd].features fields of the osdmap. However these fields belong to the OSD section of the osdmap, which the kernel doesn't decode (only the client section is decoded). Instead, let's drop this feature check. It effectively checks for luminous, so only pre-luminous OSDs would be affected in that on a PG split the kernel might resend a request that should not have been resent. Duplicates can occur in other scenarios, so both sides should already be prepared for them: see dup/replay logic on the OSD side and retry_attempt check on the client side. Cc: stable@vger.kernel.org Fixes: 7de030d6b10a ("libceph: resend on PG splits if OSD has RESEND_ON_SPLIT") Link: https://tracker.ceph.com/issues/41162 Reported-by: Jerry Lee Signed-off-by: Ilya Dryomov Tested-by: Jerry Lee Reviewed-by: Jeff Layton commit 28a282616f56990547b9dcd5c6fbd2001344664c Author: Jeff Layton Date: Thu Aug 15 06:23:38 2019 -0400 ceph: don't try fill file_lock on unsuccessful GETFILELOCK reply When ceph_mdsc_do_request returns an error, we can't assume that the filelock_reply pointer will be set. Only try to fetch fields out of the r_reply_info when it returns success. Cc: stable@vger.kernel.org Reported-by: Hector Martin Signed-off-by: Jeff Layton Reviewed-by: "Yan, Zheng" Signed-off-by: Ilya Dryomov commit c95f1c5f436badb9bb87e9b30fd573f6b3d59423 Author: Erqi Chen Date: Wed Jul 24 10:26:09 2019 +0800 ceph: clear page dirty before invalidate page clear_page_dirty_for_io(page) before mapping->a_ops->invalidatepage(). invalidatepage() clears page's private flag, if dirty flag is not cleared, the page may cause BUG_ON failure in ceph_set_page_dirty(). Cc: stable@vger.kernel.org Link: https://tracker.ceph.com/issues/40862 Signed-off-by: Erqi Chen Reviewed-by: Jeff Layton Signed-off-by: Ilya Dryomov commit af8a85a41734f37b67ba8ce69d56b685bee4ac48 Author: Luis Henriques Date: Fri Jul 19 15:32:22 2019 +0100 ceph: fix buffer free while holding i_ceph_lock in fill_inode() Calling ceph_buffer_put() in fill_inode() may result in freeing the i_xattrs.blob buffer while holding the i_ceph_lock. This can be fixed by postponing the call until later, when the lock is released. The following backtrace was triggered by fstests generic/070. BUG: sleeping function called from invalid context at mm/vmalloc.c:2283 in_atomic(): 1, irqs_disabled(): 0, pid: 3852, name: kworker/0:4 6 locks held by kworker/0:4/3852: #0: 000000004270f6bb ((wq_completion)ceph-msgr){+.+.}, at: process_one_work+0x1b8/0x5f0 #1: 00000000eb420803 ((work_completion)(&(&con->work)->work)){+.+.}, at: process_one_work+0x1b8/0x5f0 #2: 00000000be1c53a4 (&s->s_mutex){+.+.}, at: dispatch+0x288/0x1476 #3: 00000000559cb958 (&mdsc->snap_rwsem){++++}, at: dispatch+0x2eb/0x1476 #4: 000000000d5ebbae (&req->r_fill_mutex){+.+.}, at: dispatch+0x2fc/0x1476 #5: 00000000a83d0514 (&(&ci->i_ceph_lock)->rlock){+.+.}, at: fill_inode.isra.0+0xf8/0xf70 CPU: 0 PID: 3852 Comm: kworker/0:4 Not tainted 5.2.0+ #441 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.1-0-ga5cab58-prebuilt.qemu.org 04/01/2014 Workqueue: ceph-msgr ceph_con_workfn Call Trace: dump_stack+0x67/0x90 ___might_sleep.cold+0x9f/0xb1 vfree+0x4b/0x60 ceph_buffer_release+0x1b/0x60 fill_inode.isra.0+0xa9b/0xf70 ceph_fill_trace+0x13b/0xc70 ? dispatch+0x2eb/0x1476 dispatch+0x320/0x1476 ? __mutex_unlock_slowpath+0x4d/0x2a0 ceph_con_workfn+0xc97/0x2ec0 ? process_one_work+0x1b8/0x5f0 process_one_work+0x244/0x5f0 worker_thread+0x4d/0x3e0 kthread+0x105/0x140 ? process_one_work+0x5f0/0x5f0 ? kthread_park+0x90/0x90 ret_from_fork+0x3a/0x50 Signed-off-by: Luis Henriques Reviewed-by: Jeff Layton Signed-off-by: Ilya Dryomov commit 12fe3dda7ed89c95cc0ef7abc001ad1ad3e092f8 Author: Luis Henriques Date: Fri Jul 19 15:32:21 2019 +0100 ceph: fix buffer free while holding i_ceph_lock in __ceph_build_xattrs_blob() Calling ceph_buffer_put() in __ceph_build_xattrs_blob() may result in freeing the i_xattrs.blob buffer while holding the i_ceph_lock. This can be fixed by having this function returning the old blob buffer and have the callers of this function freeing it when the lock is released. The following backtrace was triggered by fstests generic/117. BUG: sleeping function called from invalid context at mm/vmalloc.c:2283 in_atomic(): 1, irqs_disabled(): 0, pid: 649, name: fsstress 4 locks held by fsstress/649: #0: 00000000a7478e7e (&type->s_umount_key#19){++++}, at: iterate_supers+0x77/0xf0 #1: 00000000f8de1423 (&(&ci->i_ceph_lock)->rlock){+.+.}, at: ceph_check_caps+0x7b/0xc60 #2: 00000000562f2b27 (&s->s_mutex){+.+.}, at: ceph_check_caps+0x3bd/0xc60 #3: 00000000f83ce16a (&mdsc->snap_rwsem){++++}, at: ceph_check_caps+0x3ed/0xc60 CPU: 1 PID: 649 Comm: fsstress Not tainted 5.2.0+ #439 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.1-0-ga5cab58-prebuilt.qemu.org 04/01/2014 Call Trace: dump_stack+0x67/0x90 ___might_sleep.cold+0x9f/0xb1 vfree+0x4b/0x60 ceph_buffer_release+0x1b/0x60 __ceph_build_xattrs_blob+0x12b/0x170 __send_cap+0x302/0x540 ? __lock_acquire+0x23c/0x1e40 ? __mark_caps_flushing+0x15c/0x280 ? _raw_spin_unlock+0x24/0x30 ceph_check_caps+0x5f0/0xc60 ceph_flush_dirty_caps+0x7c/0x150 ? __ia32_sys_fdatasync+0x20/0x20 ceph_sync_fs+0x5a/0x130 iterate_supers+0x8f/0xf0 ksys_sync+0x4f/0xb0 __ia32_sys_sync+0xa/0x10 do_syscall_64+0x50/0x1c0 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x7fc6409ab617 Signed-off-by: Luis Henriques Reviewed-by: Jeff Layton Signed-off-by: Ilya Dryomov commit 86968ef21596515958d5f0a40233d02be78ecec0 Author: Luis Henriques Date: Fri Jul 19 15:32:20 2019 +0100 ceph: fix buffer free while holding i_ceph_lock in __ceph_setxattr() Calling ceph_buffer_put() in __ceph_setxattr() may end up freeing the i_xattrs.prealloc_blob buffer while holding the i_ceph_lock. This can be fixed by postponing the call until later, when the lock is released. The following backtrace was triggered by fstests generic/117. BUG: sleeping function called from invalid context at mm/vmalloc.c:2283 in_atomic(): 1, irqs_disabled(): 0, pid: 650, name: fsstress 3 locks held by fsstress/650: #0: 00000000870a0fe8 (sb_writers#8){.+.+}, at: mnt_want_write+0x20/0x50 #1: 00000000ba0c4c74 (&type->i_mutex_dir_key#6){++++}, at: vfs_setxattr+0x55/0xa0 #2: 000000008dfbb3f2 (&(&ci->i_ceph_lock)->rlock){+.+.}, at: __ceph_setxattr+0x297/0x810 CPU: 1 PID: 650 Comm: fsstress Not tainted 5.2.0+ #437 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.1-0-ga5cab58-prebuilt.qemu.org 04/01/2014 Call Trace: dump_stack+0x67/0x90 ___might_sleep.cold+0x9f/0xb1 vfree+0x4b/0x60 ceph_buffer_release+0x1b/0x60 __ceph_setxattr+0x2b4/0x810 __vfs_setxattr+0x66/0x80 __vfs_setxattr_noperm+0x59/0xf0 vfs_setxattr+0x81/0xa0 setxattr+0x115/0x230 ? filename_lookup+0xc9/0x140 ? rcu_read_lock_sched_held+0x74/0x80 ? rcu_sync_lockdep_assert+0x2e/0x60 ? __sb_start_write+0x142/0x1a0 ? mnt_want_write+0x20/0x50 path_setxattr+0xba/0xd0 __x64_sys_lsetxattr+0x24/0x30 do_syscall_64+0x50/0x1c0 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x7ff23514359a Signed-off-by: Luis Henriques Reviewed-by: Jeff Layton Signed-off-by: Ilya Dryomov commit 5c498950f730aa17c5f8a2cdcb903524e4002ed2 Author: Luis Henriques Date: Fri Jul 19 15:32:19 2019 +0100 libceph: allow ceph_buffer_put() to receive a NULL ceph_buffer Signed-off-by: Luis Henriques Reviewed-by: Jeff Layton Signed-off-by: Ilya Dryomov commit f9f0e9ed350e15d51ad07364b4cf910de50c472a Author: Takashi Iwai Date: Tue Aug 20 21:43:42 2019 +0200 ALSA: usb-audio: Check mixer unit bitmap yet more strictly The bmControls (for UAC1) or bmMixerControls (for UAC2/3) bitmap has a variable size depending on both input and output pins. Its size is to fit with input * output bits. The problem is that the input size can't be determined simply from the unit descriptor itself but it needs to parse the whole connected sources. Although the uac_mixer_unit_get_channels() tries to check some possible overflow of this bitmap, it's incomplete due to the lack of the evaluation of input pins. For covering possible overflows, this patch adds the bitmap overflow check in the loop of input pins in parse_audio_mixer_unit(). Fixes: 0bfe5e434e66 ("ALSA: usb-audio: Check mixer unit descriptors more strictly") Cc: Signed-off-by: Takashi Iwai commit 5871cd93692c8071fb9358daccb715b5081316ac Author: Gary R Hook Date: Mon Aug 19 22:23:27 2019 +0000 crypto: ccp - Ignore unconfigured CCP device on suspend/resume If a CCP is unconfigured (e.g. there are no available queues) then there will be no data structures allocated for the device. Thus, we must check for validity of a pointer before trying to access structure members. Fixes: 720419f01832f ("crypto: ccp - Introduce the AMD Secure Processor device") Cc: Signed-off-by: Gary R Hook Signed-off-by: Herbert Xu commit 7035eef4496d95b69b0bc18e0bced09304e0afdf Author: Song Liu Date: Wed Aug 21 11:45:25 2019 -0700 md: update MAINTAINERS info I have been reviewing patches for md in the past few months. Mark me as the MD maintainer, as I have effectively been filling that role. Cc: NeilBrown Signed-off-by: Song Liu Signed-off-by: Jens Axboe commit cc07db5a5b100bc8eaab5097a23d72f858979750 Author: Dan Carpenter Date: Tue Aug 20 12:11:44 2019 +0300 gve: Copy and paste bug in gve_get_stats() There is a copy and paste error so we have "rx" where "tx" was intended in the priv->tx[] array. Fixes: f5cedc84a30d ("gve: Add transmit and receive support") Signed-off-by: Dan Carpenter Reviewed-by: Catherine Sullivan Signed-off-by: David S. Miller commit 0f404bbdaf1624f4d25dd67da7ff85eab005beac Author: Li RongQing Date: Tue Aug 20 10:46:00 2019 +0800 net: fix icmp_socket_deliver argument 2 input it expects a unsigned int, but got a __be32 Signed-off-by: Li RongQing Signed-off-by: Zhang Yu Signed-off-by: David S. Miller commit f17f7648a49aa6728649ddf79bdbcac4f1970ce4 Author: Hangbin Liu Date: Tue Aug 20 10:19:47 2019 +0800 ipv6/addrconf: allow adding multicast addr if IFA_F_MCAUTOJOIN is set In commit 93a714d6b53d ("multicast: Extend ip address command to enable multicast group join/leave on") we added a new flag IFA_F_MCAUTOJOIN to make user able to add multicast address on ethernet interface. This works for IPv4, but not for IPv6. See the inet6_addr_add code. static int inet6_addr_add() { ... if (cfg->ifa_flags & IFA_F_MCAUTOJOIN) { ipv6_mc_config(net->ipv6.mc_autojoin_sk, true...) } ifp = ipv6_add_addr(idev, cfg, true, extack); <- always fail with maddr if (!IS_ERR(ifp)) { ... } else if (cfg->ifa_flags & IFA_F_MCAUTOJOIN) { ipv6_mc_config(net->ipv6.mc_autojoin_sk, false...) } } But in ipv6_add_addr() it will check the address type and reject multicast address directly. So this feature is never worked for IPv6. We should not remove the multicast address check totally in ipv6_add_addr(), but could accept multicast address only when IFA_F_MCAUTOJOIN flag supplied. v2: update commit description Fixes: 93a714d6b53d ("multicast: Extend ip address command to enable multicast group join/leave on") Reported-by: Jianlin Shi Signed-off-by: Hangbin Liu Signed-off-by: David S. Miller commit 738a2e4b1774fe0d20d6c027a7cbafb6a1619675 Author: Florian Fainelli Date: Wed Aug 21 17:07:46 2019 -0700 net: dsa: bcm_sf2: Do not configure PHYLINK on CPU port The SF2 binding does not specify that the CPU port should have properties mandatory for successfully instantiating a PHYLINK object. As such, there will be missing properties (including fixed-link) and when attempting to validate and later configure link modes, we will have an incorrect set of parameters (interface, speed, duplex). Simply prevent the CPU port from being configured through PHYLINK since bcm_sf2_imp_setup() takes care of that already. Fixes: 0e27921816ad ("net: dsa: Use PHYLINK for the CPU/DSA ports") Signed-off-by: Florian Fainelli Signed-off-by: David S. Miller commit 1e85e6cad2d1a63d71353b9d3c338e703bbeea19 Merge: 2ba552b29b54 ec6e491353b9 Author: Dave Airlie Date: Thu Aug 22 12:59:10 2019 +1000 Merge tag 'drm-fixes-5.3-2019-08-21' of git://people.freedesktop.org/~agd5f/linux into drm-fixes drm-fixes-5.3-2019-08-21: amdgpu: - Fix gfxoff logic on RV - Powerplay fixes - Fix a possible memory leak in CS ioctl - bpc fix for display Signed-off-by: Dave Airlie From: Alex Deucher Link: https://patchwork.freedesktop.org/patch/msgid/20190822021022.3356-1-alexander.deucher@amd.com commit 2ba552b29b5407337ece2d2606805a888b800a4b Merge: 14673e153926 165d42c012be Author: Dave Airlie Date: Thu Aug 22 12:56:32 2019 +1000 Merge tag 'mediatek-drm-fixes-5.3' of https://github.com/ckhu-mediatek/linux.git-tags into drm-fixes Mediatek memory leak drm fix for Linux 5.3 Signed-off-by: Dave Airlie From: CK Hu Link: https://patchwork.freedesktop.org/patch/msgid/1566264270.30493.4.camel@mtksdaap41 commit 14673e153926d3ad89e303345d1412cd7bd7c9dd Merge: d1abaeb3be7b a53358a31c98 Author: Dave Airlie Date: Thu Aug 22 12:53:23 2019 +1000 Merge tag 'du-fixes-20190816' of git://linuxtv.org/pinchartl/media into drm-fixes R-Car LVDS encoder fix Signed-off-by: Dave Airlie From: Laurent Pinchart Link: https://patchwork.freedesktop.org/patch/msgid/20190816130115.GH5020@pendragon.ideasonboard.com commit ec6e491353b9024d4b1a65c48b21e3bc0faeae4e Author: Nicholas Kazlauskas Date: Wed Aug 21 11:27:13 2019 -0400 drm/amd/display: Calculate bpc based on max_requested_bpc [Why] The only place where state->max_bpc is updated on the connector is at the start of atomic check during drm_atomic_connector_check. It isn't updated when adding the connectors to the atomic state after the fact. It also doesn't necessarily reflect the right value when called in amdgpu during mode validation outside of atomic check. This can cause the wrong bpc to be used even if the max_requested_bpc is the correct value. [How] Don't rely on state->max_bpc reflecting the real bpc value and just do the min(...) based on display info bpc and max_requested_bpc. Fixes: 01933ba42d3d ("drm/amd/display: Use current connector state if NULL when checking bpc") Signed-off-by: Nicholas Kazlauskas Reviewed-by: Leo Li Signed-off-by: Alex Deucher commit 1a701ea924815b0518733aa8d5d05c1f6fa87062 Author: Nicolai Hähnle Date: Tue Aug 20 15:39:53 2019 +0200 drm/amdgpu: prevent memory leaks in AMDGPU_CS ioctl Error out if the AMDGPU_CS ioctl is called with multiple SYNCOBJ_OUT and/or TIMELINE_SIGNAL chunks, since otherwise the last chunk wins while the allocated array as well as the reference counts of sync objects are leaked. Signed-off-by: Nicolai Hähnle Reviewed-by: Christian König Signed-off-by: Alex Deucher commit 221a2bdbd5d3871a5f41d912b2f06cc02e8f8b38 Author: Kenneth Feng Date: Tue Aug 20 15:11:37 2019 +0800 drm/amd/amdgpu: disable MMHUB PG for navi10 Disable MMHUB PG for navi10 according to the production requirement. Signed-off-by: Kenneth Feng Reviewed-by: Hawking Zhang Reviewed-by: Kevin Wang Signed-off-by: Alex Deucher commit 155f85c0d56896552439fd4fb5f43dfc4e9f842a Author: Kevin Wang Date: Tue Aug 20 13:28:51 2019 +0800 drm/amd/powerplay: remove duplicate macro smu_get_uclk_dpm_states in amdgpu_smu.h remove duplicate macro smu_get_uclk_dpm_states in amdgpu_smu.h " #define smu_get_uclk_dpm_states(smu, clocks_in_khz, num_states) \ ((smu)->ppt_funcs->get_uclk_dpm_states ? (smu)->ppt_funcs->get_uclk_dpm_states((smu), (clocks_in_khz), (num_states)) : 0) #define smu_get_max_sustainable_clocks_by_dc(smu, max_clocks) \ ((smu)->funcs->get_max_sustainable_clocks_by_dc ? (smu)->funcs->get_max_sustainable_clocks_by_dc((smu), (max_clocks)) : 0) #define smu_get_uclk_dpm_states(smu, clocks_in_khz, num_states) \ ((smu)->ppt_funcs->get_uclk_dpm_states ? (smu)->ppt_funcs->get_uclk_dpm_states((smu), (clocks_in_khz), (num_states)) : 0) " Signed-off-by: Kevin Wang Reviewed-by: Huang Rui Signed-off-by: Alex Deucher commit 00430144ff7343369222a110985aaa6726fb26e0 Author: Kevin Wang Date: Mon Aug 19 23:38:02 2019 +0800 drm/amd/powerplay: fix variable type errors in smu_v11_0_setup_pptable fix size type errors, from uint32_t to uint16_t. it will cause only initializes the highest 16 bits in smu_get_atom_data_table function. bug report: This fixes the following static checker warning. drivers/gpu/drm/amd/amdgpu/../powerplay/smu_v11_0.c:390 smu_v11_0_setup_pptable() warn: passing casted pointer '&size' to 'smu_get_atom_data_table()' 32 vs 16. Signed-off-by: Kevin Wang Reported-by: Dan Carpenter Reviewed-by: Evan Quan Signed-off-by: Alex Deucher commit 98f58ada2d37e68125c056f1fc005748251879c2 Author: Alex Deucher Date: Thu Aug 15 08:27:09 2019 -0500 drm/amdgpu/gfx9: update pg_flags after determining if gfx off is possible We need to set certain power gating flags after we determine if the firmware version is sufficient to support gfxoff. Previously we set the pg flags in early init, but we later we might have disabled gfxoff if the firmware versions didn't support it. Move adding the additional pg flags after we determine whether or not to support gfxoff. Fixes: 005440066f92 ("drm/amdgpu: enable gfxoff again on raven series (v2)") Tested-by: Kai-Heng Feng Tested-by: Tom St Denis Signed-off-by: Alex Deucher Cc: Kai-Heng Feng Cc: stable@vger.kernel.org commit 2d683eaaeeb9d33d23674ae635e0ef1448523d18 Author: Antoine Tenart Date: Wed Aug 21 16:41:23 2019 +0200 net: cpsw: fix NULL pointer exception in the probe error path In certain cases when the probe function fails the error path calls cpsw_remove_dt() before calling platform_set_drvdata(). This is an issue as cpsw_remove_dt() uses platform_get_drvdata() to retrieve the cpsw_common data and leds to a NULL pointer exception. This patches fixes it by calling platform_set_drvdata() earlier in the probe. Fixes: 83a8471ba255 ("net: ethernet: ti: cpsw: refactor probe to group common hw initialization") Reported-by: Maxime Chevallier Signed-off-by: Antoine Tenart Reviewed-by: Grygorii Strashko Signed-off-by: David S. Miller commit 6e2866a9dfc63ca86290ad789961239de1b25a80 Merge: aad12c239418 3ee1bb7aae97 Author: David S. Miller Date: Wed Aug 21 13:49:20 2019 -0700 Merge tag 'batadv-net-for-davem-20190821' of git://git.open-mesh.org/linux-merge Simon Wunderlich says: ==================== Here is a batman-adv bugfix: - fix uninit-value in batadv_netlink_get_ifindex(), by Eric Dumazet ==================== Signed-off-by: David S. Miller commit 7846f58fba964af7cb8cf77d4d13c33254725211 Author: John Hubbard Date: Wed Aug 21 12:25:13 2019 -0700 x86/boot: Fix boot regression caused by bootparam sanitizing commit a90118c445cc ("x86/boot: Save fields explicitly, zero out everything else") had two errors: * It preserved boot_params.acpi_rsdp_addr, and * It failed to preserve boot_params.hdr Therefore, zero out acpi_rsdp_addr, and preserve hdr. Fixes: a90118c445cc ("x86/boot: Save fields explicitly, zero out everything else") Reported-by: Neil MacLeod Suggested-by: Thomas Gleixner Signed-off-by: John Hubbard Signed-off-by: Thomas Gleixner Tested-by: Neil MacLeod Cc: stable@vger.kernel.org Link: https://lkml.kernel.org/r/20190821192513.20126-1-jhubbard@nvidia.com commit aad12c2394189f606ce0308ab65505fdd9081a10 Author: Mike Rapoport Date: Wed Aug 21 14:29:29 2019 +0300 trivial: netns: fix typo in 'struct net.passive' description Replace 'decided' with 'decide' so that comment would be /* To decide when the network namespace should be freed. */ Signed-off-by: Mike Rapoport Signed-off-by: David S. Miller commit 33dc03da87888d33b56ed4a74051df398b96e5d2 Merge: a1c4cd67840e 0d31d4dbf384 Author: David S. Miller Date: Wed Aug 21 13:01:16 2019 -0700 Merge tag 'mac80211-for-davem-2019-08-21' of git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211 Johannes Berg says: ==================== Just three fixes: * extended key ID key installation * regulatory processing * possible memory leak in an error path ==================== Signed-off-by: David S. Miller commit bb7ba8069de933d69cb45dd0a5806b61033796a3 Merge: 2babd34df229 e4427372398c Author: Linus Torvalds Date: Wed Aug 21 11:48:38 2019 -0700 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm Pull KVM fixes from Paolo Bonzini: "A couple bugfixes, and mostly selftests changes" * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: selftests/kvm: make platform_info_test pass on AMD Revert "KVM: x86/mmu: Zap only the relevant pages when removing a memslot" selftests: kvm: fix state save/load on processors without XSAVE selftests: kvm: fix vmx_set_nested_state_test selftests: kvm: provide common function to enable eVMCS selftests: kvm: do not try running the VM in vmx_set_nested_state_test KVM: x86: svm: remove redundant assignment of var new_entry MAINTAINERS: add KVM x86 reviewers MAINTAINERS: change list for KVM/s390 kvm: x86: skip populating logical dest map if apic is not sw enabled commit 1bc8d18c75fef3b478dbdfef722aae09e2a9fde7 Author: Takashi Iwai Date: Wed Aug 21 20:00:02 2019 +0200 ALSA: line6: Fix memory leak at line6_init_pcm() error path I forgot to release the allocated object at the early error path in line6_init_pcm(). For addressing it, slightly shuffle the code so that the PCM destructor (pcm->private_free) is assigned properly before all error paths. Fixes: 3450121997ce ("ALSA: line6: Fix write on zero-sized buffer") Cc: Signed-off-by: Takashi Iwai commit e4427372398c31f57450565de277f861a4db5b3b Author: Vitaly Kuznetsov Date: Mon Jun 10 19:22:55 2019 +0200 selftests/kvm: make platform_info_test pass on AMD test_msr_platform_info_disabled() generates EXIT_SHUTDOWN but VMCB state is undefined after that so an attempt to launch this guest again from test_msr_platform_info_enabled() fails. Reorder the tests to make test pass. Signed-off-by: Vitaly Kuznetsov Signed-off-by: Paolo Bonzini commit 2babd34df2294a72df02dc4a3745df3408147eba Merge: 15d90b242290 78e70e780b28 Author: Linus Torvalds Date: Wed Aug 21 10:04:38 2019 -0700 Merge tag 'nfsd-5.3-1' of git://linux-nfs.org/~bfields/linux Pull nfsd fixes from Bruce Fields: "Fix nfsd bugs: three in the new nfsd/clients/ code, one in the reply cache containerization" * tag 'nfsd-5.3-1' of git://linux-nfs.org/~bfields/linux: nfsd4: Fix kernel crash when reading proc file reply_cache_stats nfsd: initialize i_private before d_add nfsd: use i_wrlock instead of rcu for nfsdfs i_private nfsd: fix dentry leak upon mkdir failure. commit 08d676d1685c2a29e4d0e1b0242324e564d4589e Author: Henk van der Laan Date: Fri Aug 16 22:08:47 2019 +0200 usb-storage: Add new JMS567 revision to unusual_devs Revision 0x0117 suffers from an identical issue to earlier revisions, therefore it should be added to the quirks list. Signed-off-by: Henk van der Laan Cc: stable Link: https://lore.kernel.org/r/20190816200847.21366-1-opensource@henkvdlaan.com Signed-off-by: Greg Kroah-Hartman commit cbe85c88ce80fb92956a0793518d415864dcead8 Author: Peter Chen Date: Tue Aug 20 02:07:58 2019 +0000 usb: chipidea: udc: don't do hardware access if gadget has stopped After _gadget_stop_activity is executed, we can consider the hardware operation for gadget has finished, and the udc can be stopped and enter low power mode. So, any later hardware operations (from usb_ep_ops APIs or usb_gadget_ops APIs) should be considered invalid, any deinitializatons has been covered at _gadget_stop_activity. I meet this problem when I plug out usb cable from PC using mass_storage gadget, my callstack like: vbus interrupt->.vbus_session-> composite_disconnect ->pm_runtime_put_sync(&_gadget->dev), the composite_disconnect will call fsg_disable, but fsg_disable calls usb_ep_disable using async way, there are register accesses for usb_ep_disable. So sometimes, I get system hang due to visit register without clock, sometimes not. The Linux Kernel USB maintainer Alan Stern suggests this kinds of solution. See: http://marc.info/?l=linux-usb&m=138541769810983&w=2. Cc: #v4.9+ Signed-off-by: Peter Chen Link: https://lore.kernel.org/r/20190820020503.27080-2-peter.chen@nxp.com Signed-off-by: Greg Kroah-Hartman commit de7b9aa633b693e77942e12f1769506efae6917b Author: Oliver Neukum Date: Tue Aug 20 11:28:25 2019 +0200 usbtmc: more sanity checking for packet size A malicious device can make the driver divide ny zero with a nonsense maximum packet size. Signed-off-by: Oliver Neukum Cc: stable Link: https://lore.kernel.org/r/20190820092826.17694-1-oneukum@suse.com Signed-off-by: Greg Kroah-Hartman commit 3afa758cfb6efe0dc94dd8500add7222f503bfa5 Author: Gustavo A. R. Silva Date: Tue Aug 20 21:16:27 2019 -0500 usb: udc: lpc32xx: silence fall-through warning Silence the following fall-through warning by adding a break statement: drivers/usb/gadget/udc/lpc32xx_udc.c:2230:3: warning: this statement may fall through [-Wimplicit-fallthrough=] Signed-off-by: Gustavo A. R. Silva Link: https://lore.kernel.org/r/20190821021627.GA2679@embeddedor Signed-off-by: Greg Kroah-Hartman commit dc1a3e8e0cc6b2293b48c044710e63395aeb4fb4 Author: Wenwen Wang Date: Sun Aug 18 19:18:34 2019 -0500 dm raid: add missing cleanup in raid_ctr() If rs_prepare_reshape() fails, no cleanup is executed, leading to leak of the raid_set structure allocated at the beginning of raid_ctr(). To fix this issue, go to the label 'bad' if the error occurs. Fixes: 11e4723206683 ("dm raid: stop keeping raid set frozen altogether") Cc: stable@vger.kernel.org Signed-off-by: Wenwen Wang Signed-off-by: Mike Snitzer commit e0702d90b79d430b0ccc276ead4f88440bb51352 Author: Dan Carpenter Date: Mon Aug 19 12:58:14 2019 +0300 dm zoned: fix potential NULL dereference in dmz_do_reclaim() This function is supposed to return error pointers so it matches the dmz_get_rnd_zone_for_reclaim() function. The current code could lead to a NULL dereference in dmz_do_reclaim() Fixes: b234c6d7a703 ("dm zoned: improve error handling in reclaim") Signed-off-by: Dan Carpenter Reviewed-by: Dmitry Fomichev Signed-off-by: Mike Snitzer commit 08c04c84a5cde3af9baac0645a7496d6dcd76822 Author: Bryan Gurney Date: Fri Aug 16 10:09:53 2019 -0400 dm dust: use dust block size for badblocklist index Change the "frontend" dust_remove_block, dust_add_block, and dust_query_block functions to store the "dust block number", instead of the sector number corresponding to the "dust block number". For the "backend" functions dust_map_read and dust_map_write, right-shift by sect_per_block_shift. This fixes the inability to emulate failure beyond the first sector of each "dust block" (for devices with a "dust block size" larger than 512 bytes). Fixes: e4f3fabd67480bf ("dm: add dust target") Cc: stable@vger.kernel.org Signed-off-by: Bryan Gurney Signed-off-by: Mike Snitzer commit 3035bb72ee47d494c041465b4add9c6407c832ed Author: Anders Roxell Date: Tue Aug 20 15:41:21 2019 +0200 selftests/bpf: install files test_xdp_vlan.sh When ./test_xdp_vlan_mode_generic.sh runs it complains that it can't find file test_xdp_vlan.sh. # selftests: bpf: test_xdp_vlan_mode_generic.sh # ./test_xdp_vlan_mode_generic.sh: line 9: ./test_xdp_vlan.sh: No such file or directory Rework so that test_xdp_vlan.sh gets installed, added to the variable TEST_PROGS_EXTENDED. Fixes: d35661fcf95d ("selftests/bpf: add wrapper scripts for test_xdp_vlan.sh") Signed-off-by: Anders Roxell Acked-by: Jesper Dangaard Brouer Signed-off-by: Daniel Borkmann commit 0604409df9e04cdec7b08d471c8c1c0c10b5554d Author: Anders Roxell Date: Tue Aug 20 15:41:34 2019 +0200 selftests/bpf: add config fragment BPF_JIT When running test_kmod.sh the following shows up # sysctl cannot stat /proc/sys/net/core/bpf_jit_enable No such file or directory cannot: stat_/proc/sys/net/core/bpf_jit_enable # # sysctl cannot stat /proc/sys/net/core/bpf_jit_harden No such file or directory cannot: stat_/proc/sys/net/core/bpf_jit_harden # Rework to enable CONFIG_BPF_JIT to solve "No such file or directory" Signed-off-by: Anders Roxell Signed-off-by: Daniel Borkmann commit e91dcb536ae263ecff07118e36bf820c229a6ecd Author: Ilya Leoshkevich Date: Mon Aug 19 14:38:47 2019 +0200 selftests/bpf: fix test_btf_dump with O= test_btf_dump fails when run with O=, because it needs to access source files and assumes they live in ./progs/, which is not the case in this scenario. Fix by instructing kselftest to copy btf_dump_test_case_*.c files to the test directory. Since kselftest does not preserve directory structure, adjust the test to look in ./progs/ and then in ./. Signed-off-by: Ilya Leoshkevich Signed-off-by: Daniel Borkmann commit 806ce6e2117a42528e7bb979e04e28229b34a612 Author: Ilya Leoshkevich Date: Tue Aug 20 16:18:04 2019 +0200 selftests/bpf: fix test_cgroup_storage on s390 test_cgroup_storage fails on s390 with an assertion failure: packets are dropped when they shouldn't. The problem is that BPF_DW packet count is accessed as BPF_W with an offset of 0, which is not correct on big-endian machines. Since the point of this test is not to verify narrow loads/stores, simply use BPF_DW when working with packet counts. Fixes: 68cfa3ac6b8d ("selftests/bpf: add a cgroup storage test") Fixes: 919646d2a3a9 ("selftests/bpf: extend the storage test to test per-cpu cgroup storage") Signed-off-by: Ilya Leoshkevich Signed-off-by: Daniel Borkmann commit 0f686ca933597cfcc0636253fc1740423c062ec7 Author: Dmitry Osipenko Date: Fri Aug 9 01:24:30 2019 +0300 Revert "mmc: sdhci-tegra: drop ->get_ro() implementation" The WRITE_PROTECT bit is always in a "protected mode" on Tegra and WP-GPIO state need to be used instead. In a case of the GPIO absence, write-enable should be assumed. External SD is writable once again as a result of this patch because the offending commit changed behaviour for the case of a missing WP-GPIO to fall back to WRITE_PROTECT bit-checking, which is incorrect for Tegra. Cc: stable@vger.kernel.org # v5.1+ Fixes: e8391453e27f ("mmc: sdhci-tegra: drop ->get_ro() implementation") Signed-off-by: Dmitry Osipenko Acked-by: Thierry Reding Acked-by: Adrian Hunter Signed-off-by: Ulf Hansson commit ed19e3035c5a16034e896eed28c5e72e02e2ff58 Author: Imre Deak Date: Thu Aug 8 19:25:47 2019 +0300 drm/i915: Fix HW readout for crtc_clock in HDMI mode The conversion during HDMI HW readout from port_clock to crtc_clock was missed when HDMI 10bpc support was added, so fix that. v2: - Unscrew the non-HDMI case. Fixes: cd9e11a8bf25 ("drm/i915/icl: Add 10-bit support for hdmi") Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=109593 Cc: Radhakrishna Sripada Cc: Ville Syrjälä Signed-off-by: Imre Deak Reviewed-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20190808162547.7009-1-imre.deak@intel.com (cherry picked from commit 2969a78aead38b49e80c821a5c683544ab16160d) Signed-off-by: Jani Nikula commit 3b5be16c7e90a69c93349d210766250fffcb54bd Author: He Zhe Date: Tue Aug 20 22:53:10 2019 +0800 modules: page-align module section allocations only for arches supporting strict module rwx We should keep the case of "#define debug_align(X) (X)" for all arches without CONFIG_HAS_STRICT_MODULE_RWX ability, which would save people, who are sensitive to system size, a lot of memory when using modules, especially for embedded systems. This is also the intention of the original #ifdef... statement and still valid for now. Note that this still keeps the effect of the fix of the following commit, 38f054d549a8 ("modules: always page-align module section allocations"), since when CONFIG_ARCH_HAS_STRICT_MODULE_RWX is enabled, module pages are aligned. Signed-off-by: He Zhe Signed-off-by: Jessica Yu commit 0d31d4dbf38412f5b8b11b4511d07b840eebe8cb Author: Hodaszi, Robert Date: Fri Jun 14 13:16:01 2019 +0000 Revert "cfg80211: fix processing world regdomain when non modular" This reverts commit 96cce12ff6e0 ("cfg80211: fix processing world regdomain when non modular"). Re-triggering a reg_process_hint with the last request on all events, can make the regulatory domain fail in case of multiple WiFi modules. On slower boards (espacially with mdev), enumeration of the WiFi modules can end up in an intersected regulatory domain, and user cannot set it with 'iw reg set' anymore. This is happening, because: - 1st module enumerates, queues up a regulatory request - request gets processed by __reg_process_hint_driver(): - checks if previous was set by CORE -> yes - checks if regulator domain changed -> yes, from '00' to e.g. 'US' -> sends request to the 'crda' - 2nd module enumerates, queues up a regulator request (which triggers the reg_todo() work) - reg_todo() -> reg_process_pending_hints() sees, that the last request is not processed yet, so it tries to process it again. __reg_process_hint driver() will run again, and: - checks if the last request's initiator was the core -> no, it was the driver (1st WiFi module) - checks, if the previous initiator was the driver -> yes - checks if the regulator domain changed -> yes, it was '00' (set by core, and crda call did not return yet), and should be changed to 'US' ------> __reg_process_hint_driver calls an intersect Besides, the reg_process_hint call with the last request is meaningless since the crda call has a timeout work. If that timeout expires, the first module's request will lost. Cc: stable@vger.kernel.org Fixes: 96cce12ff6e0 ("cfg80211: fix processing world regdomain when non modular") Signed-off-by: Robert Hodaszi Link: https://lore.kernel.org/r/20190614131600.GA13897@a1-hr Signed-off-by: Johannes Berg commit d012a06ab1d23178fc6856d8d2161fbcc4dd8ebd Author: Paolo Bonzini Date: Thu Aug 15 09:43:32 2019 +0200 Revert "KVM: x86/mmu: Zap only the relevant pages when removing a memslot" This reverts commit 4e103134b862314dc2f2f18f2fb0ab972adc3f5f. Alex Williamson reported regressions with device assignment with this patch. Even though the bug is probably elsewhere and still latent, this is needed to fix the regression. Fixes: 4e103134b862 ("KVM: x86/mmu: Zap only the relevant pages when removing a memslot", 2019-02-05) Reported-by: Alex Willamson Cc: stable@vger.kernel.org Cc: Sean Christopherson Signed-off-by: Paolo Bonzini commit 54577e5018a8c0cb79c9a0fa118a55c68715d398 Author: Paolo Bonzini Date: Tue Aug 20 17:35:52 2019 +0200 selftests: kvm: fix state save/load on processors without XSAVE state_test and smm_test are failing on older processors that do not have xcr0. This is because on those processor KVM does provide support for KVM_GET/SET_XSAVE (to avoid having to rely on the older KVM_GET/SET_FPU) but not for KVM_GET/SET_XCRS. Signed-off-by: Paolo Bonzini commit b67fd72e84a88cae64cea8ab47ccdaab3bb3094d Author: Alexander Wetzel Date: Mon Aug 5 14:34:00 2019 +0200 cfg80211: Fix Extended Key ID key install checks Fix two shortcomings in the Extended Key ID API: 1) Allow the userspace to install pairwise keys using keyid 1 without NL80211_KEY_NO_TX set. This allows the userspace to install and activate pairwise keys with keyid 1 in the same way as for keyid 0, simplifying the API usage for e.g. FILS and FT key installs. 2) IEEE 802.11 - 2016 restricts Extended Key ID usage to CCMP/GCMP ciphers in IEEE 802.11 - 2016 "9.4.2.25.4 RSN capabilities". Enforce that when installing a key. Cc: stable@vger.kernel.org # 5.2 Fixes: 6cdd3979a2bd ("nl80211/cfg80211: Extended Key ID support") Signed-off-by: Alexander Wetzel Link: https://lore.kernel.org/r/20190805123400.51567-1-alexander@wetzel-home.de Signed-off-by: Johannes Berg commit 5fd2f91ad483baffdbe798f8a08f1b41442d1e24 Author: Johannes Berg Date: Thu Aug 1 09:30:33 2019 +0200 mac80211: fix possible sta leak If TDLS station addition is rejected, the sta memory is leaked. Avoid this by moving the check before the allocation. Cc: stable@vger.kernel.org Fixes: 7ed5285396c2 ("mac80211: don't initiate TDLS connection if station is not associated to AP") Link: https://lore.kernel.org/r/20190801073033.7892-1-johannes@sipsolutions.net Signed-off-by: Johannes Berg commit 6de3c9e3f6b3eaf66859e1379b3f35dda781416b Author: Takashi Iwai Date: Thu Aug 15 11:41:06 2019 +0200 ALSA: usb-audio: Fix invalid NULL check in snd_emuusb_set_samplerate() The quirk function snd_emuusb_set_samplerate() has a NULL check for the mixer element, but this is useless in the current code. It used to be a check against mixer->id_elems[unitid] but it was changed later to the value after mixer_eleme_list_to_info() which is always non-NULL due to the container_of() usage. This patch fixes the check before the conversion. While we're at it, correct a typo in the comment in the function, too. Fixes: 8c558076c740 ("ALSA: usb-audio: Clean up mixer element list traverse") Cc: Signed-off-by: Takashi Iwai commit c3cb6674df4c4a70f949e412dfe2230483092523 Author: Gustavo A. R. Silva Date: Tue Aug 20 19:07:46 2019 -0500 video: fbdev: acornfb: Mark expected switch fall-through Mark switch cases where we are expecting to fall through. Fix the following warning (Building: rpc_defconfig arm): drivers/video/fbdev/acornfb.c: In function ‘acornfb_parse_dram’: drivers/video/fbdev/acornfb.c:860:9: warning: this statement may fall through [-Wimplicit-fallthrough=] size *= 1024; ~~~~~^~~~~~~ drivers/video/fbdev/acornfb.c:861:3: note: here case 'K': ^~~~ Signed-off-by: Gustavo A. R. Silva commit da1fb2909e701ffbae8c5d6111f475603355e6e2 Author: Gustavo A. R. Silva Date: Tue Aug 20 16:20:05 2019 -0500 scsi: libsas: sas_discover: Mark expected switch fall-through Mark switch cases where we are expecting to fall through. Fix the following warning (Building: mtx1_defconfig mips): drivers/scsi/libsas/sas_discover.c: In function ‘sas_discover_domain’: ./include/linux/printk.h:309:2: warning: this statement may fall through [-Wimplicit-fallthrough=] printk(KERN_NOTICE pr_fmt(fmt), ##__VA_ARGS__) ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/scsi/libsas/sas_discover.c:459:3: note: in expansion of macro ‘pr_notice’ pr_notice("ATA device seen but CONFIG_SCSI_SAS_ATA=N so cannot attach\n"); ^~~~~~~~~ drivers/scsi/libsas/sas_discover.c:462:2: note: here default: ^~~~~~~ Signed-off-by: Gustavo A. R. Silva commit 93cbcf5d22bbe6f2ecf64765d5f6085beceb3ee8 Author: Gustavo A. R. Silva Date: Tue Aug 20 16:03:09 2019 -0500 MIPS: Octeon: Mark expected switch fall-through Mark switch cases where we are expecting to fall through. Fix the following warning (Building: cavium_octeon_defconfig mips): arch/mips/include/asm/octeon/cvmx-sli-defs.h:47:6: warning: this statement may fall through [-Wimplicit-fallthrough=] Signed-off-by: Gustavo A. R. Silva commit 5274fdba8e3c04e9ac1ba457379afc8835f9aa0f Author: Gustavo A. R. Silva Date: Tue Aug 20 15:55:26 2019 -0500 power: supply: ab8500_charger: Mark expected switch fall-through Mark switch cases where we are expecting to fall through. Fix the following warning (Building: allmodconfig arm): drivers/power/supply/ab8500_charger.c: In function ‘ab8500_charger_max_usb_curr’: drivers/power/supply/ab8500_charger.c:738:6: warning: this statement may fall through [-Wimplicit-fallthrough=] if (di->vbus_detected) { ^ drivers/power/supply/ab8500_charger.c:745:2: note: here case USB_STAT_HM_IDGND: ^~~~ Signed-off-by: Gustavo A. R. Silva commit c9cbbb9f04f3ee27970f08d3aa6e6742a43d4ca5 Author: Gustavo A. R. Silva Date: Tue Aug 20 13:07:46 2019 -0500 watchdog: wdt285: Mark expected switch fall-through Mark switch cases where we are expecting to fall through. Fix the following warning (Building: footbridge_defconfig arm): drivers/watchdog/wdt285.c: In function ‘watchdog_ioctl’: drivers/watchdog/wdt285.c:170:3: warning: this statement may fall through [-Wimplicit-fallthrough=] watchdog_ping(); ^~~~~~~~~~~~~~~ drivers/watchdog/wdt285.c:172:2: note: here case WDIOC_GETTIMEOUT: ^~~~ Signed-off-by: Gustavo A. R. Silva commit 3f0289cb9e0ee38e0075328e59b9cd88bf5ea474 Author: Gustavo A. R. Silva Date: Tue Aug 20 12:54:32 2019 -0500 mtd: sa1100: Mark expected switch fall-through Mark switch cases where we are expecting to fall through. Fix the following warning (Building: assabet_defconfig arm): drivers/mtd/maps/sa1100-flash.c: In function ‘sa1100_probe_subdev’: drivers/mtd/maps/sa1100-flash.c:82:3: warning: this statement may fall through [-Wimplicit-fallthrough=] printk(KERN_WARNING "SA1100 flash: unknown base address " ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ "0x%08lx, assuming CS0\n", phys); ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/mtd/maps/sa1100-flash.c:85:2: note: here case SA1100_CS0_PHYS: ^~~~ Signed-off-by: Gustavo A. R. Silva commit 5334653d4ff29f5e1f216a2f5d3a86c19a479b1a Author: Gustavo A. R. Silva Date: Tue Aug 20 12:47:06 2019 -0500 drm/sun4i: tcon: Mark expected switch fall-through Mark switch cases where we are expecting to fall through. Fix the following warning (Building: sunxi_defconfig arm): drivers/gpu/drm/sun4i/sun4i_tcon.c: In function ‘sun4i_tcon0_mode_set_dithering’: drivers/gpu/drm/sun4i/sun4i_tcon.c:318:7: warning: this statement may fall through [-Wimplicit-fallthrough=] val |= SUN4I_TCON0_FRM_CTL_MODE_B; drivers/gpu/drm/sun4i/sun4i_tcon.c:319:2: note: here case MEDIA_BUS_FMT_RGB666_1X18: ^~~~ Signed-off-by: Gustavo A. R. Silva commit edf6a05976980b5c21f19a60fde175f736e4ab61 Author: Gustavo A. R. Silva Date: Tue Aug 20 13:01:03 2019 -0500 drm/sun4i: sun6i_mipi_dsi: Mark expected switch fall-through Mark switch cases where we are expecting to fall through. Fix the following warning (Building: multi_v7_defconfig arm): drivers/gpu/drm/sun4i/sun6i_mipi_dsi.c: In function ‘sun6i_dsi_transfer’: drivers/gpu/drm/sun4i/sun6i_mipi_dsi.c:993:6: warning: this statement may fall through [-Wimplicit-fallthrough=] if (msg->rx_len == 1) { ^ drivers/gpu/drm/sun4i/sun6i_mipi_dsi.c:998:2: note: here default: ^~~~~~~ Signed-off-by: Gustavo A. R. Silva commit 06264adfa2bcc8abb556dec9af0e86150a67faf0 Author: Gustavo A. R. Silva Date: Tue Aug 20 19:29:16 2019 -0500 ARM: riscpc: Mark expected switch fall-through Mark switch cases where we are expecting to fall through. Fix the following warning (Building: rpc_defconfig arm): arch/arm/mach-rpc/riscpc.c: In function ‘parse_tag_acorn’: arch/arm/mach-rpc/riscpc.c:48:13: warning: this statement may fall through [-Wimplicit-fallthrough=] vram_size += PAGE_SIZE * 256; ~~~~~~~~~~^~~~~~~~~~~~~~~~~~ arch/arm/mach-rpc/riscpc.c:49:2: note: here case 256: ^~~~ Signed-off-by: Gustavo A. R. Silva commit 377ec83643efcae869528b4b26a5070fdeba3abd Author: Gustavo A. R. Silva Date: Sun Aug 11 19:18:03 2019 -0500 dmaengine: fsldma: Mark expected switch fall-through Mark switch cases where we are expecting to fall through. Fix the following warnings (Building: powerpc-ppa8548_defconfig powerpc): drivers/dma/fsldma.c: In function ‘fsl_dma_chan_probe’: drivers/dma/fsldma.c:1165:26: warning: this statement may fall through [-Wimplicit-fallthrough=] chan->toggle_ext_pause = fsl_chan_toggle_ext_pause; ~~~~~~~~~~~~~~~~~~~~~~~^~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/dma/fsldma.c:1166:2: note: here case FSL_DMA_IP_83XX: ^~~~ Reported-by: kbuild test robot Acked-by: Li Yang Signed-off-by: Gustavo A. R. Silva commit 90ae409f9eb3bcaf38688f9ec22375816053a08e Author: Christoph Hellwig Date: Tue Aug 20 11:45:49 2019 +0900 dma-direct: fix zone selection after an unaddressable CMA allocation The new dma_alloc_contiguous hides if we allocate CMA or regular pages, and thus fails to retry a ZONE_NORMAL allocation if the CMA allocation succeeds but isn't addressable. That means we either fail outright or dip into a small zone that might not succeed either. Thanks to Hillf Danton for debugging this issue. Fixes: b1d2dc009dec ("dma-contiguous: add dma_{alloc,free}_contiguous() helpers") Reported-by: Tobias Klausmann Signed-off-by: Christoph Hellwig Tested-by: Tobias Klausmann commit a1c4cd67840ef80f6ca5f73326fa9a6719303a95 Author: Li RongQing Date: Tue Aug 20 13:52:47 2019 +0800 net: fix __ip_mc_inc_group usage in ip_mc_inc_group, memory allocation flag, not mcast mode, is expected by __ip_mc_inc_group similar issue in __ip_mc_join_group, both mcase mode and gfp_t are needed here, so use ____ip_mc_inc_group(...) Fixes: 9fb20801dab4 ("net: Fix ip_mc_{dec,inc}_group allocation context") Signed-off-by: Li RongQing Signed-off-by: Florian Fainelli Signed-off-by: Zhang Yu Signed-off-by: David S. Miller commit 96a1b033ac24ccc58156f05c183b2cba0b9412d5 Author: Terry S. Duncan Date: Mon Aug 19 17:24:02 2019 -0700 net/ncsi: Ensure 32-bit boundary for data cksum The NCSI spec indicates that if the data does not end on a 32 bit boundary, one to three padding bytes equal to 0x00 shall be present to align the checksum field to a 32-bit boundary. Signed-off-by: Terry S. Duncan Signed-off-by: David S. Miller commit 4651d1802f7063e4d8c0bcad957f46ece0c04024 Author: Jason Baron Date: Mon Aug 19 14:36:01 2019 -0400 net/smc: make sure EPOLLOUT is raised Currently, we are only explicitly setting SOCK_NOSPACE on a write timeout for non-blocking sockets. Epoll() edge-trigger mode relies on SOCK_NOSPACE being set when -EAGAIN is returned to ensure that EPOLLOUT is raised. Expand the setting of SOCK_NOSPACE to non-blocking sockets as well that can use SO_SNDTIMEO to adjust their write timeout. This mirrors the behavior that Eric Dumazet introduced for tcp sockets. Signed-off-by: Jason Baron Cc: Eric Dumazet Cc: Ursula Braun Cc: Karsten Graul Signed-off-by: David S. Miller commit 15d90b242290f228166ea79ee1cc2db6b31a2143 Merge: 5f97cbe22b76 fcf887e7caaa Author: Linus Torvalds Date: Tue Aug 20 11:18:43 2019 -0700 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid Pull HID fixes from Jiri Kosina: - a few regression fixes for wacom driver (including fix for my earlier mismerge) from Aaron Armstrong Skomra and Jason Gerecke - revert of a few Logitech device ID additions which turn out to not work perfectly with the hidpp driver at the moment; proper support is now scheduled for 5.4. Fixes from Benjamin Tissoires - scheduling-in-atomic fix for cp2112 driver, from Benjamin Tissoires - new device ID to intel-ish, from Even Xu * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid: HID: wacom: correct misreported EKR ring values HID: cp2112: prevent sleeping function called from invalid context HID: intel-ish-hid: ipc: add EHL device id HID: wacom: Correct distance scale for 2nd-gen Intuos devices HID: logitech-hidpp: remove support for the G700 over USB Revert "HID: logitech-hidpp: add USB PID for a few more supported mice" HID: wacom: add back changes dropped in merge commit commit 2323d7baab2b18d87d9bc267452e387aa9f0060a Author: Wenwen Wang Date: Sun Aug 18 13:54:46 2019 -0500 infiniband: hfi1: fix memory leaks In fault_opcodes_write(), 'data' is allocated through kcalloc(). However, it is not deallocated in the following execution if an error occurs, leading to memory leaks. To fix this issue, introduce the 'free_data' label to free 'data' before returning the error. Signed-off-by: Wenwen Wang Reviewed-by: Leon Romanovsky Acked-by: Dennis Dalessandro Link: https://lore.kernel.org/r/1566154486-3713-1-git-send-email-wenwen@cs.uga.edu Signed-off-by: Doug Ledford commit b08afa064c320e5d85cdc27228426b696c4c8dae Author: Wenwen Wang Date: Sun Aug 18 14:29:31 2019 -0500 infiniband: hfi1: fix a memory leak bug In fault_opcodes_read(), 'data' is not deallocated if debugfs_file_get() fails, leading to a memory leak. To fix this bug, introduce the 'free_data' label to free 'data' before returning the error. Signed-off-by: Wenwen Wang Reviewed-by: Leon Romanovsky Acked-by: Dennis Dalessandro Link: https://lore.kernel.org/r/1566156571-4335-1-git-send-email-wenwen@cs.uga.edu Signed-off-by: Doug Ledford commit 5c1baaa82cea2c815a5180ded402a7cd455d1810 Author: Wenwen Wang Date: Sun Aug 18 15:23:01 2019 -0500 IB/mlx4: Fix memory leaks In mlx4_ib_alloc_pv_bufs(), 'tun_qp->tx_ring' is allocated through kcalloc(). However, it is not always deallocated in the following execution if an error occurs, leading to memory leaks. To fix this issue, free 'tun_qp->tx_ring' whenever an error occurs. Signed-off-by: Wenwen Wang Acked-by: Leon Romanovsky Link: https://lore.kernel.org/r/1566159781-4642-1-git-send-email-wenwen@cs.uga.edu Signed-off-by: Doug Ledford commit a7bfb93f0211b4a2f1ffeeb259ed6206bac30460 Author: zhengbin Date: Mon Aug 19 12:27:39 2019 +0800 RDMA/cma: fix null-ptr-deref Read in cma_cleanup In cma_init, if cma_configfs_init fails, need to free the previously memory and return fail, otherwise will trigger null-ptr-deref Read in cma_cleanup. cma_cleanup cma_configfs_exit configfs_unregister_subsystem Fixes: 045959db65c6 ("IB/cma: Add configfs for rdma_cm") Reported-by: Hulk Robot Signed-off-by: zhengbin Reviewed-by: Parav Pandit Link: https://lore.kernel.org/r/1566188859-103051-1-git-send-email-zhengbin13@huawei.com Signed-off-by: Doug Ledford commit 841b07f99a4766d66f50d8a2ab941bce94cd4e70 Author: Moni Shoua Date: Thu Aug 15 11:38:34 2019 +0300 IB/mlx5: Block MR WR if UMR is not possible Check conditions that are mandatory to post_send UMR WQEs. 1. Modifying page size. 2. Modifying remote atomic permissions if atomic access is required. If either condition is not fulfilled then fail to post_send() flow. Fixes: c8d75a980fab ("IB/mlx5: Respect new UMR capabilities") Signed-off-by: Moni Shoua Reviewed-by: Guy Levi Signed-off-by: Leon Romanovsky Link: https://lore.kernel.org/r/20190815083834.9245-9-leon@kernel.org Signed-off-by: Doug Ledford commit 25a4517214ffa217a443181f7f885b914e6b328f Author: Moni Shoua Date: Thu Aug 15 11:38:33 2019 +0300 IB/mlx5: Fix MR re-registration flow to use UMR properly The UMR WQE in the MR re-registration flow requires that modify_atomic and modify_entity_size capabilities are enabled. Therefore, check that the these capabilities are present before going to umr flow and go through slow path if not. Fixes: c8d75a980fab ("IB/mlx5: Respect new UMR capabilities") Signed-off-by: Moni Shoua Reviewed-by: Guy Levi Signed-off-by: Leon Romanovsky Link: https://lore.kernel.org/r/20190815083834.9245-8-leon@kernel.org Signed-off-by: Doug Ledford commit 008157528ac5658502c0f87e872778c56c41109c Author: Moni Shoua Date: Thu Aug 15 11:38:32 2019 +0300 IB/mlx5: Report and handle ODP support properly ODP depends on the several device capabilities, among them is the ability to send UMR WQEs with that modify atomic and entity size of the MR. Therefore, only if all conditions to send such a UMR WQE are met then driver can report that ODP is supported. Use this check of conditions in all places where driver needs to know about ODP support. Also, implicit ODP support depends on ability of driver to send UMR WQEs for an indirect mkey. Therefore, verify that all conditions to do so are met when reporting support. Fixes: c8d75a980fab ("IB/mlx5: Respect new UMR capabilities") Signed-off-by: Moni Shoua Reviewed-by: Guy Levi Signed-off-by: Leon Romanovsky Link: https://lore.kernel.org/r/20190815083834.9245-7-leon@kernel.org Signed-off-by: Doug Ledford commit 0e6613b41edd2f55a4b33234c5f31410c1ed3783 Author: Moni Shoua Date: Thu Aug 15 11:38:31 2019 +0300 IB/mlx5: Consolidate use_umr checks into single function Introduce helper function to unify various use_umr checks. Signed-off-by: Moni Shoua Signed-off-by: Leon Romanovsky Link: https://lore.kernel.org/r/20190815083834.9245-6-leon@kernel.org Signed-off-by: Doug Ledford commit 60c78668ae50d6b815ead4a62216822a92097125 Author: Leon Romanovsky Date: Thu Aug 15 11:38:29 2019 +0300 RDMA/restrack: Rewrite PID namespace check to be reliable task_active_pid_ns() is wrong API to check PID namespace because it posses some restrictions and return PID namespace where the process was allocated. It created mismatches with current namespace, which can be different. Rewrite whole rdma_is_visible_in_pid_ns() logic to provide reliable results without any relation to allocated PID namespace. Fixes: 8be565e65fa9 ("RDMA/nldev: Factor out the PID namespace check") Fixes: 6a6c306a09b5 ("RDMA/restrack: Make is_visible_in_pid_ns() as an API") Reviewed-by: Mark Zhang Signed-off-by: Leon Romanovsky Link: https://lore.kernel.org/r/20190815083834.9245-4-leon@kernel.org Signed-off-by: Doug Ledford commit c8b32408b4074232d93e64b6c23b2aa96dde448e Author: Leon Romanovsky Date: Thu Aug 15 11:38:28 2019 +0300 RDMA/counters: Properly implement PID checks "Auto" configuration mode is called for visible in that PID namespace and it ensures that all counters and QPs are coexist in the same namespace and belong to same PID. Fixes: 99fa331dc862 ("RDMA/counter: Add "auto" configuration mode support") Reviewed-by: Mark Zhang Signed-off-by: Leon Romanovsky Link: https://lore.kernel.org/r/20190815083834.9245-3-leon@kernel.org Signed-off-by: Doug Ledford commit 948a7287b29e06b8c629f5e70235d857a175ceaf Author: Ido Kalir Date: Thu Aug 15 11:38:27 2019 +0300 IB/core: Fix NULL pointer dereference when bind QP to counter If QP is not visible to the pid, then we try to decrease its reference count and return from the function before the QP pointer is initialized. This lead to NULL pointer dereference. Fix it by pass directly the res to the rdma_restract_put as arg instead of &qp->res. This fixes below call trace: [ 5845.110329] BUG: kernel NULL pointer dereference, address: 00000000000000dc [ 5845.120482] Oops: 0002 [#1] SMP PTI [ 5845.129119] RIP: 0010:rdma_restrack_put+0x5/0x30 [ib_core] [ 5845.169450] Call Trace: [ 5845.170544] rdma_counter_get_qp+0x5c/0x70 [ib_core] [ 5845.172074] rdma_counter_bind_qpn_alloc+0x6f/0x1a0 [ib_core] [ 5845.173731] nldev_stat_set_doit+0x314/0x330 [ib_core] [ 5845.175279] rdma_nl_rcv_msg+0xeb/0x1d0 [ib_core] [ 5845.176772] ? __kmalloc_node_track_caller+0x20b/0x2b0 [ 5845.178321] rdma_nl_rcv+0xcb/0x120 [ib_core] [ 5845.179753] netlink_unicast+0x179/0x220 [ 5845.181066] netlink_sendmsg+0x2d8/0x3d0 [ 5845.182338] sock_sendmsg+0x30/0x40 [ 5845.183544] __sys_sendto+0xdc/0x160 [ 5845.184832] ? syscall_trace_enter+0x1f8/0x2e0 [ 5845.186209] ? __audit_syscall_exit+0x1d9/0x280 [ 5845.187584] __x64_sys_sendto+0x24/0x30 [ 5845.188867] do_syscall_64+0x48/0x120 [ 5845.190097] entry_SYSCALL_64_after_hwframe+0x44/0xa9 Fixes: 1bd8e0a9d0fd1 ("RDMA/counter: Allow manual mode configuration support") Signed-off-by: Ido Kalir Signed-off-by: Leon Romanovsky Link: https://lore.kernel.org/r/20190815083834.9245-2-leon@kernel.org Signed-off-by: Doug Ledford commit d9d1f5e7bb82415591e8b62b222cbb88c4797ef3 Author: Kaike Wan Date: Thu Aug 15 15:20:58 2019 -0400 IB/hfi1: Drop stale TID RDMA packets that cause TIDErr In a congested fabric with adaptive routing enabled, traces show that packets could be delivered out of order. A stale TID RDMA data packet could lead to TidErr if the TID entries have been released by duplicate data packets generated from retries, and subsequently erroneously force the qp into error state in the current implementation. Since the payload has already been dropped by hardware, the packet can be simply dropped and it is no longer necessary to put the qp into error state. Fixes: 9905bf06e890 ("IB/hfi1: Add functions to receive TID RDMA READ response") Cc: Reviewed-by: Mike Marciniszyn Signed-off-by: Kaike Wan Signed-off-by: Dennis Dalessandro Link: https://lore.kernel.org/r/20190815192058.105923.72324.stgit@awfm-01.aw.intel.com Signed-off-by: Doug Ledford commit 90fdae66e72bf0381d168f12dca0259617927895 Author: Kaike Wan Date: Thu Aug 15 15:20:51 2019 -0400 IB/hfi1: Add additional checks when handling TID RDMA WRITE DATA packet In a congested fabric with adaptive routing enabled, traces show that packets could be delivered out of order, which could cause incorrect processing of stale packets. For stale TID RDMA WRITE DATA packets that cause KDETH EFLAGS errors, this patch adds additional checks before processing the packets. Fixes: d72fe7d5008b ("IB/hfi1: Add a function to receive TID RDMA WRITE DATA packet") Cc: Reviewed-by: Mike Marciniszyn Signed-off-by: Kaike Wan Signed-off-by: Dennis Dalessandro Link: https://lore.kernel.org/r/20190815192051.105923.69979.stgit@awfm-01.aw.intel.com Signed-off-by: Doug Ledford commit a8adbf7d0d0a6e3bf7f99da461a06039364e028b Author: Kaike Wan Date: Thu Aug 15 15:20:45 2019 -0400 IB/hfi1: Add additional checks when handling TID RDMA READ RESP packet In a congested fabric with adaptive routing enabled, traces show that packets could be delivered out of order, which could cause incorrect processing of stale packets. For stale TID RDMA READ RESP packets that cause KDETH EFLAGS errors, this patch adds additional checks before processing the packets. Fixes: 9905bf06e890 ("IB/hfi1: Add functions to receive TID RDMA READ response") Cc: Reviewed-by: Mike Marciniszyn Signed-off-by: Kaike Wan Signed-off-by: Dennis Dalessandro Link: https://lore.kernel.org/r/20190815192045.105923.59813.stgit@awfm-01.aw.intel.com Signed-off-by: Doug Ledford commit 35d5c8b82e2c32e8e29ca195bb4dac60ba7d97fc Author: Kaike Wan Date: Thu Aug 15 15:20:39 2019 -0400 IB/hfi1: Unsafe PSN checking for TID RDMA READ Resp packet When processing a TID RDMA READ RESP packet that causes KDETH EFLAGS errors, the packet's IB PSN is checked against qp->s_last_psn and qp->s_psn without the protection of qp->s_lock, which is not safe. This patch fixes the issue by acquiring qp->s_lock first. Fixes: 9905bf06e890 ("IB/hfi1: Add functions to receive TID RDMA READ response") Cc: Reviewed-by: Mike Marciniszyn Signed-off-by: Kaike Wan Signed-off-by: Dennis Dalessandro Link: https://lore.kernel.org/r/20190815192039.105923.7852.stgit@awfm-01.aw.intel.com Signed-off-by: Doug Ledford commit d58c1834bf0d218a0bc00f8fb44874551b21da84 Author: Kaike Wan Date: Thu Aug 15 15:20:33 2019 -0400 IB/hfi1: Drop stale TID RDMA packets In a congested fabric with adaptive routing enabled, traces show that the sender could receive stale TID RDMA NAK packets that contain newer KDETH PSNs and older Verbs PSNs. If not dropped, these packets could cause the incorrect rewinding of the software flows and the incorrect completion of TID RDMA WRITE requests, and eventually leading to memory corruption and kernel crash. The current code drops stale TID RDMA ACK/NAK packets solely based on KDETH PSNs, which may lead to erroneous processing. This patch fixes the issue by also checking the Verbs PSN. Addition checks are added before rewinding the TID RDMA WRITE DATA packets. Fixes: 9e93e967f7b4 ("IB/hfi1: Add a function to receive TID RDMA ACK packet") Cc: Reviewed-by: Mike Marciniszyn Signed-off-by: Kaike Wan Signed-off-by: Dennis Dalessandro Link: https://lore.kernel.org/r/20190815192033.105923.44192.stgit@awfm-01.aw.intel.com Signed-off-by: Doug Ledford commit 9b440078017f194e56eaae3ac32f333f420c5c4e Author: Bernard Metzler Date: Mon Aug 19 16:02:57 2019 +0200 RDMA/siw: Fix potential NULL de-ref In siw_connect() we have an error flow where there is no valid qp pointer. Make sure we don't try to de-ref in that situation. Fixes: 6c52fdc244b5 ("rdma/siw: connection management") Reported-by: Dan Carpenter Signed-off-by: Bernard Metzler Link: https://lore.kernel.org/r/20190819140257.19319-1-bmt@zurich.ibm.com Signed-off-by: Doug Ledford commit 27b7fb1ab7bfad45f5702ff0c78a4822a41b1456 Author: Jason Gunthorpe Date: Thu Aug 15 11:38:30 2019 +0300 RDMA/mlx5: Fix MR npages calculation for IB_ACCESS_HUGETLB When ODP is enabled with IB_ACCESS_HUGETLB then the required pages should be calculated based on the extent of the MR, which is rounded to the nearest huge page alignment. Fixes: d2183c6f1958 ("RDMA/umem: Move page_shift from ib_umem to ib_odp_umem") Signed-off-by: Jason Gunthorpe Signed-off-by: Leon Romanovsky Link: https://lore.kernel.org/r/20190815083834.9245-5-leon@kernel.org Signed-off-by: Doug Ledford commit a3a0e43fd77013819e4b6f55e37e0efe8e35d805 Author: Jens Axboe Date: Tue Aug 20 11:03:11 2019 -0600 io_uring: don't enter poll loop if we have CQEs pending We need to check if we have CQEs pending before starting a poll loop, as those could be the events we will be spinning for (and hence we'll find none). This can happen if a CQE triggers an error, or if it is found by eg an IRQ before we get a chance to find it through polling. Signed-off-by: Jens Axboe commit cb32de1b7e2591f844f18a5513fde8e2bd49bce0 Author: Mario Limonciello Date: Fri Aug 16 15:16:19 2019 -0500 nvme: Add quirk for LiteON CL1 devices running FW 22301111 One of the components in LiteON CL1 device has limitations that can be encountered based upon boundary race conditions using the nvme bus specific suspend to idle flow. When this situation occurs the drive doesn't resume properly from suspend-to-idle. LiteON has confirmed this problem and fixed in the next firmware version. As this firmware is already in the field, avoid running nvme specific suspend to idle flow. Fixes: d916b1be94b6 ("nvme-pci: use host managed power state for suspend") Link: http://lists.infradead.org/pipermail/linux-nvme/2019-July/thread.html Signed-off-by: Mario Limonciello Signed-off-by: Charles Hyde Reviewed-by: Keith Busch Signed-off-by: Sagi Grimberg Signed-off-by: Jens Axboe commit a89fcca8185633993018dc081d6b021d005e6d0b Author: Guilherme G. Piccoli Date: Wed Aug 14 11:26:10 2019 -0300 nvme: Fix cntlid validation when not using NVMEoF Commit 1b1031ca63b2 ("nvme: validate cntlid during controller initialisation") introduced a validation for controllers with duplicate cntlid that runs on nvme_init_subsystem(). The problem is that the validation relies on ctrl->cntlid, and this value is assigned (from id_ctrl value) after the call for nvme_init_subsystem() in nvme_init_identify() for non-fabrics scenario. That leads to ctrl->cntlid always being 0 in case we have a physical set of controllers in the same subsystem. This patch fixes that by loading the discovered cntlid id_ctrl value into ctrl->cntlid before the subsystem initialization, only for the non-fabrics case. The patch was tested with emulated nvme devices (qemu) having two controllers in a single subsystem. Without the patch, we couldn't make it work failing in the duplicate check; when running with the patch, we could see the subsystem holding both controllers. For the fabrics case we see ctrl->cntlid has a more intricate relation with the admin connect, so we didn't change that. Fixes: 1b1031ca63b2 ("nvme: validate cntlid during controller initialisation") Signed-off-by: Guilherme G. Piccoli Reviewed-by: Sagi Grimberg Signed-off-by: Sagi Grimberg Signed-off-by: Jens Axboe commit 504db087aaccdb32af61539916409f7dca31ceb5 Author: Anton Eidelman Date: Mon Aug 12 23:00:36 2019 +0300 nvme-multipath: fix possible I/O hang when paths are updated nvme_state_set_live() making a path available triggers requeue_work in order to resubmit requests that ended up on requeue_list when no paths were available. This requeue_work may race with concurrent nvme_ns_head_make_request() that do not observe the live path yet. Such concurrent requests may by made by either: - New IO submission. - Requeue_work triggered by nvme_failover_req() or another ana_work. A race may cause requeue_work capture the state of requeue_list before more requests get onto the list. These requests will stay on the list forever unless requeue_work is triggered again. In order to prevent such race, nvme_state_set_live() should synchronize_srcu(&head->srcu) before triggering the requeue_work and prevent nvme_ns_head_make_request referencing an old snapshot of the path list. Reviewed-by: Christoph Hellwig Signed-off-by: Anton Eidelman Signed-off-by: Sagi Grimberg Signed-off-by: Jens Axboe commit 500f9fbadef86466a435726192f4ca4df7d94236 Author: Jens Axboe Date: Mon Aug 19 12:15:59 2019 -0600 io_uring: fix potential hang with polled IO If a request issue ends up being punted to async context to avoid blocking, we can get into a situation where the original application enters the poll loop for that very request before it has been issued. This should not be an issue, except that the polling will hold the io_uring uring_ctx mutex for the duration of the poll. When the async worker has actually issued the request, it needs to acquire this mutex to add the request to the poll issued list. Since the application polling is already holding this mutex, the workqueue sleeps on the mutex forever, and the application thus never gets a chance to poll for the very request it was interested in. Fix this by ensuring that the polling drops the uring_ctx occasionally if it's not making any progress. Reported-by: Jeffrey M. Birnbaum Signed-off-by: Jens Axboe commit a9fc4340aee041dd186d1fb8f1b5d1e9caf28212 Author: Dexuan Cui Date: Tue May 7 07:46:55 2019 +0000 Drivers: hv: vmbus: Fix virt_to_hvpfn() for X86_PAE In the case of X86_PAE, unsigned long is u32, but the physical address type should be u64. Due to the bug here, the netvsc driver can not load successfully, and sometimes the VM can panic due to memory corruption (the hypervisor writes data to the wrong location). Fixes: 6ba34171bcbd ("Drivers: hv: vmbus: Remove use of slow_virt_to_phys()") Cc: stable@vger.kernel.org Cc: Michael Kelley Reported-and-tested-by: Juliana Rodrigueiro Signed-off-by: Dexuan Cui Reviewed-by: Michael Kelley Signed-off-by: Sasha Levin commit 89eb4d8d25722a0a0194cf7fa47ba602e32a6da7 Author: Vitaly Kuznetsov Date: Mon Aug 19 16:44:09 2019 +0200 Tools: hv: kvp: eliminate 'may be used uninitialized' warning When building hv_kvp_daemon GCC-8.3 complains: hv_kvp_daemon.c: In function ‘kvp_get_ip_info.constprop’: hv_kvp_daemon.c:812:30: warning: ‘ip_buffer’ may be used uninitialized in this function [-Wmaybe-uninitialized] struct hv_kvp_ipaddr_value *ip_buffer; this seems to be a false positive: we only use ip_buffer when op == KVP_OP_GET_IP_INFO and it is only unset when op == KVP_OP_ENUMERATE. Silence the warning by initializing ip_buffer to NULL. Signed-off-by: Vitaly Kuznetsov Signed-off-by: Sasha Levin commit d09bc83640d524b8467a660db7b1d15e6562a1de Author: Dexuan Cui Date: Tue Aug 20 03:01:23 2019 +0000 Input: hyperv-keyboard: Use in-place iterator API in the channel callback Simplify the ring buffer handling with the in-place API. Also avoid the dynamic allocation and the memory leak in the channel callback function. Signed-off-by: Dexuan Cui Acked-by: Dmitry Torokhov Signed-off-by: Sasha Levin commit 16c75963723dfd8d7ca719527052f16be7258a23 Author: Dexuan Cui Date: Tue Aug 20 03:06:40 2019 +0000 Drivers: hv: vmbus: Remove the unused "tsc_page" from struct hv_context This field is no longer used after the commit 63ed4e0c67df ("Drivers: hv: vmbus: Consolidate all Hyper-V specific clocksource code") , because it's replaced by the global variable "struct ms_hyperv_tsc_page *tsc_pg;" (now, the variable is in drivers/clocksource/hyperv_timer.c). Fixes: 63ed4e0c67df ("Drivers: hv: vmbus: Consolidate all Hyper-V specific clocksource code") Signed-off-by: Dexuan Cui Signed-off-by: Sasha Levin commit fb89c39455e4b49881c5a42761bd71f03d3ef888 Author: Ivan Khoronzhuk Date: Thu Aug 15 23:56:35 2019 +0300 xdp: unpin xdp umem pages in error path Fix mem leak caused by missed unpin routine for umem pages. Fixes: 8aef7340ae9695 ("xsk: introduce xdp_umem_page") Signed-off-by: Ivan Khoronzhuk Acked-by: Jonathan Lemon Signed-off-by: Daniel Borkmann commit 5a8c31aa63578cb0ff390a57537f1cb4b312a1ed Author: Luca Coelho Date: Fri Aug 16 15:55:54 2019 +0300 iwlwifi: pcie: fix recognition of QuZ devices If the HW revision of Qu devices we found is QuZ, then we need to switch the configuration accordingly in order to use the correct FW. Add a block of ifs in order do that. Signed-off-by: Luca Coelho Signed-off-by: Kalle Valo commit 17e40e6979aaf60f356331bac129df20e1fd74a0 Author: Luca Coelho Date: Fri Aug 16 15:55:53 2019 +0300 iwlwifi: pcie: don't switch FW to qnj when ax201 is detected We have a too generic condition that switches from Qu configurations to QnJ configurations. We need to exclude some configurations so that they are not erroneously switched. Add the ax201 configuration to the list of exclusions. Signed-off-by: Luca Coelho Signed-off-by: Kalle Valo commit 884b75696873f5338c57a2613763ea8f37b4e26b Author: Emmanuel Grumbach Date: Fri Aug 16 15:55:52 2019 +0300 iwlwifi: pcie: fix the byte count table format for 22560 devices Starting from 22560, the byte count is expected to be in bytes and we have now 14 bits. Ajust the code to this. Signed-off-by: Emmanuel Grumbach Signed-off-by: Luca Coelho Signed-off-by: Kalle Valo commit 50f5604476b2bd728910b2e1803a6eafd0eeaf3d Author: Ilan Peer Date: Fri Aug 16 15:55:51 2019 +0300 iwlwifi: mvm: Allow multicast data frames only when associated The MAC context configuration always allowed multicast data frames to pass to the driver for all MAC context types, and in the case of station MAC context both when associated and when not associated. One of the outcomes of this configuration is having the FW forward encrypted multicast frames to the driver with Rx status indicating that the frame was not decrypted (as expected, since no keys were configured yet) which in turn results with unnecessary error messages. Change this behavior to allow multicast data frames only when they are actually expected, e.g., station MAC context is associated etc. Signed-off-by: Ilan Peer Signed-off-by: Luca Coelho Signed-off-by: Kalle Valo commit 95844124385eae4bd9ca5f9514a0fc33d561ac3c Author: Stanislaw Gruszka Date: Mon Aug 19 13:20:07 2019 +0200 rt2x00: clear IV's on start to fix AP mode regression To do not brake HW restart we should keep initialization vectors data. I assumed that on start the data is already initialized to zeros, but that not true on some scenarios and we should clear it. So add additional flag to check if we are under HW restart and clear IV's data if we are not. Patch fixes AP mode regression. Reported-and-tested-by: Emil Karlson Fixes: 710e6cc1595e ("rt2800: do not nullify initialization vector data") Signed-off-by: Stanislaw Gruszka Signed-off-by: Kalle Valo commit 8f2d163cb26da87e7d8e1677368b8ba1ba4d30b3 Author: Stanislaw Gruszka Date: Thu Jul 18 12:38:10 2019 +0200 mt76: mt76x0u: do not reset radio on resume On some machines mt76x0u firmware can hung during resume, what result on messages like below: [ 475.480062] mt76x0 1-8:1.0: Error: MCU response pre-completed! [ 475.990066] mt76x0 1-8:1.0: Error: send MCU cmd failed:-110 [ 475.990075] mt76x0 1-8:1.0: Error: MCU response pre-completed! [ 476.500003] mt76x0 1-8:1.0: Error: send MCU cmd failed:-110 [ 476.500012] mt76x0 1-8:1.0: Error: MCU response pre-completed! [ 477.010046] mt76x0 1-8:1.0: Error: send MCU cmd failed:-110 [ 477.010055] mt76x0 1-8:1.0: Error: MCU response pre-completed! [ 477.529997] mt76x0 1-8:1.0: Error: send MCU cmd failed:-110 [ 477.530006] mt76x0 1-8:1.0: Error: MCU response pre-completed! [ 477.824907] mt76x0 1-8:1.0: Error: send MCU cmd failed:-71 [ 477.824916] mt76x0 1-8:1.0: Error: MCU response pre-completed! [ 477.825029] usb 1-8: USB disconnect, device number 6 and possible whole system freeze. This can be avoided, if we do not perform mt76x0_chip_onoff() reset. Cc: stable@vger.kernel.org Fixes: 134b2d0d1fcf ("mt76x0: init files") Signed-off-by: Stanislaw Gruszka Signed-off-by: Kalle Valo commit 962411b05a6d3342aa649e39cda1704c1fc042c6 Author: Wenwen Wang Date: Fri Aug 16 01:56:08 2019 -0500 dmaengine: ti: omap-dma: Add cleanup in omap_dma_probe() If devm_request_irq() fails to disable all interrupts, no cleanup is performed before retuning the error. To fix this issue, invoke omap_dma_free() to do the cleanup. Signed-off-by: Wenwen Wang Acked-by: Peter Ujfalusi Link: https://lore.kernel.org/r/1565938570-7528-1-git-send-email-wenwen@cs.uga.edu Signed-off-by: Vinod Koul commit 2c231c0c1dec42192aca0f87f2dc68b8f0cbc7d2 Author: Wenwen Wang Date: Fri Aug 16 01:48:55 2019 -0500 dmaengine: ti: dma-crossbar: Fix a memory leak bug In ti_dra7_xbar_probe(), 'rsv_events' is allocated through kcalloc(). Then of_property_read_u32_array() is invoked to search for the property. However, if this process fails, 'rsv_events' is not deallocated, leading to a memory leak bug. To fix this issue, free 'rsv_events' before returning the error. Signed-off-by: Wenwen Wang Acked-by: Peter Ujfalusi Link: https://lore.kernel.org/r/1565938136-7249-1-git-send-email-wenwen@cs.uga.edu Signed-off-by: Vinod Koul commit a180d023ec7ba0e43b2385876950d9ce7ab618f1 Author: Nishka Dasgupta Date: Mon Aug 19 13:21:26 2019 +0530 auxdisplay: ht16k33: Make ht16k33_fb_fix and ht16k33_fb_var constant The static structures ht16k33_fb_fix and ht16k33_fb_var, of types fb_fix_screeninfo and fb_var_screeninfo respectively, are not used except to be copied into other variables. Hence make both of them constant to prevent unintended modification. Issue found with Coccinelle. Acked-by: Robin van der Gracht Signed-off-by: Nishka Dasgupta Signed-off-by: Miguel Ojeda commit fcf887e7caaa813eea821d11bf2b7619a37df37a Author: Aaron Armstrong Skomra Date: Fri Aug 16 12:00:54 2019 -0700 HID: wacom: correct misreported EKR ring values The EKR ring claims a range of 0 to 71 but actually reports values 1 to 72. The ring is used in relative mode so this change should not affect users. Signed-off-by: Aaron Armstrong Skomra Fixes: 72b236d60218f ("HID: wacom: Add support for Express Key Remote.") Cc: # v4.3+ Reviewed-by: Ping Cheng Reviewed-by: Jason Gerecke Signed-off-by: Jiri Kosina commit 2ca371d847511f97ef991ef612a2ce805489840e Author: Paweł Rekowski Date: Mon Aug 19 22:40:07 2019 +0200 ALSA: hda/ca0132 - Add new SBZ quirk This patch adds a new PCI subsys ID for the SBZ, as found and tested by me and some reddit users. Link: https://lore.kernel.org/lkml/20190819204008.14426-1-p.rekowski@gmail.com Signed-off-by: Paweł Rekowski Cc: Signed-off-by: Takashi Iwai commit 1a15718b41df026cffd0e42cfdc38a1384ce19f9 Author: Takashi Iwai Date: Tue Aug 20 08:58:12 2019 +0200 ALSA: usb-audio: Add implicit fb quirk for Behringer UFX1604 Behringer UFX1604 requires the similar quirk to apply implicit fb like another Behringer model UFX1204 in order to fix the noisy playback. BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=204631 Cc: Signed-off-by: Takashi Iwai commit 769a807d0b41df4201dbeb01c22eaeb3e5905532 Author: Florian Westphal Date: Mon Aug 12 10:32:13 2019 +0200 xfrm: policy: avoid warning splat when merging nodes syzbot reported a splat: xfrm_policy_inexact_list_reinsert+0x625/0x6e0 net/xfrm/xfrm_policy.c:877 CPU: 1 PID: 6756 Comm: syz-executor.1 Not tainted 5.3.0-rc2+ #57 Call Trace: xfrm_policy_inexact_node_reinsert net/xfrm/xfrm_policy.c:922 [inline] xfrm_policy_inexact_node_merge net/xfrm/xfrm_policy.c:958 [inline] xfrm_policy_inexact_insert_node+0x537/0xb50 net/xfrm/xfrm_policy.c:1023 xfrm_policy_inexact_alloc_chain+0x62b/0xbd0 net/xfrm/xfrm_policy.c:1139 xfrm_policy_inexact_insert+0xe8/0x1540 net/xfrm/xfrm_policy.c:1182 xfrm_policy_insert+0xdf/0xce0 net/xfrm/xfrm_policy.c:1574 xfrm_add_policy+0x4cf/0x9b0 net/xfrm/xfrm_user.c:1670 xfrm_user_rcv_msg+0x46b/0x720 net/xfrm/xfrm_user.c:2676 netlink_rcv_skb+0x1f0/0x460 net/netlink/af_netlink.c:2477 xfrm_netlink_rcv+0x74/0x90 net/xfrm/xfrm_user.c:2684 netlink_unicast_kernel net/netlink/af_netlink.c:1302 [inline] netlink_unicast+0x809/0x9a0 net/netlink/af_netlink.c:1328 netlink_sendmsg+0xa70/0xd30 net/netlink/af_netlink.c:1917 sock_sendmsg_nosec net/socket.c:637 [inline] sock_sendmsg net/socket.c:657 [inline] There is no reproducer, however, the warning can be reproduced by adding rules with ever smaller prefixes. The sanity check ("does the policy match the node") uses the prefix value of the node before its updated to the smaller value. To fix this, update the prefix earlier. The bug has no impact on tree correctness, this is only to prevent a false warning. Reported-by: syzbot+8cc27ace5f6972910b31@syzkaller.appspotmail.com Signed-off-by: Florian Westphal Signed-off-by: Steffen Klassert commit 936376f88ff1845b384b3a82b9cd167e53039229 Author: Christoph Hellwig Date: Tue Aug 20 10:08:38 2019 +0900 arm: select the dma-noncoherent symbols for all swiotlb builds We need to provide the arch hooks for non-coherent dma-direct and swiotlb for all swiotlb builds, not just when LPAS is enabled. Without that the Xen build that selects SWIOTLB indirectly through SWIOTLB_XEN fails to build. Fixes: ad3c7b18c5b3 ("arm: use swiotlb for bounce buffering on LPAE configs") Reported-by: Stefan Wahren Signed-off-by: Christoph Hellwig Tested-by: Stefan Wahren commit 77ffd3465ba837e9dc714e17b014e77b2eae765a Author: James Smart Date: Thu Aug 15 19:36:49 2019 -0700 scsi: lpfc: Mitigate high memory pre-allocation by SCSI-MQ When SCSI-MQ is enabled, the SCSI-MQ layers will do pre-allocation of MQ resources based on shost values set by the driver. In newer cases of the driver, which attempts to set nr_hw_queues to the cpu count, the multipliers become excessive, with a single shost having SCSI-MQ pre-allocation reaching into the multiple GBytes range. NPIV, which creates additional shosts, only multiply this overhead. On lower-memory systems, this can exhaust system memory very quickly, resulting in a system crash or failures in the driver or elsewhere due to low memory conditions. After testing several scenarios, the situation can be mitigated by limiting the value set in shost->nr_hw_queues to 4. Although the shost values were changed, the driver still had per-cpu hardware queues of its own that allowed parallelization per-cpu. Testing revealed that even with the smallish number for nr_hw_queues for SCSI-MQ, performance levels remained near maximum with the within-driver affiinitization. A module parameter was created to allow the value set for the nr_hw_queues to be tunable. Signed-off-by: Dick Kennedy Signed-off-by: James Smart Reviewed-by: Ming Lei Reviewed-by: Ewan D. Milne Signed-off-by: Martin K. Petersen commit 1edfb8ed6cc12107c2ec61b5be7bc881cfc4460e Author: Vlad Buslov Date: Mon Aug 19 10:33:04 2019 +0300 nfp: flower: verify that block cb is not busy before binding When processing FLOW_BLOCK_BIND command on indirect block, check that flow block cb is not busy. Fixes: 0d4fd02e7199 ("net: flow_offload: add flow_block_cb_is_busy() and use it") Reported-by: Jakub Kicinski Signed-off-by: Vlad Buslov Acked-by: Jakub Kicinski Signed-off-by: David S. Miller commit b68271609c4f16a79eae8069933f64345afcf888 Author: Ira Weiny Date: Mon Aug 19 18:15:28 2019 -0700 fs/xfs: Fix return code of xfs_break_leased_layouts() The parens used in the while loop would result in error being assigned the value 1 rather than the intended errno value. This is required to return -ETXTBSY from follow on break_layout() changes. Signed-off-by: Ira Weiny Reviewed-by: Darrick J. Wong Signed-off-by: Darrick J. Wong commit cd9d4ff9b78fcd0fc4708900ba3e52e71e1a7690 Author: Christophe JAILLET Date: Mon Aug 19 07:04:25 2019 +0200 Kconfig: Fix the reference to the IDT77105 Phy driver in the description of ATM_NICSTAR_USE_IDT77105 This should be IDT77105, not IDT77015. Signed-off-by: Christophe JAILLET Signed-off-by: David S. Miller commit 2f102274e8129c9c0bb3a2bde0f641531aefea8b Author: Denis Efremov Date: Tue Aug 13 09:05:30 2019 +0300 MAINTAINERS: net_failover: Fix typo in a filepath Replace "driver" with "drivers" in the filepath to net_failover.c Cc: Sridhar Samudrala Cc: David S. Miller Cc: netdev@vger.kernel.org Fixes: cfc80d9a1163 ("net: Introduce net_failover driver") Signed-off-by: Denis Efremov Signed-off-by: David S. Miller commit 3a7ef457e85173a5b9ec7a03016db5a57b717b33 Author: Stefano Brivio Date: Tue Aug 13 00:46:01 2019 +0200 ipv6: Fix return value of ipv6_mc_may_pull() for malformed packets Commit ba5ea614622d ("bridge: simplify ip_mc_check_igmp() and ipv6_mc_check_mld() calls") replaces direct calls to pskb_may_pull() in br_ipv6_multicast_mld2_report() with calls to ipv6_mc_may_pull(), that returns -EINVAL on buffers too short to be valid IPv6 packets, while maintaining the previous handling of the return code. This leads to the direct opposite of the intended effect: if the packet is malformed, -EINVAL evaluates as true, and we'll happily proceed with the processing. Return 0 if the packet is too short, in the same way as this was fixed for IPv4 by commit 083b78a9ed64 ("ip: fix ip_mc_may_pull() return value"). I don't have a reproducer for this, unlike the one referred to by the IPv4 commit, but this is clearly broken. Fixes: ba5ea614622d ("bridge: simplify ip_mc_check_igmp() and ipv6_mc_check_mld() calls") Signed-off-by: Stefano Brivio Acked-by: Guillaume Nault Signed-off-by: David S. Miller commit 5f97cbe22b7616ead7ae267c29cad73bc1444811 Merge: 287c55ed7df5 24876f09a7df Author: Linus Torvalds Date: Mon Aug 19 16:28:25 2019 -0700 Merge tag 'clk-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux Pull clk fixes from Stephen Boyd: "A couple fixes to the core framework logic that finds clk parents, a handful of samsung clk driver fixes for audio and display clks, and a small fix for the Stratix10 SoC driver that was checking the wrong register for validity" * tag 'clk-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux: clk: Fix potential NULL dereference in clk_fetch_parent_index() clk: Fix falling back to legacy parent string matching clk: socfpga: stratix10: fix rate caclulationg for cnt_clks clk: samsung: exynos542x: Move MSCL subsystem clocks to its sub-CMU clk: samsung: exynos5800: Move MAU subsystem clocks to MAU sub-CMU clk: samsung: Change signature of exynos5_subcmus_init() function commit 287c55ed7df531c30f7a5093120339193dc7f166 Merge: 06821504fd47 33da8e7c814f Author: Linus Torvalds Date: Mon Aug 19 16:17:59 2019 -0700 Merge branch 'siginfo-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace Pull kernel thread signal handling fix from Eric Biederman: "I overlooked the fact that kernel threads are created with all signals set to SIG_IGN, and accidentally caused a regression in cifs and drbd when replacing force_sig with send_sig. This is my fix for that regression. I add a new function allow_kernel_signal which allows kernel threads to receive signals sent from the kernel, but continues to ignore all signals sent from userspace. This ensures the user space interface for cifs and drbd remain the same. These kernel threads depend on blocking networking calls which block until something is received or a signal is pending. Making receiving of signals somewhat necessary for these kernel threads. Perhaps someday we can cleanup those interfaces and remove allow_kernel_signal. If not allow_kernel_signal is pretty trivial and clearly documents what is going on so I don't think we will mind carrying it" * 'siginfo-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace: signal: Allow cifs and drbd to receive their terminating signals commit e15dbcdeb9f66c9e6068f94aed60cee9844b621a Merge: ef8d8ccdc216 38a429c898dd Author: David S. Miller Date: Mon Aug 19 13:16:07 2019 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf Pablo Neira Ayuso says: ==================== Netfilter fixes for net The following patchset contains Netfilter fixes for net: 1) Remove IP MASQUERADING record in MAINTAINERS file, from Denis Efremov. 2) Counter arguments are swapped in ebtables, from Todd Seidelmann. 3) Missing netlink attribute validation in flow_offload extension. 4) Incorrect alignment in xt_nfacct that breaks 32-bits userspace / 64-bits kernels, from Juliana Rodrigueiro. 5) Missing include guard in nf_conntrack_h323_types.h, from Masahiro Yamada. ==================== Signed-off-by: David S. Miller commit ef8d8ccdc216f797e66cb4a1372f5c4c285ce1e4 Author: Eric Dumazet Date: Fri Aug 16 21:26:22 2019 -0700 tcp: make sure EPOLLOUT wont be missed As Jason Baron explained in commit 790ba4566c1a ("tcp: set SOCK_NOSPACE under memory pressure"), it is crucial we properly set SOCK_NOSPACE when needed. However, Jason patch had a bug, because the 'nonblocking' status as far as sk_stream_wait_memory() is concerned is governed by MSG_DONTWAIT flag passed at sendmsg() time : long timeo = sock_sndtimeo(sk, flags & MSG_DONTWAIT); So it is very possible that tcp sendmsg() calls sk_stream_wait_memory(), and that sk_stream_wait_memory() returns -EAGAIN with SOCK_NOSPACE cleared, if sk->sk_sndtimeo has been set to a small (but not zero) value. This patch removes the 'noblock' variable since we must always set SOCK_NOSPACE if -EAGAIN is returned. It also renames the do_nonblock label since we might reach this code path even if we were in blocking mode. Fixes: 790ba4566c1a ("tcp: set SOCK_NOSPACE under memory pressure") Signed-off-by: Eric Dumazet Cc: Jason Baron Reported-by: Vladimir Rutsky Acked-by: Soheil Hassas Yeganeh Acked-by: Neal Cardwell Acked-by: Jason Baron Signed-off-by: David S. Miller commit d0ff14fdc987303aeeb7de6f1bd72c3749ae2a9b Author: Michael Kelley Date: Thu Aug 1 23:53:53 2019 +0000 genirq: Properly pair kobject_del() with kobject_add() If alloc_descs() fails before irq_sysfs_init() has run, free_desc() in the cleanup path will call kobject_del() even though the kobject has not been added with kobject_add(). Fix this by making the call to kobject_del() conditional on whether irq_sysfs_init() has run. This problem surfaced because commit aa30f47cf666 ("kobject: Add support for default attribute groups to kobj_type") makes kobject_del() stricter about pairing with kobject_add(). If the pairing is incorrrect, a WARNING and backtrace occur in sysfs_remove_group() because there is no parent. [ tglx: Add a comment to the code and make it work with CONFIG_SYSFS=n ] Fixes: ecb3f394c5db ("genirq: Expose interrupt information through sysfs") Signed-off-by: Michael Kelley Signed-off-by: Thomas Gleixner Acked-by: Greg Kroah-Hartman Cc: stable@vger.kernel.org Link: https://lkml.kernel.org/r/1564703564-4116-1-git-send-email-mikelley@microsoft.com commit c49a0a80137c7ca7d6ced4c812c9e07a949f6f24 Author: Tom Lendacky Date: Mon Aug 19 15:52:35 2019 +0000 x86/CPU/AMD: Clear RDRAND CPUID bit on AMD family 15h/16h There have been reports of RDRAND issues after resuming from suspend on some AMD family 15h and family 16h systems. This issue stems from a BIOS not performing the proper steps during resume to ensure RDRAND continues to function properly. RDRAND support is indicated by CPUID Fn00000001_ECX[30]. This bit can be reset by clearing MSR C001_1004[62]. Any software that checks for RDRAND support using CPUID, including the kernel, will believe that RDRAND is not supported. Update the CPU initialization to clear the RDRAND CPUID bit for any family 15h and 16h processor that supports RDRAND. If it is known that the family 15h or family 16h system does not have an RDRAND resume issue or that the system will not be placed in suspend, the "rdrand=force" kernel parameter can be used to stop the clearing of the RDRAND CPUID bit. Additionally, update the suspend and resume path to save and restore the MSR C001_1004 value to ensure that the RDRAND CPUID setting remains in place after resuming from suspend. Note, that clearing the RDRAND CPUID bit does not prevent a processor that normally supports the RDRAND instruction from executing it. So any code that determined the support based on family and model won't #UD. Signed-off-by: Tom Lendacky Signed-off-by: Borislav Petkov Cc: Andrew Cooper Cc: Andrew Morton Cc: Chen Yu Cc: "H. Peter Anvin" Cc: Ingo Molnar Cc: Jonathan Corbet Cc: Josh Poimboeuf Cc: Juergen Gross Cc: Kees Cook Cc: "linux-doc@vger.kernel.org" Cc: "linux-pm@vger.kernel.org" Cc: Nathan Chancellor Cc: Paolo Bonzini Cc: Pavel Machek Cc: "Rafael J. Wysocki" Cc: Cc: Thomas Gleixner Cc: "x86@kernel.org" Link: https://lkml.kernel.org/r/7543af91666f491547bd86cebb1e17c66824ab9f.1566229943.git.thomas.lendacky@amd.com commit f9ef724d4896763479f3921afd1ee61552fc9836 Author: Jeronimo Borque Date: Sun Aug 18 22:35:38 2019 -0300 ALSA: hda - Fixes inverted Conexant GPIO mic mute led "enabled" parameter historically referred to the device input or output, not to the led indicator. After the changes added with the led helper functions the mic mute led logic refers to the led and not to the mic input which caused led indicator to be negated. Fixing logic in cxt_update_gpio_led and updated cxt_fixup_gpio_mute_hook Also updated debug messages to ease further debugging if necessary. Fixes: 184e302b46c9 ("ALSA: hda/conexant - Use the mic-mute LED helper") Suggested-by: Takashi Iwai Signed-off-by: Jeronimo Borque Cc: Signed-off-by: Takashi Iwai commit 06821504fd47a5e5b641aeeb638a0ae10a216ef8 Merge: 555df336c754 cfef46d692ef Author: Linus Torvalds Date: Mon Aug 19 10:00:01 2019 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from David Miller: 1) Fix jmp to 1st instruction in x64 JIT, from Alexei Starovoitov. 2) Severl kTLS fixes in mlx5 driver, from Tariq Toukan. 3) Fix severe performance regression due to lack of SKB coalescing of fragments during local delivery, from Guillaume Nault. 4) Error path memory leak in sch_taprio, from Ivan Khoronzhuk. 5) Fix batched events in skbedit packet action, from Roman Mashak. 6) Propagate VLAN TX offload to hw_enc_features in bond and team drivers, from Yue Haibing. 7) RXRPC local endpoint refcounting fix and read after free in rxrpc_queue_local(), from David Howells. 8) Fix endian bug in ibmveth multicast list handling, from Thomas Falcon. 9) Oops, make nlmsg_parse() wrap around the correct function, __nlmsg_parse not __nla_parse(). Fix from David Ahern. 10) Memleak in sctp_scend_reset_streams(), fro Zheng Bin. 11) Fix memory leak in cxgb4, from Wenwen Wang. 12) Yet another race in AF_PACKET, from Eric Dumazet. 13) Fix false detection of retransmit failures in tipc, from Tuong Lien. 14) Use after free in ravb_tstamp_skb, from Tho Vu. * git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (101 commits) ravb: Fix use-after-free ravb_tstamp_skb netfilter: nf_tables: map basechain priority to hardware priority net: sched: use major priority number as hardware priority wimax/i2400m: fix a memory leak bug net: cavium: fix driver name ibmvnic: Unmap DMA address of TX descriptor buffers after use bnxt_en: Fix to include flow direction in L2 key bnxt_en: Use correct src_fid to determine direction of the flow bnxt_en: Suppress HWRM errors for HWRM_NVM_GET_VARIABLE command bnxt_en: Fix handling FRAG_ERR when NVM_INSTALL_UPDATE cmd fails bnxt_en: Improve RX doorbell sequence. bnxt_en: Fix VNIC clearing logic for 57500 chips. net: kalmia: fix memory leaks cx82310_eth: fix a memory leak bug bnx2x: Fix VF's VLAN reconfiguration in reload. Bluetooth: Add debug setting for changing minimum encryption key size tipc: fix false detection of retransmit failures lan78xx: Fix memory leaks MAINTAINERS: r8169: Update path to the driver MAINTAINERS: PHY LIBRARY: Update files in the record ... commit 555df336c754ac9de1af9a5c72508918b3796b18 Author: David Howells Date: Mon Aug 19 16:02:01 2019 +0100 keys: Fix description size The maximum key description size is 4095. Commit f771fde82051 ("keys: Simplify key description management") inadvertantly reduced that to 255 and made sizes between 256 and 4095 work weirdly, and any size whereby size & 255 == 0 would cause an assertion in __key_link_begin() at the following line: BUG_ON(index_key->desc_len == 0); This can be fixed by simply increasing the size of desc_len in struct keyring_index_key to a u16. Note the argument length test in keyutils only checked empty descriptions and descriptions with a size around the limit (ie. 4095) and not for all the values in between, so it missed this. This has been addressed and https://git.kernel.org/pub/scm/linux/kernel/git/dhowells/keyutils.git/commit/?id=066bf56807c26cd3045a25f355b34c1d8a20a5aa now exhaustively tests all possible lengths of type, description and payload and then some. The assertion failure looks something like: kernel BUG at security/keys/keyring.c:1245! ... RIP: 0010:__key_link_begin+0x88/0xa0 ... Call Trace: key_create_or_update+0x211/0x4b0 __x64_sys_add_key+0x101/0x200 do_syscall_64+0x5b/0x1e0 entry_SYSCALL_64_after_hwframe+0x44/0xa9 It can be triggered by: keyctl add user "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" a @s Fixes: f771fde82051 ("keys: Simplify key description management") Reported-by: kernel test robot Signed-off-by: David Howells Signed-off-by: Linus Torvalds commit 0a46fff2f9108c2c44218380a43a736cf4612541 Author: Kirill A. Shutemov Date: Tue Aug 13 16:16:54 2019 +0300 x86/boot/compressed/64: Fix boot on machines with broken E820 table BIOS on Samsung 500C Chromebook reports very rudimentary E820 table that consists of 2 entries: BIOS-e820: [mem 0x0000000000000000-0x0000000000000fff] usable BIOS-e820: [mem 0x00000000fffff000-0x00000000ffffffff] reserved It breaks logic in find_trampoline_placement(): bios_start lands on the end of the first 4k page and trampoline start gets placed below 0. Detect underflow and don't touch bios_start for such cases. It makes kernel ignore E820 table on machines that doesn't have two usable pages below BIOS_START_MAX. Fixes: 1b3a62643660 ("x86/boot/compressed/64: Validate trampoline placement against E820") Signed-off-by: Kirill A. Shutemov Signed-off-by: Borislav Petkov Cc: "H. Peter Anvin" Cc: Ingo Molnar Cc: Thomas Gleixner Cc: x86-ml Link: https://bugzilla.kernel.org/show_bug.cgi?id=203463 Link: https://lkml.kernel.org/r/20190813131654.24378-1-kirill.shutemov@linux.intel.com commit 06c9fdf3b9f1acc6e53753c99c54c39764cc979f Author: Trond Myklebust Date: Wed Aug 14 15:42:43 2019 -0400 NFS: On fatal writeback errors, we need to call nfs_inode_remove_request() If the writeback error is fatal, we need to remove the tracking structures (i.e. the nfs_page) from the inode. Fixes: 6fbda89b257f ("NFS: Replace custom error reporting mechanism...") Signed-off-by: Trond Myklebust commit 17d8c5d145000070c581f2a8aa01edc7998582ab Author: Trond Myklebust Date: Wed Aug 14 14:19:09 2019 -0400 NFS: Fix initialisation of I/O result struct in nfs_pgio_rpcsetup Initialise the result count to 0 rather than initialising it to the argument count. The reason is that we want to ensure we record the I/O stats correctly in the case where an error is returned (for instance in the layoutstats). Signed-off-by: Trond Myklebust commit eb2c50da9e256dbbb3ff27694440e4c1900cfef8 Author: Trond Myklebust Date: Mon Aug 12 18:04:36 2019 -0400 NFS: Ensure O_DIRECT reports an error if the bytes read/written is 0 If the attempt to resend the I/O results in no bytes being read/written, we must ensure that we report the error. Signed-off-by: Trond Myklebust Fixes: 0a00b77b331a ("nfs: mirroring support for direct io") Cc: stable@vger.kernel.org # v3.20+ commit f4340e9314dbfadc48758945f85fc3b16612d06f Author: Trond Myklebust Date: Mon Aug 12 15:19:54 2019 -0400 NFSv4/pnfs: Fix a page lock leak in nfs_pageio_resend() If the attempt to resend the pages fails, we need to ensure that we clean up those pages that were not transmitted. Fixes: d600ad1f2bdb ("NFS41: pop some layoutget errors to application") Signed-off-by: Trond Myklebust Cc: stable@vger.kernel.org # v4.5+ commit 9821421a291b548ef4369c6998745baa36ddecd5 Author: Trond Myklebust Date: Fri Aug 9 12:15:07 2019 -0400 NFSv4: Fix return value in nfs_finish_open() If the file turns out to be of the wrong type after opening, we want to revalidate the path and retry, so return EOPENSTALE rather than ESTALE. Signed-off-by: Trond Myklebust commit 90cf500e338ab3f3c0f126ba37e36fb6a9058441 Author: Trond Myklebust Date: Fri Aug 9 15:03:11 2019 -0400 NFSv4: Fix return values for nfs4_file_open() Currently, we are translating RPC level errors such as timeouts, as well as interrupts etc into EOPENSTALE, which forces a single replay of the open attempt. What we actually want to do is force the replay only in the cases where the returned error indicates that the file may have changed on the server. So the fix is to spell out the exact set of errors where we want to return EOPENSTALE. Signed-off-by: Trond Myklebust commit 7e10cc25bfa0dd3602bbcf5cc9c759a90eb675dc Author: Trond Myklebust Date: Fri Aug 9 12:06:43 2019 -0400 NFS: Don't refresh attributes with mounted-on-file information If we've been given the attributes of the mounted-on-file, then do not use those to check or update the attributes on the application-visible inode. Signed-off-by: Trond Myklebust commit 2d05dba2b25ecb0f8fc3a0b4eb2232da6454a47b Author: Benjamin Tissoires Date: Mon Aug 12 18:04:44 2019 +0200 HID: cp2112: prevent sleeping function called from invalid context When calling request_threaded_irq() with a CP2112, the function cp2112_gpio_irq_startup() is called in a IRQ context. Therefore we can not sleep, and we can not call cp2112_gpio_direction_input() there. Move the call to cp2112_gpio_direction_input() earlier to have a working driver. Signed-off-by: Benjamin Tissoires Signed-off-by: Jiri Kosina commit b640be5bc8e4673dc8049cf74176ddedecea5597 Author: Even Xu Date: Fri Aug 9 21:18:29 2019 +0800 HID: intel-ish-hid: ipc: add EHL device id EHL is a new platform using ishtp solution, add its device id to support list. Signed-off-by: Even Xu Acked-by: Srinivas Pandruvada Signed-off-by: Jiri Kosina commit b72fb1dcd2ea9d29417711cb302cef3006fa8d5a Author: Jason Gerecke Date: Wed Aug 7 14:11:55 2019 -0700 HID: wacom: Correct distance scale for 2nd-gen Intuos devices Distance values reported by 2nd-gen Intuos tablets are on an inverted scale (0 == far, 63 == near). We need to change them over to a normal scale before reporting to userspace or else userspace drivers and applications can get confused. Ref: https://github.com/linuxwacom/input-wacom/issues/98 Fixes: eda01dab53 ("HID: wacom: Add four new Intuos devices") Signed-off-by: Jason Gerecke Cc: # v4.4+ Signed-off-by: Jiri Kosina commit 38a429c898ddd210cc35463b096389f97c3c5a73 Author: Masahiro Yamada Date: Mon Aug 19 16:39:27 2019 +0900 netfilter: add include guard to nf_conntrack_h323_types.h Add a header include guard just in case. Signed-off-by: Masahiro Yamada Signed-off-by: Pablo Neira Ayuso commit 33da8e7c814f77310250bb54a9db36a44c5de784 Author: Eric W. Biederman Date: Fri Aug 16 12:33:54 2019 -0500 signal: Allow cifs and drbd to receive their terminating signals My recent to change to only use force_sig for a synchronous events wound up breaking signal reception cifs and drbd. I had overlooked the fact that by default kthreads start out with all signals set to SIG_IGN. So a change I thought was safe turned out to have made it impossible for those kernel thread to catch their signals. Reverting the work on force_sig is a bad idea because what the code was doing was very much a misuse of force_sig. As the way force_sig ultimately allowed the signal to happen was to change the signal handler to SIG_DFL. Which after the first signal will allow userspace to send signals to these kernel threads. At least for wake_ack_receiver in drbd that does not appear actively wrong. So correct this problem by adding allow_kernel_signal that will allow signals whose siginfo reports they were sent by the kernel through, but will not allow userspace generated signals, and update cifs and drbd to call allow_kernel_signal in an appropriate place so that their thread can receive this signal. Fixing things this way ensures that userspace won't be able to send signals and cause problems, that it is clear which signals the threads are expecting to receive, and it guarantees that nothing else in the system will be affected. This change was partly inspired by similar cifs and drbd patches that added allow_signal. Reported-by: ronnie sahlberg Reported-by: Christoph Böhmwalder Tested-by: Christoph Böhmwalder Cc: Steve French Cc: Philipp Reisner Cc: David Laight Fixes: 247bc9470b1e ("cifs: fix rmmod regression in cifs.ko caused by force_sig changes") Fixes: 72abe3bcf091 ("signal/cifs: Fix cifs_put_tcp_session to call send_sig instead of force_sig") Fixes: fee109901f39 ("signal/drbd: Use send_sig not force_sig") Fixes: 3cf5d076fb4d ("signal: Remove task parameter from force_sig") Signed-off-by: "Eric W. Biederman" commit f897e60a12f0b9146357780d317879bce2a877dc Author: Thomas Gleixner Date: Fri Aug 9 14:54:07 2019 +0200 x86/apic: Handle missing global clockevent gracefully Some newer machines do not advertise legacy timers. The kernel can handle that situation if the TSC and the CPU frequency are enumerated by CPUID or MSRs and the CPU supports TSC deadline timer. If the CPU does not support TSC deadline timer the local APIC timer frequency has to be known as well. Some Ryzens machines do not advertize legacy timers, but there is no reliable way to determine the bus frequency which feeds the local APIC timer when the machine allows overclocking of that frequency. As there is no legacy timer the local APIC timer calibration crashes due to a NULL pointer dereference when accessing the not installed global clock event device. Switch the calibration loop to a non interrupt based one, which polls either TSC (if frequency is known) or jiffies. The latter requires a global clockevent. As the machines which do not have a global clockevent installed have a known TSC frequency this is a non issue. For older machines where TSC frequency is not known, there is no known case where the legacy timers do not exist as that would have been reported long ago. Reported-by: Daniel Drake Reported-by: Jiri Slaby Signed-off-by: Thomas Gleixner Tested-by: Daniel Drake Cc: stable@vger.kernel.org Link: https://lkml.kernel.org/r/alpine.DEB.2.21.1908091443030.21433@nanos.tec.linutronix.de Link: http://bugzilla.opensuse.org/show_bug.cgi?id=1142926#c12 commit f1c6ece23729257fb46562ff9224cf5f61b818da Author: Andrea Righi Date: Mon Aug 12 20:43:02 2019 +0200 kprobes: Fix potential deadlock in kprobe_optimizer() lockdep reports the following deadlock scenario: WARNING: possible circular locking dependency detected kworker/1:1/48 is trying to acquire lock: 000000008d7a62b2 (text_mutex){+.+.}, at: kprobe_optimizer+0x163/0x290 but task is already holding lock: 00000000850b5e2d (module_mutex){+.+.}, at: kprobe_optimizer+0x31/0x290 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #1 (module_mutex){+.+.}: __mutex_lock+0xac/0x9f0 mutex_lock_nested+0x1b/0x20 set_all_modules_text_rw+0x22/0x90 ftrace_arch_code_modify_prepare+0x1c/0x20 ftrace_run_update_code+0xe/0x30 ftrace_startup_enable+0x2e/0x50 ftrace_startup+0xa7/0x100 register_ftrace_function+0x27/0x70 arm_kprobe+0xb3/0x130 enable_kprobe+0x83/0xa0 enable_trace_kprobe.part.0+0x2e/0x80 kprobe_register+0x6f/0xc0 perf_trace_event_init+0x16b/0x270 perf_kprobe_init+0xa7/0xe0 perf_kprobe_event_init+0x3e/0x70 perf_try_init_event+0x4a/0x140 perf_event_alloc+0x93a/0xde0 __do_sys_perf_event_open+0x19f/0xf30 __x64_sys_perf_event_open+0x20/0x30 do_syscall_64+0x65/0x1d0 entry_SYSCALL_64_after_hwframe+0x49/0xbe -> #0 (text_mutex){+.+.}: __lock_acquire+0xfcb/0x1b60 lock_acquire+0xca/0x1d0 __mutex_lock+0xac/0x9f0 mutex_lock_nested+0x1b/0x20 kprobe_optimizer+0x163/0x290 process_one_work+0x22b/0x560 worker_thread+0x50/0x3c0 kthread+0x112/0x150 ret_from_fork+0x3a/0x50 other info that might help us debug this: Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(module_mutex); lock(text_mutex); lock(module_mutex); lock(text_mutex); *** DEADLOCK *** As a reproducer I've been using bcc's funccount.py (https://github.com/iovisor/bcc/blob/master/tools/funccount.py), for example: # ./funccount.py '*interrupt*' That immediately triggers the lockdep splat. Fix by acquiring text_mutex before module_mutex in kprobe_optimizer(). Signed-off-by: Andrea Righi Acked-by: Masami Hiramatsu Cc: Anil S Keshavamurthy Cc: David S. Miller Cc: Linus Torvalds Cc: Naveen N. Rao Cc: Peter Zijlstra Cc: Thomas Gleixner Fixes: d5b844a2cf50 ("ftrace/x86: Remove possible deadlock between register_kprobe() and ftrace_run_update_code()") Link: http://lkml.kernel.org/r/20190812184302.GA7010@xps-13 Signed-off-by: Ingo Molnar commit 77d760328ee015cf89460c52bfd5a6b0a09b7472 Author: Su Yanjun Date: Fri Aug 16 16:43:21 2019 +0800 perf/x86: Fix typo in comment No functional change. Signed-off-by: Su Yanjun Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Thomas Gleixner Link: http://lkml.kernel.org/r/1565945001-4413-1-git-send-email-suyj.fnst@cn.fujitsu.com Signed-off-by: Ingo Molnar commit b0fdc01354f45d43f082025636ef808968a27b36 Author: Sebastian Andrzej Siewior Date: Fri Aug 16 18:06:26 2019 +0200 sched/core: Schedule new worker even if PI-blocked If a task is PI-blocked (blocking on sleeping spinlock) then we don't want to schedule a new kworker if we schedule out due to lock contention because !RT does not do that as well. A spinning spinlock disables preemption and a worker does not schedule out on lock contention (but spin). On RT the RW-semaphore implementation uses an rtmutex so tsk_is_pi_blocked() will return true if a task blocks on it. In this case we will now start a new worker which may deadlock if one worker is waiting on progress from another worker. Since a RW-semaphore starts a new worker on !RT, we should do the same on RT. XFS is able to trigger this deadlock. Allow to schedule new worker if the current worker is PI-blocked. Signed-off-by: Sebastian Andrzej Siewior Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Thomas Gleixner Link: http://lkml.kernel.org/r/20190816160626.12742-1-bigeasy@linutronix.de Signed-off-by: Ingo Molnar commit 89a26cd4b501e9511d3cd3d22327fc76a75a38b3 Author: Juliana Rodrigueiro Date: Fri Aug 16 17:02:22 2019 +0200 netfilter: xt_nfacct: Fix alignment mismatch in xt_nfacct_match_info When running a 64-bit kernel with a 32-bit iptables binary, the size of the xt_nfacct_match_info struct diverges. kernel: sizeof(struct xt_nfacct_match_info) : 40 iptables: sizeof(struct xt_nfacct_match_info)) : 36 Trying to append nfacct related rules results in an unhelpful message. Although it is suggested to look for more information in dmesg, nothing can be found there. # iptables -A -m nfacct --nfacct-name iptables: Invalid argument. Run `dmesg' for more information. This patch fixes the memory misalignment by enforcing 8-byte alignment within the struct's first revision. This solution is often used in many other uapi netfilter headers. Signed-off-by: Juliana Rodrigueiro Acked-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit 14c415862c0630e01712a4eeaf6159a2b1b6d2a4 Author: Pablo Neira Ayuso Date: Fri Aug 16 11:23:58 2019 +0200 netfilter: nft_flow_offload: missing netlink attribute policy The netlink attribute policy for NFTA_FLOW_TABLE_NAME is missing. Fixes: a3c90f7a2323 ("netfilter: nf_tables: flow offload expression") Signed-off-by: Pablo Neira Ayuso commit f20faa06d83de440bec8e200870784c3458793c4 Author: Todd Seidelmann Date: Wed Aug 14 10:54:16 2019 -0400 netfilter: ebtables: Fix argument order to ADD_COUNTER The ordering of arguments to the x_tables ADD_COUNTER macro appears to be wrong in ebtables (cf. ip_tables.c, ip6_tables.c, and arp_tables.c). This causes data corruption in the ebtables userspace tools because they get incorrect packet & byte counts from the kernel. Fixes: d72133e628803 ("netfilter: ebtables: use ADD_COUNTER macro") Signed-off-by: Todd Seidelmann Signed-off-by: Pablo Neira Ayuso commit 0d7342c3637462fc6291b392ced9af0f4ca4dab4 Author: Denis Efremov Date: Wed Aug 14 15:35:02 2019 +0300 MAINTAINERS: Remove IP MASQUERADING record This entry is in MAINTAINERS for historical purpose. It doesn't match current sources since the commit adf82accc5f5 ("netfilter: x_tables: merge ip and ipv6 masquerade modules") moved the module. The net/netfilter/xt_MASQUERADE.c module is already under the netfilter section. Thus, there is no purpose to keep this separate entry in MAINTAINERS. Cc: Florian Westphal Cc: Juanjo Ciarlante Cc: netfilter-devel@vger.kernel.org Suggested-by: Pablo Neira Ayuso Signed-off-by: Denis Efremov Signed-off-by: Pablo Neira Ayuso commit 5d888b481e6abc726b36c86f0bf13af1583bb336 Author: Darrick J. Wong Date: Wed Aug 14 17:38:09 2019 -0700 xfs: fix reflink source file racing with directio writes While trawling through the dedupe file comparison code trying to fix page deadlocking problems, Dave Chinner noticed that the reflink code only takes shared IOLOCK/MMAPLOCKs on the source file. Because page_mkwrite and directio writes do not take the EXCL versions of those locks, this means that reflink can race with writer processes. For pure remapping this can lead to undefined behavior and file corruption; for dedupe this means that we cannot be sure that the contents are identical when we decide to go ahead with the remapping. Signed-off-by: Darrick J. Wong Reviewed-by: Christoph Hellwig commit dec43da46f63eb71f519d963ba6832838e4262a3 Author: Phil Reid Date: Thu Jul 25 10:48:45 2019 +0800 fpga: altera-ps-spi: Fix getting of optional confd gpio Currently the driver does not handle EPROBE_DEFER for the confd gpio. Use devm_gpiod_get_optional() instead of devm_gpiod_get() and return error codes from altera_ps_probe(). Fixes: 5692fae0742d ("fpga manager: Add altera-ps-spi driver for Altera FPGAs") Signed-off-by: Phil Reid Signed-off-by: Moritz Fischer commit 165d42c012be69900f0e2f8545626cb9e7d4a832 Author: Nishka Dasgupta Date: Sat Jul 6 19:00:21 2019 +0530 drm/mediatek: mtk_drm_drv.c: Add of_node_put() before goto Each iteration of for_each_child_of_node puts the previous node, but in the case of a goto from the middle of the loop, there is no put, thus causing a memory leak. Hence add an of_node_put before the goto in two places. Issue found with Coccinelle. Fixes: 119f5173628a (drm/mediatek: Add DRM Driver for Mediatek SoC MT8173) Signed-off-by: Nishka Dasgupta Signed-off-by: CK Hu commit d1abaeb3be7b5fa6d7a1fbbd2e14e3310005c4c1 Author: Linus Torvalds Date: Sun Aug 18 14:31:08 2019 -0700 Linux 5.3-rc5 commit cfef46d692efd852a0da6803f920cc756eea2855 Author: Tho Vu Date: Fri Aug 16 17:17:02 2019 +0200 ravb: Fix use-after-free ravb_tstamp_skb When a Tx timestamp is requested, a pointer to the skb is stored in the ravb_tstamp_skb struct. This was done without an skb_get. There exists the possibility that the skb could be freed by ravb_tx_free (when ravb_tx_free is called from ravb_start_xmit) before the timestamp was processed, leading to a use-after-free bug. Use skb_get when filling a ravb_tstamp_skb struct, and add appropriate frees/consumes when a ravb_tstamp_skb struct is freed. Fixes: c156633f1353 ("Renesas Ethernet AVB driver proper") Signed-off-by: Tho Vu Signed-off-by: Kazuya Mizuguchi Signed-off-by: Simon Horman Signed-off-by: David S. Miller commit 5cbe9102ae2398c0f410fd4f832d9f038e751a29 Merge: 44ef3a032528 3bc158f8d033 Author: David S. Miller Date: Sun Aug 18 14:13:23 2019 -0700 Merge branch 'flow_offload-hardware-priority-fixes' Pablo Neira Ayuso says: ==================== flow_offload hardware priority fixes This patchset contains two updates for the flow_offload users: 1) Pass the major tc priority to drivers so they do not have to lshift it. This is a preparation patch for the fix coming in patch #2. 2) Set the hardware priority from the netfilter basechain priority, some drivers break when using the existing hardware priority number that is set to zero. v5: fix patch 2/2 to address a clang warning and to simplify the priority mapping. ==================== Signed-off-by: David S. Miller commit 3bc158f8d0330f0ac58597c023acca2234c14616 Author: Pablo Neira Ayuso Date: Fri Aug 16 03:24:10 2019 +0200 netfilter: nf_tables: map basechain priority to hardware priority This patch adds initial support for offloading basechains using the priority range from 1 to 65535. This is restricting the netfilter priority range to 16-bit integer since this is what most drivers assume so far from tc. It should be possible to extend this range of supported priorities later on once drivers are updated to support for 32-bit integer priorities. Signed-off-by: Pablo Neira Ayuso Signed-off-by: David S. Miller commit ef01adae0e43cfb2468d0ea07137cc63cf31495c Author: Pablo Neira Ayuso Date: Fri Aug 16 03:24:09 2019 +0200 net: sched: use major priority number as hardware priority tc transparently maps the software priority number to hardware. Update it to pass the major priority which is what most drivers expect. Update drivers too so they do not need to lshift the priority field of the flow_cls_common_offload object. The stmmac driver is an exception, since this code assumes the tc software priority is fine, therefore, lshift it just to be conservative. Signed-off-by: Pablo Neira Ayuso Acked-by: Jiri Pirko Signed-off-by: David S. Miller commit 44ef3a03252844a8753479b0cea7f29e4a804bdc Author: Wenwen Wang Date: Thu Aug 15 15:29:51 2019 -0500 wimax/i2400m: fix a memory leak bug In i2400m_barker_db_init(), 'options_orig' is allocated through kstrdup() to hold the original command line options. Then, the options are parsed. However, if an error occurs during the parsing process, 'options_orig' is not deallocated, leading to a memory leak bug. To fix this issue, free 'options_orig' before returning the error. Signed-off-by: Wenwen Wang Signed-off-by: David S. Miller commit 3434341004a380f4e47c3a03d4320d43982162a0 Author: Stephen Hemminger Date: Thu Aug 15 12:49:49 2019 -0700 net: cavium: fix driver name The driver name gets exposed in sysfs under /sys/bus/pci/drivers so it should look like other devices. Change it to be common format (instead of "Cavium PTP"). This is a trivial fix that was observed by accident because Debian kernels were building this driver into kernel (bug). Signed-off-by: Stephen Hemminger Signed-off-by: David S. Miller commit 80f0fe0934cd3daa13a5e4d48a103f469115b160 Author: Thomas Falcon Date: Wed Aug 14 14:57:05 2019 -0500 ibmvnic: Unmap DMA address of TX descriptor buffers after use There's no need to wait until a completion is received to unmap TX descriptor buffers that have been passed to the hypervisor. Instead unmap it when the hypervisor call has completed. This patch avoids the possibility that a buffer will not be unmapped because a TX completion is lost or mishandled. Reported-by: Abdul Haleem Tested-by: Devesh K. Singh Signed-off-by: Thomas Falcon Signed-off-by: David S. Miller commit 37b0a733c12137bc1d3325c44797333177607632 Merge: f1472cb09f11 9bf46566e80f Author: David S. Miller Date: Sun Aug 18 13:05:01 2019 -0700 Merge branch 'bnxt_en-Bug-fixes' Michael Chan says: ==================== bnxt_en: Bug fixes. 2 Bug fixes related to 57500 shutdown sequence and doorbell sequence, 2 TC Flower bug fixes related to the setting of the flow direction, 1 NVRAM update bug fix, and a minor fix to suppress an unnecessary error message. Please queue for -stable as well. Thanks. ==================== Signed-off-by: David S. Miller commit 9bf46566e80fd94845527d01ebd888eb49313551 Author: Somnath Kotur Date: Sat Aug 17 17:04:52 2019 -0400 bnxt_en: Fix to include flow direction in L2 key FW expects the driver to provide unique flow reference handles for Tx or Rx flows. When a Tx flow and an Rx flow end up sharing a reference handle, flow offload does not seem to work. This could happen in the case of 2 flows having their L2 fields wildcarded but in different direction. Fix to incorporate the flow direction as part of the L2 key v2: Move the dir field to the end of the bnxt_tc_l2_key struct to fix the warning reported by kbuild test robot . There is existing code that initializes the structure using nested initializer and will warn with the new u8 field added to the beginning. The structure also packs nicer when this new u8 is added to the end of the structure [MChan]. Fixes: abd43a13525d ("bnxt_en: Support for 64-bit flow handle.") Signed-off-by: Somnath Kotur Signed-off-by: Michael Chan Signed-off-by: David S. Miller commit 685ec6a81bb0d47faf1dba49437d5bdaede2733d Author: Venkat Duvvuru Date: Sat Aug 17 17:04:51 2019 -0400 bnxt_en: Use correct src_fid to determine direction of the flow Direction of the flow is determined using src_fid. For an RX flow, src_fid is PF's fid and for TX flow, src_fid is VF's fid. Direction of the flow must be specified, when getting statistics for that flow. Currently, for DECAP flow, direction is determined incorrectly, i.e., direction is initialized as TX for DECAP flow, instead of RX. Because of which, stats are not reported for this DECAP flow, though it is offloaded and there is traffic for that flow, resulting in flow age out. This patch fixes the problem by determining the DECAP flow's direction using correct fid. Set the flow direction in all cases for consistency even if 64-bit flow handle is not used. Fixes: abd43a13525d ("bnxt_en: Support for 64-bit flow handle.") Signed-off-by: Venkat Duvvuru Signed-off-by: Michael Chan Signed-off-by: David S. Miller commit b703ba751dbb4bcd086509ed4b28102bc1670b35 Author: Vasundhara Volam Date: Sat Aug 17 17:04:50 2019 -0400 bnxt_en: Suppress HWRM errors for HWRM_NVM_GET_VARIABLE command For newly added NVM parameters, older firmware may not have the support. Suppress the error message to avoid the unncessary error message which is triggered when devlink calls the driver during initialization. Fixes: 782a624d00fa ("bnxt_en: Add bnxt_en initial params table and register it.") Signed-off-by: Vasundhara Volam Signed-off-by: Michael Chan Signed-off-by: David S. Miller commit dd2ebf3404c7c295014bc025dea23960960ceb1a Author: Vasundhara Volam Date: Sat Aug 17 17:04:49 2019 -0400 bnxt_en: Fix handling FRAG_ERR when NVM_INSTALL_UPDATE cmd fails If FW returns FRAG_ERR in response error code, driver is resending the command only when HWRM command returns success. Fix the code to resend NVM_INSTALL_UPDATE command with DEFRAG install flags, if FW returns FRAG_ERR in its response error code. Fixes: cb4d1d626145 ("bnxt_en: Retry failed NVM_INSTALL_UPDATE with defragmentation flag enabled.") Signed-off-by: Vasundhara Volam Signed-off-by: Michael Chan Signed-off-by: David S. Miller commit e8f267b063208372f7a329c6d5288d58944d873c Author: Michael Chan Date: Sat Aug 17 17:04:48 2019 -0400 bnxt_en: Improve RX doorbell sequence. When both RX buffers and RX aggregation buffers have to be replenished at the end of NAPI, post the RX aggregation buffers first before RX buffers. Otherwise, we may run into a situation where there are only RX buffers without RX aggregation buffers for a split second. This will cause the hardware to abort the RX packet and report buffer errors, which will cause unnecessary cleanup by the driver. Ringing the Aggregation ring doorbell first before the RX ring doorbell will prevent some of these buffer errors. Use the same sequence during ring initialization as well. Fixes: 697197e5a173 ("bnxt_en: Re-structure doorbells.") Signed-off-by: Michael Chan Signed-off-by: David S. Miller commit a46ecb116fb7f722fa8cb2da01959c36e4e10c41 Author: Michael Chan Date: Sat Aug 17 17:04:47 2019 -0400 bnxt_en: Fix VNIC clearing logic for 57500 chips. During device shutdown, the VNIC clearing sequence needs to be modified to free the VNIC first before freeing the RSS contexts. The current code is doing the reverse and we can get mis-directed RX completions to CP ring ID 0 when the RSS contexts are freed and zeroed. The clearing of RSS contexts is not required with the new sequence. Refactor the VNIC clearing logic into a new function bnxt_clear_vnic() and do the chip specific VNIC clearing sequence. Fixes: 7b3af4f75b81 ("bnxt_en: Add RSS support for 57500 chips.") Signed-off-by: Michael Chan Signed-off-by: David S. Miller commit f1472cb09f11ddb41d4be84f0650835cb65a9073 Author: Wenwen Wang Date: Wed Aug 14 13:56:43 2019 -0500 net: kalmia: fix memory leaks In kalmia_init_and_get_ethernet_addr(), 'usb_buf' is allocated through kmalloc(). In the following execution, if the 'status' returned by kalmia_send_init_packet() is not 0, 'usb_buf' is not deallocated, leading to memory leaks. To fix this issue, add the 'out' label to free 'usb_buf'. Signed-off-by: Wenwen Wang Signed-off-by: David S. Miller commit 1eca92eef18719027d394bf1a2d276f43e7cf886 Author: Wenwen Wang Date: Wed Aug 14 13:03:38 2019 -0500 cx82310_eth: fix a memory leak bug In cx82310_bind(), 'dev->partial_data' is allocated through kmalloc(). Then, the execution waits for the firmware to become ready. If the firmware is not ready in time, the execution is terminated. However, the allocated 'dev->partial_data' is not deallocated on this path, leading to a memory leak bug. To fix this issue, free 'dev->partial_data' before returning the error. Signed-off-by: Wenwen Wang Signed-off-by: David S. Miller commit 6825e5a6c45dbd473f8b2993a065bbea15347632 Merge: 3039fadf2bfd 834de5c1aa76 Author: Linus Torvalds Date: Sun Aug 18 12:56:42 2019 -0700 Merge tag 'fixes-for-5.3-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux Pull MTD fix from Richard Weinberger: "A single fix for MTD to correctly set the spi-nor WP pin" * tag 'fixes-for-5.3-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux: mtd: spi-nor: Fix the disabling of write protection at init commit 4a4d2d372fb9b9229327e2ed01d5d9572eddf4de Author: Manish Chopra Date: Sun Aug 18 07:25:48 2019 -0700 bnx2x: Fix VF's VLAN reconfiguration in reload. Commit 04f05230c5c13 ("bnx2x: Remove configured vlans as part of unload sequence."), introduced a regression in driver that as a part of VF's reload flow, VLANs created on the VF doesn't get re-configured in hardware as vlan metadata/info was not getting cleared for the VFs which causes vlan PING to stop. This patch clears the vlan metadata/info so that VLANs gets re-configured back in the hardware in VF's reload flow and PING/traffic continues for VLANs created over the VFs. Fixes: 04f05230c5c13 ("bnx2x: Remove configured vlans as part of unload sequence.") Signed-off-by: Manish Chopra Signed-off-by: Sudarsana Kalluru Signed-off-by: Shahed Shaikh Signed-off-by: David S. Miller commit 3039fadf2bfdc104dc963820c305778c7c1a6229 Merge: c332f3a70e7a 07301df7d2fc Author: Linus Torvalds Date: Sun Aug 18 09:51:48 2019 -0700 Merge tag 'for-5.3-rc4-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux Pull btrfs fixes from David Sterba: "Two fixes that popped up during testing: - fix for sysfs-related code that adds/removes block groups, warnings appear during several fstests in connection with sysfs updates in 5.3, the fix essentially replaces a workaround with scope NOFS and applies to 5.2-based branch too - add sanity check of trim range" * tag 'for-5.3-rc4-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux: btrfs: trim: Check the range passed into to prevent overflow Btrfs: fix sysfs warning and missing raid sysfs directories commit c332f3a70e7a094e4a60d68a2c4c6f051ed7f04d Merge: 645c03aaca2b a90118c445cc Author: Linus Torvalds Date: Sun Aug 18 09:45:42 2019 -0700 Merge branch 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 fixes from Thomas Gleixner: "A set of fixes for x86: - Fix the inconsistent error handling in the umwait init code - Rework the boot param zeroing so gcc9 stops complaining about out of bound memset. The resulting source code is actually more sane to read than the smart solution we had - Maintainers update so Tony gets involved when Intel models are added - Some more fallthrough fixes" * 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/boot: Save fields explicitly, zero out everything else MAINTAINERS, x86/CPU: Tony Luck will maintain asm/intel-family.h x86/fpu/math-emu: Address fallthrough warnings x86/apic/32: Fix yet another implicit fallthrough warning x86/umwait: Fix error handling in umwait_init() commit 645c03aaca2bc02f5d5cc70804ca00b248b729dc Merge: 5bba5c9c86b3 cbd32a1c56e3 Author: Linus Torvalds Date: Sun Aug 18 09:36:51 2019 -0700 Merge branch 'efi-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull EFI fix from Thomas Gleixner: "A single fix for a EFI mixed mode regression caused by recent rework which did not take the firmware bitwidth into account" * 'efi-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: efi-stub: Fix get_efi_config_table on mixed-mode setups commit 5bba5c9c86b31895f5cb67f2db2b0f0cddc96dc6 Merge: 4503c0a41571 0dda5907b0fc Author: Linus Torvalds Date: Sun Aug 18 09:26:16 2019 -0700 Merge tag 'spdx-5.3-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/spdx Pull SPDX fixes from Greg KH: "Here are four small SPDX fixes for 5.3-rc5. A few style fixes for some SPDX comments, added an SPDX tag for one file, and fix up some GPL boilerplate for another file. All of these have been in linux-next for a few weeks with no reported issues (they are comment changes only, so that's to be expected...)" * tag 'spdx-5.3-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/spdx: i2c: stm32: Use the correct style for SPDX License Identifier intel_th: Use the correct style for SPDX License Identifier coccinelle: api/atomic_as_refcounter: add SPDX License Identifier kernel/configs: Replace GPL boilerplate code with SPDX identifier commit 4503c0a41571bf17ef49bd147da83250d86ff7d5 Merge: ae1a616af36e 9cd02b09a0f4 Author: Linus Torvalds Date: Sun Aug 18 09:17:41 2019 -0700 Merge tag 'char-misc-5.3-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc Pull char/misc driver fixes from Greg KH: "Here are some small char and misc driver fixes for 5.3-rc5. These are two different subsystems needing some fixes, the habanalabs driver which is has some more big endian fixes for problems found. The other are some small soundwire fixes, including some Kconfig dependencies needed to resolve reported build errors. All of these have been in linux-next this week with no reported issues" * tag 'char-misc-5.3-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: misc: xilinx-sdfec: fix dependency and build error habanalabs: fix device IRQ unmasking for BE host habanalabs: fix endianness handling for internal QMAN submission habanalabs: fix completion queue handling when host is BE habanalabs: fix endianness handling for packets from user habanalabs: fix DRAM usage accounting on context tear down habanalabs: Avoid double free in error flow soundwire: fix regmap dependencies and align with other serial links soundwire: cadence_master: fix definitions for INTSTAT0/1 soundwire: cadence_master: fix register definition for SLAVE_STATE commit ae1a616af36e5ad0726407b76feed5060a424744 Merge: 359334caf777 48b30e10bfc2 Author: Linus Torvalds Date: Sun Aug 18 09:14:56 2019 -0700 Merge tag 'staging-5.3-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging Pull staging/IIO fixes from Greg KH: "Here are four small staging and iio driver fixes for 5.3-rc5 Two are for the dt3000 comedi driver for some reported problems found in that codebase, and two are some small iio fixes. All of these have been in linux-next this week with no reported issues" * tag 'staging-5.3-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging: staging: comedi: dt3000: Fix rounding up of timer divisor staging: comedi: dt3000: Fix signed integer overflow 'divider * base' iio: adc: max9611: Fix temperature reading in probe iio: frequency: adf4371: Fix output frequency setting commit 359334caf777854fc0647c610f4c34be5eaeb3ca Merge: 8fde2832bd0b 6a5f43d1d8bd Author: Linus Torvalds Date: Sun Aug 18 09:11:29 2019 -0700 Merge tag 'usb-5.3-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb Pull USB fixes from Greg KH: "Here are number of small USB fixes for 5.3-rc5. Syzbot has been on a tear recently now that it has some good USB debugging hooks integrated, so there's a number of fixes in here found by those tools for some _very_ old bugs. Also a handful of gadget driver fixes for reported issues, some hopefully-final dma fixes for host controller drivers, and some new USB serial gadget driver ids. All of these have been in linux-next this week with no reported issues (the usb-serial ones were in linux-next in its own branch, but merged into mine on Friday)" * tag 'usb-5.3-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: usb: add a hcd_uses_dma helper usb: don't create dma pools for HCDs with a localmem_pool usb: chipidea: imx: fix EPROBE_DEFER support during driver probe usb: host: fotg2: restart hcd after port reset USB: CDC: fix sanity checks in CDC union parser usb: cdc-acm: make sure a refcount is taken early enough USB: serial: option: add the BroadMobi BM818 card USB: serial: option: Add Motorola modem UARTs USB: core: Fix races in character device registration and deregistraion usb: gadget: mass_storage: Fix races between fsg_disable and fsg_set_alt usb: gadget: composite: Clear "suspended" on reset/disconnect usb: gadget: udc: renesas_usb3: Fix sysfs interface of "role" USB: serial: option: add D-Link DWM-222 device ID USB: serial: option: Add support for ZTE MF871A commit 8fde2832bd0bdc5a2b57330a9e9c3d2fa16bd1d8 Merge: 85d8d3b172eb a982eeb09b60 Author: Linus Torvalds Date: Sat Aug 17 19:39:54 2019 -0700 Merge tag 'for-linus-2019-08-17' of git://git.kernel.dk/linux-block Pull block fixes from Jens Axboe: "A collection of fixes that should go into this series. This contains: - Revert of the REQ_NOWAIT_INLINE and associated dio changes. There were still corner cases there, and even though I had a solution for it, it's too involved for this stage. (me) - Set of NVMe fixes (via Sagi) - io_uring fix for fixed buffers (Anthony) - io_uring defer issue fix (Jackie) - Regression fix for queue sync at exit time (zhengbin) - xen blk-back memory leak fix (Wenwen)" * tag 'for-linus-2019-08-17' of git://git.kernel.dk/linux-block: io_uring: fix an issue when IOSQE_IO_LINK is inserted into defer list block: remove REQ_NOWAIT_INLINE io_uring: fix manual setup of iov_iter for fixed buffers xen/blkback: fix memory leaks blk-mq: move cancel of requeue_work to the front of blk_exit_queue nvme-pci: Fix async probe remove race nvme: fix controller removal race with scan work nvme-rdma: fix possible use-after-free in connect error flow nvme: fix a possible deadlock when passthru commands sent to a multipath device nvme-core: Fix extra device_put() call on error path nvmet-file: fix nvmet_file_flush() always returning an error nvmet-loop: Flush nvme_delete_wq when removing the port nvmet: Fix use-after-free bug when a port is removed nvme-multipath: revalidate nvme_ns_head gendisk in nvme_validate_ns commit 85d8d3b172eb37b23dcdbe9fa7a85e343642bfea Merge: 05c525326957 bafe1e79e05d Author: Linus Torvalds Date: Sat Aug 17 19:31:30 2019 -0700 Merge tag 'hyperv-fixes-signed' of git://git.kernel.org/pub/scm/linux/kernel/git/hyperv/linux Pull Hyper-V fixes from Sasha Levin: - A few fixes for the userspace hyper-v tools from Adrian Vladu. - A fix for the hyper-v MAINTAINERs entry from Lan Tianyu. - Fix for SPDX license identifier in the userspace tools from Nishad Kamdar. * tag 'hyperv-fixes-signed' of git://git.kernel.org/pub/scm/linux/kernel/git/hyperv/linux: MAINTAINERS: Fix Hyperv vIOMMU driver file name tools: hv: Use the correct style for SPDX License Identifier tools: hv: fix typos in toolchain tools: hv: fix KVP and VSS daemons exit code tools: hv: fixed Python pep8/flake8 warnings for lsvmbus commit 42eb4554702d40668968da333ffa37cc0a15ff9e Merge: 712042313b23 58a96fc35375 Author: David S. Miller Date: Sat Aug 17 12:37:47 2019 -0700 Merge branch 'for-upstream' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth Johan Hedberg says: ==================== pull request: bluetooth 2019-08-17 Here's a set of Bluetooth fixes for the 5.3-rc series: - Multiple fixes for Qualcomm (btqca & hci_qca) drivers - Minimum encryption key size debugfs setting (this is required for Bluetooth Qualification) - Fix hidp_send_message() to have a meaningful return value ==================== Signed-off-by: David S. Miller commit bafe1e79e05de725e26b3f60c90b49e635b686b9 Author: Lan Tianyu Date: Tue Mar 26 14:28:21 2019 +0800 MAINTAINERS: Fix Hyperv vIOMMU driver file name The Hyperv vIOMMU file name should be "hyperv-iommu.c" rather than "hyperv_iommu.c". This patch is to fix it. Signed-off-by: Lan Tianyu Signed-off-by: Sasha Levin commit 61e0f39105b7926a41bc03158eccf5ed13207ebd Author: Nishad Kamdar Date: Mon Jul 22 19:01:17 2019 +0530 tools: hv: Use the correct style for SPDX License Identifier This patch corrects the SPDX License Identifier style in the trace header file related to Microsoft Hyper-V client drivers. For C header files Documentation/process/license-rules.rst mandates C-like comments (opposed to C source files where C++ style should be used) Changes made by using a script provided by Joe Perches here: https://lkml.org/lkml/2019/2/7/46 Suggested-by: Joe Perches Signed-off-by: Nishad Kamdar Acked-by: Greg Kroah-Hartman Signed-off-by: Sasha Levin commit 2d35c66036b2494c329a32468c85405493370e75 Author: Adrian Vladu Date: Mon May 6 16:51:24 2019 +0000 tools: hv: fix typos in toolchain Fix typos in the HyperV toolchain. Signed-off-by: Adrian Vladu Cc: "K. Y. Srinivasan" Cc: Haiyang Zhang Cc: Stephen Hemminger Cc: Sasha Levin Cc: Alessandro Pilotti Signed-off-by: Sasha Levin commit b0995156071b0ff29a5902964a9dc8cfad6f81c0 Author: Adrian Vladu Date: Mon May 6 16:50:58 2019 +0000 tools: hv: fix KVP and VSS daemons exit code HyperV KVP and VSS daemons should exit with 0 when the '--help' or '-h' flags are used. Signed-off-by: Adrian Vladu Cc: "K. Y. Srinivasan" Cc: Haiyang Zhang Cc: Stephen Hemminger Cc: Sasha Levin Cc: Alessandro Pilotti Signed-off-by: Sasha Levin commit 5912e791f3018de0a007c8cfa9cb38c97d3e5f5c Author: Adrian Vladu Date: Mon May 6 17:27:37 2019 +0000 tools: hv: fixed Python pep8/flake8 warnings for lsvmbus Fixed pep8/flake8 python style code for lsvmbus tool. The TAB indentation was on purpose ignored (pep8 rule W191) to make sure the code is complying with the Linux code guideline. The following command doe not show any warnings now: pep8 --ignore=W191 lsvmbus flake8 --ignore=W191 lsvmbus Signed-off-by: Adrian Vladu Cc: "K. Y. Srinivasan" Cc: Haiyang Zhang Cc: Stephen Hemminger Cc: Sasha Levin Cc: Dexuan Cui Cc: Alessandro Pilotti Signed-off-by: Sasha Levin commit 05c525326957b504561d271f669d3b315930422f Merge: 2f478b60118f 90865a3dc597 Author: Linus Torvalds Date: Sat Aug 17 10:44:50 2019 -0700 Merge branch 'i2c/for-current' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux Pull i2c fixes from Wolfram Sang: "I2C has one revert because of a regression, two fixes for tiny race windows (which we were not able to trigger), a MAINTAINERS addition, and a SPDX fix" * 'i2c/for-current' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux: i2c: stm32: Use the correct style for SPDX License Identifier i2c: emev2: avoid race when unregistering slave client i2c: rcar: avoid race when unregistering slave client MAINTAINERS: i2c-imx: take over maintainership Revert "i2c: imx: improve the error handling in i2c_imx_dma_request()" commit 2f478b60118f48bf66eaddcca0d23e80f87a682d Merge: 6e625a1a3f47 69703eb9a8ae Author: Linus Torvalds Date: Sat Aug 17 10:36:47 2019 -0700 Merge tag 'riscv/for-v5.3-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux Pull RISC-V fixes from Paul Walmsley: - Two patches to fix significant bugs in floating point register context handling - A minor fix in RISC-V flush_tlb_page(), to supply a valid end address to flush_tlb_range() - Two minor defconfig additions: to build the virtio hwrng driver by default (for QEMU targets), and to partially synchronize the 32-bit defconfig with the 64-bit defconfig * tag 'riscv/for-v5.3-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux: riscv: Make __fstate_clean() work correctly. riscv: Correct the initialized flow of FP register riscv: defconfig: Update the defconfig riscv: rv32_defconfig: Update the defconfig riscv: fix flush_tlb_range() end address for flush_tlb_page() commit 6a5f43d1d8bd3779e428178438caf33f60427124 Merge: edfbcb321faf e5d8badf37e6 Author: Greg Kroah-Hartman Date: Sat Aug 17 17:09:33 2019 +0200 Merge tag 'usb-serial-5.3-rc5' of https://git.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial into usb-linus Johan writes: USB-serial fixes for 5.3-rc5 Here are some new modem device ids. All have been in linux-next with no reported issues. Signed-off-by: Johan Hovold * tag 'usb-serial-5.3-rc5' of https://git.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial: USB: serial: option: add the BroadMobi BM818 card USB: serial: option: Add Motorola modem UARTs USB: serial: option: add D-Link DWM-222 device ID USB: serial: option: Add support for ZTE MF871A commit 58a96fc35375ab87db7c5b69336f5befde1b548f Author: Marcel Holtmann Date: Tue Jul 16 20:34:41 2019 +0200 Bluetooth: Add debug setting for changing minimum encryption key size For testing and qualification purposes it is useful to allow changing the minimum encryption key size value that the host stack is going to enforce. This adds a new debugfs setting min_encrypt_key_size to achieve this functionality. Signed-off-by: Marcel Holtmann Signed-off-by: Johan Hedberg commit 12ece2d53d3e8f827e972caf497c165f7729c717 Author: Tony Luck Date: Thu Aug 15 11:16:24 2019 -0700 x86/cpu: Explain Intel model naming convention Dave Hansen spelled out the rules in an e-mail: https://lkml.kernel.org/r/91eefbe4-e32b-d762-be4d-672ff915db47@intel.com Copy those right into the file to make it easy for people to find them. Suggested-by: Borislav Petkov Signed-off-by: Tony Luck Signed-off-by: Borislav Petkov Acked-by: Thomas Gleixner Cc: "H. Peter Anvin" Cc: Dave Hansen Cc: Ingo Molnar Cc: x86-ml Link: https://lkml.kernel.org/r/20190815224704.GA10025@agluck-desk2.amr.corp.intel.com commit edc58dd0123b552453a74369bd0c8d890b497b4b Author: Darrick J. Wong Date: Sun Aug 11 15:52:25 2019 -0700 vfs: fix page locking deadlocks when deduping files When dedupe wants to use the page cache to compare parts of two files for dedupe, we must be very careful to handle locking correctly. The current code doesn't do this. It must lock and unlock the page only once if the two pages are the same, since the overlapping range check doesn't catch this when blocksize < pagesize. If the pages are distinct but from the same file, we must observe page locking order and lock them in order of increasing offset to avoid clashing with writeback locking. Fixes: 876bec6f9bbfcb3 ("vfs: refactor clone/dedupe_file_range common functions") Signed-off-by: Darrick J. Wong Reviewed-by: Bill O'Donnell Reviewed-by: Matthew Wilcox (Oracle) commit 4529e6d7a6ab727aa85b1dd3cbfa9e82f10f730d Author: Christoph Hellwig Date: Thu Aug 15 23:41:06 2019 -0700 xfs: compat_ioctl: use compat_ptr() For 31-bit s390 user space, we have to pass pointer arguments through compat_ptr() in the compat_ioctl handler. Signed-off-by: Arnd Bergmann Signed-off-by: Christoph Hellwig Reviewed-by: Eric Sandeen Reviewed-by: Darrick J. Wong Signed-off-by: Darrick J. Wong commit 314e01a6d7ddf04608440beb087b21d8aa32f03f Author: Christoph Hellwig Date: Thu Aug 15 23:41:06 2019 -0700 xfs: fall back to native ioctls for unhandled compat ones Always try the native ioctl if we don't have a compat handler. This removes a lot of boilerplate code as 'modern' ioctls should generally be compat clean, and fixes the missing entries for the recently added FS_IOC_GETFSLABEL/FS_IOC_SETFSLABEL ioctls. Fixes: f7664b31975b ("xfs: implement online get/set fs label") Signed-off-by: Christoph Hellwig Reviewed-by: Eric Sandeen Reviewed-by: Darrick J. Wong Signed-off-by: Darrick J. Wong commit 6e625a1a3f471d63989d3a66cdf6a0c307654848 Merge: b7e7c85dc7b0 cd8869f4cb25 Author: Linus Torvalds Date: Fri Aug 16 17:27:55 2019 -0700 Merge tag 'xtensa-20190816' of git://github.com/jcmvbkbc/linux-xtensa Pull Xtensa fix from Max Filippov: "Add missing isync into cpu_reset to make sure ITLB changes are effective" * tag 'xtensa-20190816' of git://github.com/jcmvbkbc/linux-xtensa: xtensa: add missing isync to the cpu_reset TLB code commit 712042313b23b5df7451faf4b279beb3025e990c Author: Tuong Lien Date: Thu Aug 15 10:24:08 2019 +0700 tipc: fix false detection of retransmit failures This commit eliminates the use of the link 'stale_limit' & 'prev_from' (besides the already removed - 'stale_cnt') variables in the detection of repeated retransmit failures as there is no proper way to initialize them to avoid a false detection, i.e. it is not really a retransmission failure but due to a garbage values in the variables. Instead, a jiffies variable will be added to individual skbs (like the way we restrict the skb retransmissions) in order to mark the first skb retransmit time. Later on, at the next retransmissions, the timestamp will be checked to see if the skb in the link transmq is "too stale", that is, the link tolerance time has passed, so that a link reset will be ordered. Note, just checking on the first skb in the queue is fine enough since it must be the oldest one. A counter is also added to keep track the actual skb retransmissions' number for later checking when the failure happens. The downside of this approach is that the skb->cb[] buffer is about to be exhausted, however it is always able to allocate another memory area and keep a reference to it when needed. Fixes: 77cf8edbc0e7 ("tipc: simplify stale link failure criteria") Reported-by: Hoang Le Acked-by: Ying Xue Acked-by: Jon Maloy Signed-off-by: Tuong Lien Signed-off-by: David S. Miller commit df451f83e1fc0fa3764a2724b0faaaf9d07ab1b6 Author: Andreas Kemnade Date: Fri Aug 16 18:50:00 2019 +0200 gpio: of: fix Freescale SPI CS quirk handling On the gta04 we see: spi_gpio: probe of spi_lcd failed with error -2 The quirk introduced in commit e3023bf80639 ("gpio: of: Handle the Freescale SPI CS") can also be triggered by a temporary -EPROBE_DEFER and so "convert" it to a hard -ENOENT. Disable that conversion by checking for -EPROBE_DEFER. Fixes: e3023bf80639 ("gpio: of: Handle the Freescale SPI CS") Suggested-by: H. Nikolaus Schaller Signed-off-by: Andreas Kemnade Link: https://lore.kernel.org/r/20190816165000.32334-1-andreas@kemnade.info Signed-off-by: Linus Walleij commit b9cbf8a64865b50fd0f4a3915fa00ac7365cdf8f Author: Wenwen Wang Date: Wed Aug 14 11:23:13 2019 -0500 lan78xx: Fix memory leaks In lan78xx_probe(), a new urb is allocated through usb_alloc_urb() and saved to 'dev->urb_intr'. However, in the following execution, if an error occurs, 'dev->urb_intr' is not deallocated, leading to memory leaks. To fix this issue, invoke usb_free_urb() to free the allocated urb before returning from the function. Signed-off-by: Wenwen Wang Signed-off-by: David S. Miller commit 0a66c20a6a123d6dc96c6197f02455cb64615271 Author: Denis Efremov Date: Wed Aug 14 15:12:09 2019 +0300 MAINTAINERS: r8169: Update path to the driver Update MAINTAINERS record to reflect the filename change. The file was moved in commit 25e992a4603c ("r8169: rename r8169.c to r8169_main.c") Cc: Heiner Kallweit Cc: nic_swsd@realtek.com Cc: David S. Miller Cc: netdev@vger.kernel.org Signed-off-by: Denis Efremov Reviewed-by: Heiner Kallweit Signed-off-by: David S. Miller commit 5a69e4980258c56f6d4c2048a1b9c260218785b7 Author: Denis Efremov Date: Wed Aug 14 15:58:00 2019 +0300 MAINTAINERS: PHY LIBRARY: Update files in the record Update MAINTAINERS to reflect that sysfs-bus-mdio was removed in commit a6cd0d2d493a ("Documentation: net-sysfs: Remove duplicate PHY device documentation") and sysfs-class-net-phydev was added in commit 86f22d04dfb5 ("net: sysfs: Document PHY device sysfs attributes"). Cc: Florian Fainelli Cc: Andrew Lunn Cc: Heiner Kallweit Cc: David S. Miller Cc: netdev@vger.kernel.org Signed-off-by: Denis Efremov Reviewed-by: Florian Fainelli Signed-off-by: David S. Miller commit b7e7c85dc7b0ea5ff821756c331489e3b151eed1 Merge: 2d63ba3e41db b6143d10d23e Author: Linus Torvalds Date: Fri Aug 16 10:51:47 2019 -0700 Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux Pull arm64 fixes from Catalin Marinas: - Don't taint the kernel if CPUs have different sets of page sizes supported (other than the one in use). - Issue I-cache maintenance for module ftrace trampoline. * tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux: arm64: ftrace: Ensure module ftrace trampoline is coherent with I-side arm64: cpufeature: Don't treat granule sizes as strict commit 78e70e780b289ff59ec33a9f9c1fcecaf17a46e1 Author: He Zhe Date: Tue Aug 6 17:41:04 2019 +0800 nfsd4: Fix kernel crash when reading proc file reply_cache_stats reply_cache_stats uses wrong parameter as seq file private structure and thus causes the following kernel crash when users read /proc/fs/nfsd/reply_cache_stats BUG: kernel NULL pointer dereference, address: 00000000000001f9 PGD 0 P4D 0 Oops: 0000 [#3] SMP PTI CPU: 6 PID: 1502 Comm: cat Tainted: G D 5.3.0-rc3+ #1 Hardware name: Intel Corporation Broadwell Client platform/Basking Ridge, BIOS BDW-E2R1.86C.0118.R01.1503110618 03/11/2015 RIP: 0010:nfsd_reply_cache_stats_show+0x3b/0x2d0 Code: 41 54 49 89 f4 48 89 fe 48 c7 c7 b3 10 33 88 53 bb e8 03 00 00 e8 88 82 d1 ff bf 58 89 41 00 e8 eb c5 85 00 48 83 eb 01 75 f0 <41> 8b 94 24 f8 01 00 00 48 c7 c6 be 10 33 88 4c 89 ef bb e8 03 00 RSP: 0018:ffffaa520106fe08 EFLAGS: 00010246 RAX: 000000cfe1a77123 RBX: 0000000000000000 RCX: 0000000000291b46 RDX: 000000cf00000000 RSI: 0000000000000006 RDI: 0000000000291b28 RBP: ffffaa520106fe20 R08: 0000000000000006 R09: 000000cfe17e55dd R10: ffffa424e47c0000 R11: 000000000000030b R12: 0000000000000001 R13: ffffa424e5697000 R14: 0000000000000001 R15: ffffa424e5697000 FS: 00007f805735f580(0000) GS:ffffa424f8f80000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00000000000001f9 CR3: 00000000655ce005 CR4: 00000000003606e0 Call Trace: seq_read+0x194/0x3e0 __vfs_read+0x1b/0x40 vfs_read+0x95/0x140 ksys_read+0x61/0xe0 __x64_sys_read+0x1a/0x20 do_syscall_64+0x4d/0x120 entry_SYSCALL_64_after_hwframe+0x44/0xa9 RIP: 0033:0x7f805728b861 Code: fe ff ff 50 48 8d 3d 86 b4 09 00 e8 79 e0 01 00 66 0f 1f 84 00 00 00 00 00 48 8d 05 d9 19 0d 00 8b 00 85 c0 75 13 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 57 c3 66 0f 1f 44 00 00 48 83 ec 28 48 89 54 RSP: 002b:00007ffea1ce3c38 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 RAX: ffffffffffffffda RBX: 0000000000020000 RCX: 00007f805728b861 RDX: 0000000000020000 RSI: 00007f8057183000 RDI: 0000000000000003 RBP: 00007f8057183000 R08: 00007f8057182010 R09: 0000000000000000 R10: 0000000000000022 R11: 0000000000000246 R12: 0000559a60e8ff10 R13: 0000000000000003 R14: 0000000000020000 R15: 0000000000020000 Modules linked in: CR2: 00000000000001f9 ---[ end trace 01613595153f0cba ]--- RIP: 0010:nfsd_reply_cache_stats_show+0x3b/0x2d0 Code: 41 54 49 89 f4 48 89 fe 48 c7 c7 b3 10 33 88 53 bb e8 03 00 00 e8 88 82 d1 ff bf 58 89 41 00 e8 eb c5 85 00 48 83 eb 01 75 f0 <41> 8b 94 24 f8 01 00 00 48 c7 c6 be 10 33 88 4c 89 ef bb e8 03 00 RSP: 0018:ffffaa52004b3e08 EFLAGS: 00010246 RAX: 0000002bab45a7c6 RBX: 0000000000000000 RCX: 0000000000291b4c RDX: 0000002b00000000 RSI: 0000000000000004 RDI: 0000000000291b28 RBP: ffffaa52004b3e20 R08: 0000000000000004 R09: 0000002bab1c8c7a R10: ffffa424e5500000 R11: 00000000000002a9 R12: 0000000000000001 R13: ffffa424e4475000 R14: 0000000000000001 R15: ffffa424e4475000 FS: 00007f805735f580(0000) GS:ffffa424f8f80000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00000000000001f9 CR3: 00000000655ce005 CR4: 00000000003606e0 Killed Fixes: 3ba75830ce17 ("nfsd4: drc containerization") Signed-off-by: He Zhe Signed-off-by: J. Bruce Fields commit 24876f09a7dfe36a82f53d304d8c1bceb3257a0f Author: Martin Blumenstingl Date: Fri Aug 16 00:31:55 2019 +0200 clk: Fix potential NULL dereference in clk_fetch_parent_index() Don't compare the parent clock name with a NULL name in the clk_parent_map. This prevents a kernel crash when passing NULL core->parents[i].name to strcmp(). An example which triggered this is a mux clock with four parents when each of them is referenced in the clock driver using clk_parent_data.fw_name and then calling clk_set_parent(clk, 3rd_parent) on this mux. In this case the first parent is also the HW default so core->parents[i].hw is populated when the clock is registered. Calling clk_set_parent(clk, 3rd_parent) will then go through all parents and skip the first parent because it's hw pointer doesn't match. For the second parent no hw pointer is cached yet and clk_core_get(core, 1) returns a non-matching pointer (which is correct because we are comparing the second with the third parent). Comparing the result of clk_core_get(core, 2) with the requested parent gives a match. However we don't reach this point because right after the clk_core_get(core, 1) mismatch the old code tried to !strcmp(parent->name, NULL) (where the second argument is actually core->parents[i].name, but that was never populated by the clock driver). Signed-off-by: Martin Blumenstingl Link: https://lkml.kernel.org/r/20190815223155.21384-1-martin.blumenstingl@googlemail.com Fixes: fc0c209c147f ("clk: Allow parents to be specified without string names") Signed-off-by: Stephen Boyd commit 4f8c6aba37da199155a121c6cdc38505a9eb0259 Author: Stephen Boyd Date: Tue Aug 13 14:41:47 2019 -0700 clk: Fix falling back to legacy parent string matching Calls to clk_core_get() will return ERR_PTR(-EINVAL) if we've started migrating a clk driver to use the DT based style of specifying parents but we haven't made any DT updates yet. This happens when we pass a non-NULL value as the 'name' argument of of_parse_clkspec(). That function returns -EINVAL in such a situation, instead of -ENOENT like we expected. The return value comes back up to clk_core_fill_parent_index() which proceeds to skip calling clk_core_lookup() because the error pointer isn't equal to -ENOENT, it's -EINVAL. Furthermore, we blindly overwrite the error pointer returned by clk_core_get() with NULL when there isn't a legacy .name member specified in the parent map. This isn't too bad right now because we don't really care to differentiate NULL from an error, but in the future we should only try to do a legacy lookup if we know we might find something. This way DT lookups that fail don't try to lookup based on strings when there isn't any string to match, hiding the error from DT parsing. Fix both these problems so that clk provider drivers can use the new style of parent mapping without having to also update their DT at the same time. This patch is based on an earlier patch from Taniya Das which checked for -EINVAL in addition to -ENOENT return values from clk_core_get(). Fixes: 601b6e93304a ("clk: Allow parents to be specified via clkspec index") Cc: Taniya Das Cc: Jerome Brunet Cc: Chen-Yu Tsai Reported-by: Taniya Das Signed-off-by: Stephen Boyd Link: https://lkml.kernel.org/r/20190813214147.34394-1-sboyd@kernel.org Tested-by: Taniya Das commit b6143d10d23ebb4a77af311e8b8b7f019d0163e6 Author: Will Deacon Date: Fri Aug 16 14:57:43 2019 +0100 arm64: ftrace: Ensure module ftrace trampoline is coherent with I-side The initial support for dynamic ftrace trampolines in modules made use of an indirect branch which loaded its target from the beginning of a special section (e71a4e1bebaf7 ("arm64: ftrace: add support for far branches to dynamic ftrace")). Since no instructions were being patched, no cache maintenance was needed. However, later in be0f272bfc83 ("arm64: ftrace: emit ftrace-mod.o contents through code") this code was reworked to output the trampoline instructions directly into the PLT entry but, unfortunately, the necessary cache maintenance was overlooked. Add a call to __flush_icache_range() after writing the new trampoline instructions but before patching in the branch to the trampoline. Cc: Ard Biesheuvel Cc: James Morse Cc: Fixes: be0f272bfc83 ("arm64: ftrace: emit ftrace-mod.o contents through code") Signed-off-by: Will Deacon Signed-off-by: Catalin Marinas commit 2d63ba3e41db3ceb0d23924ed2879b910276e24c Merge: 9da5bb24bb36 a3ee2477c45f Author: Linus Torvalds Date: Fri Aug 16 09:13:16 2019 -0700 Merge tag 'pm-5.3-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull power management fixes from Rafael Wysocki: "These add a check to avoid recent suspend-to-idle power regression on systems with NVMe drives where the PCIe ASPM policy is "performance" (or when the kernel is built without ASPM support), fix an issue related to frequency limits in the schedutil cpufreq governor and fix a mistake related to the PM QoS usage in the cpufreq core introduced recently. Specifics: - Disable NVMe power optimization related to suspend-to-idle added recently on systems where PCIe ASPM is not able to put PCIe links into low-power states to prevent excess power from being drawn by the system while suspended (Rafael Wysocki). - Make the schedutil governor handle frequency limits changes properly in all cases (Viresh Kumar). - Prevent the cpufreq core from treating positive values returned by dev_pm_qos_update_request() as errors (Viresh Kumar)" * tag 'pm-5.3-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: nvme-pci: Allow PCI bus-level PM to be used if ASPM is disabled PCI/ASPM: Add pcie_aspm_enabled() cpufreq: schedutil: Don't skip freq update when limits change cpufreq: dev_pm_qos_update_request() can return 1 on success commit 9da5bb24bb368567a43ac2df0e108e43d80f3564 Merge: cfa0bb2aef99 d555c34338ca Author: Linus Torvalds Date: Fri Aug 16 08:59:33 2019 -0700 Merge tag 'dmaengine-fix-5.3-rc5' of git://git.infradead.org/users/vkoul/slave-dma Pull dmaengine fixes from Vinod Koul: "Fixes in dmaengine drivers for: - dw-edma: endianess, _iomem type and stack usages - ste_dma40: unneeded variable and null-pointer dereference - tegra210-adma: unused function - omap-dma: off-by-one fix" * tag 'dmaengine-fix-5.3-rc5' of git://git.infradead.org/users/vkoul/slave-dma: omap-dma/omap_vout_vrfb: fix off-by-one fi value dmaengine: stm32-mdma: Fix a possible null-pointer dereference in stm32_mdma_irq_handler() dmaengine: tegra210-adma: Fix unused function warnings dmaengine: ste_dma40: fix unneeded variable warning dmaengine: dw-edma: fix endianess confusion dmaengine: dw-edma: fix __iomem type confusion dmaengine: dw-edma: fix unnecessary stack usage commit cfa0bb2aef998a64d5ad2c065be8511ad98d5d79 Merge: ec037ac244c0 19bce474c45b Author: Linus Torvalds Date: Fri Aug 16 08:49:45 2019 -0700 Merge tag 'sound-5.3-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "All small fixes targeted for stable: - Two fixes for USB-audio with malformed descriptor, spotted by fuzzers - Two fixes Conexant HD-audio codec wrt power management - Quirks for HD-audio AMD platform and HP laptop - HD-audio memory leak fix" * tag 'sound-5.3-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: ALSA: usb-audio: Fix a stack buffer overflow bug in check_input_term ALSA: usb-audio: Fix an OOB bug in parse_audio_mixer_unit ALSA: hda - Add a generic reboot_notify ALSA: hda - Let all conexant codec enter D3 when rebooting ALSA: hda/realtek - Add quirk for HP Envy x360 ALSA: hda - Fix a memory leak bug ALSA: hda - Apply workaround for another AMD chip 1022:1487 commit ec037ac244c070f9eedcdf5cdb23bd817e7b8cf4 Merge: a69e90512d9d a85abd5d45ad Author: Linus Torvalds Date: Fri Aug 16 08:41:15 2019 -0700 Merge tag 'drm-fixes-2019-08-16' of git://anongit.freedesktop.org/drm/drm Pull drm fixes from Dave Airlie: "Nothing too crazy this week, one amdgpu fix to use vmalloc for a struct that grew in size, and another MST fix for nouveau, and some other misc fixes: i915: - single GVT use after free fix scheduler: - entity destruction race fix amdgpu: - struct allocation fix - gfx9 soft recovery fix nouveau: - followup MST fix ast: - vga register race fix" * tag 'drm-fixes-2019-08-16' of git://anongit.freedesktop.org/drm/drm: drm/nouveau: Only recalculate PBN/VCPI on mode/connector changes drm/ast: Fixed reboot test may cause system hanged drm/scheduler: use job count instead of peek drm/amd/display: use kvmalloc for dc_state (v2) drm/amdgpu: fix gfx9 soft recovery drm/i915: Use after free in error path in intel_vgpu_create_workload() commit a53358a31c989c360ea59536d28762b9d2d68d19 Author: Jacopo Mondi Date: Mon Aug 5 18:18:37 2019 +0200 drm: rcar_lvds: Fix dual link mode operations The R-Car LVDS encoder units support dual-link operations by splitting the pixel output between the primary encoder and the companion encoder. Currently the companion encoder fails at probe time, causing the registration of the primary to fail as well, preventing the whole DU unit from being registered at all. Fix this by not bailing out from probe with error if the "renesas,companion" property is not specified. Fixes: fa440d870358 ("drm: rcar-du: lvds: Add support for dual-link mode") Reported-by: Fabrizio Castro Signed-off-by: Jacopo Mondi Reviewed-by: Laurent Pinchart Signed-off-by: Laurent Pinchart commit a3ee2477c45f73184a64d9c6cf97855a52732dc6 Merge: 4eaefe8c621c 600f5badb78c Author: Rafael J. Wysocki Date: Fri Aug 16 14:24:51 2019 +0200 Merge branch 'pm-cpufreq' * pm-cpufreq: cpufreq: schedutil: Don't skip freq update when limits change cpufreq: dev_pm_qos_update_request() can return 1 on success commit a90118c445cc7f07781de26a9684d4ec58bfcfd1 Author: John Hubbard Date: Tue Jul 30 22:46:27 2019 -0700 x86/boot: Save fields explicitly, zero out everything else Recent gcc compilers (gcc 9.1) generate warnings about an out of bounds memset, if the memset goes accross several fields of a struct. This generated a couple of warnings on x86_64 builds in sanitize_boot_params(). Fix this by explicitly saving the fields in struct boot_params that are intended to be preserved, and zeroing all the rest. [ tglx: Tagged for stable as it breaks the warning free build there as well ] Suggested-by: Thomas Gleixner Suggested-by: H. Peter Anvin Signed-off-by: John Hubbard Signed-off-by: Thomas Gleixner Cc: stable@vger.kernel.org Link: https://lkml.kernel.org/r/20190731054627.5627-2-jhubbard@nvidia.com commit 9cd02b09a0f4439e5323c20b710331771c2b6341 Merge: 01fd150f4aff 8676b3ca4673 Author: Greg Kroah-Hartman Date: Fri Aug 16 12:35:56 2019 +0200 Merge tag 'soundwire-5.3-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/soundwire into char-misc-linus Vinod writes: soundwire fixes for v5.3-rc5 Pierre sent fixes which are queued now for v5.3-rc5 are: - regmap dependecy - cadence register definitions * tag 'soundwire-5.3-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/soundwire: soundwire: fix regmap dependencies and align with other serial links soundwire: cadence_master: fix definitions for INTSTAT0/1 soundwire: cadence_master: fix register definition for SLAVE_STATE commit d34b044038bfb0e19caa8b019910efc465f41d5f Author: Quentin Monnet Date: Thu Aug 15 15:22:23 2019 +0100 tools: bpftool: close prog FD before exit on showing a single program When showing metadata about a single program by invoking "bpftool prog show PROG", the file descriptor referring to the program is not closed before returning from the function. Let's close it. Fixes: 71bb428fe2c1 ("tools: bpf: add bpftool") Signed-off-by: Quentin Monnet Reviewed-by: Jakub Kicinski Acked-by: Andrii Nakryiko Signed-off-by: Alexei Starovoitov commit a85abd5d45adba75535b7fc6d9f78329a693b7a9 Merge: 2f62c5d6ed0a daa37200d489 Author: Dave Airlie Date: Fri Aug 16 12:41:52 2019 +1000 Merge tag 'drm-intel-fixes-2019-08-15' of git://anongit.freedesktop.org/drm/drm-intel into drm-fixes drm/i915 fixes for v5.4-rc5: - GVT use-after-free fix Signed-off-by: Dave Airlie From: Jani Nikula Link: https://patchwork.freedesktop.org/patch/msgid/87zhkag9ic.fsf@intel.com commit 480fd998bdcd7f77ea601303144811099a12a442 Merge: 12ed60151345 06d9532fa6b3 Author: David S. Miller Date: Thu Aug 15 16:33:22 2019 -0700 Merge tag 'rxrpc-fixes-20190814' of git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs David Howells says: ==================== rxrpc: Fix local endpoint handling Here's a pair of patches that fix two issues in the handling of local endpoints (rxrpc_local structs): (1) Use list_replace_init() rather than list_replace() if we're going to unconditionally delete the replaced item later, lest the list get corrupted. (2) Don't access the rxrpc_local object after passing our ref to the workqueue, not even to illuminate tracepoints, as the work function may cause the object to be freed. We have to cache the information beforehand. ==================== Signed-off-by: David S. Miller commit 12ed60151345f92d788ee2693824c1831c6c6cb2 Merge: 32d3182cd2cd dfe42be15fde Author: David S. Miller Date: Thu Aug 15 14:01:14 2019 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf Pablo Neira Ayuso says: ==================== Netfilter fixes for net This patchset contains Netfilter fixes for net: 1) Extend selftest to cover flowtable with ipsec, from Florian Westphal. 2) Fix interaction of ipsec with flowtable, also from Florian. 3) User-after-free with bound set to rule that fails to load. 4) Adjust state and timeout for flows that expire. 5) Timeout update race with flows in teardown state. 6) Ensure conntrack id hash calculation use invariants as input, from Dirk Morris. 7) Do not push flows into flowtable for TCP fin/rst packets. ==================== Signed-off-by: David S. Miller commit 32d3182cd2cd29b2e7e04df7b0db350fbe11289f Author: Eric Dumazet Date: Wed Aug 14 02:11:57 2019 -0700 net/packet: fix race in tpacket_snd() packet_sendmsg() checks tx_ring.pg_vec to decide if it must call tpacket_snd(). Problem is that the check is lockless, meaning another thread can issue a concurrent setsockopt(PACKET_TX_RING ) to flip tx_ring.pg_vec back to NULL. Given that tpacket_snd() grabs pg_vec_lock mutex, we can perform the check again to solve the race. syzbot reported : kasan: CONFIG_KASAN_INLINE enabled kasan: GPF could be caused by NULL-ptr deref or user memory access general protection fault: 0000 [#1] PREEMPT SMP KASAN CPU: 1 PID: 11429 Comm: syz-executor394 Not tainted 5.3.0-rc4+ #101 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:packet_lookup_frame+0x8d/0x270 net/packet/af_packet.c:474 Code: c1 ee 03 f7 73 0c 80 3c 0e 00 0f 85 cb 01 00 00 48 8b 0b 89 c0 4c 8d 24 c1 48 b8 00 00 00 00 00 fc ff df 4c 89 e1 48 c1 e9 03 <80> 3c 01 00 0f 85 94 01 00 00 48 8d 7b 10 4d 8b 3c 24 48 b8 00 00 RSP: 0018:ffff88809f82f7b8 EFLAGS: 00010246 RAX: dffffc0000000000 RBX: ffff8880a45c7030 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 1ffff110148b8e06 RDI: ffff8880a45c703c RBP: ffff88809f82f7e8 R08: ffff888087aea200 R09: fffffbfff134ae50 R10: fffffbfff134ae4f R11: ffffffff89a5727f R12: 0000000000000000 R13: 0000000000000001 R14: ffff8880a45c6ac0 R15: 0000000000000000 FS: 00007fa04716f700(0000) GS:ffff8880ae900000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fa04716edb8 CR3: 0000000091eb4000 CR4: 00000000001406e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: packet_current_frame net/packet/af_packet.c:487 [inline] tpacket_snd net/packet/af_packet.c:2667 [inline] packet_sendmsg+0x590/0x6250 net/packet/af_packet.c:2975 sock_sendmsg_nosec net/socket.c:637 [inline] sock_sendmsg+0xd7/0x130 net/socket.c:657 ___sys_sendmsg+0x3e2/0x920 net/socket.c:2311 __sys_sendmmsg+0x1bf/0x4d0 net/socket.c:2413 __do_sys_sendmmsg net/socket.c:2442 [inline] __se_sys_sendmmsg net/socket.c:2439 [inline] __x64_sys_sendmmsg+0x9d/0x100 net/socket.c:2439 do_syscall_64+0xfd/0x6a0 arch/x86/entry/common.c:296 entry_SYSCALL_64_after_hwframe+0x49/0xbe Fixes: 69e3c75f4d54 ("net: TX_RING and packet mmap") Signed-off-by: Eric Dumazet Reported-by: syzbot Signed-off-by: David S. Miller commit bebd6997163addc1938db8c61754a23ffdf8ccc4 Author: J. Bruce Fields Date: Thu Aug 15 16:18:26 2019 -0400 nfsd: initialize i_private before d_add A process could race in an open and attempt to read one of these files before i_private is initialized, and get a spurious error. Reported-by: Al Viro Signed-off-by: J. Bruce Fields commit 5729b6e5a1bcb0bbc28abe82d749c7392f66d2c7 Author: Mikulas Patocka Date: Sat Aug 10 12:30:27 2019 -0400 dm integrity: fix a crash due to BUG_ON in __journal_read_write() Fix a crash that was introduced by the commit 724376a04d1a. The crash is reported here: https://gitlab.com/cryptsetup/cryptsetup/issues/468 When reading from the integrity device, the function dm_integrity_map_continue calls find_journal_node to find out if the location to read is present in the journal. Then, it calculates how many sectors are consecutively stored in the journal. Then, it locks the range with add_new_range and wait_and_add_new_range. The problem is that during wait_and_add_new_range, we hold no locks (we don't hold ic->endio_wait.lock and we don't hold a range lock), so the journal may change arbitrarily while wait_and_add_new_range sleeps. The code then goes to __journal_read_write and hits BUG_ON(journal_entry_get_sector(je) != logical_sector); because the journal has changed. In order to fix this bug, we need to re-check the journal location after wait_and_add_new_range. We restrict the length to one block in order to not complicate the code too much. Fixes: 724376a04d1a ("dm integrity: implement fair range locks") Cc: stable@vger.kernel.org # v4.19+ Signed-off-by: Mikulas Patocka Signed-off-by: Mike Snitzer commit ad1bd578bd5afdf20de0bead42d25f199601211d Author: Dmitry Fomichev Date: Fri Aug 2 15:02:51 2019 -0700 dm zoned: fix a few typos Signed-off-by: Dmitry Fomichev Reviewed-by: Damien Le Moal Signed-off-by: Mike Snitzer commit bae9a0aa331d4cc20bd73c11f91abfceda4b7b29 Author: Dmitry Fomichev Date: Fri Aug 2 15:02:50 2019 -0700 dm zoned: add SPDX license identifiers Signed-off-by: Dmitry Fomichev Reviewed-by: Damien Le Moal Signed-off-by: Mike Snitzer commit 75d66ffb48efb30f2dd42f041ba8b39c5b2bd115 Author: Dmitry Fomichev Date: Sat Aug 10 14:43:11 2019 -0700 dm zoned: properly handle backing device failure dm-zoned is observed to lock up or livelock in case of hardware failure or some misconfiguration of the backing zoned device. This patch adds a new dm-zoned target function that checks the status of the backing device. If the request queue of the backing device is found to be in dying state or the SCSI backing device enters offline state, the health check code sets a dm-zoned target flag prompting all further incoming I/O to be rejected. In order to detect backing device failures timely, this new function is called in the request mapping path, at the beginning of every reclaim run and before performing any metadata I/O. The proper way out of this situation is to do dmsetup remove and recreate the target when the problem with the backing device is resolved. Fixes: 3b1a94c88b79 ("dm zoned: drive-managed zoned block device target") Cc: stable@vger.kernel.org Signed-off-by: Dmitry Fomichev Reviewed-by: Damien Le Moal Signed-off-by: Mike Snitzer commit d7428c50118e739e672656c28d2b26b09375d4e0 Author: Dmitry Fomichev Date: Sat Aug 10 14:43:10 2019 -0700 dm zoned: improve error handling in i/o map code Some errors are ignored in the I/O path during queueing chunks for processing by chunk works. Since at least these errors are transient in nature, it should be possible to retry the failed incoming commands. The fix - Errors that can happen while queueing chunks are carried upwards to the main mapping function and it now returns DM_MAPIO_REQUEUE for any incoming requests that can not be properly queued. Error logging/debug messages are added where needed. Fixes: 3b1a94c88b79 ("dm zoned: drive-managed zoned block device target") Cc: stable@vger.kernel.org Signed-off-by: Dmitry Fomichev Reviewed-by: Damien Le Moal Signed-off-by: Mike Snitzer commit b234c6d7a703661b5045c5bf569b7c99d2edbf88 Author: Dmitry Fomichev Date: Sat Aug 10 14:43:09 2019 -0700 dm zoned: improve error handling in reclaim There are several places in reclaim code where errors are not propagated to the main function, dmz_reclaim(). This function is responsible for unlocking zones that might be still locked at the end of any failed reclaim iterations. As the result, some device zones may be left permanently locked for reclaim, degrading target's capability to reclaim zones. This patch fixes these issues as follows - Make sure that dmz_reclaim_buf(), dmz_reclaim_seq_data() and dmz_reclaim_rnd_data() return error codes to the caller. dmz_reclaim() function is renamed to dmz_do_reclaim() to avoid clashing with "struct dmz_reclaim" and is modified to return the error to the caller. dmz_get_zone_for_reclaim() now returns an error instead of NULL pointer and reclaim code checks for that error. Error logging/debug messages are added where necessary. Fixes: 3b1a94c88b79 ("dm zoned: drive-managed zoned block device target") Cc: stable@vger.kernel.org Signed-off-by: Dmitry Fomichev Reviewed-by: Damien Le Moal Signed-off-by: Mike Snitzer commit d1fef41465f0e8cae0693fb184caa6bfafb6cd16 Author: Dmitry Fomichev Date: Mon Aug 5 16:56:03 2019 -0700 dm kcopyd: always complete failed jobs This patch fixes a problem in dm-kcopyd that may leave jobs in complete queue indefinitely in the event of backing storage failure. This behavior has been observed while running 100% write file fio workload against an XFS volume created on top of a dm-zoned target device. If the underlying storage of dm-zoned goes to offline state under I/O, kcopyd sometimes never issues the end copy callback and dm-zoned reclaim work hangs indefinitely waiting for that completion. This behavior was traced down to the error handling code in process_jobs() function that places the failed job to complete_jobs queue, but doesn't wake up the job handler. In case of backing device failure, all outstanding jobs may end up going to complete_jobs queue via this code path and then stay there forever because there are no more successful I/O jobs to wake up the job handler. This patch adds a wake() call to always wake up kcopyd job wait queue for all I/O jobs that fail before dm_io() gets called for that job. The patch also sets the write error status in all sub jobs that are failed because their master job has failed. Fixes: b73c67c2cbb00 ("dm kcopyd: add sequential write feature") Cc: stable@vger.kernel.org Signed-off-by: Dmitry Fomichev Reviewed-by: Damien Le Moal Signed-off-by: Mike Snitzer commit cf3591ef832915892f2499b7e54b51d4c578b28c Author: Mikulas Patocka Date: Thu Aug 8 05:40:04 2019 -0400 Revert "dm bufio: fix deadlock with loop device" Revert the commit bd293d071ffe65e645b4d8104f9d8fe15ea13862. The proper fix has been made available with commit d0a255e795ab ("loop: set PF_MEMALLOC_NOIO for the worker thread"). Note that the fix offered by commit bd293d071ffe doesn't really prevent the deadlock from occuring - if we look at the stacktrace reported by Junxiao Bi, we see that it hangs in bit_wait_io and not on the mutex - i.e. it has already successfully taken the mutex. Changing the mutex from mutex_lock to mutex_trylock won't help with deadlocks that happen afterwards. PID: 474 TASK: ffff8813e11f4600 CPU: 10 COMMAND: "kswapd0" #0 [ffff8813dedfb938] __schedule at ffffffff8173f405 #1 [ffff8813dedfb990] schedule at ffffffff8173fa27 #2 [ffff8813dedfb9b0] schedule_timeout at ffffffff81742fec #3 [ffff8813dedfba60] io_schedule_timeout at ffffffff8173f186 #4 [ffff8813dedfbaa0] bit_wait_io at ffffffff8174034f #5 [ffff8813dedfbac0] __wait_on_bit at ffffffff8173fec8 #6 [ffff8813dedfbb10] out_of_line_wait_on_bit at ffffffff8173ff81 #7 [ffff8813dedfbb90] __make_buffer_clean at ffffffffa038736f [dm_bufio] #8 [ffff8813dedfbbb0] __try_evict_buffer at ffffffffa0387bb8 [dm_bufio] #9 [ffff8813dedfbbd0] dm_bufio_shrink_scan at ffffffffa0387cc3 [dm_bufio] #10 [ffff8813dedfbc40] shrink_slab at ffffffff811a87ce #11 [ffff8813dedfbd30] shrink_zone at ffffffff811ad778 #12 [ffff8813dedfbdc0] kswapd at ffffffff811ae92f #13 [ffff8813dedfbec0] kthread at ffffffff810a8428 #14 [ffff8813dedfbf50] ret_from_fork at ffffffff81745242 Signed-off-by: Mikulas Patocka Cc: stable@vger.kernel.org Fixes: bd293d071ffe ("dm bufio: fix deadlock with loop device") Depends-on: d0a255e795ab ("loop: set PF_MEMALLOC_NOIO for the worker thread") Signed-off-by: Mike Snitzer commit 19bce474c45be69a284ecee660aa12d8f1e88f18 Author: Hui Peng Date: Thu Aug 15 00:31:34 2019 -0400 ALSA: usb-audio: Fix a stack buffer overflow bug in check_input_term `check_input_term` recursively calls itself with input from device side (e.g., uac_input_terminal_descriptor.bCSourceID) as argument (id). In `check_input_term`, if `check_input_term` is called with the same `id` argument as the caller, it triggers endless recursive call, resulting kernel space stack overflow. This patch fixes the bug by adding a bitmap to `struct mixer_build` to keep track of the checked ids and stop the execution if some id has been checked (similar to how parse_audio_unit handles unitid argument). Reported-by: Hui Peng Reported-by: Mathias Payer Signed-off-by: Hui Peng Cc: Signed-off-by: Takashi Iwai commit 20fb7c7a39b5c719e2e619673b5f5729ee7d2306 Author: Wenwen Wang Date: Wed Aug 14 01:38:39 2019 -0500 net: myri10ge: fix memory leaks In myri10ge_probe(), myri10ge_alloc_slices() is invoked to allocate slices related structures. Later on, myri10ge_request_irq() is used to get an irq. However, if this process fails, the allocated slices related structures are not deallocated, leading to memory leaks. To fix this issue, revise the target label of the goto statement to 'abort_with_slices'. Signed-off-by: Wenwen Wang Signed-off-by: David S. Miller commit d85f01775850a35eae47a0090839baf510c1ef12 Author: John Fastabend Date: Wed Aug 14 05:31:54 2019 +0000 net: tls, fix sk_write_space NULL write when tx disabled The ctx->sk_write_space pointer is only set when TLS tx mode is enabled. When running without TX mode its a null pointer but we still set the sk sk_write_space pointer on close(). Fix the close path to only overwrite sk->sk_write_space when the current pointer is to the tls_write_space function indicating the tls module should clean it up properly as well. Reported-by: Hillf Danton Cc: Ying Xue Cc: Andrey Konovalov Fixes: 57c722e932cfb ("net/tls: swap sk_write_space on close") Signed-off-by: John Fastabend Reviewed-by: Jakub Kicinski Signed-off-by: David S. Miller commit 6f967f8b1be7001b31c46429f2ee7d275af2190f Author: Wenwen Wang Date: Wed Aug 14 00:14:49 2019 -0500 liquidio: add cleanup in octeon_setup_iq() If oct->fn_list.enable_io_queues() fails, no cleanup is executed, leading to memory/resource leaks. To fix this issue, invoke octeon_delete_instr_queue() before returning from the function. Signed-off-by: Wenwen Wang Signed-off-by: David S. Miller commit a69e90512d9def6bd8064d84cff9ffd8b15eaa1b Merge: 4ec1fa692dc7 8612de3f7ba6 Author: Linus Torvalds Date: Thu Aug 15 12:29:36 2019 -0700 Merge tag 'xfs-5.3-fixes-2' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux Pull xfs fixes from Darrick Wong: - Fix crashes when the attr fork isn't present due to errors but inode inactivation tries to zap the attr data anyway. - Convert more directory corruption debugging asserts to actual EFSCORRUPTED returns instead of blowing up later on. - Don't fail writeback just because we ran out of memory allocating metadata log data. * tag 'xfs-5.3-fixes-2' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux: xfs: don't crash on null attr fork xfs_bmapi_read xfs: remove more ondisk directory corruption asserts fs: xfs: xfs_log: Don't use KM_MAYFAIL at xfs_log_reserve(). commit 4ec1fa692dc7dc915c3485a7fad928924fc13de2 Merge: 329120423947 9a67b72552f8 Author: Linus Torvalds Date: Thu Aug 15 12:15:45 2019 -0700 Merge tag 'iomap-5.3-fixes-1' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux Pull iomap fixlet from Darrick Wong: "A single update to the MAINTAINERS entry for iomap now that we've removed fs/iomap.c" * tag 'iomap-5.3-fixes-1' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux: MAINTAINERS: iomap: Remove fs/iomap.c record commit 0b24a441765527c797ef3bdb2a539547e0df9a7e Merge: 2aafdf5a5786 f43d48d10a42 Author: David S. Miller Date: Thu Aug 15 12:09:39 2019 -0700 Merge tag 'mlx5-fixes-2019-08-15' of git://git.kernel.org/pub/scm/linux/kernel/git/saeed/linux Saeed Mahameed says: ==================== Mellanox, mlx5 fixes 2019-08-15 This series introduces two fixes to mlx5 driver. 1) Eran fixes a compatibility issue with ethtool flash. 2) Maxim fixes a race in XSK wakeup flow. Please pull and let me know if there is any problem. ==================== Signed-off-by: David S. Miller commit dc46bba709cfb45e4b2d40cf45aaeacb82690504 Author: J. Bruce Fields Date: Wed Aug 14 21:57:37 2019 -0400 nfsd: use i_wrlock instead of rcu for nfsdfs i_private synchronize_rcu() gets called multiple times each time a client is destroyed. If the laundromat thread has a lot of clients to destroy, the delay can be noticeable. This was causing pynfs test RENEW3 to fail. We could embed an rcu_head in each inode and do the kref_put in an rcu callback. But simplest is just to take a lock here. (I also wonder if the laundromat thread would be better replaced by a bunch of scheduled work or timers or something.) Signed-off-by: J. Bruce Fields commit d6846bfbeeac873d85f32bd2b988fa94c89dbcb8 Author: Tetsuo Handa Date: Mon Aug 12 11:16:11 2019 +0900 nfsd: fix dentry leak upon mkdir failure. syzbot is reporting that nfsd_mkdir() forgot to remove dentry created by d_alloc_name() when __nfsd_mkdir() failed (due to memory allocation fault injection) [1]. [1] https://syzkaller.appspot.com/bug?id=ce41a1f769ea4637ebffedf004a803e8405b4674 Signed-off-by: Tetsuo Handa Reported-by: syzbot Fixes: e8a79fb14f6b76b5 ("nfsd: add nfsd/clients directory") [bfields: clean up in nfsd_mkdir instead of __nfsd_mkdir] Signed-off-by: J. Bruce Fields commit f43d48d10a42787c1de1d3facd7db210c91db1da Author: Eran Ben Elisha Date: Thu Aug 1 14:27:30 2019 +0300 net/mlx5e: Fix compatibility issue with ethtool flash device Cited patch deleted ethtool flash device support, as ethtool core can fallback into devlink flash callback. However, this is supported only if there is a devlink port registered over the corresponding netdevice. As mlx5e do not have devlink port support over native netdevice, it broke the ability to flash device via ethtool. This patch re-add the ethtool callback to avoid user functionality breakage when trying to flash device via ethtool. Fixes: 9c8bca2637b8 ("mlx5: Move firmware flash implementation to devlink") Signed-off-by: Eran Ben Elisha Acked-by: Jiri Pirko Signed-off-by: Saeed Mahameed commit e0d57d9c7e7a223f3c2ff8b7b63ec1bf63f11ed4 Author: Maxim Mikityanskiy Date: Fri Aug 2 14:42:14 2019 +0300 net/mlx5e: Fix a race with XSKICOSQ in XSK wakeup flow Add a missing spinlock around XSKICOSQ usage at the activation stage, because there is a race between a configuration change and the application calling sendto(). Fixes: db05815b36cb ("net/mlx5e: Add XSK zero-copy support") Signed-off-by: Maxim Mikityanskiy Reviewed-by: Tariq Toukan Signed-off-by: Saeed Mahameed commit 2aafdf5a5786ebbd8ccfe132ed6267c6962c5c3c Author: Anders Roxell Date: Thu Aug 15 09:58:26 2019 +0200 selftests: net: tcp_fastopen_backup_key.sh: fix shellcheck issue When running tcp_fastopen_backup_key.sh the following issue was seen in a busybox environment. ./tcp_fastopen_backup_key.sh: line 33: [: -ne: unary operator expected Shellcheck showed the following issue. $ shellcheck tools/testing/selftests/net/tcp_fastopen_backup_key.sh In tools/testing/selftests/net/tcp_fastopen_backup_key.sh line 33: if [ $val -ne 0 ]; then ^-- SC2086: Double quote to prevent globbing and word splitting. Rework to do a string comparison instead. Signed-off-by: Anders Roxell Signed-off-by: David S. Miller commit a982eeb09b6030e567b8b815277c8c9197168040 Author: Jackie Liu Date: Wed Aug 14 17:35:22 2019 +0800 io_uring: fix an issue when IOSQE_IO_LINK is inserted into defer list This patch may fix two issues: First, when IOSQE_IO_DRAIN set, the next IOs need to be inserted into defer list to delay execution, but link io will be actively scheduled to run by calling io_queue_sqe. Second, when multiple LINK_IOs are inserted together with defer_list, the LINK_IO is no longer keep order. |-------------| | LINK_IO | ----> insert to defer_list ----------- |-------------| | | LINK_IO | ----> insert to defer_list ----------| |-------------| | | LINK_IO | ----> insert to defer_list ----------| |-------------| | | NORMAL_IO | ----> insert to defer_list ----------| |-------------| | | queue_work at same time <-----| Fixes: 9e645e1105c ("io_uring: add support for sqe links") Signed-off-by: Jackie Liu Signed-off-by: Jens Axboe commit 7bafda88de20b2990461d253c5475007436e355c Author: Bjorn Helgaas Date: Thu Aug 15 12:12:38 2019 -0500 Documentation PCI: Fix pciebus-howto.rst filename typo 2e6422444894 ("Documentation: PCI: convert PCIEBUS-HOWTO.txt to reST") incorrectly renamed PCIEBUS-HOWTO.txt to picebus-howto.rst. Rename it to pciebus-howto.rst. Fixes: 2e6422444894 ("Documentation: PCI: convert PCIEBUS-HOWTO.txt to reST") Signed-off-by: Bjorn Helgaas commit 7b6620d7db566a46f49b4b9deab9fa061fd4b59b Author: Jens Axboe Date: Thu Aug 15 11:09:16 2019 -0600 block: remove REQ_NOWAIT_INLINE We had a few issues with this code, and there's still a problem around how we deal with error handling for chained/split bios. For now, just revert the code and we'll try again with a thoroug solution. This reverts commits: e15c2ffa1091 ("block: fix O_DIRECT error handling for bio fragments") 0eb6ddfb865c ("block: Fix __blkdev_direct_IO() for bio fragments") 6a43074e2f46 ("block: properly handle IOCB_NOWAIT for async O_DIRECT IO") 893a1c97205a ("blk-mq: allow REQ_NOWAIT to return an error inline") Signed-off-by: Jens Axboe commit 99c79f6692ccdc42e04deea8a36e22bb48168a62 Author: Aleix Roca Nonell Date: Thu Aug 15 14:03:22 2019 +0200 io_uring: fix manual setup of iov_iter for fixed buffers Commit bd11b3a391e3 ("io_uring: don't use iov_iter_advance() for fixed buffers") introduced an optimization to avoid using the slow iov_iter_advance by manually populating the iov_iter iterator in some cases. However, the computation of the iterator count field was erroneous: The first bvec was always accounted for an extent of page size even if the bvec length was smaller. In consequence, some I/O operations on fixed buffers were unable to operate on the full extent of the buffer, consistently skipping some bytes at the end of it. Fixes: bd11b3a391e3 ("io_uring: don't use iov_iter_advance() for fixed buffers") Cc: stable@vger.kernel.org Signed-off-by: Aleix Roca Nonell Signed-off-by: Jens Axboe commit ad54567ad5d8e938ee6cf02e4f3867f18835ae6e Author: Lyude Paul Date: Thu Aug 1 18:01:17 2019 -0400 PCI: Reset both NVIDIA GPU and HDA in ThinkPad P50 workaround quirk_reset_lenovo_thinkpad_50_nvgpu() resets NVIDIA GPUs to work around an apparent BIOS defect. It previously used pci_reset_function(), and the available method was a bus reset, which was fine because there was only one function on the bus. After b516ea586d71 ("PCI: Enable NVIDIA HDA controllers"), there are now two functions (the HDA controller and the GPU itself) on the bus, so the reset fails. Use pci_reset_bus() explicitly instead of pci_reset_function() since it's OK to reset both devices. [bhelgaas: commit log, add e0547c81bfcf] Fixes: b516ea586d71 ("PCI: Enable NVIDIA HDA controllers") Fixes: e0547c81bfcf ("PCI: Reset Lenovo ThinkPad P50 nvgpu at boot if necessary") Link: https://lore.kernel.org/r/20190801220117.14952-1-lyude@redhat.com Signed-off-by: Lyude Paul Signed-off-by: Bjorn Helgaas Acked-by: Ben Skeggs Cc: Lukas Wunner Cc: Daniel Drake Cc: Aaron Plattner Cc: Peter Wu Cc: Ilia Mirkin Cc: Karol Herbst Cc: Maik Freudenberg commit 329120423947e8b36fd2f8b5cf69944405d0aece Merge: 2b245b8b033a 6c4d6bc54864 Author: Linus Torvalds Date: Thu Aug 15 09:20:17 2019 -0700 Merge tag 'auxdisplay-for-linus-v5.3-rc5' of git://github.com/ojeda/linux Pull auxdisplay fixes from Miguel Ojeda: "A few minor auxdisplay improvements: - A couple of small header cleanups for charlcd (Masahiro Yamada) - A trivial typo fix for the examples of cfag12864b (Masahiro Yamada) - An Kconfig help text improvement for charlcd (Mans Rullgard) - An error path fix for panel (zhengbin)" * tag 'auxdisplay-for-linus-v5.3-rc5' of git://github.com/ojeda/linux: auxdisplay: Fix a typo in cfag12864b-example.c auxdisplay: charlcd: add include guard to charlcd.h auxdisplay: charlcd: move charlcd.h to drivers/auxdisplay auxdisplay: charlcd: add help text for backlight initial state auxdisplay: panel: need to delete scan_timer when misc_register fails in panel_attach commit 2b245b8b033a90c6373400a29ec93a8713601eff Merge: 41de59634046 83f82d7a4258 Author: Linus Torvalds Date: Thu Aug 15 09:18:56 2019 -0700 Merge tag 'devicetree-fixes-for-5.3-3' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux Pull devicetree fixes from Rob Herring: - Fix building DT binding examples for in tree builds - Correct some refcounting in adjust_local_phandle_references() - Update FSL FEC binding with deprecated properties - Schema fix in stm32 pinctrl - Fix typo in of_irq_parse_one docbook comment * tag 'devicetree-fixes-for-5.3-3' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux: of: irq: fix a trivial typo in a doc comment dt-bindings: pinctrl: stm32: Fix 'st,syscfg' schema dt-bindings: fec: explicitly mark deprecated properties of: resolver: Add of_node_put() before return and break dt-bindings: Fix generated example files getting added to schemas commit 01fd150f4aff5bee03db5bda3b94c1bdbe9c6375 Author: Randy Dunlap Date: Tue Aug 13 16:01:20 2019 -0700 misc: xilinx-sdfec: fix dependency and build error lib/devres.c, which implements devm_ioremap_resource(), is only built when CONFIG_HAS_IOMEM is set/enabled, so XILINX_SDFEC should depend on HAS_IOMEM. Fixes this build error (as seen on UML builds): ERROR: "devm_ioremap_resource" [drivers/misc/xilinx_sdfec.ko] undefined! Fixes: 76d83e1c3233 ("misc: xilinx-sdfec: add core driver") Signed-off-by: Randy Dunlap Cc: Derek Kiernan Cc: Dragan Cvetic Cc: Greg Kroah-Hartman Cc: Geert Uytterhoeven Cc: Arnd Bergmann Link: https://lore.kernel.org/r/f9004be5-9925-327b-3ec2-6506e46fe565@infradead.org Signed-off-by: Greg Kroah-Hartman commit 3829100a63724f6dbf264b2a7f06e7f638ed952d Author: Andreas Kemnade Date: Wed Aug 14 23:43:19 2019 +0200 regulator: twl: voltage lists for vdd1/2 on twl4030 _opp_supported_by_regulators() wrongly ignored errors from regulator_is_supported_voltage(), so it considered errors as success. Since commit 498209445124 ("regulator: core: simplify return value on suported_voltage") regulator_is_supported_voltage() returns a real boolean, so errors make _opp_supported_by_regulators() return false. That reveals a problem with the declaration of the VDD1/2 regulators on twl4030. The VDD1/VDD2 regulators on twl4030 are neither defined with voltage lists nor with the continuous flag set, so regulator_is_supported_voltage() returns false and an error before above mentioned commit (which was considered success) The result is that after the above mentioned commit cpufreq does not work properly e.g. dm3730. [ 2.490997] core: _opp_supported_by_regulators: OPP minuV: 1012500 maxuV: 1012500, not supported by regulator [ 2.501617] cpu cpu0: _opp_add: OPP not supported by regulators (300000000) [ 2.509246] core: _opp_supported_by_regulators: OPP minuV: 1200000 maxuV: 1200000, not supported by regulator [ 2.519775] cpu cpu0: _opp_add: OPP not supported by regulators (600000000) [ 2.527313] core: _opp_supported_by_regulators: OPP minuV: 1325000 maxuV: 1325000, not supported by regulator [ 2.537750] cpu cpu0: _opp_add: OPP not supported by regulators (800000000) The patch fixes declaration of VDD1/2 regulators by adding proper voltage lists. Fixes: 498209445124 ("regulator: core: simplify return value on suported_voltage") Cc: stable@vger.kernel.org Signed-off-by: Andreas Kemnade Tested-by: Adam Ford #logicpd-torpedo-37xx-devkit Link: https://lore.kernel.org/r/20190814214319.24087-1-andreas@kemnade.info Signed-off-by: Mark Brown commit edfbcb321faf07ca970e4191abe061deeb7d3788 Author: Christoph Hellwig Date: Sun Aug 11 10:05:16 2019 +0200 usb: add a hcd_uses_dma helper The USB buffer allocation code is the only place in the usb core (and in fact the whole kernel) that uses is_device_dma_capable, while the URB mapping code uses the uses_dma flag in struct usb_bus. Switch the buffer allocation to use the uses_dma flag used by the rest of the USB code, and create a helper in hcd.h that checks this flag as well as the CONFIG_HAS_DMA to simplify the caller a bit. Signed-off-by: Christoph Hellwig Link: https://lore.kernel.org/r/20190811080520.21712-3-hch@lst.de Signed-off-by: Greg Kroah-Hartman commit dd3ecf17ba70a70d2c9ef9ba725281b84f8eef12 Author: Christoph Hellwig Date: Sun Aug 11 10:05:15 2019 +0200 usb: don't create dma pools for HCDs with a localmem_pool If the HCD provides a localmem pool we will never use the DMA pools, so don't create them. Fixes: b0310c2f09bb ("USB: use genalloc for USB HCs with local memory") Signed-off-by: Christoph Hellwig Link: https://lore.kernel.org/r/20190811080520.21712-2-hch@lst.de Signed-off-by: Greg Kroah-Hartman commit 141822aa3f79efc8a2ec3ed464f2fd2c93ccd803 Author: André Draszik Date: Sat Aug 10 16:07:58 2019 +0100 usb: chipidea: imx: fix EPROBE_DEFER support during driver probe If driver probe needs to be deferred, e.g. because ci_hdrc_add_device() isn't ready yet, this driver currently misbehaves badly: a) success is still reported to the driver core (meaning a 2nd probe attempt will never be done), leaving the driver in a dysfunctional state and the hardware unusable b) driver remove / shutdown OOPSes: [ 206.786916] Unable to handle kernel paging request at virtual address fffffdff [ 206.794148] pgd = 880b9f82 [ 206.796890] [fffffdff] *pgd=abf5e861, *pte=00000000, *ppte=00000000 [ 206.803179] Internal error: Oops: 37 [#1] PREEMPT SMP ARM [ 206.808581] Modules linked in: wl18xx evbug [ 206.813308] CPU: 1 PID: 1 Comm: systemd-shutdow Not tainted 4.19.35+gf345c93b4195 #1 [ 206.821053] Hardware name: Freescale i.MX7 Dual (Device Tree) [ 206.826813] PC is at ci_hdrc_remove_device+0x4/0x20 [ 206.831699] LR is at ci_hdrc_imx_remove+0x20/0xe8 [ 206.836407] pc : [<805cd4b0>] lr : [<805d62cc>] psr: 20000013 [ 206.842678] sp : a806be40 ip : 00000001 fp : 80adbd3c [ 206.847906] r10: 80b1b794 r9 : 80d5dfe0 r8 : a8192c44 [ 206.853136] r7 : 80db93a0 r6 : a8192c10 r5 : a8192c00 r4 : a93a4a00 [ 206.859668] r3 : 00000000 r2 : a8192ce4 r1 : ffffffff r0 : fffffdfb [ 206.866201] Flags: nzCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment none [ 206.873341] Control: 10c5387d Table: a9e0c06a DAC: 00000051 [ 206.879092] Process systemd-shutdow (pid: 1, stack limit = 0xb271353c) [ 206.885624] Stack: (0xa806be40 to 0xa806c000) [ 206.889992] be40: a93a4a00 805d62cc a8192c1c a8170e10 a8192c10 8049a490 80d04d08 00000000 [ 206.898179] be60: 00000000 80d0da2c fee1dead 00000000 a806a000 00000058 00000000 80148b08 [ 206.906366] be80: 01234567 80148d8c a9858600 00000000 00000000 00000000 00000000 80d04d08 [ 206.914553] bea0: 00000000 00000000 a82741e0 a9858600 00000024 00000002 a9858608 00000005 [ 206.922740] bec0: 0000001e 8022c058 00000000 00000000 a806bf14 a9858600 00000000 a806befc [ 206.930927] bee0: a806bf78 00000000 7ee12c30 8022c18c a806bef8 a806befc 00000000 00000001 [ 206.939115] bf00: 00000000 00000024 a806bf14 00000005 7ee13b34 7ee12c68 00000004 7ee13f20 [ 206.947302] bf20: 00000010 7ee12c7c 00000005 7ee12d04 0000000a 76e7dc00 00000001 80d0f140 [ 206.955490] bf40: ab637880 a974de40 60000013 80d0f140 ab6378a0 80d04d08 a8080470 a9858600 [ 206.963677] bf60: a9858600 00000000 00000000 8022c24c 00000000 80144310 00000000 00000000 [ 206.971864] bf80: 80101204 80d04d08 00000000 80d04d08 00000000 00000000 00000003 00000058 [ 206.980051] bfa0: 80101204 80101000 00000000 00000000 fee1dead 28121969 01234567 00000000 [ 206.988237] bfc0: 00000000 00000000 00000003 00000058 00000000 00000000 00000000 00000000 [ 206.996425] bfe0: 0049ffb0 7ee13d58 0048a84b 76f245a6 60000030 fee1dead 00000000 00000000 [ 207.004622] [<805cd4b0>] (ci_hdrc_remove_device) from [<805d62cc>] (ci_hdrc_imx_remove+0x20/0xe8) [ 207.013509] [<805d62cc>] (ci_hdrc_imx_remove) from [<8049a490>] (device_shutdown+0x16c/0x218) [ 207.022050] [<8049a490>] (device_shutdown) from [<80148b08>] (kernel_restart+0xc/0x50) [ 207.029980] [<80148b08>] (kernel_restart) from [<80148d8c>] (sys_reboot+0xf4/0x1f0) [ 207.037648] [<80148d8c>] (sys_reboot) from [<80101000>] (ret_fast_syscall+0x0/0x54) [ 207.045308] Exception stack(0xa806bfa8 to 0xa806bff0) [ 207.050368] bfa0: 00000000 00000000 fee1dead 28121969 01234567 00000000 [ 207.058554] bfc0: 00000000 00000000 00000003 00000058 00000000 00000000 00000000 00000000 [ 207.066737] bfe0: 0049ffb0 7ee13d58 0048a84b 76f245a6 [ 207.071799] Code: ebffffa8 e3a00000 e8bd8010 e92d4010 (e5904004) [ 207.078021] ---[ end trace be47424e3fd46e9f ]--- [ 207.082647] Kernel panic - not syncing: Fatal exception [ 207.087894] ---[ end Kernel panic - not syncing: Fatal exception ]--- c) the error path in combination with driver removal causes imbalanced calls to the clk_*() and pm_()* APIs a) happens because the original intended return value is overwritten (with 0) by the return code of regulator_disable() in ci_hdrc_imx_probe()'s error path b) happens because ci_pdev is -EPROBE_DEFER, which causes ci_hdrc_remove_device() to OOPS Fix a) by being more careful in ci_hdrc_imx_probe()'s error path and not overwriting the real error code Fix b) by calling the respective cleanup functions during remove only when needed (when ci_pdev != NULL, i.e. when everything was initialised correctly). This also has the side effect of not causing imbalanced clk_*() and pm_*() API calls as part of the error code path. Fixes: 7c8e8909417e ("usb: chipidea: imx: add HSIC support") Signed-off-by: André Draszik Cc: stable CC: Peter Chen CC: Greg Kroah-Hartman CC: Shawn Guo CC: Sascha Hauer CC: Pengutronix Kernel Team CC: Fabio Estevam CC: NXP Linux Team CC: linux-usb@vger.kernel.org CC: linux-arm-kernel@lists.infradead.org CC: linux-kernel@vger.kernel.org Link: https://lore.kernel.org/r/20190810150758.17694-1-git@andred.net Signed-off-by: Greg Kroah-Hartman commit 777758888ffe59ef754cc39ab2f275dc277732f4 Author: Hans Ulli Kroll Date: Sat Aug 10 17:04:58 2019 +0200 usb: host: fotg2: restart hcd after port reset On the Gemini SoC the FOTG2 stalls after port reset so restart the HCD after each port reset. Signed-off-by: Hans Ulli Kroll Signed-off-by: Linus Walleij Link: https://lore.kernel.org/r/20190810150458.817-1-linus.walleij@linaro.org Signed-off-by: Greg Kroah-Hartman commit 54364278fb3cabdea51d6398b07c87415065b3fc Author: Oliver Neukum Date: Tue Aug 13 11:35:41 2019 +0200 USB: CDC: fix sanity checks in CDC union parser A few checks checked for the size of the pointer to a structure instead of the structure itself. Copy & paste issue presumably. Fixes: e4c6fb7794982 ("usbnet: move the CDC parser into USB core") Cc: stable Reported-by: syzbot+45a53506b65321c1fe91@syzkaller.appspotmail.com Signed-off-by: Oliver Neukum Link: https://lore.kernel.org/r/20190813093541.18889-1-oneukum@suse.com Signed-off-by: Greg Kroah-Hartman commit c52873e5a1ef72f845526d9f6a50704433f9c625 Author: Oliver Neukum Date: Thu Aug 8 16:21:19 2019 +0200 usb: cdc-acm: make sure a refcount is taken early enough destroy() will decrement the refcount on the interface, so that it needs to be taken so early that it never undercounts. Fixes: 7fb57a019f94e ("USB: cdc-acm: Fix potential deadlock (lockdep warning)") Cc: stable Reported-and-tested-by: syzbot+1b2449b7b5dc240d107a@syzkaller.appspotmail.com Signed-off-by: Oliver Neukum Link: https://lore.kernel.org/r/20190808142119.7998-1-oneukum@suse.com Signed-off-by: Greg Kroah-Hartman commit 305cd70ec311be420cc9154e77427dd9aaa0b7bc Merge: c372740c070a dc7f2cb218b5 Author: Arnd Bergmann Date: Thu Aug 15 14:46:43 2019 +0200 Merge tag 'amlogic-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/khilman/linux-amlogic into arm/fixes arm64: dts: Amlogic fixes for v5.3-rc - a few small DT fixes for g12a/g12b platforms * tag 'amlogic-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/khilman/linux-amlogic: arm64: dts: amlogic: odroid-n2: keep SD card regulator always on arm64: dts: meson-g12a-sei510: enable IR controller arm64: dts: meson-g12a: add missing dwc2 phy-names commit c372740c070addb565bbd6837e2f750bdf262e30 Merge: ebc526233b9d 4a65bbb9109e Author: Arnd Bergmann Date: Thu Aug 15 14:27:41 2019 +0200 Merge tag 'omap-for-v5.3/fixes-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/tmlind/linux-omap into arm/fixes Fixes for omap variants for v5.3-rc cycle We have another fix to disable voltage switching for am57xx SDIO as the bootrom cannot handle all the voltages after a reset that thought I had already sent a pull request for earlier but forgot. And we also update dra74x iodelay configuration for mmc3 to use the recommended values. Then I noticed we had introduced few new boot warnings with the various recent ti-sysc changes and wanted to fix those. I also noticed we still have too many warnings to be able to spot the real ones easily and fixed up few of those. Sure some of the warnings have been around for a long time and few of the fixes could have waited for the merge window, but having more usable dmesg log level output is a valuable. Other fixes are IO size correction for am335x UARTs that cause issues for at least FreeBSD using the same device tree file that checks that the child IO range is not larger than the parent has. For omap1 ams-delta keyboard we need to fix a irq ack that broke with all the recent gpio changes. And there are also few static checker warning fixes for recent am335x PM changes and ti-sysc driver and one switch fall-though update. * tag 'omap-for-v5.3/fixes-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/tmlind/linux-omap: soc: ti: pm33xx: Make two symbols static soc: ti: pm33xx: Fix static checker warnings ARM: OMAP: dma: Mark expected switch fall-throughs ARM: dts: Fix incomplete dts data for am3 and am4 mmc bus: ti-sysc: Simplify cleanup upon failures in sysc_probe() ARM: OMAP1: ams-delta-fiq: Fix missing irq_ack ARM: dts: dra74x: Fix iodelay configuration for mmc3 ARM: dts: am335x: Fix UARTs length ARM: OMAP2+: Fix omap4 errata warning on other SoCs ARM: dts: Fix incorrect dcan register mapping for am3, am4 and dra7 ARM: dts: Fix flags for gpio7 bus: ti-sysc: Fix using configured sysc mask value bus: ti-sysc: Fix handling of forced idle ARM: OMAP2+: Fix missing SYSC_HAS_RESET_STATUS for dra7 epwmss ARM: dts: am57xx: Disable voltage switching for SD card Link: https://lore.kernel.org/r/pull-1565844391-332885@atomide.com Signed-off-by: Arnd Bergmann commit e5d8badf37e6b547842f2fcde10361b29e08bd36 Author: Bob Ham Date: Wed Jul 24 07:52:26 2019 -0700 USB: serial: option: add the BroadMobi BM818 card Add a VID:PID for the BroadMobi BM818 M.2 card T: Bus=01 Lev=03 Prnt=40 Port=03 Cnt=01 Dev#= 44 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=2020 ProdID=2060 Rev=00.00 S: Manufacturer=Qualcomm, Incorporated S: Product=Qualcomm CDMA Technologies MSM C: #Ifs= 5 Cfg#= 1 Atr=e0 MxPwr=500mA I: If#=0x0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none) I: If#=0x1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none) I: If#=0x2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none) I: If#=0x3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=fe Prot=ff Driver=(none) I: If#=0x4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none) Signed-off-by: Bob Ham Signed-off-by: Angus Ainslie (Purism) Cc: stable [ johan: use USB_DEVICE_INTERFACE_CLASS() ] Signed-off-by: Johan Hovold commit 6caf0be40a707689e8ff8824fdb96ef77685b1ba Author: Tony Lindgren Date: Thu Aug 15 01:26:02 2019 -0700 USB: serial: option: Add Motorola modem UARTs On Motorola Mapphone devices such as Droid 4 there are five USB ports that do not use the same layout as Gobi 1K/2K/etc devices listed in qcserial.c. So we should use qcaux.c or option.c as noted by Dan Williams . As the Motorola USB serial ports have an interrupt endpoint as shown with lsusb -v, we should use option.c instead of qcaux.c as pointed out by Johan Hovold . The ff/ff/ff interfaces seem to always be UARTs on Motorola devices. For the other interfaces, class 0x0a (CDC Data) should not in general be added as they are typically part of a multi-interface function as noted earlier by Bjørn Mork . However, looking at the Motorola mapphone kernel code, the mdm6600 0x0a class is only used for flashing the modem firmware, and there are no other interfaces. So I've added that too with more details below as it works just fine. The ttyUSB ports on Droid 4 are: ttyUSB0 DIAG, CQDM-capable ttyUSB1 MUX or NMEA, no response ttyUSB2 MUX or NMEA, no response ttyUSB3 TCMD ttyUSB4 AT-capable The ttyUSB0 is detected as QCDM capable by ModemManager. I think it's only used for debugging with ModemManager --debug for sending custom AT commands though. ModemManager already can manage data connection using the USB QMI ports that are already handled by the qmi_wwan.c driver. To enable the MUX or NMEA ports, it seems that something needs to be done additionally to enable them, maybe via the DIAG or TCMD port. It might be just a NVRAM setting somewhere, but I have no idea what NVRAM settings may need changing for that. The TCMD port seems to be a Motorola custom protocol for testing the modem and to configure it's NVRAM and seems to work just fine based on a quick test with a minimal tcmdrw tool I wrote. The voice modem AT-capable port seems to provide only partial support, and no PM support compared to the TS 27.010 based UART wired directly to the modem. The UARTs added with this change are the same product IDs as the Motorola Mapphone Android Linux kernel mdm6600_id_table. I don't have any mdm9600 based devices, so I have only tested these on mdm6600 based droid 4. Then for the class 0x0a (CDC Data) mode, the Motorola Mapphone Android Linux kernel driver moto_flashqsc.c just seems to change the port->bulk_out_size to 8K from the default. And is only used for flashing the modem firmware it seems. I've verified that flashing the modem with signed firmware works just fine with the option driver after manually toggling the GPIO pins, so I've added droid 4 modem flashing mode to the option driver. I've not added the other devices listed in moto_flashqsc.c in case they really need different port->bulk_out_size. Those can be added as they get tested to work for flashing the modem. After this patch the output of /sys/kernel/debug/usb/devices has the following for normal 22b8:2a70 mode including the related qmi_wwan interfaces: T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 2 Spd=12 MxCh= 0 D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=22b8 ProdID=2a70 Rev= 0.00 S: Manufacturer=Motorola, Incorporated S: Product=Flash MZ600 C:* #Ifs= 9 Cfg#= 1 Atr=e0 MxPwr=500mA I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option E: Ad=81(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms E: Ad=01(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms I:* If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option E: Ad=82(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms E: Ad=02(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms I:* If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option E: Ad=83(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms E: Ad=03(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms I:* If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option E: Ad=84(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms E: Ad=04(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms I:* If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=option E: Ad=85(I) Atr=03(Int.) MxPS= 64 Ivl=5ms E: Ad=86(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms E: Ad=05(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms I:* If#= 5 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=fb Prot=ff Driver=qmi_wwan E: Ad=87(I) Atr=03(Int.) MxPS= 64 Ivl=5ms E: Ad=88(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms E: Ad=06(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms I:* If#= 6 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=fb Prot=ff Driver=qmi_wwan E: Ad=89(I) Atr=03(Int.) MxPS= 64 Ivl=5ms E: Ad=8a(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms E: Ad=07(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms I:* If#= 7 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=fb Prot=ff Driver=qmi_wwan E: Ad=8b(I) Atr=03(Int.) MxPS= 64 Ivl=5ms E: Ad=8c(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms E: Ad=08(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms I:* If#= 8 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=fb Prot=ff Driver=qmi_wwan E: Ad=8d(I) Atr=03(Int.) MxPS= 64 Ivl=5ms E: Ad=8e(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms E: Ad=09(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms In 22b8:900e "qc_dload" mode the device shows up as: T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 2 Spd=12 MxCh= 0 D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=22b8 ProdID=900e Rev= 0.00 S: Manufacturer=Motorola, Incorporated S: Product=Flash MZ600 C:* #Ifs= 1 Cfg#= 1 Atr=e0 MxPwr=500mA I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option E: Ad=81(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms E: Ad=01(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms And in 22b8:4281 "ram_downloader" mode the device shows up as: T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 2 Spd=12 MxCh= 0 D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=22b8 ProdID=4281 Rev= 0.00 S: Manufacturer=Motorola, Incorporated S: Product=Flash MZ600 C:* #Ifs= 1 Cfg#= 1 Atr=e0 MxPwr=500mA I:* If#= 0 Alt= 0 #EPs= 2 Cls=0a(data ) Sub=00 Prot=fc Driver=option E: Ad=81(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms E: Ad=01(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms Cc: Bjørn Mork Cc: Dan Williams Cc: Lars Melin Cc: Marcel Partap Cc: Merlijn Wajer Cc: Michael Scott Cc: NeKit Cc: Pavel Machek Cc: Sebastian Reichel Tested-by: Pavel Machek Signed-off-by: Tony Lindgren Cc: stable Signed-off-by: Johan Hovold commit 5ed1c835ed8b522ce25071cc2d56a9a09bd5b59e Author: Tony Luck Date: Wed Aug 14 16:40:30 2019 -0700 MAINTAINERS, x86/CPU: Tony Luck will maintain asm/intel-family.h There are a few different subsystems in the kernel that depend on model specific behaviour (perf, EDAC, power, ...). Easier for just one person to have the task to get new model numbers included instead of having these groups trip over each other to do it. [ bp: s/Cpu/CPU/ and add x86@kernel.org so that it gets CCed too as FYI. ] Signed-off-by: Tony Luck Signed-off-by: Borislav Petkov Acked-by: Thomas Gleixner Cc: Dave Hansen Cc: x86-ml Link: https://lkml.kernel.org/r/20190814234030.30817-1-tony.luck@intel.com commit c930e19790bbbff31c018009907c813fa0925f63 Author: Paolo Bonzini Date: Wed Aug 14 12:07:34 2019 -0400 selftests: kvm: fix vmx_set_nested_state_test vmx_set_nested_state_test is trying to use the KVM_STATE_NESTED_EVMCS without enabling enlightened VMCS first. Correct the outcome of the test, and actually test that it succeeds after the capability is enabled. Signed-off-by: Paolo Bonzini commit 65efa61dc0d536d5f0602c33ee805a57cc07e9dc Author: Paolo Bonzini Date: Wed Aug 14 12:02:41 2019 -0400 selftests: kvm: provide common function to enable eVMCS There are two tests already enabling eVMCS and a third is coming. Add a function that enables the capability and tests the result. Signed-off-by: Paolo Bonzini commit 92cd0f0be3d7adb63611c28693ec0399beded837 Author: Paolo Bonzini Date: Wed Aug 14 18:18:55 2019 +0200 selftests: kvm: do not try running the VM in vmx_set_nested_state_test This test is only covering various edge cases of the KVM_SET_NESTED_STATE ioctl. Running the VM does not really add anything. Signed-off-by: Paolo Bonzini commit 2f62c5d6ed0abae8e70bd83f4d41b9d63acde45a Merge: db1231ddc046 e1b4ce25dbc9 Author: Dave Airlie Date: Thu Aug 15 13:29:18 2019 +1000 Merge tag 'drm-fixes-5.3-2019-08-14' of git://people.freedesktop.org/~agd5f/linux into drm-fixes drm-fixes-5.3-2019-08-14: amdgpu: - Use kvalloc for dc_state to avoid allocation failures in some cases. - Fix gfx9 soft recovery scheduler: - Fix a race condition when destroying entities Signed-off-by: Dave Airlie From: Alex Deucher Link: https://patchwork.freedesktop.org/patch/msgid/20190815024919.3434-1-alexander.deucher@amd.com commit db1231ddc04682f60d56ff42447f13099c6c4a4c Author: Lyude Paul Date: Thu Aug 8 20:53:05 2019 -0400 drm/nouveau: Only recalculate PBN/VCPI on mode/connector changes I -thought- I had fixed this entirely, but it looks like that I didn't test this thoroughly enough as we apparently still make one big mistake with nv50_msto_atomic_check() - we don't handle the following scenario: * CRTC #1 has n VCPI allocated to it, is attached to connector DP-4 which is attached to encoder #1. enabled=y active=n * CRTC #1 is changed from DP-4 to DP-5, causing: * DP-4 crtc=#1→NULL (VCPI n→0) * DP-5 crtc=NULL→#1 * CRTC #1 steals encoder #1 back from DP-4 and gives it to DP-5 * CRTC #1 maintains the same mode as before, just with a different connector * mode_changed=n connectors_changed=y (we _SHOULD_ do VCPI 0→n here, but don't) Once the above scenario is repeated once, we'll attempt freeing VCPI from the connector that we didn't allocate due to the connectors changing, but the mode staying the same. Sigh. Since nv50_msto_atomic_check() has broken a few times now, let's rethink things a bit to be more careful: limit both VCPI/PBN allocations to mode_changed || connectors_changed, since neither VCPI or PBN should ever need to change outside of routing and mode changes. Changes since v1: * Fix accidental reversal of clock and bpp arguments in drm_dp_calc_pbn_mode() - William Lewis Signed-off-by: Lyude Paul Reported-by: Bohdan Milar Tested-by: Bohdan Milar Fixes: 232c9eec417a ("drm/nouveau: Use atomic VCPI helpers for MST") References: 412e85b60531 ("drm/nouveau: Only release VCPI slots on mode changes") Cc: Lyude Paul Cc: Ben Skeggs Cc: Daniel Vetter Cc: David Airlie Cc: Jerry Zuo Cc: Harry Wentland Cc: Juston Li Cc: Laurent Pinchart Cc: Karol Herbst Cc: Ilia Mirkin Cc: # v5.1+ Acked-by: Ben Skeggs Signed-off-by: Dave Airlie Link: https://patchwork.freedesktop.org/patch/msgid/20190809005307.18391-1-lyude@redhat.com commit 05b439711f6ff8700e8660f97a1179650778b9cb Author: Y.C. Chen Date: Wed Apr 11 09:27:39 2018 +0800 drm/ast: Fixed reboot test may cause system hanged There is another thread still access standard VGA I/O while loading drm driver. Disable standard VGA I/O decode to avoid this issue. Signed-off-by: Y.C. Chen Reviewed-by: Benjamin Herrenschmidt Signed-off-by: Dave Airlie Link: https://patchwork.freedesktop.org/patch/msgid/1523410059-18415-1-git-send-email-yc_chen@aspeedtech.com commit c554336efa9bbc28d6ec14efbee3c7d63c61a34f Author: Wenwen Wang Date: Tue Aug 13 04:18:52 2019 -0500 cxgb4: fix a memory leak bug In blocked_fl_write(), 't' is not deallocated if bitmap_parse_user() fails, leading to a memory leak bug. To fix this issue, free t before returning the error. Signed-off-by: Wenwen Wang Signed-off-by: David S. Miller commit 83f82d7a42583e93d0f0dde3d61ed10f75c0f4d8 Author: Lubomir Rintel Date: Wed Aug 7 15:22:31 2019 +0200 of: irq: fix a trivial typo in a doc comment Diverged from what the code does with commit 530210c7814e ("of/irq: Replace of_irq with of_phandle_args"). Signed-off-by: Lubomir Rintel Signed-off-by: Rob Herring commit 626633425c079742c04f4f2d81c16962b084605c Author: Rob Herring Date: Tue Aug 13 14:47:54 2019 -0600 dt-bindings: pinctrl: stm32: Fix 'st,syscfg' schema The proper way to add additional contraints to an existing json-schema is using 'allOf' to reference the base schema. Using just '$ref' doesn't work. Fix this for the 'st,syscfg' property. Cc: Mark Rutland Cc: Maxime Coquelin Cc: Alexandre Torgue Cc: linux-gpio@vger.kernel.org Cc: linux-stm32@st-md-mailman.stormreply.com Cc: linux-arm-kernel@lists.infradead.org Reviewed-by: Linus Walleij Signed-off-by: Rob Herring commit 7c7cfdcf7f1777c7376fc9a239980de04b6b5ea1 Author: Adrian Hunter Date: Wed Aug 14 15:59:50 2019 +0300 scsi: ufs: Fix NULL pointer dereference in ufshcd_config_vreg_hpm() Fix the following BUG: [ 187.065689] BUG: kernel NULL pointer dereference, address: 000000000000001c [ 187.065790] RIP: 0010:ufshcd_vreg_set_hpm+0x3c/0x110 [ufshcd_core] [ 187.065938] Call Trace: [ 187.065959] ufshcd_resume+0x72/0x290 [ufshcd_core] [ 187.065980] ufshcd_system_resume+0x54/0x140 [ufshcd_core] [ 187.065993] ? pci_pm_restore+0xb0/0xb0 [ 187.066005] ufshcd_pci_resume+0x15/0x20 [ufshcd_pci] [ 187.066017] pci_pm_thaw+0x4c/0x90 [ 187.066030] dpm_run_callback+0x5b/0x150 [ 187.066043] device_resume+0x11b/0x220 Voltage regulators are optional, so functions must check they exist before dereferencing. Note this issue is hidden if CONFIG_REGULATORS is not set, because the offending code is optimised away. Notes for stable: The issue first appears in commit 57d104c153d3 ("ufs: add UFS power management support") but is inadvertently fixed in commit 60f0187031c0 ("scsi: ufs: disable vccq if it's not needed by UFS device") which in turn was reverted by commit 730679817d83 ("Revert "scsi: ufs: disable vccq if it's not needed by UFS device""). So fix applies v3.18 to v4.5 and v5.1+ Fixes: 57d104c153d3 ("ufs: add UFS power management support") Fixes: 730679817d83 ("Revert "scsi: ufs: disable vccq if it's not needed by UFS device"") Cc: stable@vger.kernel.org Signed-off-by: Adrian Hunter Signed-off-by: Martin K. Petersen commit a86a75865ff4d8c05f355d1750a5250aec89ab15 Author: Dmitry Fomichev Date: Sun Aug 11 11:25:10 2019 -0700 scsi: target: tcmu: avoid use-after-free after command timeout In tcmu_handle_completion() function, the variable called read_len is always initialized with a value taken from se_cmd structure. If this function is called to complete an expired (timed out) out command, the session command pointed by se_cmd is likely to be already deallocated by the target core at that moment. As the result, this access triggers a use-after-free warning from KASAN. This patch fixes the code not to touch se_cmd when completing timed out TCMU commands. It also resets the pointer to se_cmd at the time when the TCMU_CMD_BIT_EXPIRED flag is set because it is going to become invalid after calling target_complete_cmd() later in the same function, tcmu_check_expired_cmd(). Signed-off-by: Dmitry Fomichev Acked-by: Mike Christie Reviewed-by: Damien Le Moal Signed-off-by: Martin K. Petersen commit 26fa656e9a0cbccddf7db132ea020d2169dbe46e Author: Bill Kuzeja Date: Wed Aug 14 10:24:41 2019 -0400 scsi: qla2xxx: Fix gnl.l memory leak on adapter init failure If HBA initialization fails unexpectedly (exiting via probe_failed:), we may fail to free vha->gnl.l. So that we don't attempt to double free, set this pointer to NULL after a free and check for NULL at probe_failed: so we know whether or not to call dma_free_coherent. Signed-off-by: Bill Kuzeja Acked-by: Himanshu Madhani Signed-off-by: Martin K. Petersen commit 070955558e820b9a89c570b91b1f21762f62b288 Author: Alexandre Courbot Date: Mon Jul 29 14:33:35 2019 +0900 drm/mediatek: set DMA max segment size This driver requires imported PRIME buffers to appear contiguously in its IO address space. Make sure this is the case by setting the maximum DMA segment size to a more suitable value than the default 64KB. Signed-off-by: Alexandre Courbot Reviewed-by: Tomasz Figa Signed-off-by: CK Hu commit 4c6f3196e6ea111c456c6086dc3f57d4706b0b2d Author: Alexandre Courbot Date: Mon Jul 29 14:33:34 2019 +0900 drm/mediatek: use correct device to import PRIME buffers PRIME buffers should be imported using the DMA device. To this end, use a custom import function that mimics drm_gem_prime_import_dev(), but passes the correct device. Fixes: 119f5173628aa ("drm/mediatek: Add DRM Driver for Mediatek SoC MT8173.") Signed-off-by: Alexandre Courbot Signed-off-by: CK Hu commit 41de59634046b19cd53a1983594a95135c656997 Merge: e22a97a2a85d 1ee1119d184b Author: Linus Torvalds Date: Wed Aug 14 15:29:53 2019 -0700 Merge tag 'Wimplicit-fallthrough-5.3-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gustavoars/linux Pull fallthrough fixes from Gustavo A. R. Silva: "Fix sh mainline builds: - Fix fall-through warning in sh. - Fix missing break bug in sh (this is a 10-year-old bug) Currently, mainline builds for sh are broken. These patches fix that" * tag 'Wimplicit-fallthrough-5.3-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gustavoars/linux: sh: kernel: hw_breakpoint: Fix missing break in switch statement sh: kernel: disassemble: Mark expected switch fall-throughs commit e22a97a2a85d2a0bdfb134cbbc7ff856ae67edba Merge: a8dba0531bc0 9dd0b82ef530 Author: Linus Torvalds Date: Wed Aug 14 14:21:14 2019 -0700 Merge tag 'afs-fixes-20190814' of git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs Pull afs fixes from David Howells: - Fix the CB.ProbeUuid handler to generate its reply correctly. - Fix a mix up in indices when parsing a Volume Location entry record. - Fix a potential NULL-pointer deref when cleaning up a read request. - Fix the expected data version of the destination directory in afs_rename(). - Fix afs_d_revalidate() to only update d_fsdata if it's not the same as the directory data version to reduce the likelihood of overwriting the result of a competing operation. (d_fsdata carries the directory DV or the least-significant word thereof). - Fix the tracking of the data-version on a directory and make sure that dentry objects get properly initialised, updated and revalidated. Also fix rename to update d_fsdata to match the new directory's DV if the dentry gets moved over and unhash the dentry to stop afs_d_revalidate() from interfering. * tag 'afs-fixes-20190814' of git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs: afs: Fix missing dentry data version updating afs: Only update d_fsdata if different in afs_d_revalidate() afs: Fix off-by-one in afs_rename() expected data version calculation fs: afs: Fix a possible null-pointer dereference in afs_put_read() afs: Fix loop index mixup in afs_deliver_vl_get_entry_by_name_u() afs: Fix the CB.ProbeUuid service handler to reply correctly commit 27df5c7068bf23cab282dc64b1c9894429b3b8a0 Author: Ilya Leoshkevich Date: Wed Aug 14 12:41:09 2019 +0200 selftests/bpf: fix "bind{4, 6} deny specific IP & port" on s390 "bind4 allow specific IP & port" and "bind6 deny specific IP & port" fail on s390 because of endianness issue: the 4 IP address bytes are loaded as a word and compared with a constant, but the value of this constant should be different on big- and little- endian machines, which is not the case right now. Use __bpf_constant_ntohl to generate proper value based on machine endianness. Fixes: 1d436885b23b ("selftests/bpf: Selftest for sys_bind post-hooks.") Signed-off-by: Ilya Leoshkevich Signed-off-by: Daniel Borkmann commit e1b4ce25dbc93ab0cb8ed0f236a3b9ff7b03802c Author: Christian König Date: Fri Aug 9 17:27:21 2019 +0200 drm/scheduler: use job count instead of peek The spsc_queue_peek function is accessing queue->head which belongs to the consumer thread and shouldn't be accessed by the producer This is fixing a rare race condition when destroying entities. Signed-off-by: Christian König Acked-by: Andrey Grodzovsky Reviewed-by: Monk.liu@amd.com Signed-off-by: Alex Deucher commit 69703eb9a8ae28a46cd5bce7d69ceeef6273a104 Author: Vincent Chen Date: Wed Aug 14 16:23:53 2019 +0800 riscv: Make __fstate_clean() work correctly. Make the __fstate_clean() function correctly set the state of sstatus.FS in pt_regs to SR_FS_CLEAN. Fixes: 7db91e57a0acd ("RISC-V: Task implementation") Cc: linux-stable Signed-off-by: Vincent Chen Reviewed-by: Anup Patel Reviewed-by: Christoph Hellwig [paul.walmsley@sifive.com: expanded "Fixes" commit ID] Signed-off-by: Paul Walmsley commit 8ac71d7e46b94a4fc8ffc6f1c88004cdf24459e8 Author: Vincent Chen Date: Wed Aug 14 16:23:52 2019 +0800 riscv: Correct the initialized flow of FP register The following two reasons cause FP registers are sometimes not initialized before starting the user program. 1. Currently, the FP context is initialized in flush_thread() function and we expect these initial values to be restored to FP register when doing FP context switch. However, the FP context switch only occurs in switch_to function. Hence, if this process does not be scheduled out and scheduled in before entering the user space, the FP registers have no chance to initialize. 2. In flush_thread(), the state of reg->sstatus.FS inherits from the parent. Hence, the state of reg->sstatus.FS may be dirty. If this process is scheduled out during flush_thread() and initializing the FP register, the fstate_save() in switch_to will corrupt the FP context which has been initialized until flush_thread(). To solve the 1st case, the initialization of the FP register will be completed in start_thread(). It makes sure all FP registers are initialized before starting the user program. For the 2nd case, the state of reg->sstatus.FS in start_thread will be set to SR_FS_OFF to prevent this process from corrupting FP context in doing context save. The FP state is set to SR_FS_INITIAL in start_trhead(). Signed-off-by: Vincent Chen Reviewed-by: Anup Patel Reviewed-by: Christoph Hellwig Fixes: 7db91e57a0acd ("RISC-V: Task implementation") Cc: stable@vger.kernel.org [paul.walmsley@sifive.com: fixed brace alignment issue reported by checkpatch] Signed-off-by: Paul Walmsley commit a8dba0531bc0ba8b65e77a4a858da4b6eeaa1b92 Merge: e83b009c5c36 2c8ccb37b08f Author: Linus Torvalds Date: Wed Aug 14 11:10:38 2019 -0700 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma Pull rdma fixes from Doug Ledford: "Fairly small pull request for -rc3. I'm out of town the rest of this week, so I made sure to clean out as much as possible from patchworks in enough time for 0-day to chew through it (Yay! for 0-day being back online! :-)). Jason might send through any emergency stuff that could pop up, otherwise I'm back next week. The only real thing of note is the siw ABI change. Since we just merged siw *this* release, there are no prior kernel releases to maintain kernel ABI with. I told Bernard that if there is anything else about the siw ABI he thinks he might want to change before it goes set in stone, he should get it in ASAP. The siw module was around for several years outside the kernel tree, and it had to be revamped considerably for inclusion upstream, so we are making no attempts to be backward compatible with the out of tree version. Once 5.3 is actually released, we will have our baseline ABI to maintain. Summary: - Fix a memory registration release flow issue that was causing a WARN_ON (mlx5) - If the counters for a port aren't allocated, then we can't do operations on the non-existent counters (core) - Check the right variable for error code result (mlx5) - Fix a use after free issue (mlx5) - Fix an off by one memory leak (siw) - Actually return an error code on error (core) - Allow siw to be built on 32bit arches (siw, ABI change, but OK since siw was just merged this merge window and there is no prior released kernel to maintain compatibility with and we also updated the rdma-core user space package to match)" * tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma: RDMA/siw: Change CQ flags from 64->32 bits RDMA/core: Fix error code in stat_get_doit_qp() RDMA/siw: Fix a memory leak in siw_init_cpulist() IB/mlx5: Fix use-after-free error while accessing ev_file pointer IB/mlx5: Check the correct variable in error handling code RDMA/counter: Prevent QP counter binding if counters unsupported IB/mlx5: Fix implicit MR release flow commit daac07156b330b18eb5071aec4b3ddca1c377f2c Author: Hui Peng Date: Tue Aug 13 22:34:04 2019 -0400 ALSA: usb-audio: Fix an OOB bug in parse_audio_mixer_unit The `uac_mixer_unit_descriptor` shown as below is read from the device side. In `parse_audio_mixer_unit`, `baSourceID` field is accessed from index 0 to `bNrInPins` - 1, the current implementation assumes that descriptor is always valid (the length of descriptor is no shorter than 5 + `bNrInPins`). If a descriptor read from the device side is invalid, it may trigger out-of-bound memory access. ``` struct uac_mixer_unit_descriptor { __u8 bLength; __u8 bDescriptorType; __u8 bDescriptorSubtype; __u8 bUnitID; __u8 bNrInPins; __u8 baSourceID[]; } ``` This patch fixes the bug by add a sanity check on the length of the descriptor. Reported-by: Hui Peng Reported-by: Mathias Payer Cc: Signed-off-by: Hui Peng Signed-off-by: Takashi Iwai commit e83b009c5c366b678c7986fa6c1d38fed06c954c Merge: b5e33e44d994 33dcb37cef74 Author: Linus Torvalds Date: Wed Aug 14 10:31:11 2019 -0700 Merge tag 'dma-mapping-5.3-4' of git://git.infradead.org/users/hch/dma-mapping Pull dma-mapping fixes from Christoph Hellwig: - fix the handling of the bus_dma_mask in dma_get_required_mask, which caused a regression in this merge window (Lucas Stach) - fix a regression in the handling of DMA_ATTR_NO_KERNEL_MAPPING (me) - fix dma_mmap_coherent to not cause page attribute mismatches on coherent architectures like x86 (me) * tag 'dma-mapping-5.3-4' of git://git.infradead.org/users/hch/dma-mapping: dma-mapping: fix page attributes for dma_mmap_* dma-direct: don't truncate dma_required_mask to bus addressing capabilities dma-direct: fix DMA_ATTR_NO_KERNEL_MAPPING commit 3ee1bb7aae97324ec9078da1f00cb2176919563f Author: Eric Dumazet Date: Mon Aug 12 04:57:27 2019 -0700 batman-adv: fix uninit-value in batadv_netlink_get_ifindex() batadv_netlink_get_ifindex() needs to make sure user passed a correct u32 attribute. syzbot reported : BUG: KMSAN: uninit-value in batadv_netlink_dump_hardif+0x70d/0x880 net/batman-adv/netlink.c:968 CPU: 1 PID: 11705 Comm: syz-executor888 Not tainted 5.1.0+ #1 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x191/0x1f0 lib/dump_stack.c:113 kmsan_report+0x130/0x2a0 mm/kmsan/kmsan.c:622 __msan_warning+0x75/0xe0 mm/kmsan/kmsan_instr.c:310 batadv_netlink_dump_hardif+0x70d/0x880 net/batman-adv/netlink.c:968 genl_lock_dumpit+0xc6/0x130 net/netlink/genetlink.c:482 netlink_dump+0xa84/0x1ab0 net/netlink/af_netlink.c:2253 __netlink_dump_start+0xa3a/0xb30 net/netlink/af_netlink.c:2361 genl_family_rcv_msg net/netlink/genetlink.c:550 [inline] genl_rcv_msg+0xfc1/0x1a40 net/netlink/genetlink.c:627 netlink_rcv_skb+0x431/0x620 net/netlink/af_netlink.c:2486 genl_rcv+0x63/0x80 net/netlink/genetlink.c:638 netlink_unicast_kernel net/netlink/af_netlink.c:1311 [inline] netlink_unicast+0xf3e/0x1020 net/netlink/af_netlink.c:1337 netlink_sendmsg+0x127e/0x12f0 net/netlink/af_netlink.c:1926 sock_sendmsg_nosec net/socket.c:651 [inline] sock_sendmsg net/socket.c:661 [inline] ___sys_sendmsg+0xcc6/0x1200 net/socket.c:2260 __sys_sendmsg net/socket.c:2298 [inline] __do_sys_sendmsg net/socket.c:2307 [inline] __se_sys_sendmsg+0x305/0x460 net/socket.c:2305 __x64_sys_sendmsg+0x4a/0x70 net/socket.c:2305 do_syscall_64+0xbc/0xf0 arch/x86/entry/common.c:291 entry_SYSCALL_64_after_hwframe+0x63/0xe7 RIP: 0033:0x440209 Fixes: b60620cf567b ("batman-adv: netlink: hardif query") Signed-off-by: Eric Dumazet Reported-by: syzbot Signed-off-by: Sven Eckelmann Signed-off-by: Simon Wunderlich commit b5e33e44d994bb03c75f1901d47b1cf971f752a0 Merge: cab6d5b66b98 3a18844dcf89 Author: Linus Torvalds Date: Wed Aug 14 10:16:59 2019 -0700 Merge tag 'iommu-fixes-v5.3-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu Pull iommu fixes from Joerg Roedel: - A couple more fixes for the Intel VT-d driver for bugs introduced during the recent conversion of this driver to use IOMMU core default domains. - Fix for common dma-iommu code to make sure MSI mappings happen in the correct domain for a device. - Fix a corner case in the handling of sg-lists in dma-iommu code that might cause dma_length to be truncated. - Mark a switch as fall-through in arm-smmu code. * tag 'iommu-fixes-v5.3-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu: iommu/vt-d: Fix possible use-after-free of private domain iommu/vt-d: Detach domain before using a private one iommu/dma: Handle SG length overflow better iommu/vt-d: Correctly check format of page table in debugfs iommu/vt-d: Detach domain when move device out of group iommu/arm-smmu: Mark expected switch fall-through iommu/dma: Handle MSI mappings separately commit cab6d5b66b984ddeb8b0ff2ad2ddc06f7f406cda Merge: ee1c7bd33e66 4643d67e8cb0 Author: Linus Torvalds Date: Wed Aug 14 09:53:46 2019 -0700 Merge branch 'akpm' (patches from Andrew) Merge misc VM fixes from Andrew Morton: "A bunch of hotfixes, all affecting mm/. The two-patch series from Andrea may be controversial. This restores patches which were reverted in Dec 2018 due to a regression report [*]. After extensive discussion it is evident that the problems which these patches solved were significantly more serious than the problems they introduced. I am told that major distros are already carrying these two patches for this reason" [*] See https://lore.kernel.org/lkml/alpine.DEB.2.21.1812061343240.144733@chino.kir.corp.google.com/ https://lore.kernel.org/lkml/alpine.DEB.2.21.1812031545560.161134@chino.kir.corp.google.com/ for the google-specific issues brought up by David Rijentes. And as Andrew says: "I'm unaware of anyone else who will be adversely affected by this, and google already carries over a thousand kernel patches - another won't kill them. There has been sporadic discussion about fixing these things for real but it's clear that nobody apart from David is particularly motivated" * emailed patches from Andrew Morton : hugetlbfs: fix hugetlb page migration/fault race causing SIGBUS mm, vmscan: do not special-case slab reclaim when watermarks are boosted Revert "mm, thp: restore node-local hugepage allocations" Revert "Revert "mm, thp: consolidate THP gfp handling into alloc_hugepage_direct_gfpmask"" include/asm-generic/5level-fixup.h: fix variable 'p4d' set but not used seq_file: fix problem when seeking mid-record mm: workingset: fix vmstat counters for shadow nodes mm/usercopy: use memory range to be accessed for wraparound check mm: kmemleak: disable early logging in case of error mm/vmalloc.c: fix percpu free VM area search criteria mm/memcontrol.c: fix use after free in mem_cgroup_iter() mm/z3fold.c: fix z3fold_destroy_pool() race condition mm/z3fold.c: fix z3fold_destroy_pool() ordering mm: mempolicy: handle vma with unmovable pages mapped correctly in mbind mm: mempolicy: make the behavior consistent when MPOL_MF_MOVE* and MPOL_MF_STRICT were specified mm/hmm: fix bad subpage pointer in try_to_unmap_one mm/hmm: fix ZONE_DEVICE anon page mapping reuse mm: document zone device struct page field usage commit c7ec75ea4d5316518adc87224e3cff47192579e7 Author: Dinh Nguyen Date: Wed Aug 14 10:30:14 2019 -0500 clk: socfpga: stratix10: fix rate caclulationg for cnt_clks Checking bypass_reg is incorrect for calculating the cnt_clk rates. Instead we should be checking that there is a proper hardware register that holds the clock divider. Cc: stable@vger.kernel.org Signed-off-by: Dinh Nguyen Link: https://lkml.kernel.org/r/20190814153014.12962-1-dinguyen@kernel.org Signed-off-by: Stephen Boyd commit c8e174b39887ea1992286ff8ffdbcf79f6057cf2 Author: Miaohe Lin Date: Mon Aug 12 10:33:00 2019 +0800 KVM: x86: svm: remove redundant assignment of var new_entry new_entry is reassigned a new value next line. So it's redundant and remove it. Signed-off-by: Miaohe Lin Signed-off-by: Paolo Bonzini commit ed4e7b057e9e75cecd56f6c3434f88eaa69c1209 Author: Paolo Bonzini Date: Fri Aug 9 09:30:02 2019 +0200 MAINTAINERS: add KVM x86 reviewers This is probably overdue---KVM x86 has quite a few contributors that usually review each other's patches, which is really helpful to me. Formalize this by listing them as reviewers. I am including people with various expertise: - Joerg for SVM (with designated reviewers, it makes more sense to have him in the main KVM/x86 stanza) - Sean for MMU and VMX - Jim for VMX - Vitaly for Hyper-V and possibly SVM - Wanpeng for LAPIC and paravirtualization. Please ack if you are okay with this arrangement, otherwise speak up. In other news, Radim is going to leave Red Hat soon. However, he has not been very much involved in upstream KVM development for some time, and in the immediate future he is still going to help maintain kvm/queue while I am on vacation. Since not much is going to change, I will let him decide whether he wants to keep the maintainer role after he leaves. Acked-by: Joerg Roedel Acked-by: Vitaly Kuznetsov Acked-by: Wanpeng Li Cc: Sean Christopherson Cc: Jim Mattson Signed-off-by: Paolo Bonzini commit 74260dc278a725b692b1a201c6b780a02804d3e4 Author: Paolo Bonzini Date: Fri Aug 9 09:18:43 2019 +0200 MAINTAINERS: change list for KVM/s390 KVM/s390 does not have a list of its own, and linux-s390 is in the loop anyway thanks to the generic arch/s390 match. So use the generic KVM list for s390 patches. Signed-off-by: Paolo Bonzini commit b14c876b994f208b6b95c222056e1deb0a45de0e Author: Radim Krcmar Date: Tue Aug 13 23:37:37 2019 -0400 kvm: x86: skip populating logical dest map if apic is not sw enabled recalculate_apic_map does not santize ldr and it's possible that multiple bits are set. In that case, a previous valid entry can potentially be overwritten by an invalid one. This condition is hit when booting a 32 bit, >8 CPU, RHEL6 guest and then triggering a crash to boot a kdump kernel. This is the sequence of events: 1. Linux boots in bigsmp mode and enables PhysFlat, however, it still writes to the LDR which probably will never be used. 2. However, when booting into kdump, the stale LDR values remain as they are not cleared by the guest and there isn't a apic reset. 3. kdump boots with 1 cpu, and uses Logical Destination Mode but the logical map has been overwritten and points to an inactive vcpu. Signed-off-by: Radim Krcmar Signed-off-by: Bandan Das Signed-off-by: Paolo Bonzini commit 6600c0808e2ea2939009e53983f066fe38bd308a Author: Rocky Liao Date: Wed Aug 14 15:42:39 2019 +0800 Bluetooth: hci_qca: Skip 1 error print in device_want_to_sleep() Don't fall through to print error message when receive sleep indication in HCI_IBS_RX_ASLEEP state, this is allowed behavior. Signed-off-by: Rocky Liao Signed-off-by: Marcel Holtmann commit 90865a3dc597bd8463efacb749561095ba70b0aa Author: Nishad Kamdar Date: Sat Aug 3 19:43:35 2019 +0530 i2c: stm32: Use the correct style for SPDX License Identifier This patch corrects the SPDX License Identifier style in header file related to STM32 Driver for I2C hardware bus support. For C header files Documentation/process/license-rules.rst mandates C-like comments (opposed to C source files where C++ style should be used) Changes made by using a script provided by Joe Perches here: https://lkml.org/lkml/2019/2/7/46 Suggested-by: Joe Perches Signed-off-by: Nishad Kamdar Signed-off-by: Wolfram Sang commit d7437fc0d8291181debe032671a289b6bd93f46f Author: Wolfram Sang Date: Thu Aug 8 21:54:17 2019 +0200 i2c: emev2: avoid race when unregistering slave client After we disabled interrupts, there might still be an active one running. Sync before clearing the pointer to the slave device. Fixes: c31d0a00021d ("i2c: emev2: add slave support") Reported-by: Krzysztof Adamski Signed-off-by: Wolfram Sang Reviewed-by: Krzysztof Adamski Signed-off-by: Wolfram Sang commit 7b814d852af6944657c2961039f404c4490771c0 Author: Wolfram Sang Date: Thu Aug 8 21:39:10 2019 +0200 i2c: rcar: avoid race when unregistering slave client After we disabled interrupts, there might still be an active one running. Sync before clearing the pointer to the slave device. Fixes: de20d1857dd6 ("i2c: rcar: add slave support") Reported-by: Krzysztof Adamski Signed-off-by: Wolfram Sang Reviewed-by: Krzysztof Adamski Signed-off-by: Wolfram Sang commit 06d9532fa6b34f12a6d75711162d47c17c1add72 Author: David Howells Date: Tue Aug 13 22:26:36 2019 +0100 rxrpc: Fix read-after-free in rxrpc_queue_local() rxrpc_queue_local() attempts to queue the local endpoint it is given and then, if successful, prints a trace line. The trace line includes the current usage count - but we're not allowed to look at the local endpoint at this point as we passed our ref on it to the workqueue. Fix this by reading the usage count before queuing the work item. Also fix the reading of local->debug_id for trace lines, which must be done with the same consideration as reading the usage count. Fixes: 09d2bf595db4 ("rxrpc: Add a tracepoint to track rxrpc_local refcounting") Reported-by: syzbot+78e71c5bab4f76a6a719@syzkaller.appspotmail.com Signed-off-by: David Howells commit b00df840fb4004b7087940ac5f68801562d0d2de Author: David Howells Date: Mon Aug 12 23:30:06 2019 +0100 rxrpc: Fix local endpoint replacement When a local endpoint (struct rxrpc_local) ceases to be in use by any AF_RXRPC sockets, it starts the process of being destroyed, but this doesn't cause it to be removed from the namespace endpoint list immediately as tearing it down isn't trivial and can't be done in softirq context, so it gets deferred. If a new socket comes along that wants to bind to the same endpoint, a new rxrpc_local object will be allocated and rxrpc_lookup_local() will use list_replace() to substitute the new one for the old. Then, when the dying object gets to rxrpc_local_destroyer(), it is removed unconditionally from whatever list it is on by calling list_del_init(). However, list_replace() doesn't reset the pointers in the replaced list_head and so the list_del_init() will likely corrupt the local endpoints list. Fix this by using list_replace_init() instead. Fixes: 730c5fd42c1e ("rxrpc: Fix local endpoint refcounting") Reported-by: syzbot+193e29e9387ea5837f1d@syzkaller.appspotmail.com Signed-off-by: David Howells commit 8fc3ae3b109d17157102f0abf9c8fb1e16bf810a Author: Oleksij Rempel Date: Mon Aug 12 07:08:17 2019 +0200 MAINTAINERS: i2c-imx: take over maintainership I would like to maintain the i2c-imx driver. Since I work with different i.MX variants and have access to the hardware, I can spend some time on the reviewing of this driver. Signed-off-by: Oleksij Rempel Signed-off-by: Wolfram Sang commit e8c220fac415d9f4a994b0c2871b835feac1eb4e Author: Fabio Estevam Date: Thu Aug 8 18:01:36 2019 -0300 Revert "i2c: imx: improve the error handling in i2c_imx_dma_request()" Since commit e1ab9a468e3b ("i2c: imx: improve the error handling in i2c_imx_dma_request()") when booting with the DMA driver as module (such as CONFIG_FSL_EDMA=m) the following endless clk warnings are seen: [ 153.077831] ------------[ cut here ]------------ [ 153.082528] WARNING: CPU: 0 PID: 15 at drivers/clk/clk.c:924 clk_core_disable_lock+0x18/0x24 [ 153.093077] i2c0 already disabled [ 153.096416] Modules linked in: [ 153.099521] CPU: 0 PID: 15 Comm: kworker/0:1 Tainted: G W 5.2.0+ #321 [ 153.107290] Hardware name: Freescale Vybrid VF5xx/VF6xx (Device Tree) [ 153.113772] Workqueue: events deferred_probe_work_func [ 153.118979] [] (unwind_backtrace) from [] (show_stack+0x10/0x14) [ 153.126778] [] (show_stack) from [] (dump_stack+0x9c/0xd4) [ 153.134051] [] (dump_stack) from [] (__warn+0xf8/0x124) [ 153.141056] [] (__warn) from [] (warn_slowpath_fmt+0x38/0x48) [ 153.148580] [] (warn_slowpath_fmt) from [] (clk_core_disable_lock+0x18/0x24) [ 153.157413] [] (clk_core_disable_lock) from [] (i2c_imx_probe+0x554/0x6ec) [ 153.166076] [] (i2c_imx_probe) from [] (platform_drv_probe+0x48/0x98) [ 153.174297] [] (platform_drv_probe) from [] (really_probe+0x1d8/0x2c0) [ 153.182605] [] (really_probe) from [] (driver_probe_device+0x5c/0x174) [ 153.190909] [] (driver_probe_device) from [] (bus_for_each_drv+0x44/0x8c) [ 153.199480] [] (bus_for_each_drv) from [] (__device_attach+0xa0/0x108) [ 153.207782] [] (__device_attach) from [] (bus_probe_device+0x88/0x90) [ 153.215999] [] (bus_probe_device) from [] (deferred_probe_work_func+0x60/0x90) [ 153.225003] [] (deferred_probe_work_func) from [] (process_one_work+0x204/0x634) [ 153.234178] [] (process_one_work) from [] (worker_thread+0x20/0x484) [ 153.242315] [] (worker_thread) from [] (kthread+0x118/0x150) [ 153.249758] [] (kthread) from [] (ret_from_fork+0x14/0x20) [ 153.257006] Exception stack(0xdde43fb0 to 0xdde43ff8) [ 153.262095] 3fa0: 00000000 00000000 00000000 00000000 [ 153.270306] 3fc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 [ 153.278520] 3fe0: 00000000 00000000 00000000 00000000 00000013 00000000 [ 153.285159] irq event stamp: 3323022 [ 153.288787] hardirqs last enabled at (3323021): [] _raw_spin_unlock_irq+0x24/0x2c [ 153.297261] hardirqs last disabled at (3323022): [] clk_enable_lock+0x10/0x124 [ 153.305392] softirqs last enabled at (3322092): [] __do_softirq+0x344/0x540 [ 153.313352] softirqs last disabled at (3322081): [] irq_exit+0x10c/0x128 [ 153.320946] ---[ end trace a506731ccd9bd703 ]--- This endless clk warnings behaviour is well explained by Andrey Smirnov: "Allocating DMA after registering I2C adapter can lead to infinite probing loop, for example, consider the following scenario: 1. i2c_imx_probe() is called and successfully registers an I2C adapter via i2c_add_numbered_adapter() 2. As a part of i2c_add_numbered_adapter() new I2C slave devices are added from DT which results in a call to driver_deferred_probe_trigger() 3. i2c_imx_probe() continues and calls i2c_imx_dma_request() which due to lack of proper DMA driver returns -EPROBE_DEFER 4. i2c_imx_probe() fails, removes I2C adapter and returns -EPROBE_DEFER, which places it into deferred probe list 5. Deferred probe work triggered in #2 above kicks in and calls i2c_imx_probe() again thus bringing us to step #1" So revert commit e1ab9a468e3b ("i2c: imx: improve the error handling in i2c_imx_dma_request()") and restore the old behaviour, in order to avoid regressions on existing setups. Cc: Reported-by: Andrey Smirnov Reported-by: Russell King Fixes: e1ab9a468e3b ("i2c: imx: improve the error handling in i2c_imx_dma_request()") Signed-off-by: Fabio Estevam Signed-off-by: Wolfram Sang commit dfe42be15fde16232340b8b2a57c359f51cc10d9 Author: Pablo Neira Ayuso Date: Tue Aug 13 17:41:13 2019 +0200 netfilter: nft_flow_offload: skip tcp rst and fin packets TCP rst and fin packets do not qualify to place a flow into the flowtable. Most likely there will be no more packets after connection closure. Without this patch, this flow entry expires and connection tracking picks up the entry in ESTABLISHED state using the fixup timeout, which makes this look inconsistent to the user for a connection that is actually already closed. Signed-off-by: Pablo Neira Ayuso commit 68e03b85474a51ec1921b4d13204782594ef7223 Author: YueHaibing Date: Wed Jul 31 20:38:14 2019 +0800 gpio: Fix build error of function redefinition when do randbuilding, I got this error: In file included from drivers/hwmon/pmbus/ucd9000.c:19:0: ./include/linux/gpio/driver.h:576:1: error: redefinition of gpiochip_add_pin_range gpiochip_add_pin_range(struct gpio_chip *chip, const char *pinctl_name, ^~~~~~~~~~~~~~~~~~~~~~ In file included from drivers/hwmon/pmbus/ucd9000.c:18:0: ./include/linux/gpio.h:245:1: note: previous definition of gpiochip_add_pin_range was here gpiochip_add_pin_range(struct gpio_chip *chip, const char *pinctl_name, ^~~~~~~~~~~~~~~~~~~~~~ Reported-by: Hulk Robot Fixes: 964cb341882f ("gpio: move pincontrol calls to ") Signed-off-by: YueHaibing Link: https://lore.kernel.org/r/20190731123814.46624-1-yuehaibing@huawei.com Signed-off-by: Linus Walleij commit 2c60e6b5c9241b24b8b523fefd3e44fb85622cda Author: Bartosz Golaszewski Date: Tue Aug 6 13:41:51 2019 +0200 gpiolib: never report open-drain/source lines as 'input' to user-space If the driver doesn't support open-drain/source config options, we emulate this behavior when setting the direction by calling gpiod_direction_input() if the default value is 0 (open-source) or 1 (open-drain), thus not actively driving the line in those cases. This however clears the FLAG_IS_OUT bit for the GPIO line descriptor and makes the LINEINFO ioctl() incorrectly report this line's mode as 'input' to user-space. This commit modifies the ioctl() to always set the GPIOLINE_FLAG_IS_OUT bit in the lineinfo structure's flags field. Since it's impossible to use the input mode and open-drain/source options at the same time, we can be sure the reported information will be correct. Fixes: 521a2ad6f862 ("gpio: add userspace ABI for GPIO line information") Cc: stable Signed-off-by: Bartosz Golaszewski Link: https://lore.kernel.org/r/20190806114151.17652-1-brgl@bgdev.pl Signed-off-by: Linus Walleij commit 871b9066027702e6e6589da0e1edd3b7dede7205 Author: Hui Wang Date: Wed Aug 14 12:09:08 2019 +0800 ALSA: hda - Add a generic reboot_notify Make codec enter D3 before rebooting or poweroff can fix the noise issue on some laptops. And in theory it is harmless for all codecs to enter D3 before rebooting or poweroff, let us add a generic reboot_notify, then realtek and conexant drivers can call this function. Cc: stable@vger.kernel.org Signed-off-by: Hui Wang Signed-off-by: Takashi Iwai commit 401714d9534aad8c24196b32600da683116bbe09 Author: Hui Wang Date: Wed Aug 14 12:09:07 2019 +0800 ALSA: hda - Let all conexant codec enter D3 when rebooting We have 3 new lenovo laptops which have conexant codec 0x14f11f86, these 3 laptops also have the noise issue when rebooting, after letting the codec enter D3 before rebooting or poweroff, the noise disappers. Instead of adding a new ID again in the reboot_notify(), let us make this function apply to all conexant codec. In theory make codec enter D3 before rebooting or poweroff is harmless, and I tested this change on a couple of other Lenovo laptops which have different conexant codecs, there is no side effect so far. Cc: stable@vger.kernel.org Signed-off-by: Hui Wang Signed-off-by: Takashi Iwai commit 6d5afe20397b478192ed8c38ec0ee10fa3aec649 Author: zhengbin Date: Tue Aug 13 22:05:50 2019 +0800 sctp: fix memleak in sctp_send_reset_streams If the stream outq is not empty, need to kfree nstr_list. Fixes: d570a59c5b5f ("sctp: only allow the out stream reset when the stream outq is empty") Reported-by: Hulk Robot Signed-off-by: zhengbin Acked-by: Marcelo Ricardo Leitner Acked-by: Neil Horman Signed-off-by: Jakub Kicinski commit d00ee64e1dcf09b3afefd1340f3e9eb637272714 Author: David Ahern Date: Mon Aug 12 13:07:07 2019 -0700 netlink: Fix nlmsg_parse as a wrapper for strict message parsing Eric reported a syzbot warning: BUG: KMSAN: uninit-value in nh_valid_get_del_req+0x6f1/0x8c0 net/ipv4/nexthop.c:1510 CPU: 0 PID: 11812 Comm: syz-executor444 Not tainted 5.3.0-rc3+ #17 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x191/0x1f0 lib/dump_stack.c:113 kmsan_report+0x162/0x2d0 mm/kmsan/kmsan_report.c:109 __msan_warning+0x75/0xe0 mm/kmsan/kmsan_instr.c:294 nh_valid_get_del_req+0x6f1/0x8c0 net/ipv4/nexthop.c:1510 rtm_del_nexthop+0x1b1/0x610 net/ipv4/nexthop.c:1543 rtnetlink_rcv_msg+0x115a/0x1580 net/core/rtnetlink.c:5223 netlink_rcv_skb+0x431/0x620 net/netlink/af_netlink.c:2477 rtnetlink_rcv+0x50/0x60 net/core/rtnetlink.c:5241 netlink_unicast_kernel net/netlink/af_netlink.c:1302 [inline] netlink_unicast+0xf6c/0x1050 net/netlink/af_netlink.c:1328 netlink_sendmsg+0x110f/0x1330 net/netlink/af_netlink.c:1917 sock_sendmsg_nosec net/socket.c:637 [inline] sock_sendmsg net/socket.c:657 [inline] ___sys_sendmsg+0x14ff/0x1590 net/socket.c:2311 __sys_sendmmsg+0x53a/0xae0 net/socket.c:2413 __do_sys_sendmmsg net/socket.c:2442 [inline] __se_sys_sendmmsg+0xbd/0xe0 net/socket.c:2439 __x64_sys_sendmmsg+0x56/0x70 net/socket.c:2439 do_syscall_64+0xbc/0xf0 arch/x86/entry/common.c:297 entry_SYSCALL_64_after_hwframe+0x63/0xe7 The root cause is nlmsg_parse calling __nla_parse which means the header struct size is not checked. nlmsg_parse should be a wrapper around __nlmsg_parse with NL_VALIDATE_STRICT for the validate argument very much like nlmsg_parse_deprecated is for NL_VALIDATE_LIBERAL. Fixes: 3de6440354465 ("netlink: re-add parse/validate functions in strict mode") Reported-by: Eric Dumazet Reported-by: syzbot Signed-off-by: David Ahern Reviewed-by: Eric Dumazet Signed-off-by: Jakub Kicinski commit c36757eb9dee13681227ad3676d37f14b3a2b2af Author: Heiner Kallweit Date: Mon Aug 12 21:20:02 2019 +0200 net: phy: consider AN_RESTART status when reading link status After configuring and restarting aneg we immediately try to read the link status. On some systems the PHY may not yet have cleared the "aneg complete" and "link up" bits, resulting in a false link-up signal. See [0] for a report. Clause 22 and 45 both require the PHY to keep the AN_RESTART bit set until the PHY actually starts auto-negotiation. Let's consider this in the generic functions for reading link status. The commit marked as fixed is the first one where the patch applies cleanly. [0] https://marc.info/?t=156518400300003&r=1&w=2 Fixes: c1164bb1a631 ("net: phy: check PMAPMD link status only in genphy_c45_read_link") Tested-by: Yonglong Liu Signed-off-by: Heiner Kallweit Reviewed-by: Andrew Lunn Signed-off-by: Jakub Kicinski commit 48ec7014c56e5eb2fbf6f479896143622d834f3b Author: Wenwen Wang Date: Mon Aug 12 14:11:35 2019 -0500 net/mlx4_en: fix a memory leak bug In mlx4_en_config_rss_steer(), 'rss_map->indir_qp' is allocated through kzalloc(). After that, mlx4_qp_alloc() is invoked to configure RSS indirection. However, if mlx4_qp_alloc() fails, the allocated 'rss_map->indir_qp' is not deallocated, leading to a memory leak bug. To fix the above issue, add the 'qp_alloc_err' label to free 'rss_map->indir_qp'. Fixes: 4931c6ef04b4 ("net/mlx4_en: Optimized single ring steering") Signed-off-by: Wenwen Wang Reviewed-by: Tariq Toukan Signed-off-by: Jakub Kicinski commit 66cf4710b23ab2adda11155684a2c8826f4fe732 Author: Thomas Falcon Date: Mon Aug 12 16:13:06 2019 -0500 ibmveth: Convert multicast list size for little-endian system The ibm,mac-address-filters property defines the maximum number of addresses the hypervisor's multicast filter list can support. It is encoded as a big-endian integer in the OF device tree, but the virtual ethernet driver does not convert it for use by little-endian systems. As a result, the driver is not behaving as it should on affected systems when a large number of multicast addresses are assigned to the device. Reported-by: Hangbin Liu Signed-off-by: Thomas Falcon Signed-off-by: Jakub Kicinski commit 072f79400032f74917726cf76f4248367ea2b5b8 Author: Julian Wiedmann Date: Mon Aug 12 16:44:35 2019 +0200 s390/qeth: serialize cmd reply with concurrent timeout Callbacks for a cmd reply run outside the protection of card->lock, to allow for additional cmds to be issued & enqueued in parallel. When qeth_send_control_data() bails out for a cmd without having received a reply (eg. due to timeout), its callback may concurrently be processing a reply that just arrived. In this case, the callback potentially accesses a stale reply->reply_param area that eg. was on-stack and has already been released. To avoid this race, add some locking so that qeth_send_control_data() can (1) wait for a concurrently running callback, and (2) zap any pending callback that still wants to run. Signed-off-by: Julian Wiedmann Signed-off-by: Jakub Kicinski commit d568cb3f935123b4fb42b9029ebcfebc4e4533a2 Author: Alistair Francis Date: Tue Aug 13 16:32:30 2019 -0700 riscv: defconfig: Update the defconfig Update the defconfig: - Add CONFIG_HW_RANDOM=y and CONFIG_HW_RANDOM_VIRTIO=y to enable VirtIORNG when running on QEMU Signed-off-by: Alistair Francis Signed-off-by: Paul Walmsley commit 500bc2c1f48aa6efad9474fdbe0c7cd8d600484c Author: Alistair Francis Date: Tue Aug 13 16:32:29 2019 -0700 riscv: rv32_defconfig: Update the defconfig Update the rv32_defconfig: - Add 'CONFIG_DEVTMPFS_MOUNT=y' to match the RISC-V defconfig - Add CONFIG_HW_RANDOM=y and CONFIG_HW_RANDOM_VIRTIO=y to enable VirtIORNG when running on QEMU Signed-off-by: Alistair Francis Signed-off-by: Paul Walmsley commit a1794de8b92ea6bc2037f445b296814ac826693e Author: Xin Long Date: Mon Aug 12 20:49:12 2019 +0800 sctp: fix the transport error_count check As the annotation says in sctp_do_8_2_transport_strike(): "If the transport error count is greater than the pf_retrans threshold, and less than pathmaxrtx ..." It should be transport->error_count checked with pathmaxrxt, instead of asoc->pf_retrans. Fixes: 5aa93bcf66f4 ("sctp: Implement quick failover draft from tsvwg") Signed-off-by: Xin Long Acked-by: Marcelo Ricardo Leitner Signed-off-by: Jakub Kicinski commit 074014abdf2bd2a00da3dd14a6ae04cafc1d62cc Author: Colin Ian King Date: Tue Aug 13 15:28:18 2019 +0100 net: ieee802154: remove redundant assignment to rc Variable rc is initialized to a value that is never read and it is re-assigned later. The initialization is redundant and can be removed. Addresses-Coverity: ("Unused value") Signed-off-by: Colin Ian King Signed-off-by: Stefan Schmidt commit 4643d67e8cb0b3536ef0ab5cddd1cedc73fa14ad Author: Mike Kravetz Date: Tue Aug 13 15:38:00 2019 -0700 hugetlbfs: fix hugetlb page migration/fault race causing SIGBUS Li Wang discovered that LTP/move_page12 V2 sometimes triggers SIGBUS in the kernel-v5.2.3 testing. This is caused by a race between hugetlb page migration and page fault. If a hugetlb page can not be allocated to satisfy a page fault, the task is sent SIGBUS. This is normal hugetlbfs behavior. A hugetlb fault mutex exists to prevent two tasks from trying to instantiate the same page. This protects against the situation where there is only one hugetlb page, and both tasks would try to allocate. Without the mutex, one would fail and SIGBUS even though the other fault would be successful. There is a similar race between hugetlb page migration and fault. Migration code will allocate a page for the target of the migration. It will then unmap the original page from all page tables. It does this unmap by first clearing the pte and then writing a migration entry. The page table lock is held for the duration of this clear and write operation. However, the beginnings of the hugetlb page fault code optimistically checks the pte without taking the page table lock. If clear (as it can be during the migration unmap operation), a hugetlb page allocation is attempted to satisfy the fault. Note that the page which will eventually satisfy this fault was already allocated by the migration code. However, the allocation within the fault path could fail which would result in the task incorrectly being sent SIGBUS. Ideally, we could take the hugetlb fault mutex in the migration code when modifying the page tables. However, locks must be taken in the order of hugetlb fault mutex, page lock, page table lock. This would require significant rework of the migration code. Instead, the issue is addressed in the hugetlb fault code. After failing to allocate a huge page, take the page table lock and check for huge_pte_none before returning an error. This is the same check that must be made further in the code even if page allocation is successful. Link: http://lkml.kernel.org/r/20190808000533.7701-1-mike.kravetz@oracle.com Fixes: 290408d4a250 ("hugetlb: hugepage migration core") Signed-off-by: Mike Kravetz Reported-by: Li Wang Tested-by: Li Wang Reviewed-by: Naoya Horiguchi Acked-by: Michal Hocko Cc: Cyril Hrubis Cc: Xishi Qiu Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 28360f398778d7623a5ff8a8e90958c0d925e120 Author: Mel Gorman Date: Tue Aug 13 15:37:57 2019 -0700 mm, vmscan: do not special-case slab reclaim when watermarks are boosted Dave Chinner reported a problem pointing a finger at commit 1c30844d2dfe ("mm: reclaim small amounts of memory when an external fragmentation event occurs"). The report is extensive: https://lore.kernel.org/linux-mm/20190807091858.2857-1-david@fromorbit.com/ and it's worth recording the most relevant parts (colorful language and typos included). When running a simple, steady state 4kB file creation test to simulate extracting tarballs larger than memory full of small files into the filesystem, I noticed that once memory fills up the cache balance goes to hell. The workload is creating one dirty cached inode for every dirty page, both of which should require a single IO each to clean and reclaim, and creation of inodes is throttled by the rate at which dirty writeback runs at (via balance dirty pages). Hence the ingest rate of new cached inodes and page cache pages is identical and steady. As a result, memory reclaim should quickly find a steady balance between page cache and inode caches. The moment memory fills, the page cache is reclaimed at a much faster rate than the inode cache, and evidence suggests that the inode cache shrinker is not being called when large batches of pages are being reclaimed. In roughly the same time period that it takes to fill memory with 50% pages and 50% slab caches, memory reclaim reduces the page cache down to just dirty pages and slab caches fill the entirety of memory. The LRU is largely full of dirty pages, and we're getting spikes of random writeback from memory reclaim so it's all going to shit. Behaviour never recovers, the page cache remains pinned at just dirty pages, and nothing I could tune would make any difference. vfs_cache_pressure makes no difference - I would set it so high it should trim the entire inode caches in a single pass, yet it didn't do anything. It was clear from tracing and live telemetry that the shrinkers were pretty much not running except when there was absolutely no memory free at all, and then they did the minimum necessary to free memory to make progress. So I went looking at the code, trying to find places where pages got reclaimed and the shrinkers weren't called. There's only one - kswapd doing boosted reclaim as per commit 1c30844d2dfe ("mm: reclaim small amounts of memory when an external fragmentation event occurs"). The watermark boosting introduced by the commit is triggered in response to an allocation "fragmentation event". The boosting was not intended to target THP specifically and triggers even if THP is disabled. However, with Dave's perfectly reasonable workload, fragmentation events can be very common given the ratio of slab to page cache allocations so boosting remains active for long periods of time. As high-order allocations might use compaction and compaction cannot move slab pages the decision was made in the commit to special-case kswapd when watermarks are boosted -- kswapd avoids reclaiming slab as reclaiming slab does not directly help compaction. As Dave notes, this decision means that slab can be artificially protected for long periods of time and messes up the balance with slab and page caches. Removing the special casing can still indirectly help avoid fragmentation by avoiding fragmentation-causing events due to slab allocation as pages from a slab pageblock will have some slab objects freed. Furthermore, with the special casing, reclaim behaviour is unpredictable as kswapd sometimes examines slab and sometimes does not in a manner that is tricky to tune or analyse. This patch removes the special casing. The downside is that this is not a universal performance win. Some benchmarks that depend on the residency of data when rereading metadata may see a regression when slab reclaim is restored to its original behaviour. Similarly, some benchmarks that only read-once or write-once may perform better when page reclaim is too aggressive. The primary upside is that slab shrinker is less surprising (arguably more sane but that's a matter of opinion), behaves consistently regardless of the fragmentation state of the system and properly obeys VM sysctls. A fsmark benchmark configuration was constructed similar to what Dave reported and is codified by the mmtest configuration config-io-fsmark-small-file-stream. It was evaluated on a 1-socket machine to avoid dealing with NUMA-related issues and the timing of reclaim. The storage was an SSD Samsung Evo and a fresh trimmed XFS filesystem was used for the test data. This is not an exact replication of Dave's setup. The configuration scales its parameters depending on the memory size of the SUT to behave similarly across machines. The parameters mean the first sample reported by fs_mark is using 50% of RAM which will barely be throttled and look like a big outlier. Dave used fake NUMA to have multiple kswapd instances which I didn't replicate. Finally, the number of iterations differ from Dave's test as the target disk was not large enough. While not identical, it should be representative. fsmark 5.3.0-rc3 5.3.0-rc3 vanilla shrinker-v1r1 Min 1-files/sec 4444.80 ( 0.00%) 4765.60 ( 7.22%) 1st-qrtle 1-files/sec 5005.10 ( 0.00%) 5091.70 ( 1.73%) 2nd-qrtle 1-files/sec 4917.80 ( 0.00%) 4855.60 ( -1.26%) 3rd-qrtle 1-files/sec 4667.40 ( 0.00%) 4831.20 ( 3.51%) Max-1 1-files/sec 11421.50 ( 0.00%) 9999.30 ( -12.45%) Max-5 1-files/sec 11421.50 ( 0.00%) 9999.30 ( -12.45%) Max-10 1-files/sec 11421.50 ( 0.00%) 9999.30 ( -12.45%) Max-90 1-files/sec 4649.60 ( 0.00%) 4780.70 ( 2.82%) Max-95 1-files/sec 4491.00 ( 0.00%) 4768.20 ( 6.17%) Max-99 1-files/sec 4491.00 ( 0.00%) 4768.20 ( 6.17%) Max 1-files/sec 11421.50 ( 0.00%) 9999.30 ( -12.45%) Hmean 1-files/sec 5004.75 ( 0.00%) 5075.96 ( 1.42%) Stddev 1-files/sec 1778.70 ( 0.00%) 1369.66 ( 23.00%) CoeffVar 1-files/sec 33.70 ( 0.00%) 26.05 ( 22.71%) BHmean-99 1-files/sec 5053.72 ( 0.00%) 5101.52 ( 0.95%) BHmean-95 1-files/sec 5053.72 ( 0.00%) 5101.52 ( 0.95%) BHmean-90 1-files/sec 5107.05 ( 0.00%) 5131.41 ( 0.48%) BHmean-75 1-files/sec 5208.45 ( 0.00%) 5206.68 ( -0.03%) BHmean-50 1-files/sec 5405.53 ( 0.00%) 5381.62 ( -0.44%) BHmean-25 1-files/sec 6179.75 ( 0.00%) 6095.14 ( -1.37%) 5.3.0-rc3 5.3.0-rc3 vanillashrinker-v1r1 Duration User 501.82 497.29 Duration System 4401.44 4424.08 Duration Elapsed 8124.76 8358.05 This is showing a slight skew for the max result representing a large outlier for the 1st, 2nd and 3rd quartile are similar indicating that the bulk of the results show little difference. Note that an earlier version of the fsmark configuration showed a regression but that included more samples taken while memory was still filling. Note that the elapsed time is higher. Part of this is that the configuration included time to delete all the test files when the test completes -- the test automation handles the possibility of testing fsmark with multiple thread counts. Without the patch, many of these objects would be memory resident which is part of what the patch is addressing. There are other important observations that justify the patch. 1. With the vanilla kernel, the number of dirty pages in the system is very low for much of the test. With this patch, dirty pages is generally kept at 10% which matches vm.dirty_background_ratio which is normal expected historical behaviour. 2. With the vanilla kernel, the ratio of Slab/Pagecache is close to 0.95 for much of the test i.e. Slab is being left alone and dominating memory consumption. With the patch applied, the ratio varies between 0.35 and 0.45 with the bulk of the measured ratios roughly half way between those values. This is a different balance to what Dave reported but it was at least consistent. 3. Slabs are scanned throughout the entire test with the patch applied. The vanille kernel has periods with no scan activity and then relatively massive spikes. 4. Without the patch, kswapd scan rates are very variable. With the patch, the scan rates remain quite steady. 4. Overall vmstats are closer to normal expectations 5.3.0-rc3 5.3.0-rc3 vanilla shrinker-v1r1 Ops Direct pages scanned 99388.00 328410.00 Ops Kswapd pages scanned 45382917.00 33451026.00 Ops Kswapd pages reclaimed 30869570.00 25239655.00 Ops Direct pages reclaimed 74131.00 5830.00 Ops Kswapd efficiency % 68.02 75.45 Ops Kswapd velocity 5585.75 4002.25 Ops Page reclaim immediate 1179721.00 430927.00 Ops Slabs scanned 62367361.00 73581394.00 Ops Direct inode steals 2103.00 1002.00 Ops Kswapd inode steals 570180.00 5183206.00 o Vanilla kernel is hitting direct reclaim more frequently, not very much in absolute terms but the fact the patch reduces it is interesting o "Page reclaim immediate" in the vanilla kernel indicates dirty pages are being encountered at the tail of the LRU. This is generally bad and means in this case that the LRU is not long enough for dirty pages to be cleaned by the background flush in time. This is much reduced by the patch. o With the patch, kswapd is reclaiming 10 times more slab pages than with the vanilla kernel. This is indicative of the watermark boosting over-protecting slab A more complete set of tests were run that were part of the basis for introducing boosting and while there are some differences, they are well within tolerances. Bottom line, the special casing kswapd to avoid slab behaviour is unpredictable and can lead to abnormal results for normal workloads. This patch restores the expected behaviour that slab and page cache is balanced consistently for a workload with a steady allocation ratio of slab/pagecache pages. It also means that if there are workloads that favour the preservation of slab over pagecache that it can be tuned via vm.vfs_cache_pressure where as the vanilla kernel effectively ignores the parameter when boosting is active. Link: http://lkml.kernel.org/r/20190808182946.GM2739@techsingularity.net Fixes: 1c30844d2dfe ("mm: reclaim small amounts of memory when an external fragmentation event occurs") Signed-off-by: Mel Gorman Reviewed-by: Dave Chinner Acked-by: Vlastimil Babka Cc: Michal Hocko Cc: [5.0+] Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit a8282608c88e08b1782141026eab61204c1e533f Author: Andrea Arcangeli Date: Tue Aug 13 15:37:53 2019 -0700 Revert "mm, thp: restore node-local hugepage allocations" This reverts commit 2f0799a0ffc033b ("mm, thp: restore node-local hugepage allocations"). commit 2f0799a0ffc033b was rightfully applied to avoid the risk of a severe regression that was reported by the kernel test robot at the end of the merge window. Now we understood the regression was a false positive and was caused by a significant increase in fairness during a swap trashing benchmark. So it's safe to re-apply the fix and continue improving the code from there. The benchmark that reported the regression is very useful, but it provides a meaningful result only when there is no significant alteration in fairness during the workload. The removal of __GFP_THISNODE increased fairness. __GFP_THISNODE cannot be used in the generic page faults path for new memory allocations under the MPOL_DEFAULT mempolicy, or the allocation behavior significantly deviates from what the MPOL_DEFAULT semantics are supposed to be for THP and 4k allocations alike. Setting THP defrag to "always" or using MADV_HUGEPAGE (with THP defrag set to "madvise") has never meant to provide an implicit MPOL_BIND on the "current" node the task is running on, causing swap storms and providing a much more aggressive behavior than even zone_reclaim_node = 3. Any workload who could have benefited from __GFP_THISNODE has now to enable zone_reclaim_mode=1||2||3. __GFP_THISNODE implicitly provided the zone_reclaim_mode behavior, but it only did so if THP was enabled: if THP was disabled, there would have been no chance to get any 4k page from the current node if the current node was full of pagecache, which further shows how this __GFP_THISNODE was misplaced in MADV_HUGEPAGE. MADV_HUGEPAGE has never been intended to provide any zone_reclaim_mode semantics, in fact the two are orthogonal, zone_reclaim_mode = 1|2|3 must work exactly the same with MADV_HUGEPAGE set or not. The performance characteristic of memory depends on the hardware details. The numbers below are obtained on Naples/EPYC architecture and the N/A projection extends them to show what we should aim for in the future as a good THP NUMA locality default. The benchmark used exercises random memory seeks (note: the cost of the page faults is not part of the measurement). D0 THP | D0 4k | D1 THP | D1 4k | D2 THP | D2 4k | D3 THP | D3 4k | ... 0% | +43% | +45% | +106% | +131% | +224% | N/A | N/A D0 means distance zero (i.e. local memory), D1 means distance one (i.e. intra socket memory), D2 means distance two (i.e. inter socket memory), etc... For the guest physical memory allocated by qemu and for guest mode kernel the performance characteristic of RAM is more complex and an ideal default could be: D0 THP | D1 THP | D0 4k | D2 THP | D1 4k | D3 THP | D2 4k | D3 4k | ... 0% | +58% | +101% | N/A | +222% | N/A | N/A | N/A NOTE: the N/A are projections and haven't been measured yet, the measurement in this case is done on a 1950x with only two NUMA nodes. The THP case here means THP was used both in the host and in the guest. After applying this commit the THP NUMA locality order that we'll get out of MADV_HUGEPAGE is this: D0 THP | D1 THP | D2 THP | D3 THP | ... | D0 4k | D1 4k | D2 4k | D3 4k | ... Before this commit it was: D0 THP | D0 4k | D1 4k | D2 4k | D3 4k | ... Even if we ignore the breakage of large workloads that can't fit in a single node that the __GFP_THISNODE implicit "current node" mbind caused, the THP NUMA locality order provided by __GFP_THISNODE was still not the one we shall aim for in the long term (i.e. the first one at the top). After this commit is applied, we can introduce a new allocator multi order API and to replace those two alloc_pages_vmas calls in the page fault path, with a single multi order call: unsigned int order = (1 << HPAGE_PMD_ORDER) | (1 << 0); page = alloc_pages_multi_order(..., &order); if (!page) goto out; if (!(order & (1 << 0))) { VM_WARN_ON(order != 1 << HPAGE_PMD_ORDER); /* THP fault */ } else { VM_WARN_ON(order != 1 << 0); /* 4k fallback */ } The page allocator logic has to be altered so that when it fails on any zone with order 9, it has to try again with a order 0 before falling back to the next zone in the zonelist. After that we need to do more measurements and evaluate if adding an opt-in feature for guest mode is worth it, to swap "DN 4k | DN+1 THP" with "DN+1 THP | DN 4k" at every NUMA distance crossing. Link: http://lkml.kernel.org/r/20190503223146.2312-3-aarcange@redhat.com Signed-off-by: Andrea Arcangeli Acked-by: Michal Hocko Acked-by: Mel Gorman Cc: Vlastimil Babka Cc: David Rientjes Cc: Zi Yan Cc: Stefan Priebe - Profihost AG Cc: "Kirill A. Shutemov" Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 92717d429b38e4f9f934eed7e605cc42858f1839 Author: Andrea Arcangeli Date: Tue Aug 13 15:37:50 2019 -0700 Revert "Revert "mm, thp: consolidate THP gfp handling into alloc_hugepage_direct_gfpmask"" Patch series "reapply: relax __GFP_THISNODE for MADV_HUGEPAGE mappings". The fixes for what was originally reported as "pathological THP behavior" we rightfully reverted to be sure not to introduced regressions at end of a merge window after a severe regression report from the kernel bot. We can safely re-apply them now that we had time to analyze the problem. The mm process worked fine, because the good fixes were eventually committed upstream without excessive delay. The regression reported by the kernel bot however forced us to revert the good fixes to be sure not to introduce regressions and to give us the time to analyze the issue further. The silver lining is that this extra time allowed to think more at this issue and also plan for a future direction to improve things further in terms of THP NUMA locality. This patch (of 2): This reverts commit 356ff8a9a78fb35d ("Revert "mm, thp: consolidate THP gfp handling into alloc_hugepage_direct_gfpmask"). So it reapplies 89c83fb539f954 ("mm, thp: consolidate THP gfp handling into alloc_hugepage_direct_gfpmask"). Consolidation of the THP allocation flags at the same place was meant to be a clean up to easier handle otherwise scattered code which is imposing a maintenance burden. There were no real problems observed with the gfp mask consolidation but the reversion was rushed through without a larger consensus regardless. This patch brings the consolidation back because this should make the long term maintainability easier as well as it should allow future changes to be less error prone. [mhocko@kernel.org: changelog additions] Link: http://lkml.kernel.org/r/20190503223146.2312-2-aarcange@redhat.com Signed-off-by: Andrea Arcangeli Acked-by: Michal Hocko Cc: Mel Gorman Cc: Vlastimil Babka Cc: David Rientjes Cc: Zi Yan Cc: Stefan Priebe - Profihost AG Cc: "Kirill A. Shutemov" Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 0cfaee2af3a04c0be5f056cebe5f804dedc59a43 Author: Qian Cai Date: Tue Aug 13 15:37:47 2019 -0700 include/asm-generic/5level-fixup.h: fix variable 'p4d' set but not used A compiler throws a warning on an arm64 system since commit 9849a5697d3d ("arch, mm: convert all architectures to use 5level-fixup.h"), mm/kasan/init.c: In function 'kasan_free_p4d': mm/kasan/init.c:344:9: warning: variable 'p4d' set but not used [-Wunused-but-set-variable] p4d_t *p4d; ^~~ because p4d_none() in "5level-fixup.h" is compiled away while it is a static inline function in "pgtable-nopud.h". However, if converted p4d_none() to a static inline there, powerpc would be unhappy as it reads those in assembler language in "arch/powerpc/include/asm/book3s/64/pgtable.h", so it needs to skip assembly include for the static inline C function. While at it, converted a few similar functions to be consistent with the ones in "pgtable-nopud.h". Link: http://lkml.kernel.org/r/20190806232917.881-1-cai@lca.pw Signed-off-by: Qian Cai Acked-by: Arnd Bergmann Cc: Kirill A. Shutemov Cc: Michal Hocko Cc: Jason Gunthorpe Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 6a2aeab59e97101b4001bac84388fc49a992f87e Author: NeilBrown Date: Tue Aug 13 15:37:44 2019 -0700 seq_file: fix problem when seeking mid-record If you use lseek or similar (e.g. pread) to access a location in a seq_file file that is within a record, rather than at a record boundary, then the first read will return the remainder of the record, and the second read will return the whole of that same record (instead of the next record). When seeking to a record boundary, the next record is correctly returned. This bug was introduced by a recent patch (identified below). Before that patch, seq_read() would increment m->index when the last of the buffer was returned (m->count == 0). After that patch, we rely on ->next to increment m->index after filling the buffer - but there was one place where that didn't happen. Link: https://lkml.kernel.org/lkml/877e7xl029.fsf@notabene.neil.brown.name/ Fixes: 1f4aace60b0e ("fs/seq_file.c: simplify seq_file iteration code and interface") Signed-off-by: NeilBrown Reported-by: Sergei Turchanov Tested-by: Sergei Turchanov Cc: Alexander Viro Cc: Markus Elfring Cc: [4.19+] Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit ec9f02384f6053f2a5417e82b65078edc5364a8d Author: Roman Gushchin Date: Tue Aug 13 15:37:41 2019 -0700 mm: workingset: fix vmstat counters for shadow nodes Memcg counters for shadow nodes are broken because the memcg pointer is obtained in a wrong way. The following approach is used: virt_to_page(xa_node)->mem_cgroup Since commit 4d96ba353075 ("mm: memcg/slab: stop setting page->mem_cgroup pointer for slab pages") page->mem_cgroup pointer isn't set for slab pages, so memcg_from_slab_page() should be used instead. Also I doubt that it ever worked correctly: virt_to_head_page() should be used instead of virt_to_page(). Otherwise objects residing on tail pages are not accounted, because only the head page contains a valid mem_cgroup pointer. That was a case since the introduction of these counters by the commit 68d48e6a2df5 ("mm: workingset: add vmstat counter for shadow nodes"). Link: http://lkml.kernel.org/r/20190801233532.138743-1-guro@fb.com Fixes: 4d96ba353075 ("mm: memcg/slab: stop setting page->mem_cgroup pointer for slab pages") Signed-off-by: Roman Gushchin Acked-by: Johannes Weiner Cc: Vladimir Davydov Cc: Shakeel Butt Cc: Michal Hocko Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 951531691c4bcaa59f56a316e018bc2ff1ddf855 Author: Isaac J. Manjarres Date: Tue Aug 13 15:37:37 2019 -0700 mm/usercopy: use memory range to be accessed for wraparound check Currently, when checking to see if accessing n bytes starting at address "ptr" will cause a wraparound in the memory addresses, the check in check_bogus_address() adds an extra byte, which is incorrect, as the range of addresses that will be accessed is [ptr, ptr + (n - 1)]. This can lead to incorrectly detecting a wraparound in the memory address, when trying to read 4 KB from memory that is mapped to the the last possible page in the virtual address space, when in fact, accessing that range of memory would not cause a wraparound to occur. Use the memory range that will actually be accessed when considering if accessing a certain amount of bytes will cause the memory address to wrap around. Link: http://lkml.kernel.org/r/1564509253-23287-1-git-send-email-isaacm@codeaurora.org Fixes: f5509cc18daa ("mm: Hardened usercopy") Signed-off-by: Prasad Sodagudi Signed-off-by: Isaac J. Manjarres Co-developed-by: Prasad Sodagudi Reviewed-by: William Kucharski Acked-by: Kees Cook Cc: Greg Kroah-Hartman Cc: Trilok Soni Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit fcf3a5b62f431ce9feeac73afbe128b7b6395dbc Author: Catalin Marinas Date: Tue Aug 13 15:37:34 2019 -0700 mm: kmemleak: disable early logging in case of error If an error occurs during kmemleak_init() (e.g. kmem cache cannot be created), kmemleak is disabled but kmemleak_early_log remains enabled. Subsequently, when the .init.text section is freed, the log_early() function no longer exists. To avoid a page fault in such scenario, ensure that kmemleak_disable() also disables early logging. Link: http://lkml.kernel.org/r/20190731152302.42073-1-catalin.marinas@arm.com Signed-off-by: Catalin Marinas Reported-by: Qian Cai Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 5336e52c9e46afa69b7a85a0a091f0e4daa23d6e Author: Kuppuswamy Sathyanarayanan Date: Tue Aug 13 15:37:31 2019 -0700 mm/vmalloc.c: fix percpu free VM area search criteria Recent changes to the vmalloc code by commit 68ad4a330433 ("mm/vmalloc.c: keep track of free blocks for vmap allocation") can cause spurious percpu allocation failures. These, in turn, can result in panic()s in the slub code. One such possible panic was reported by Dave Hansen in following link https://lkml.org/lkml/2019/6/19/939. Another related panic observed is, RIP: 0033:0x7f46f7441b9b Call Trace: dump_stack+0x61/0x80 pcpu_alloc.cold.30+0x22/0x4f mem_cgroup_css_alloc+0x110/0x650 cgroup_apply_control_enable+0x133/0x330 cgroup_mkdir+0x41b/0x500 kernfs_iop_mkdir+0x5a/0x90 vfs_mkdir+0x102/0x1b0 do_mkdirat+0x7d/0xf0 do_syscall_64+0x5b/0x180 entry_SYSCALL_64_after_hwframe+0x44/0xa9 VMALLOC memory manager divides the entire VMALLOC space (VMALLOC_START to VMALLOC_END) into multiple VM areas (struct vm_areas), and it mainly uses two lists (vmap_area_list & free_vmap_area_list) to track the used and free VM areas in VMALLOC space. And pcpu_get_vm_areas(offsets[], sizes[], nr_vms, align) function is used for allocating congruent VM areas for percpu memory allocator. In order to not conflict with VMALLOC users, pcpu_get_vm_areas allocates VM areas near the end of the VMALLOC space. So the search for free vm_area for the given requirement starts near VMALLOC_END and moves upwards towards VMALLOC_START. Prior to commit 68ad4a330433, the search for free vm_area in pcpu_get_vm_areas() involves following two main steps. Step 1: Find a aligned "base" adress near VMALLOC_END. va = free vm area near VMALLOC_END Step 2: Loop through number of requested vm_areas and check, Step 2.1: if (base < VMALLOC_START) 1. fail with error Step 2.2: // end is offsets[area] + sizes[area] if (base + end > va->vm_end) 1. Move the base downwards and repeat Step 2 Step 2.3: if (base + start < va->vm_start) 1. Move to previous free vm_area node, find aligned base address and repeat Step 2 But Commit 68ad4a330433 removed Step 2.2 and modified Step 2.3 as below: Step 2.3: if (base + start < va->vm_start || base + end > va->vm_end) 1. Move to previous free vm_area node, find aligned base address and repeat Step 2 Above change is the root cause of spurious percpu memory allocation failures. For example, consider a case where a relatively large vm_area (~ 30 TB) was ignored in free vm_area search because it did not pass the base + end < vm->vm_end boundary check. Ignoring such large free vm_area's would lead to not finding free vm_area within boundary of VMALLOC_start to VMALLOC_END which in turn leads to allocation failures. So modify the search algorithm to include Step 2.2. Link: http://lkml.kernel.org/r/20190729232139.91131-1-sathyanarayanan.kuppuswamy@linux.intel.com Fixes: 68ad4a330433 ("mm/vmalloc.c: keep track of free blocks for vmap allocation") Signed-off-by: Kuppuswamy Sathyanarayanan Reported-by: Dave Hansen Acked-by: Dennis Zhou Reviewed-by: Uladzislau Rezki (Sony) Cc: Roman Gushchin Cc: sathyanarayanan kuppuswamy Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 54a83d6bcbf8f4700013766b974bf9190d40b689 Author: Miles Chen Date: Tue Aug 13 15:37:28 2019 -0700 mm/memcontrol.c: fix use after free in mem_cgroup_iter() This patch is sent to report an use after free in mem_cgroup_iter() after merging commit be2657752e9e ("mm: memcg: fix use after free in mem_cgroup_iter()"). I work with android kernel tree (4.9 & 4.14), and commit be2657752e9e ("mm: memcg: fix use after free in mem_cgroup_iter()") has been merged to the trees. However, I can still observe use after free issues addressed in the commit be2657752e9e. (on low-end devices, a few times this month) backtrace: css_tryget <- crash here mem_cgroup_iter shrink_node shrink_zones do_try_to_free_pages try_to_free_pages __perform_reclaim __alloc_pages_direct_reclaim __alloc_pages_slowpath __alloc_pages_nodemask To debug, I poisoned mem_cgroup before freeing it: static void __mem_cgroup_free(struct mem_cgroup *memcg) for_each_node(node) free_mem_cgroup_per_node_info(memcg, node); free_percpu(memcg->stat); + /* poison memcg before freeing it */ + memset(memcg, 0x78, sizeof(struct mem_cgroup)); kfree(memcg); } The coredump shows the position=0xdbbc2a00 is freed. (gdb) p/x ((struct mem_cgroup_per_node *)0xe5009e00)->iter[8] $13 = {position = 0xdbbc2a00, generation = 0x2efd} 0xdbbc2a00: 0xdbbc2e00 0x00000000 0xdbbc2800 0x00000100 0xdbbc2a10: 0x00000200 0x78787878 0x00026218 0x00000000 0xdbbc2a20: 0xdcad6000 0x00000001 0x78787800 0x00000000 0xdbbc2a30: 0x78780000 0x00000000 0x0068fb84 0x78787878 0xdbbc2a40: 0x78787878 0x78787878 0x78787878 0xe3fa5cc0 0xdbbc2a50: 0x78787878 0x78787878 0x00000000 0x00000000 0xdbbc2a60: 0x00000000 0x00000000 0x00000000 0x00000000 0xdbbc2a70: 0x00000000 0x00000000 0x00000000 0x00000000 0xdbbc2a80: 0x00000000 0x00000000 0x00000000 0x00000000 0xdbbc2a90: 0x00000001 0x00000000 0x00000000 0x00100000 0xdbbc2aa0: 0x00000001 0xdbbc2ac8 0x00000000 0x00000000 0xdbbc2ab0: 0x00000000 0x00000000 0x00000000 0x00000000 0xdbbc2ac0: 0x00000000 0x00000000 0xe5b02618 0x00001000 0xdbbc2ad0: 0x00000000 0x78787878 0x78787878 0x78787878 0xdbbc2ae0: 0x78787878 0x78787878 0x78787878 0x78787878 0xdbbc2af0: 0x78787878 0x78787878 0x78787878 0x78787878 0xdbbc2b00: 0x78787878 0x78787878 0x78787878 0x78787878 0xdbbc2b10: 0x78787878 0x78787878 0x78787878 0x78787878 0xdbbc2b20: 0x78787878 0x78787878 0x78787878 0x78787878 0xdbbc2b30: 0x78787878 0x78787878 0x78787878 0x78787878 0xdbbc2b40: 0x78787878 0x78787878 0x78787878 0x78787878 0xdbbc2b50: 0x78787878 0x78787878 0x78787878 0x78787878 0xdbbc2b60: 0x78787878 0x78787878 0x78787878 0x78787878 0xdbbc2b70: 0x78787878 0x78787878 0x78787878 0x78787878 0xdbbc2b80: 0x78787878 0x78787878 0x00000000 0x78787878 0xdbbc2b90: 0x78787878 0x78787878 0x78787878 0x78787878 0xdbbc2ba0: 0x78787878 0x78787878 0x78787878 0x78787878 In the reclaim path, try_to_free_pages() does not setup sc.target_mem_cgroup and sc is passed to do_try_to_free_pages(), ..., shrink_node(). In mem_cgroup_iter(), root is set to root_mem_cgroup because sc->target_mem_cgroup is NULL. It is possible to assign a memcg to root_mem_cgroup.nodeinfo.iter in mem_cgroup_iter(). try_to_free_pages struct scan_control sc = {...}, target_mem_cgroup is 0x0; do_try_to_free_pages shrink_zones shrink_node mem_cgroup *root = sc->target_mem_cgroup; memcg = mem_cgroup_iter(root, NULL, &reclaim); mem_cgroup_iter() if (!root) root = root_mem_cgroup; ... css = css_next_descendant_pre(css, &root->css); memcg = mem_cgroup_from_css(css); cmpxchg(&iter->position, pos, memcg); My device uses memcg non-hierarchical mode. When we release a memcg: invalidate_reclaim_iterators() reaches only dead_memcg and its parents. If non-hierarchical mode is used, invalidate_reclaim_iterators() never reaches root_mem_cgroup. static void invalidate_reclaim_iterators(struct mem_cgroup *dead_memcg) { struct mem_cgroup *memcg = dead_memcg; for (; memcg; memcg = parent_mem_cgroup(memcg) ... } So the use after free scenario looks like: CPU1 CPU2 try_to_free_pages do_try_to_free_pages shrink_zones shrink_node mem_cgroup_iter() if (!root) root = root_mem_cgroup; ... css = css_next_descendant_pre(css, &root->css); memcg = mem_cgroup_from_css(css); cmpxchg(&iter->position, pos, memcg); invalidate_reclaim_iterators(memcg); ... __mem_cgroup_free() kfree(memcg); try_to_free_pages do_try_to_free_pages shrink_zones shrink_node mem_cgroup_iter() if (!root) root = root_mem_cgroup; ... mz = mem_cgroup_nodeinfo(root, reclaim->pgdat->node_id); iter = &mz->iter[reclaim->priority]; pos = READ_ONCE(iter->position); css_tryget(&pos->css) <- use after free To avoid this, we should also invalidate root_mem_cgroup.nodeinfo.iter in invalidate_reclaim_iterators(). [cai@lca.pw: fix -Wparentheses compilation warning] Link: http://lkml.kernel.org/r/1564580753-17531-1-git-send-email-cai@lca.pw Link: http://lkml.kernel.org/r/20190730015729.4406-1-miles.chen@mediatek.com Fixes: 5ac8fb31ad2e ("mm: memcontrol: convert reclaim iterator to simple css refcounting") Signed-off-by: Miles Chen Signed-off-by: Qian Cai Acked-by: Michal Hocko Cc: Johannes Weiner Cc: Vladimir Davydov Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit b997052bc3ac444a0bceab1093aff7ae71ed419e Author: Henry Burns Date: Tue Aug 13 15:37:25 2019 -0700 mm/z3fold.c: fix z3fold_destroy_pool() race condition The constraint from the zpool use of z3fold_destroy_pool() is there are no outstanding handles to memory (so no active allocations), but it is possible for there to be outstanding work on either of the two wqs in the pool. Calling z3fold_deregister_migration() before the workqueues are drained means that there can be allocated pages referencing a freed inode, causing any thread in compaction to be able to trip over the bad pointer in PageMovable(). Link: http://lkml.kernel.org/r/20190726224810.79660-2-henryburns@google.com Fixes: 1f862989b04a ("mm/z3fold.c: support page migration") Signed-off-by: Henry Burns Reviewed-by: Shakeel Butt Reviewed-by: Jonathan Adams Cc: Vitaly Vul Cc: Vitaly Wool Cc: David Howells Cc: Thomas Gleixner Cc: Al Viro Cc: Henry Burns Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 6051d3bd3b91e96c59e62b8be2dba1cc2b19ee40 Author: Henry Burns Date: Tue Aug 13 15:37:21 2019 -0700 mm/z3fold.c: fix z3fold_destroy_pool() ordering The constraint from the zpool use of z3fold_destroy_pool() is there are no outstanding handles to memory (so no active allocations), but it is possible for there to be outstanding work on either of the two wqs in the pool. If there is work queued on pool->compact_workqueue when it is called, z3fold_destroy_pool() will do: z3fold_destroy_pool() destroy_workqueue(pool->release_wq) destroy_workqueue(pool->compact_wq) drain_workqueue(pool->compact_wq) do_compact_page(zhdr) kref_put(&zhdr->refcount) __release_z3fold_page(zhdr, ...) queue_work_on(pool->release_wq, &pool->work) *BOOM* So compact_wq needs to be destroyed before release_wq. Link: http://lkml.kernel.org/r/20190726224810.79660-1-henryburns@google.com Fixes: 5d03a6613957 ("mm/z3fold.c: use kref to prevent page free/compact race") Signed-off-by: Henry Burns Reviewed-by: Shakeel Butt Reviewed-by: Jonathan Adams Cc: Vitaly Vul Cc: Vitaly Wool Cc: David Howells Cc: Thomas Gleixner Cc: Al Viro Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit a53190a4aaa36494f4d7209fd1fcc6f2ee08e0e0 Author: Yang Shi Date: Tue Aug 13 15:37:18 2019 -0700 mm: mempolicy: handle vma with unmovable pages mapped correctly in mbind When running syzkaller internally, we ran into the below bug on 4.9.x kernel: kernel BUG at mm/huge_memory.c:2124! invalid opcode: 0000 [#1] SMP KASAN CPU: 0 PID: 1518 Comm: syz-executor107 Not tainted 4.9.168+ #2 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 0.5.1 01/01/2011 task: ffff880067b34900 task.stack: ffff880068998000 RIP: split_huge_page_to_list+0x8fb/0x1030 mm/huge_memory.c:2124 Call Trace: split_huge_page include/linux/huge_mm.h:100 [inline] queue_pages_pte_range+0x7e1/0x1480 mm/mempolicy.c:538 walk_pmd_range mm/pagewalk.c:50 [inline] walk_pud_range mm/pagewalk.c:90 [inline] walk_pgd_range mm/pagewalk.c:116 [inline] __walk_page_range+0x44a/0xdb0 mm/pagewalk.c:208 walk_page_range+0x154/0x370 mm/pagewalk.c:285 queue_pages_range+0x115/0x150 mm/mempolicy.c:694 do_mbind mm/mempolicy.c:1241 [inline] SYSC_mbind+0x3c3/0x1030 mm/mempolicy.c:1370 SyS_mbind+0x46/0x60 mm/mempolicy.c:1352 do_syscall_64+0x1d2/0x600 arch/x86/entry/common.c:282 entry_SYSCALL_64_after_swapgs+0x5d/0xdb Code: c7 80 1c 02 00 e8 26 0a 76 01 <0f> 0b 48 c7 c7 40 46 45 84 e8 4c RIP [] split_huge_page_to_list+0x8fb/0x1030 mm/huge_memory.c:2124 RSP with the below test: uint64_t r[1] = {0xffffffffffffffff}; int main(void) { syscall(__NR_mmap, 0x20000000, 0x1000000, 3, 0x32, -1, 0); intptr_t res = 0; res = syscall(__NR_socket, 0x11, 3, 0x300); if (res != -1) r[0] = res; *(uint32_t*)0x20000040 = 0x10000; *(uint32_t*)0x20000044 = 1; *(uint32_t*)0x20000048 = 0xc520; *(uint32_t*)0x2000004c = 1; syscall(__NR_setsockopt, r[0], 0x107, 0xd, 0x20000040, 0x10); syscall(__NR_mmap, 0x20fed000, 0x10000, 0, 0x8811, r[0], 0); *(uint64_t*)0x20000340 = 2; syscall(__NR_mbind, 0x20ff9000, 0x4000, 0x4002, 0x20000340, 0x45d4, 3); return 0; } Actually the test does: mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 socket(AF_PACKET, SOCK_RAW, 768) = 3 setsockopt(3, SOL_PACKET, PACKET_TX_RING, {block_size=65536, block_nr=1, frame_size=50464, frame_nr=1}, 16) = 0 mmap(0x20fed000, 65536, PROT_NONE, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_DENYWRITE, 3, 0) = 0x20fed000 mbind(..., MPOL_MF_STRICT|MPOL_MF_MOVE) = 0 The setsockopt() would allocate compound pages (16 pages in this test) for packet tx ring, then the mmap() would call packet_mmap() to map the pages into the user address space specified by the mmap() call. When calling mbind(), it would scan the vma to queue the pages for migration to the new node. It would split any huge page since 4.9 doesn't support THP migration, however, the packet tx ring compound pages are not THP and even not movable. So, the above bug is triggered. However, the later kernel is not hit by this issue due to commit d44d363f6578 ("mm: don't assume anonymous pages have SwapBacked flag"), which just removes the PageSwapBacked check for a different reason. But, there is a deeper issue. According to the semantic of mbind(), it should return -EIO if MPOL_MF_MOVE or MPOL_MF_MOVE_ALL was specified and MPOL_MF_STRICT was also specified, but the kernel was unable to move all existing pages in the range. The tx ring of the packet socket is definitely not movable, however, mbind() returns success for this case. Although the most socket file associates with non-movable pages, but XDP may have movable pages from gup. So, it sounds not fine to just check the underlying file type of vma in vma_migratable(). Change migrate_page_add() to check if the page is movable or not, if it is unmovable, just return -EIO. But do not abort pte walk immediately, since there may be pages off LRU temporarily. We should migrate other pages if MPOL_MF_MOVE* is specified. Set has_unmovable flag if some paged could not be not moved, then return -EIO for mbind() eventually. With this change the above test would return -EIO as expected. [yang.shi@linux.alibaba.com: fix review comments from Vlastimil] Link: http://lkml.kernel.org/r/1563556862-54056-3-git-send-email-yang.shi@linux.alibaba.com Link: http://lkml.kernel.org/r/1561162809-59140-3-git-send-email-yang.shi@linux.alibaba.com Signed-off-by: Yang Shi Reviewed-by: Vlastimil Babka Cc: Michal Hocko Cc: Mel Gorman Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit d883544515aae54842c21730b880172e7894fde9 Author: Yang Shi Date: Tue Aug 13 15:37:15 2019 -0700 mm: mempolicy: make the behavior consistent when MPOL_MF_MOVE* and MPOL_MF_STRICT were specified When both MPOL_MF_MOVE* and MPOL_MF_STRICT was specified, mbind() should try best to migrate misplaced pages, if some of the pages could not be migrated, then return -EIO. There are three different sub-cases: 1. vma is not migratable 2. vma is migratable, but there are unmovable pages 3. vma is migratable, pages are movable, but migrate_pages() fails If #1 happens, kernel would just abort immediately, then return -EIO, after a7f40cfe3b7a ("mm: mempolicy: make mbind() return -EIO when MPOL_MF_STRICT is specified"). If #3 happens, kernel would set policy and migrate pages with best-effort, but won't rollback the migrated pages and reset the policy back. Before that commit, they behaves in the same way. It'd better to keep their behavior consistent. But, rolling back the migrated pages and resetting the policy back sounds not feasible, so just make #1 behave as same as #3. Userspace will know that not everything was successfully migrated (via -EIO), and can take whatever steps it deems necessary - attempt rollback, determine which exact page(s) are violating the policy, etc. Make queue_pages_range() return 1 to indicate there are unmovable pages or vma is not migratable. The #2 is not handled correctly in the current kernel, the following patch will fix it. [yang.shi@linux.alibaba.com: fix review comments from Vlastimil] Link: http://lkml.kernel.org/r/1563556862-54056-2-git-send-email-yang.shi@linux.alibaba.com Link: http://lkml.kernel.org/r/1561162809-59140-2-git-send-email-yang.shi@linux.alibaba.com Signed-off-by: Yang Shi Reviewed-by: Vlastimil Babka Cc: Michal Hocko Cc: Mel Gorman Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 1de13ee59225dfc98d483f8cce7d83f97c0b31de Author: Ralph Campbell Date: Tue Aug 13 15:37:11 2019 -0700 mm/hmm: fix bad subpage pointer in try_to_unmap_one When migrating an anonymous private page to a ZONE_DEVICE private page, the source page->mapping and page->index fields are copied to the destination ZONE_DEVICE struct page and the page_mapcount() is increased. This is so rmap_walk() can be used to unmap and migrate the page back to system memory. However, try_to_unmap_one() computes the subpage pointer from a swap pte which computes an invalid page pointer and a kernel panic results such as: BUG: unable to handle page fault for address: ffffea1fffffffc8 Currently, only single pages can be migrated to device private memory so no subpage computation is needed and it can be set to "page". [rcampbell@nvidia.com: add comment] Link: http://lkml.kernel.org/r/20190724232700.23327-4-rcampbell@nvidia.com Link: http://lkml.kernel.org/r/20190719192955.30462-4-rcampbell@nvidia.com Fixes: a5430dda8a3a1c ("mm/migrate: support un-addressable ZONE_DEVICE page in migration") Signed-off-by: Ralph Campbell Cc: "Jérôme Glisse" Cc: "Kirill A. Shutemov" Cc: Mike Kravetz Cc: Christoph Hellwig Cc: Jason Gunthorpe Cc: John Hubbard Cc: Andrea Arcangeli Cc: Andrey Ryabinin Cc: Christoph Lameter Cc: Dan Williams Cc: Dave Hansen Cc: Ira Weiny Cc: Jan Kara Cc: Lai Jiangshan Cc: Logan Gunthorpe Cc: Martin Schwidefsky Cc: Matthew Wilcox Cc: Mel Gorman Cc: Michal Hocko Cc: Pekka Enberg Cc: Randy Dunlap Cc: Vlastimil Babka Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 7ab0ad0e74f82db1a7e0810828785e44305cff20 Author: Ralph Campbell Date: Tue Aug 13 15:37:07 2019 -0700 mm/hmm: fix ZONE_DEVICE anon page mapping reuse When a ZONE_DEVICE private page is freed, the page->mapping field can be set. If this page is reused as an anonymous page, the previous value can prevent the page from being inserted into the CPU's anon rmap table. For example, when migrating a pte_none() page to device memory: migrate_vma(ops, vma, start, end, src, dst, private) migrate_vma_collect() src[] = MIGRATE_PFN_MIGRATE migrate_vma_prepare() /* no page to lock or isolate so OK */ migrate_vma_unmap() /* no page to unmap so OK */ ops->alloc_and_copy() /* driver allocates ZONE_DEVICE page for dst[] */ migrate_vma_pages() migrate_vma_insert_page() page_add_new_anon_rmap() __page_set_anon_rmap() /* This check sees the page's stale mapping field */ if (PageAnon(page)) return /* page->mapping is not updated */ The result is that the migration appears to succeed but a subsequent CPU fault will be unable to migrate the page back to system memory or worse. Clear the page->mapping field when freeing the ZONE_DEVICE page so stale pointer data doesn't affect future page use. Link: http://lkml.kernel.org/r/20190719192955.30462-3-rcampbell@nvidia.com Fixes: b7a523109fb5c9d2d6dd ("mm: don't clear ->mapping in hmm_devmem_free") Signed-off-by: Ralph Campbell Reviewed-by: John Hubbard Reviewed-by: Christoph Hellwig Cc: Dan Williams Cc: Jason Gunthorpe Cc: Logan Gunthorpe Cc: Ira Weiny Cc: Matthew Wilcox Cc: Mel Gorman Cc: Jan Kara Cc: "Kirill A. Shutemov" Cc: Michal Hocko Cc: Andrea Arcangeli Cc: Mike Kravetz Cc: "Jérôme Glisse" Cc: Andrey Ryabinin Cc: Christoph Lameter Cc: Dave Hansen Cc: Lai Jiangshan Cc: Martin Schwidefsky Cc: Pekka Enberg Cc: Randy Dunlap Cc: Vlastimil Babka Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 76470ccd62f18bfa0954bec10f2329339f793914 Author: Ralph Campbell Date: Tue Aug 13 15:37:04 2019 -0700 mm: document zone device struct page field usage Patch series "mm/hmm: fixes for device private page migration", v3. Testing the latest linux git tree turned up a few bugs with page migration to and from ZONE_DEVICE private and anonymous pages. Hopefully it clarifies how ZONE_DEVICE private struct page uses the same mapping and index fields from the source anonymous page mapping. This patch (of 3): Struct page for ZONE_DEVICE private pages uses the page->mapping and and page->index fields while the source anonymous pages are migrated to device private memory. This is so rmap_walk() can find the page when migrating the ZONE_DEVICE private page back to system memory. ZONE_DEVICE pmem backed fsdax pages also use the page->mapping and page->index fields when files are mapped into a process address space. Add comments to struct page and remove the unused "_zd_pad_1" field to make this more clear. Link: http://lkml.kernel.org/r/20190724232700.23327-2-rcampbell@nvidia.com Signed-off-by: Ralph Campbell Reviewed-by: John Hubbard Cc: Matthew Wilcox Cc: Vlastimil Babka Cc: Christoph Lameter Cc: Dave Hansen Cc: Jérôme Glisse Cc: "Kirill A . Shutemov" Cc: Lai Jiangshan Cc: Martin Schwidefsky Cc: Pekka Enberg Cc: Randy Dunlap Cc: Andrey Ryabinin Cc: Christoph Hellwig Cc: Jason Gunthorpe Cc: Andrew Morton Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit eb93685847a9055283d05951c1b205e737f38533 Author: Paul Walmsley Date: Wed Aug 7 19:07:34 2019 -0700 riscv: fix flush_tlb_range() end address for flush_tlb_page() The RISC-V kernel implementation of flush_tlb_page() when CONFIG_SMP is set is wrong. It passes zero to flush_tlb_range() as the final address to flush, but it should be at least 'addr'. Some other Linux architecture ports use the beginning address to flush, plus PAGE_SIZE, as the final address to flush. This might flush slightly more than what's needed, but it seems unlikely that being more clever would improve anything. So let's just take that implementation for now. While here, convert the macro into a static inline function, primarily to avoid unintentional multiple evaluations of 'addr'. This second version of the patch fixes a coding style issue found by Christoph Hellwig . Reported-by: Andreas Schwab Signed-off-by: Paul Walmsley Reviewed-by: Christoph Hellwig commit ee1c7bd33e66376067fd6306b730789ee2ae53e4 Merge: 60a8db790255 2d6c25215ab2 Author: Linus Torvalds Date: Tue Aug 13 11:46:24 2019 -0700 Merge tag 'tpmdd-next-20190813' of git://git.infradead.org/users/jjs/linux-tpmdd Pull tpm fixes from Jarkko Sakkinen: "One more bug fix for the next release" * tag 'tpmdd-next-20190813' of git://git.infradead.org/users/jjs/linux-tpmdd: KEYS: trusted: allow module init if TPM is inactive or deactivated commit 60a8db790255a6bebcdc41d97e8084a440398206 Merge: d45331b00ddb a86c71ba3022 Author: Linus Torvalds Date: Tue Aug 13 10:31:31 2019 -0700 Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull SCSI fix from James Bottomley: "Single lpfc fix, for a single-cpu corner case" * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: scsi: lpfc: Fix crash when cpu count is 1 and null irq affinity mask commit 2d6c25215ab26bb009de3575faab7b685f138e92 Author: Roberto Sassu Date: Mon Aug 5 18:44:27 2019 +0200 KEYS: trusted: allow module init if TPM is inactive or deactivated Commit c78719203fc6 ("KEYS: trusted: allow trusted.ko to initialize w/o a TPM") allows the trusted module to be loaded even if a TPM is not found, to avoid module dependency problems. However, trusted module initialization can still fail if the TPM is inactive or deactivated. tpm_get_random() returns an error. This patch removes the call to tpm_get_random() and instead extends the PCR specified by the user with zeros. The security of this alternative is equivalent to the previous one, as either option prevents with a PCR update unsealing and misuse of sealed data by a user space process. Even if a PCR is extended with zeros, instead of random data, it is still computationally infeasible to find a value as input for a new PCR extend operation, to obtain again the PCR value that would allow unsealing. Cc: stable@vger.kernel.org Fixes: 240730437deb ("KEYS: trusted: explicitly use tpm_chip structure...") Signed-off-by: Roberto Sassu Reviewed-by: Tyler Hicks Suggested-by: Mimi Zohar Reviewed-by: Jarkko Sakkinen Signed-off-by: Jarkko Sakkinen commit 2c8ccb37b08fe364f02a9914daca474d43151453 Author: Bernard Metzler Date: Fri Aug 9 17:18:16 2019 +0200 RDMA/siw: Change CQ flags from 64->32 bits This patch changes the driver/user shared (mmapped) CQ notification flags field from unsigned 64-bits size to unsigned 32-bits size. This enables building siw on 32-bit architectures. This patch changes the siw-abi, but as siw was only just merged in this merge window cycle, there are no released kernels with the prior abi. We are making no attempt to be binary compatible with siw user space libraries prior to the merge of siw into the upstream kernel, only moving forward with upstream kernels and upstream rdma-core provided siw libraries are we guaranteeing compatibility. Signed-off-by: Bernard Metzler Link: https://lore.kernel.org/r/20190809151816.13018-1-bmt@zurich.ibm.com Signed-off-by: Doug Ledford commit 656c8e9cc1badbc18eefe6ba01d33ebbcae61b9a Author: Dirk Morris Date: Thu Aug 8 13:57:51 2019 -0700 netfilter: conntrack: Use consistent ct id hash calculation Change ct id hash calculation to only use invariants. Currently the ct id hash calculation is based on some fields that can change in the lifetime on a conntrack entry in some corner cases. The current hash uses the whole tuple which contains an hlist pointer which will change when the conntrack is placed on the dying list resulting in a ct id change. This patch also removes the reply-side tuple and extension pointer from the hash calculation so that the ct id will will not change from initialization until confirmation. Fixes: 3c79107631db1f7 ("netfilter: ctnetlink: don't use conntrack/expect object addresses as id") Signed-off-by: Dirk Morris Acked-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit 190d03814eb3b49d4f87ff38fef26d36f3568a60 Author: Takashi Iwai Date: Tue Aug 13 17:39:56 2019 +0200 ALSA: hda/realtek - Add quirk for HP Envy x360 HP Envy x360 (AMD Ryzen-based model) with 103c:8497 needs the same quirk like HP Spectre x360 for enabling the mute LED over Mic3 pin. BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=204373 Cc: Signed-off-by: Takashi Iwai commit 9a67b72552f8d019948453e56ca7db8c7e5a94ba Author: Denis Efremov Date: Tue Aug 13 08:15:07 2019 -0700 MAINTAINERS: iomap: Remove fs/iomap.c record Update MAINTAINERS to reflect that fs/iomap.c file was splitted into separate files in fs/iomap/ Cc: Darrick J. Wong Cc: Christoph Hellwig Cc: linux-fsdevel@vger.kernel.org Fixes: cb7181ff4b1c ("iomap: move the main iteration code into a separate file") Signed-off-by: Denis Efremov Reviewed-by: Darrick J. Wong Signed-off-by: Darrick J. Wong commit a3384b8d9f63cc042711293bb97bdc92dca0391d Author: Benjamin Tissoires Date: Tue Aug 13 15:38:07 2019 +0200 HID: logitech-hidpp: remove support for the G700 over USB The G700 suffers from the same issue than the G502: when plugging it in, the driver tries to contact it but it fails. This timeout is problematic as it introduce a delay in the boot, and having only the mouse event node means that the hardware macros keys can not be relayed to the userspace. Link: https://github.com/libratbag/libratbag/issues/797 Fixes: 91cf9a98ae41 ("HID: logitech-hidpp: make .probe usbhid capable") Cc: stable@vger.kernel.org # v5.2 Reviewed-by: Filipe Laíns Signed-off-by: Benjamin Tissoires commit addf3382c47c033e579c9c88f18e36c4e75d806a Author: Benjamin Tissoires Date: Tue Aug 13 15:38:06 2019 +0200 Revert "HID: logitech-hidpp: add USB PID for a few more supported mice" This partially reverts commit 27fc32fd9417968a459d43d9a7c50fd423d53eb9. It turns out that the G502 has some issues with hid-logitech-hidpp: when plugging it in, the driver tries to contact it but it fails. So the driver bails out leaving only the mouse event node available. This timeout is problematic as it introduce a delay in the boot, and having only the mouse event node means that the hardware macros keys can not be relayed to the userspace. Filipe and I just gave a shot at the following devices: G403 Wireless (0xC082) G703 (0xC087) G703 Hero (0xC090) G903 (0xC086) G903 Hero (0xC091) G Pro (0xC088) Reverting the devices we are not sure that works flawlessly. Reviewed-by: Filipe Laíns Signed-off-by: Benjamin Tissoires commit 91b4db5313a2c793aabc2143efb8ed0cf0fdd097 Author: Ilya Leoshkevich Date: Mon Aug 12 18:18:07 2019 +0200 s390/bpf: use 32-bit index for tail calls "p runtime/jit: pass > 32bit index to tail_call" fails when bpf_jit_enable=1, because the tail call is not executed. This in turn is because the generated code assumes index is 64-bit, while it must be 32-bit, and as a result prog array bounds check fails, while it should pass. Even if bounds check would have passed, the code that follows uses 64-bit index to compute prog array offset. Fix by using clrj instead of clgrj for comparing index with array size, and also by using llgfr for truncating index to 32 bits before using it to compute prog array offset. Fixes: 6651ee070b31 ("s390/bpf: implement bpf_tail_call() helper") Reported-by: Yauheni Kaliuta Acked-by: Vasily Gorbik Signed-off-by: Ilya Leoshkevich Signed-off-by: Daniel Borkmann commit daa37200d48906d71c63ce178bf7d410b7e07082 Merge: d45331b00ddb eac4471d0882 Author: Jani Nikula Date: Tue Aug 13 16:26:34 2019 +0300 Merge tag 'gvt-fixes-2019-08-13' of https://github.com/intel/gvt-linux into drm-intel-fixes gvt-fixes-2019-08-13 - Fix one use-after-free error (Dan) Signed-off-by: Jani Nikula From: Zhenyu Wang Link: https://patchwork.freedesktop.org/patch/msgid/20190813095845.GF19140@zhen-hp.sh.intel.com commit 834de5c1aa768eb3d233d6544ea7153826c4b206 Author: Tudor Ambarus Date: Wed Jul 31 08:46:16 2019 +0000 mtd: spi-nor: Fix the disabling of write protection at init spi_nor_spansion_clear_sr_bp() depends on spansion_quad_enable(). While spansion_quad_enable() is selected as default when initializing the flash parameters, the nor->quad_enable() method can be overwritten later on when parsing BFPT. Select the write protection disable mechanism at spi_nor_init() time, when the nor->quad_enable() method is already known. Fixes: 191f5c2ed4b6faba ("mtd: spi-nor: use 16-bit WRR command when QE is set on spansion flashes") Signed-off-by: Tudor Ambarus Reviewed-by: Vignesh Raghavendra Signed-off-by: Richard Weinberger commit 4a65bbb9109ed7edd4b6ed7168ced48abb8561a2 Author: YueHaibing Date: Sat Apr 13 22:12:43 2019 +0800 soc: ti: pm33xx: Make two symbols static Fix sparse warnings: drivers/soc/ti/pm33xx.c:144:27: warning: symbol 'rtc_wake_src' was not declared. Should it be static? drivers/soc/ti/pm33xx.c:160:5: warning: symbol 'am33xx_rtc_only_idle' was not declared. Should it be static? Signed-off-by: YueHaibing Signed-off-by: Tony Lindgren commit ebc526233b9dd2a5aefdc012048b56f09481e460 Merge: d45331b00ddb a5580eb394c8 Author: Arnd Bergmann Date: Tue Aug 13 14:05:09 2019 +0200 Merge tag 'imx-fixes-5.3-2' of git://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux into arm/fixes i.MX fixes for 5.3, round 2: - A fix on vf610-bk4 board qspi device description to get SPI-NOR memory recognized correctly. * tag 'imx-fixes-5.3-2' of git://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux: ARM: dts: vf610-bk4: Fix qspi node description Link: https://lore.kernel.org/r/20190812160020.GA12364@X250 Signed-off-by: Arnd Bergmann commit d8e0cecbcaf09f38661bfb7da4c1e62297308672 Author: Keerthy Date: Wed Jun 26 13:20:14 2019 +0530 soc: ti: pm33xx: Fix static checker warnings The patch fixes a bunch of static checker warnings. Reported-by: Dan Carpenter Signed-off-by: Keerthy Signed-off-by: Tony Lindgren commit 5717fe5ab38f9ccb32718bcb03bea68409c9cce4 Author: Will Deacon Date: Mon Aug 12 16:02:25 2019 +0100 arm64: cpufeature: Don't treat granule sizes as strict If a CPU doesn't support the page size for which the kernel is configured, then we will complain and refuse to bring it online. For secondary CPUs (and the boot CPU on a system booting with EFI), we will also print an error identifying the mismatch. Consequently, the only time that the cpufeature code can detect a granule size mismatch is for a granule other than the one that is currently being used. Although we would rather such systems didn't exist, we've unfortunately lost that battle and Kevin reports that on his amlogic S922X (odroid-n2 board) we end up warning and taining with defconfig because 16k pages are not supported by all of the CPUs. In such a situation, we don't actually care about the feature mismatch, particularly now that KVM only exposes the sanitised view of the CPU registers (commit 93390c0a1b20 - "arm64: KVM: Hide unsupported AArch64 CPU features from guests"). Treat the granule fields as non-strict and let Kevin run without a tainted kernel. Cc: Marc Zyngier Reported-by: Kevin Hilman Tested-by: Kevin Hilman Acked-by: Mark Rutland Acked-by: Suzuki K Poulose Signed-off-by: Will Deacon [catalin.marinas@arm.com: changelog updated with KVM sanitised regs commit] Signed-off-by: Catalin Marinas commit 0c0d1ec21b2f6070e22b54b2de874f1af960ced8 Author: Gustavo A. R. Silva Date: Sun Jul 28 18:22:40 2019 -0500 ARM: OMAP: dma: Mark expected switch fall-throughs Mark switch cases where we are expecting to fall through. This patch fixes the following warnings: arch/arm/plat-omap/dma.c: In function 'omap_set_dma_src_burst_mode': arch/arm/plat-omap/dma.c:384:6: warning: this statement may fall through [-Wimplicit-fallthrough=] if (dma_omap2plus()) { ^ arch/arm/plat-omap/dma.c:393:2: note: here case OMAP_DMA_DATA_BURST_16: ^~~~ arch/arm/plat-omap/dma.c:394:6: warning: this statement may fall through [-Wimplicit-fallthrough=] if (dma_omap2plus()) { ^ arch/arm/plat-omap/dma.c:402:2: note: here default: ^~~~~~~ arch/arm/plat-omap/dma.c: In function 'omap_set_dma_dest_burst_mode': arch/arm/plat-omap/dma.c:473:6: warning: this statement may fall through [-Wimplicit-fallthrough=] if (dma_omap2plus()) { ^ arch/arm/plat-omap/dma.c:481:2: note: here default: ^~~~~~~ Notice that, in this particular case, the code comment is modified in accordance with what GCC is expecting to find. Reported-by: Stephen Rothwell Signed-off-by: Gustavo A. R. Silva Reviewed-by: Kees Cook Signed-off-by: Tony Lindgren commit 5d2fc542e8c92130b55ddeb81876ec398adf4d13 Author: Raag Jadav Date: Tue Aug 13 00:09:54 2019 +0530 regulator: act8945a-regulator: fix ldo register addresses in set_mode hook According to ACT8945A datasheet[1], operating modes for ldos are controlled by BIT(5) of their respective _CTRL registers. [1] https://active-semi.com/wp-content/uploads/ACT8945A_Datasheet.pdf Fixes: 7482d6ecc68e ("regulator: act8945a-regulator: Implement PM functionalities") Signed-off-by: Raag Jadav Link: https://lore.kernel.org/r/1565635194-5816-1-git-send-email-raagjadav@gmail.com Signed-off-by: Mark Brown commit 50e4b5cac403b9d376fe61d64fd2d41f26a194f9 Merge: 58e16d792a6a 5b63fb90adb9 Author: Tony Lindgren Date: Tue Aug 13 04:04:16 2019 -0700 Merge branch 'ti-sysc-fixes' into fixes commit 5b63fb90adb95a178ad403e1703f59bf1ff2c16b Author: Tony Lindgren Date: Tue Jul 23 00:29:23 2019 -0700 ARM: dts: Fix incomplete dts data for am3 and am4 mmc Commit 4e27f752ab8c ("ARM: OMAP2+: Drop mmc platform data for am330x and am43xx") dropped legacy mmc platform data for am3 and am4, but missed the fact that we never updated the dts files for mmc3 that is directly on l3 interconnect instead of l4 interconnect. This leads to a situation with no legacy platform data and incomplete dts data. Let's update the mmc instances on l3 interconnect to probe properly with ti-sysc interconnect target module driver to make mmc3 work again. Let's still keep legacy "ti,hwmods" property around for v5.2 kernel and only drop it later on. Note that there is no need to use property status = "disabled" for mmc3. The default for dts is enabled, and runtime PM will idle unused instances just fine. Fixes: 4e27f752ab8c ("ARM: OMAP2+: Drop mmc platform data for am330x and am43xx") Reported-by: David Lechner Tested-by: David Lechner Signed-off-by: Tony Lindgren commit 58e16d792a6a8c6b750f637a4649967fcac853dc Merge: fa8397e45c64 a304f483b6b0 Author: Tony Lindgren Date: Tue Aug 13 03:40:10 2019 -0700 Merge branch 'ti-sysc-fixes' into fixes commit a304f483b6b00d42bde41c45ca52c670945348e2 Author: Suman Anna Date: Tue Jun 25 18:33:15 2019 -0500 bus: ti-sysc: Simplify cleanup upon failures in sysc_probe() The clocks are not yet parsed and prepared until after a successful sysc_get_clocks(), so there is no need to unprepare the clocks upon any failure of any of the prior functions in sysc_probe(). The current code path would have been a no-op because of the clock validity checks within sysc_unprepare(), but let's just simplify the cleanup path by returning the error directly. While at this, also fix the cleanup path for a sysc_init_resets() failure which is executed after the clocks are prepared. Signed-off-by: Suman Anna Signed-off-by: Tony Lindgren commit fa8397e45c64e60c80373bc19ee56e42a6bed9b6 Author: Janusz Krzysztofik Date: Sun Aug 11 10:48:02 2019 +0200 ARM: OMAP1: ams-delta-fiq: Fix missing irq_ack Non-serio path of Amstrad Delta FIQ deferred handler depended on irq_ack() method provided by OMAP GPIO driver. That method has been removed by commit 693de831c6e5 ("gpio: omap: remove irq_ack method"). Remove useless code from the deferred handler and reimplement the missing operation inside the base FIQ handler. Should another dependency - irq_unmask() - be ever removed from the OMAP GPIO driver, WARN once if missing. Signed-off-by: Janusz Krzysztofik Signed-off-by: Tony Lindgren commit 07f9a8be66a9bd86f9eaedf8f8aeb416195adab8 Author: Faiz Abbas Date: Wed Aug 7 16:22:38 2019 +0530 ARM: dts: dra74x: Fix iodelay configuration for mmc3 According to the latest am572x[1] and dra74x[2] data manuals, mmc3 default, hs, sdr12 and sdr25 modes use iodelay values given in MMC3_MANUAL1. Set the MODE_SELECT bit for these so that manual mode is selected and correct iodelay values can be configured. [1] http://www.ti.com/lit/ds/symlink/am5728.pdf [2] http://www.ti.com/lit/ds/symlink/dra746.pdf Signed-off-by: Faiz Abbas Signed-off-by: Tony Lindgren commit 8613e2ca4fff764f23785eadfa54a08631ee682a Author: Emmanuel Vadot Date: Wed Jul 24 14:23:29 2019 +0200 ARM: dts: am335x: Fix UARTs length As seen on the AM335x TRM all the UARTs controller only are 0x1000 in size. Fix this in the DTS. Signed-off-by: Emmanuel Vadot Signed-off-by: Tony Lindgren commit 45da5e09dd32fa98c32eaafe2513db6bd75e2f4f Author: Tony Lindgren Date: Tue Jul 23 04:37:45 2019 -0700 ARM: OMAP2+: Fix omap4 errata warning on other SoCs We have errata i688 workaround produce warnings on SoCs other than omap4 and omap5: omap4_sram_init:Unable to allocate sram needed to handle errata I688 omap4_sram_init:Unable to get sram pool needed to handle errata I688 This is happening because there is no ti,omap4-mpu node, or no SRAM to configure for the other SoCs, so let's remove the warning based on the SoC revision checks. As nobody has complained it seems that the other SoC variants do not need this workaround. Signed-off-by: Tony Lindgren commit 7cdf6e40537f4f287c8e21b99cb4cd082a33bef0 Author: Aaron Armstrong Skomra Date: Mon Aug 12 11:55:52 2019 -0700 HID: wacom: add back changes dropped in merge commit Merge commit 74acee309fb2 ("Merge branches 'for-5.2/fixes', 'for-5.3/doc', 'for-5.3/ish', 'for-5.3/logitech' and 'for-5.3/wacom' into for-linus") inadvertently dropped this change from commit 912c6aa67ad4 ("HID: wacom: Add 2nd gen Intuos Pro Small support"). Signed-off-by: Aaron Armstrong Skomra Signed-off-by: Jiri Kosina commit 10e62b47973b0b0ceda076255bcb147b83e20517 Author: John Garry Date: Tue Jul 30 21:29:56 2019 +0800 bus: hisi_lpc: Add .remove method to avoid driver unbind crash The original driver author seemed to be under the impression that a driver cannot be removed if it does not have a .remove method. Or maybe if it is a built-in platform driver. This is not true. This crash can be created: root@ubuntu:/sys/bus/platform/drivers/hisi-lpc# echo HISI0191\:00 > unbind root@ubuntu:/sys/bus/platform/drivers/hisi-lpc# ipmitool raw 6 1 Unable to handle kernel paging request at virtual address ffff000010035010 Mem abort info: ESR = 0x96000047 Exception class = DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 Data abort info: ISV = 0, ISS = 0x00000047 CM = 0, WnR = 1 swapper pgtable: 4k pages, 48-bit VAs, pgdp=000000000118b000 [ffff000010035010] pgd=0000041ffbfff003, pud=0000041ffbffe003, pmd=0000041ffbffd003, pte=0000000000000000 Internal error: Oops: 96000047 [#1] PREEMPT SMP Modules linked in: CPU: 17 PID: 1473 Comm: ipmitool Not tainted 5.2.0-rc5-00003-gf68c53b414a3-dirty #198 Hardware name: Huawei Taishan 2280 /D05, BIOS Hisilicon D05 IT21 Nemo 2.0 RC0 04/18/2018 pstate: 20000085 (nzCv daIf -PAN -UAO) pc : hisi_lpc_target_in+0x7c/0x120 lr : hisi_lpc_target_in+0x70/0x120 sp : ffff00001efe3930 x29: ffff00001efe3930 x28: ffff841f9f599200 x27: 0000000000000002 x26: 0000000000000000 x25: 0000000000000080 x24: 00000000000000e4 x23: 0000000000000000 x22: 0000000000000064 x21: ffff801fb667d280 x20: 0000000000000001 x19: ffff00001efe39ac x18: 0000000000000000 x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000 x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000 x11: 0000000000000000 x10: 0000000000000000 x9 : 0000000000000000 x8 : ffff841febe60340 x7 : ffff801fb55c52e8 x6 : 0000000000000000 x5 : 0000000000ffc0e3 x4 : 0000000000000001 x3 : ffff801fb667d280 x2 : 0000000000000001 x1 : ffff000010035010 x0 : ffff000010035000 Call trace: hisi_lpc_target_in+0x7c/0x120 hisi_lpc_comm_in+0x88/0x98 logic_inb+0x5c/0xb8 port_inb+0x18/0x20 bt_event+0x38/0x808 smi_event_handler+0x4c/0x5a0 check_start_timer_thread.part.4+0x40/0x58 sender+0x78/0x88 smi_send.isra.6+0x94/0x108 i_ipmi_request+0x2c4/0x8f8 ipmi_request_settime+0x124/0x160 handle_send_req+0x19c/0x208 ipmi_ioctl+0x2c0/0x990 do_vfs_ioctl+0xb8/0x8f8 ksys_ioctl+0x80/0xb8 __arm64_sys_ioctl+0x1c/0x28 el0_svc_common.constprop.0+0x64/0x160 el0_svc_handler+0x28/0x78 el0_svc+0x8/0xc Code: 941d1511 aa0003f9 f94006a0 91004001 (b9000034) ---[ end trace aa842b86af7069e4 ]--- The problem here is that the host goes away but the associated logical PIO region remains registered, as do the children devices. Fix by adding a .remove method to tidy-up by removing the child devices and unregistering the logical PIO region. Cc: stable@vger.kernel.org Fixes: adf38bb0b595 ("HISI LPC: Support the LPC host on Hip06/Hip07 with DT bindings") Signed-off-by: John Garry Signed-off-by: Wei Xu commit 1b15a5632a809ab57d403fd972ca68785363b654 Author: John Garry Date: Tue Jul 30 21:29:55 2019 +0800 bus: hisi_lpc: Unregister logical PIO range to avoid potential use-after-free If, after registering a logical PIO range, the driver probe later fails, the logical PIO range memory will be released automatically. This causes an issue, in that the logical PIO range is not unregistered and the released range memory may be later referenced. Fix by unregistering the logical PIO range. And since we now unregister the logical PIO range for probe failure, avoid the special ordering of setting logical PIO range ops, which was the previous (poor) attempt at a safeguard against this. Cc: stable@vger.kernel.org Fixes: adf38bb0b595 ("HISI LPC: Support the LPC host on Hip06/Hip07 with DT bindings") Signed-off-by: John Garry Signed-off-by: Wei Xu commit b884e2de2afc68ce30f7093747378ef972dde253 Author: John Garry Date: Tue Jul 30 21:29:54 2019 +0800 lib: logic_pio: Add logic_pio_unregister_range() Add a function to unregister a logical PIO range. Logical PIO space can still be leaked when unregistering certain LOGIC_PIO_CPU_MMIO regions, but this acceptable for now since there are no callers to unregister LOGIC_PIO_CPU_MMIO regions, and the logical PIO region allocation scheme would need significant work to improve this. Cc: stable@vger.kernel.org Signed-off-by: John Garry Signed-off-by: Wei Xu commit 0a27142bd1ee259e24a0be2b0133e5ca5df8da91 Author: John Garry Date: Tue Jul 30 21:29:53 2019 +0800 lib: logic_pio: Avoid possible overlap for unregistering regions The code was originally written to not support unregistering logical PIO regions. To accommodate supporting unregistering logical PIO regions, subtly modify LOGIC_PIO_CPU_MMIO region registration code, such that the "end" of the registered regions is the "end" of the last region, and not the sum of the sizes of all the registered regions. Cc: stable@vger.kernel.org Signed-off-by: John Garry Signed-off-by: Wei Xu commit 06709e81c668f5f56c65b806895b278517bd44e0 Author: John Garry Date: Tue Jul 30 21:29:52 2019 +0800 lib: logic_pio: Fix RCU usage The traversing of io_range_list with list_for_each_entry_rcu() is not properly protected by rcu_read_lock() and rcu_read_unlock(), so add them. These functions mark the critical section scope where the list is protected for the reader, it cannot be "reclaimed". Any updater - in this case, the logical PIO registration functions - cannot update the list until the reader exits this critical section. In addition, the list traversing used in logic_pio_register_range() does not need to use the rcu variant. This is because we are already using io_range_mutex to guarantee mutual exclusion from mutating the list. Cc: stable@vger.kernel.org Fixes: 031e3601869c ("lib: Add generic PIO mapping method") Signed-off-by: John Garry Signed-off-by: Wei Xu commit 31ec0dd38085aaeb75ab04211bf3b51ad917c9b4 Author: Alex Deucher Date: Thu Aug 8 00:29:23 2019 -0500 drm/amd/display: use kvmalloc for dc_state (v2) It's large and doesn't need contiguous memory. Fixes allocation failures in some cases. v2: kvfree the memory. Reviewed-by: Andrey Grodzovsky Signed-off-by: Alex Deucher commit 17b6d2d528542bc60ad400add35728b2259b3cc1 Author: Pierre-Eric Pelloux-Prayer Date: Tue Aug 6 18:27:26 2019 +0200 drm/amdgpu: fix gfx9 soft recovery The SOC15_REG_OFFSET() macro wasn't used, making the soft recovery fail. v2: use WREG32_SOC15 instead of WREG32 + SOC15_REG_OFFSET Signed-off-by: Pierre-Eric Pelloux-Prayer Reviewed-by: Alex Deucher Reviewed-by: Christian König Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit fd295733e702a63c189fea8294c12e04b5e5ecc0 Author: Sven Van Asbroeck Date: Thu Jul 18 16:14:53 2019 -0400 dt-bindings: fec: explicitly mark deprecated properties fec's gpio phy reset properties have been deprecated. Update the dt-bindings documentation to explicitly mark them as such, and provide a short description of the recommended alternative. Signed-off-by: Sven Van Asbroeck Signed-off-by: Rob Herring commit 60d437bbff358748fcfc3bce5f08da9a6b3761da Author: Nishka Dasgupta Date: Tue Jul 16 11:13:30 2019 +0530 of: resolver: Add of_node_put() before return and break Each iteration of for_each_child_of_node puts the previous node, but in the case of a return or break from the middle of the loop, there is no put, thus causing a memory leak. Hence add an of_node_put before the return or break in three places. Issue found with Coccinelle. Signed-off-by: Nishka Dasgupta Signed-off-by: Rob Herring commit cd8869f4cb257f22b89495ca40f5281e58ba359c Author: Max Filippov Date: Mon Aug 12 15:01:30 2019 -0700 xtensa: add missing isync to the cpu_reset TLB code ITLB entry modifications must be followed by the isync instruction before the new entries are possibly used. cpu_reset lacks one isync between ITLB way 6 initialization and jump to the identity mapping. Add missing isync to xtensa cpu_reset. Cc: stable@vger.kernel.org Signed-off-by: Max Filippov commit bb0ce4c1517d299d1a38075ecded62a5a5342c6b Author: André Draszik Date: Fri Aug 9 12:20:25 2019 +0100 net: phy: at803x: stop switching phy delay config needlessly This driver does a funny dance disabling and re-enabling RX and/or TX delays. In any of the RGMII-ID modes, it first disables the delays, just to re-enable them again right away. This looks like a needless exercise. Just enable the respective delays when in any of the relevant 'id' modes, and disable them otherwise. Also, remove comments which don't add anything that can't be seen by looking at the code. Signed-off-by: André Draszik CC: Andrew Lunn CC: Florian Fainelli CC: Heiner Kallweit CC: "David S. Miller" CC: netdev@vger.kernel.org Signed-off-by: David S. Miller commit 48b30e10bfc20ec6195642cc09ea6f08a8015df7 Merge: 8e2a589a3fc3 b9ddd5091160 Author: Greg Kroah-Hartman Date: Mon Aug 12 22:47:59 2019 +0200 Merge tag 'iio-fixes-for-5.3b' of git://git.kernel.org/pub/scm/linux/kernel/git/jic23/iio into staging-linus Jonathan writes: Second set of IIO fix for the 5.3 cycle. * adf4371 - Calculation of the value to program to control the output frequency was incorrect. * max9611 - Fix temperature reading in probe. A recent fix for a wrong mask meant this code was looked at afresh. A second bug became obvious in which the return value was used inplace of the desired register value. This had no visible effect other than a communication test not actually testing the communications. * tag 'iio-fixes-for-5.3b' of git://git.kernel.org/pub/scm/linux/kernel/git/jic23/iio: iio: adc: max9611: Fix temperature reading in probe iio: frequency: adf4371: Fix output frequency setting commit 303911cfc5b95d33687d9046133ff184cf5043ff Author: Alan Stern Date: Mon Aug 12 16:11:07 2019 -0400 USB: core: Fix races in character device registration and deregistraion The syzbot fuzzer has found two (!) races in the USB character device registration and deregistration routines. This patch fixes the races. The first race results from the fact that usb_deregister_dev() sets usb_minors[intf->minor] to NULL before calling device_destroy() on the class device. This leaves a window during which another thread can allocate the same minor number but will encounter a duplicate name error when it tries to register its own class device. A typical error message in the system log would look like: sysfs: cannot create duplicate filename '/class/usbmisc/ldusb0' The patch fixes this race by destroying the class device first. The second race is in usb_register_dev(). When that routine runs, it first allocates a minor number, then drops minor_rwsem, and then creates the class device. If the device creation fails, the minor number is deallocated and the whole routine returns an error. But during the time while minor_rwsem was dropped, there is a window in which the minor number is allocated and so another thread can successfully open the device file. Typically this results in use-after-free errors or invalid accesses when the other thread closes its open file reference, because the kernel then tries to release resources that were already deallocated when usb_register_dev() failed. The patch fixes this race by keeping minor_rwsem locked throughout the entire routine. Reported-and-tested-by: syzbot+30cf45ebfe0b0c4847a1@syzkaller.appspotmail.com Signed-off-by: Alan Stern CC: Link: https://lore.kernel.org/r/Pine.LNX.4.44L0.1908121607590.1659-100000@iolanthe.rowland.org Signed-off-by: Greg Kroah-Hartman commit 91be2587e82a0f16348fd8f12a57e4c328baffc7 Author: Thomas Gleixner Date: Mon Aug 12 20:16:17 2019 +0200 x86/fpu/math-emu: Address fallthrough warnings /home/tglx/work/kernel/linus/linux/arch/x86/math-emu/errors.c: In function ‘FPU_printall’: /home/tglx/work/kernel/linus/linux/arch/x86/math-emu/errors.c:187:9: warning: this statement may fall through [-Wimplicit-fallthrough=] tagi = FPU_Special(r); ~~~~~^~~~~~~~~~~~~~~~ /home/tglx/work/kernel/linus/linux/arch/x86/math-emu/errors.c:188:3: note: here case TAG_Valid: ^~~~ /home/tglx/work/kernel/linus/linux/arch/x86/math-emu/fpu_trig.c: In function ‘fyl2xp1’: /home/tglx/work/kernel/linus/linux/arch/x86/math-emu/fpu_trig.c:1353:7: warning: this statement may fall through [-Wimplicit-fallthrough=] if (denormal_operand() < 0) ^ /home/tglx/work/kernel/linus/linux/arch/x86/math-emu/fpu_trig.c:1356:3: note: here case TAG_Zero: Remove the pointless 'break;' after 'continue;' while at it. Signed-off-by: Thomas Gleixner commit 5785675dfef4f9edcee66edef7b3af21618d2707 Author: Borislav Petkov Date: Sun Aug 11 17:40:36 2019 +0200 x86/apic/32: Fix yet another implicit fallthrough warning Fix arch/x86/kernel/apic/probe_32.c: In function ‘default_setup_apic_routing’: arch/x86/kernel/apic/probe_32.c:146:7: warning: this statement may fall through [-Wimplicit-fallthrough=] if (!APIC_XAPIC(version)) { ^ arch/x86/kernel/apic/probe_32.c:151:3: note: here case X86_VENDOR_HYGON: ^~~~ for 32-bit builds. Signed-off-by: Borislav Petkov Signed-off-by: Thomas Gleixner Link: https://lkml.kernel.org/r/20190811154036.29805-1-bp@alien8.de commit 12072a68961af20e84ddb4aba2387ba5f70e8c14 Author: Balakrishna Godavarthi Date: Thu Aug 8 14:26:08 2019 +0530 Bluetooth: btqca: Reset download type to default This patch will reset the download flag to default value before retrieving the download mode type. Fixes: 32646db8cc28 ("Bluetooth: btqca: inject command complete event during fw download") Signed-off-by: Balakrishna Godavarthi Tested-by: Claire Chang Reviewed-by: Claire Chang Signed-off-by: Marcel Holtmann commit c7c5ae2902bf8fe9acc75f798c0de75ac9295ccf Author: Claire Chang Date: Tue Aug 6 17:56:29 2019 +0800 Bluetooth: btqca: release_firmware after qca_inject_cmd_complete_event commit 32646db8cc28 ("Bluetooth: btqca: inject command complete event during fw download") added qca_inject_cmd_complete_event() for certain qualcomm chips. However, qca_download_firmware() will return without calling release_firmware() in this case. This leads to a memory leak like the following found by kmemleak: unreferenced object 0xfffffff3868a5880 (size 128): comm "kworker/u17:5", pid 347, jiffies 4294676481 (age 312.157s) hex dump (first 32 bytes): ac fd 00 00 00 00 00 00 00 d0 7e 17 80 ff ff ff ..........~..... 00 00 00 00 00 00 00 00 00 59 8a 86 f3 ff ff ff .........Y...... backtrace: [<00000000978ce31d>] kmem_cache_alloc_trace+0x194/0x298 [<000000006ea0398c>] _request_firmware+0x74/0x4e4 [<000000004da31ca0>] request_firmware+0x44/0x64 [<0000000094572996>] qca_download_firmware+0x74/0x6e4 [btqca] [<00000000b24d615a>] qca_uart_setup+0xc0/0x2b0 [btqca] [<00000000364a6d5a>] qca_setup+0x204/0x570 [hci_uart] [<000000006be1a544>] hci_uart_setup+0xa8/0x148 [hci_uart] [<00000000d64c0f4f>] hci_dev_do_open+0x144/0x530 [bluetooth] [<00000000f69f5110>] hci_power_on+0x84/0x288 [bluetooth] [<00000000d4151583>] process_one_work+0x210/0x420 [<000000003cf3dcfb>] worker_thread+0x2c4/0x3e4 [<000000007ccaf055>] kthread+0x124/0x134 [<00000000bef1f723>] ret_from_fork+0x10/0x18 [<00000000c36ee3dd>] 0xffffffffffffffff unreferenced object 0xfffffff37b16de00 (size 128): comm "kworker/u17:5", pid 347, jiffies 4294676873 (age 311.766s) hex dump (first 32 bytes): da 07 00 00 00 00 00 00 00 50 ff 0b 80 ff ff ff .........P...... 00 00 00 00 00 00 00 00 00 dd 16 7b f3 ff ff ff ...........{.... backtrace: [<00000000978ce31d>] kmem_cache_alloc_trace+0x194/0x298 [<000000006ea0398c>] _request_firmware+0x74/0x4e4 [<000000004da31ca0>] request_firmware+0x44/0x64 [<0000000094572996>] qca_download_firmware+0x74/0x6e4 [btqca] [<000000000cde20a9>] qca_uart_setup+0x144/0x2b0 [btqca] [<00000000364a6d5a>] qca_setup+0x204/0x570 [hci_uart] [<000000006be1a544>] hci_uart_setup+0xa8/0x148 [hci_uart] [<00000000d64c0f4f>] hci_dev_do_open+0x144/0x530 [bluetooth] [<00000000f69f5110>] hci_power_on+0x84/0x288 [bluetooth] [<00000000d4151583>] process_one_work+0x210/0x420 [<000000003cf3dcfb>] worker_thread+0x2c4/0x3e4 [<000000007ccaf055>] kthread+0x124/0x134 [<00000000bef1f723>] ret_from_fork+0x10/0x18 [<00000000c36ee3dd>] 0xffffffffffffffff Make sure release_firmware() is called aftre qca_inject_cmd_complete_event() to avoid the memory leak. Fixes: 32646db8cc28 ("Bluetooth: btqca: inject command complete event during fw download") Signed-off-by: Claire Chang Reviewed-by: Balakrishna Godavarthi Signed-off-by: Marcel Holtmann commit 8612de3f7ba6e900465e340516b8313806d27b2d Author: Darrick J. Wong Date: Sun Aug 11 15:52:27 2019 -0700 xfs: don't crash on null attr fork xfs_bmapi_read Zorro Lang reported a crash in generic/475 if we try to inactivate a corrupt inode with a NULL attr fork (stack trace shortened somewhat): RIP: 0010:xfs_bmapi_read+0x311/0xb00 [xfs] RSP: 0018:ffff888047f9ed68 EFLAGS: 00010202 RAX: dffffc0000000000 RBX: ffff888047f9f038 RCX: 1ffffffff5f99f51 RDX: 0000000000000002 RSI: 0000000000000008 RDI: 0000000000000012 RBP: ffff888002a41f00 R08: ffffed10005483f0 R09: ffffed10005483ef R10: ffffed10005483ef R11: ffff888002a41f7f R12: 0000000000000004 R13: ffffe8fff53b5768 R14: 0000000000000005 R15: 0000000000000001 FS: 00007f11d44b5b80(0000) GS:ffff888114200000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000ef6000 CR3: 000000002e176003 CR4: 00000000001606e0 Call Trace: xfs_dabuf_map.constprop.18+0x696/0xe50 [xfs] xfs_da_read_buf+0xf5/0x2c0 [xfs] xfs_da3_node_read+0x1d/0x230 [xfs] xfs_attr_inactive+0x3cc/0x5e0 [xfs] xfs_inactive+0x4c8/0x5b0 [xfs] xfs_fs_destroy_inode+0x31b/0x8e0 [xfs] destroy_inode+0xbc/0x190 xfs_bulkstat_one_int+0xa8c/0x1200 [xfs] xfs_bulkstat_one+0x16/0x20 [xfs] xfs_bulkstat+0x6fa/0xf20 [xfs] xfs_ioc_bulkstat+0x182/0x2b0 [xfs] xfs_file_ioctl+0xee0/0x12a0 [xfs] do_vfs_ioctl+0x193/0x1000 ksys_ioctl+0x60/0x90 __x64_sys_ioctl+0x6f/0xb0 do_syscall_64+0x9f/0x4d0 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x7f11d39a3e5b The "obvious" cause is that the attr ifork is null despite the inode claiming an attr fork having at least one extent, but it's not so obvious why we ended up with an inode in that state. Reported-by: Zorro Lang Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=204031 Signed-off-by: Darrick J. Wong Reviewed-by: Bill O'Donnell commit 858b44dc62a1018312fd9cbd15db24237a897e0e Author: Darrick J. Wong Date: Sun Aug 11 15:52:26 2019 -0700 xfs: remove more ondisk directory corruption asserts Continue our game of replacing ASSERTs for corrupt ondisk metadata with EFSCORRUPTED returns. Signed-off-by: Darrick J. Wong Reviewed-by: Bill O'Donnell commit 48d9cc9d85dde37c87abb7ac9bbec6598ba44b56 Author: Fabian Henneke Date: Mon Jul 15 19:40:56 2019 +0200 Bluetooth: hidp: Let hidp_send_message return number of queued bytes Let hidp_send_message return the number of successfully queued bytes instead of an unconditional 0. With the return value fixed to 0, other drivers relying on hidp, such as hidraw, can not return meaningful values from their respective implementations of write(). In particular, with the current behavior, a hidraw device's write() will have different return values depending on whether the device is connected via USB or Bluetooth, which makes it harder to abstract away the transport layer. Signed-off-by: Fabian Henneke Signed-off-by: Marcel Holtmann commit a2780889e247561744dd8efbd3478a1999b72ae3 Author: Harish Bandi Date: Fri Jul 12 10:39:40 2019 +0530 Bluetooth: hci_qca: Send VS pre shutdown command. WCN399x chips are coex chips, it needs a VS pre shutdown command while turning off the BT. So that chip can inform BT is OFF to other active clients. Signed-off-by: Harish Bandi Signed-off-by: Marcel Holtmann commit 2fde6afb8c7fce8e679c1072891cd31d54af5b83 Author: Matthias Kaehlcke Date: Mon Jul 8 14:57:42 2019 -0700 Bluetooth: btqca: Use correct byte format for opcode of injected command The opcode of the command injected by commit 32646db8cc28 ("Bluetooth: btqca: inject command complete event during fw download") uses the CPU byte format, however it should always be little endian. In practice it shouldn't really matter, since all we need is an opcode != 0, but still let's do things correctly and keep sparse happy. Fixes: 32646db8cc28 ("Bluetooth: btqca: inject command complete event during fw download") Reported-by: kbuild test robot Signed-off-by: Matthias Kaehlcke Signed-off-by: Marcel Holtmann commit 4974c839d45e2ac89ce0e82b49d548cc12e02a9c Author: Wei Yongjun Date: Tue Jul 9 01:35:30 2019 +0000 Bluetooth: hci_qca: Use kfree_skb() instead of kfree() Use kfree_skb() instead of kfree() to free sk_buff. Fixes: 2faa3f15fa2f ("Bluetooth: hci_qca: wcn3990: Drop baudrate change vendor event") Signed-off-by: Wei Yongjun Reviewed-by: Matthias Kaehlcke Signed-off-by: Marcel Holtmann commit 8059ba0bd0e4694e51c2ee6438a77b325f06c0d5 Author: Matthias Kaehlcke Date: Tue Jul 9 15:44:50 2019 -0700 Bluetooth: btqca: Add a short delay before downloading the NVM On WCN3990 downloading the NVM sometimes fails with a "TLV response size mismatch" error: [ 174.949955] Bluetooth: btqca.c:qca_download_firmware() hci0: QCA Downloading qca/crnv21.bin [ 174.958718] Bluetooth: btqca.c:qca_tlv_send_segment() hci0: QCA TLV response size mismatch It seems the controller needs a short time after downloading the firmware before it is ready for the NVM. A delay as short as 1 ms seems sufficient, make it 10 ms just in case. No event is received during the delay, hence we don't just silently drop an extra event. Signed-off-by: Matthias Kaehlcke Signed-off-by: Marcel Holtmann commit 5ee6310fb163ba7c66718905d4a19f1e71e641e0 Author: Wei Yongjun Date: Wed Jul 10 06:12:22 2019 +0000 Bluetooth: btusb: Fix error return code in btusb_mtk_setup_firmware() Fix to return error code -EINVAL from the error handling case instead of 0, as done elsewhere in this function. Fixes: a1c49c434e15 ("Bluetooth: btusb: Add protocol support for MediaTek MT7668U USB devices") Signed-off-by: Wei Yongjun Signed-off-by: Marcel Holtmann commit bb2d267c448f4bc3a3389d97c56391cb779178ae Author: Ilya Leoshkevich Date: Mon Aug 12 17:03:32 2019 +0200 s390/bpf: fix lcgr instruction encoding "masking, test in bounds 3" fails on s390, because BPF_ALU64_IMM(BPF_NEG, BPF_REG_2, 0) ignores the top 32 bits of BPF_REG_2. The reason is that JIT emits lcgfr instead of lcgr. The associated comment indicates that the code was intended to emit lcgr in the first place, it's just that the wrong opcode was used. Fix by using the correct opcode. Fixes: 054623105728 ("s390/bpf: Add s390x eBPF JIT compiler backend") Signed-off-by: Ilya Leoshkevich Acked-by: Vasily Gorbik Signed-off-by: Daniel Borkmann commit 932727c55653c1d7838d0ecd0cdce4393be156e0 Author: Dan Carpenter Date: Fri Aug 9 13:13:19 2019 +0300 RDMA/core: Fix error code in stat_get_doit_qp() We need to set the error codes on these paths. Currently the only possible error code is -EMSGSIZE so that's what the patch uses. Fixes: 83c2c1fcbd08 ("RDMA/nldev: Allow get counter mode through RDMA netlink") Signed-off-by: Dan Carpenter Reviewed-by: Leon Romanovsky Link: https://lore.kernel.org/r/20190809101311.GA17867@mwanda Signed-off-by: Doug Ledford commit 17c19287ecf54fb55f155902dcd39c62a9547c4e Author: Dan Carpenter Date: Fri Aug 9 17:09:04 2019 +0300 RDMA/siw: Fix a memory leak in siw_init_cpulist() The error handling code doesn't free siw_cpu_info.tx_valid_cpus[0]. The first iteration through the loop is a no-op so this is sort of an off by one bug. Also Bernard pointed out that we can remove the NULL assignment and simplify the code a bit. Fixes: bdcf26bf9b3a ("rdma/siw: network and RDMA core interface") Signed-off-by: Dan Carpenter Reviewed-by: Bernard Metzler Reviewed-by: Bernard Metzler Link: https://lore.kernel.org/r/20190809140904.GB3552@mwanda Signed-off-by: Doug Ledford commit 7ea33253e910647876c9ccab720b662ae240a157 Merge: d45331b00ddb b421d83a3947 Author: Greg Kroah-Hartman Date: Mon Aug 12 16:51:07 2019 +0200 Merge tag 'misc-habanalabs-fixes-2019-08-12' of git://people.freedesktop.org/~gabbayo/linux into char-misc-next Oded writes: This tag contains a couple of important fixes: - Four fixes when running on s390 architecture (BE). With these fixes, the driver is fully functional on Big-endian architectures. The fixes include: - Validation/Patching of user packets - Completion queue handling - Internal H/W queues submission - Device IRQ unmasking operation - Fix to double free in an error path to avoid kernel corruption - Fix to DRAM usage accounting when a user process is terminated forcefully. * tag 'misc-habanalabs-fixes-2019-08-12' of git://people.freedesktop.org/~gabbayo/linux: habanalabs: fix device IRQ unmasking for BE host habanalabs: fix endianness handling for internal QMAN submission habanalabs: fix completion queue handling when host is BE habanalabs: fix endianness handling for packets from user habanalabs: fix DRAM usage accounting on context tear down habanalabs: Avoid double free in error flow commit e9eec6a55c95fb918036bfe29c26a535dca1ad49 Author: Yishai Hadas Date: Thu Aug 8 11:15:38 2019 +0300 IB/mlx5: Fix use-after-free error while accessing ev_file pointer Call to uverbs_close_fd() releases file pointer to 'ev_file' and mlx5_ib_dev is going to be inaccessible. Cache pointer prior cleaning resources to solve the KASAN warning below. BUG: KASAN: use-after-free in devx_async_event_close+0x391/0x480 [mlx5_ib] Read of size 8 at addr ffff888301e3cec0 by task devx_direct_tes/4631 CPU: 1 PID: 4631 Comm: devx_direct_tes Tainted: G OE 5.3.0-rc1-for-upstream-dbg-2019-07-26_01-19-56-93 #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu2 04/01/2014 Call Trace: dump_stack+0x9a/0xeb print_address_description+0x1e2/0x400 ? devx_async_event_close+0x391/0x480 [mlx5_ib] __kasan_report+0x15c/0x1df ? devx_async_event_close+0x391/0x480 [mlx5_ib] kasan_report+0xe/0x20 devx_async_event_close+0x391/0x480 [mlx5_ib] __fput+0x26a/0x7b0 task_work_run+0x10d/0x180 exit_to_usermode_loop+0x137/0x160 do_syscall_64+0x3c7/0x490 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x7f5df907d664 Code: 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b7 0f 1f 80 00 00 00 00 8b 05 6a cd 20 00 48 63 ff 85 c0 75 13 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 44 f3 c3 66 90 48 83 ec 18 48 89 7c 24 08 e8 RSP: 002b:00007ffd353cb958 EFLAGS: 00000246 ORIG_RAX: 0000000000000003 RAX: 0000000000000000 RBX: 000056017a88c348 RCX: 00007f5df907d664 RDX: 00007f5df969d400 RSI: 00007f5de8f1ec90 RDI: 0000000000000006 RBP: 00007f5df9681dc0 R08: 00007f5de8736410 R09: 000056017a9d2dd0 R10: 000000000000000b R11: 0000000000000246 R12: 00007f5de899d7d0 R13: 00007f5df96c4248 R14: 00007f5de8f1ecb0 R15: 000056017ae41308 Allocated by task 4631: save_stack+0x19/0x80 kasan_kmalloc.constprop.3+0xa0/0xd0 alloc_uobj+0x71/0x230 [ib_uverbs] alloc_begin_fd_uobject+0x2e/0xc0 [ib_uverbs] rdma_alloc_begin_uobject+0x96/0x140 [ib_uverbs] ib_uverbs_run_method+0xdf0/0x1940 [ib_uverbs] ib_uverbs_cmd_verbs+0x57e/0xdb0 [ib_uverbs] ib_uverbs_ioctl+0x177/0x260 [ib_uverbs] do_vfs_ioctl+0x18f/0x1010 ksys_ioctl+0x70/0x80 __x64_sys_ioctl+0x6f/0xb0 do_syscall_64+0x95/0x490 entry_SYSCALL_64_after_hwframe+0x49/0xbe Freed by task 4631: save_stack+0x19/0x80 __kasan_slab_free+0x11d/0x160 slab_free_freelist_hook+0x67/0x1a0 kfree+0xb9/0x2a0 uverbs_close_fd+0x118/0x1c0 [ib_uverbs] devx_async_event_close+0x28a/0x480 [mlx5_ib] __fput+0x26a/0x7b0 task_work_run+0x10d/0x180 exit_to_usermode_loop+0x137/0x160 do_syscall_64+0x3c7/0x490 entry_SYSCALL_64_after_hwframe+0x49/0xbe The buggy address belongs to the object at ffff888301e3cda8 which belongs to the cache kmalloc-512 of size 512 The buggy address is located 280 bytes inside of 512-byte region [ffff888301e3cda8, ffff888301e3cfa8) The buggy address belongs to the page: page:ffffea000c078e00 refcount:1 mapcount:0 mapping:ffff888352811300 index:0x0 compound_mapcount: 0 flags: 0x2fffff80010200(slab|head) raw: 002fffff80010200 ffffea000d152608 ffffea000c077808 ffff888352811300 raw: 0000000000000000 0000000000250025 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff888301e3cd80: fc fc fc fc fc fb fb fb fb fb fb fb fb fb fb fb ffff888301e3ce00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff888301e3ce80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff888301e3cf00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff888301e3cf80: fb fb fb fb fb fc fc fc fc fc fc fc fc fc fc fc Disabling lock debugging due to kernel taint Cc: # 5.2 Fixes: 759738537142 ("IB/mlx5: Enable subscription for device events over DEVX") Signed-off-by: Yishai Hadas Signed-off-by: Leon Romanovsky Reviewed-by: Jason Gunthorpe Link: https://lore.kernel.org/r/20190808081538.28772-1-leon@kernel.org Signed-off-by: Doug Ledford commit 8e2a589a3fc36ce858d42e767c3bcd8fc62a512b Author: Ian Abbott Date: Mon Aug 12 13:08:14 2019 +0100 staging: comedi: dt3000: Fix rounding up of timer divisor `dt3k_ns_to_timer()` determines the prescaler and divisor to use to produce a desired timing period. It is influenced by a rounding mode and can round the divisor up, down, or to the nearest value. However, the code for rounding up currently does the same as rounding down! Fix ir by using the `DIV_ROUND_UP()` macro to calculate the divisor when rounding up. Also, change the types of the `divider`, `base` and `prescale` variables from `int` to `unsigned int` to avoid mixing signed and unsigned types in the calculations. Also fix a typo in a nearby comment: "improvment" => "improvement". Signed-off-by: Ian Abbott Cc: stable Link: https://lore.kernel.org/r/20190812120814.21188-1-abbotti@mev.co.uk Signed-off-by: Greg Kroah-Hartman commit b4d98bc3fc93ec3a58459948a2c0e0c9b501cd88 Author: Ian Abbott Date: Mon Aug 12 12:15:17 2019 +0100 staging: comedi: dt3000: Fix signed integer overflow 'divider * base' In `dt3k_ns_to_timer()` the following lines near the end of the function result in a signed integer overflow: prescale = 15; base = timer_base * (1 << prescale); divider = 65535; *nanosec = divider * base; (`divider`, `base` and `prescale` are type `int`, `timer_base` and `*nanosec` are type `unsigned int`. The value of `timer_base` will be either 50 or 100.) The main reason for the overflow is that the calculation for `base` is completely wrong. It should be: base = timer_base * (prescale + 1); which matches an earlier instance of this calculation in the same function. Reported-by: David Binderman Cc: Signed-off-by: Ian Abbott Link: https://lore.kernel.org/r/20190812111517.26803-1-abbotti@mev.co.uk Signed-off-by: Greg Kroah-Hartman commit ae78ca3cf3d9e9f914bfcd0bc5c389ff18b9c2e0 Author: Wenwen Wang Date: Sun Aug 11 12:23:22 2019 -0500 xen/blkback: fix memory leaks In read_per_ring_refs(), after 'req' and related memory regions are allocated, xen_blkif_map() is invoked to map the shared frame, irq, and etc. However, if this mapping process fails, no cleanup is performed, leading to memory leaks. To fix this issue, invoke the cleanup before returning the error. Acked-by: Roger Pau Monné Reviewed-by: Boris Ostrovsky Signed-off-by: Wenwen Wang Signed-off-by: Jens Axboe commit e26cc08265dda37d2acc8394604f220ef412299d Author: zhengbin Date: Mon Aug 12 20:36:55 2019 +0800 blk-mq: move cancel of requeue_work to the front of blk_exit_queue blk_exit_queue will free elevator_data, while blk_mq_requeue_work will access it. Move cancel of requeue_work to the front of blk_exit_queue to avoid use-after-free. blk_exit_queue blk_mq_requeue_work __elevator_exit blk_mq_run_hw_queues blk_mq_exit_sched blk_mq_run_hw_queue dd_exit_queue blk_mq_hctx_has_pending kfree(elevator_data) blk_mq_sched_has_work dd_has_work Fixes: fbc2a15e3433 ("blk-mq: move cancel of requeue_work into blk_mq_release") Cc: stable@vger.kernel.org Reviewed-by: Ming Lei Signed-off-by: zhengbin Signed-off-by: Jens Axboe commit 0cf25bc5d0816a40b464269d36b85021dd091f6d Merge: d45331b00ddb 4a56a478a525 Author: Greg Kroah-Hartman Date: Mon Aug 12 15:39:53 2019 +0200 Merge tag 'fixes-for-v5.3-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/balbi/usb into usb-linus Felipe writes: USB: fixes for v5.3-rc4 Just a three fixes this time around. A race condition on mass storage gadget between disable() and set_alt() Clear a flag that was left set upon reset or disconnect A fix for renesas_usb3 UDC's sysfs interface * tag 'fixes-for-v5.3-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/balbi/usb: usb: gadget: mass_storage: Fix races between fsg_disable and fsg_set_alt usb: gadget: composite: Clear "suspended" on reset/disconnect usb: gadget: udc: renesas_usb3: Fix sysfs interface of "role" commit 63daf4e166545363f3b875f5b81aecb46e1e1d19 Author: Tomi Valkeinen Date: Fri Aug 9 13:00:38 2019 +0300 drm/omap: ensure we have a valid dma_mask The omapdrm driver uses dma_set_coherent_mask(), but that's not enough anymore when LPAE is enabled. From Christoph Hellwig : > The traditional arm DMA code ignores, but the generic dma-direct/swiotlb > has stricter checks and thus fails mappings without a DMA mask. As we > use swiotlb for arm with LPAE now, omapdrm needs to catch up and > actually set a DMA mask. Change the dma_set_coherent_mask() call to dma_coerce_mask_and_coherent() so that the dev->dma_mask is also set. Fixes: ad3c7b18c5b3 ("arm: use swiotlb for bounce buffering on LPAE configs") Reported-by: "H. Nikolaus Schaller" Signed-off-by: Tomi Valkeinen Link: https://patchwork.freedesktop.org/patch/msgid/c219e7e6-0f66-d6fd-e0cf-59c803386825@ti.com Reviewed-by: Christoph Hellwig Reviewed-by: Peter Ujfalusi commit 181ae8844578d0a80f188c1d195fd6bb91bcec81 Merge: 8f1c748b9a77 d45331b00ddb Author: Maarten Lankhorst Date: Mon Aug 12 15:14:03 2019 +0200 Merge remote-tracking branch 'drm/drm-fixes' into drm-misc-fixes Backport requested for omap dma mask fix. I'm not sure it still requires it, but just in case. :) Signed-off-by: Maarten Lankhorst commit b9ee5e04fd77898208c51b1395fa0b5e8536f9b6 Author: Christophe Leroy Date: Thu Aug 8 12:48:26 2019 +0000 powerpc/64e: Drop stale call to smp_processor_id() which hangs SMP startup Commit ebb9d30a6a74 ("powerpc/mm: any thread in one core can be the first to setup TLB1") removed the need to know the cpu_id in early_init_this_mmu(), but the call to smp_processor_id() which was marked __maybe_used remained. Since commit ed1cd6deb013 ("powerpc: Activate CONFIG_THREAD_INFO_IN_TASK") thread_info cannot be reached before MMU is properly set up. Drop this stale call to smp_processor_id() which makes SMP hang when CONFIG_PREEMPT is set. Fixes: ebb9d30a6a74 ("powerpc/mm: any thread in one core can be the first to setup TLB1") Fixes: ed1cd6deb013 ("powerpc: Activate CONFIG_THREAD_INFO_IN_TASK") Cc: stable@vger.kernel.org # v5.1+ Reported-by: Chris Packham Signed-off-by: Christophe Leroy Tested-by: Chris Packham Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/bef479514f4c08329fa649f67735df8918bc0976.1565268248.git.christophe.leroy@c-s.fr commit e7409258845a0f64967f8377e99294d438137537 Author: Fenghua Yu Date: Fri Aug 9 18:40:37 2019 -0700 x86/umwait: Fix error handling in umwait_init() Currently, failure of cpuhp_setup_state() is ignored and the syscore ops and the control interfaces can still be added even after the failure. But, this error handling will cause a few issues: 1. The CPUs may have different values in the IA32_UMWAIT_CONTROL MSR because there is no way to roll back the control MSR on the CPUs which already set the MSR before the failure. 2. If the sysfs interface is added successfully, there will be a mismatch between the global control value and the control MSR: - The interface shows the default global control value. But, the control MSR is not set to the value because the CPU online function, which is supposed to set the MSR to the value, is not installed. - If the sysadmin changes the global control value through the interface, the control MSR on all current online CPUs is set to the new value. But, the control MSR on newly onlined CPUs after the value change will not be set to the new value due to lack of the CPU online function. 3. On resume from suspend/hibernation, the boot CPU restores the control MSR to the global control value through the syscore ops. But, the control MSR on all APs is not set due to lake of the CPU online function. To solve the issues and enforce consistent behavior on the failure of the CPU hotplug setup, make the following changes: 1. Cache the original control MSR value which is configured by hardware or BIOS before kernel boot. This value is likely to be 0. But it could be a different number as well. Cache the control MSR only once before the MSR is changed. 2. Add the CPU offline function so that the MSR is restored to the original control value on all CPUs on the failure. 3. On the failure, exit from cpumait_init() so that the syscore ops and the control interfaces are not added. Reported-by: Valdis Kletnieks Suggested-by: Thomas Gleixner Signed-off-by: Fenghua Yu Signed-off-by: Thomas Gleixner Link: https://lkml.kernel.org/r/1565401237-60936-1-git-send-email-fenghua.yu@intel.com commit cbd32a1c56e36fedaa93a727699188bd3e6e6f67 Merge: 48c7d73b2362 b61fbc887af7 Author: Thomas Gleixner Date: Mon Aug 12 14:36:27 2019 +0200 Merge tag 'efi-urgent' of git://git.kernel.org/pub/scm/linux/kernel/git/efi/efi into efi/urgent Pull a single EFI fix for v5.3 from Ard: - Fix mixed mode breakage in EFI config table handling for TPM. commit 8f1c748b9a7751ee1297b4880788a09f7c802eb4 Author: Mihail Atanassov Date: Mon Aug 5 09:56:25 2019 +0000 drm/komeda: Add support for 'memory-region' DT node property The 'memory-region' property of the komeda display driver DT binding allows the use of a 'reserved-memory' node for buffer allocations. Add the requisite of_reserved_mem_device_{init,release} calls to actually make use of the memory if present. Changes since v1: - Move handling inside komeda_parse_dt Signed-off-by: Mihail Atanassov Reviewed-by: James Qian Wang (Arm Technology China) Signed-off-by: james qian wang (Arm Technology China) Link: https://patchwork.freedesktop.org/patch/msgid/20190805095408.21285-1-mihail.atanassov@arm.com commit a9577f1921255b975da2a47d8f6733b2d6c98193 Author: Lowry Li (Arm Technology China) Date: Tue Aug 6 06:31:56 2019 +0000 drm/komeda: Adds internal bpp computing for arm afbc only format YU08 YU10 The drm_format_info doesn't have any cpp or block_size (both are zero) information for arm only afbc format YU08/YU10. we need to compute it by ourselves. Changes since v1: 1. Removed redundant warning check in komeda_get_afbc_format_bpp(); 2. Removed a redundant empty line; 3. Rebased the branch. Signed-off-by: Lowry Li (Arm Technology China) Reviewed-by: James Qian Wang (Arm Technology China) Signed-off-by: james qian wang (Arm Technology China) Link: https://patchwork.freedesktop.org/patch/msgid/1565073104-24047-1-git-send-email-lowry.li@arm.com Link: https://patchwork.freedesktop.org/patch/msgid/1565073104-24047-1-git-send-email-lowry.li@arm.com commit b61fbc887af7a13a1c90c84c1feaeb4c9780e1e2 Author: Hans de Goede Date: Wed Aug 7 23:59:03 2019 +0200 efi-stub: Fix get_efi_config_table on mixed-mode setups Fix get_efi_config_table using the wrong structs when booting a 64 bit kernel on 32 bit firmware. Fixes: 82d736ac56d7 ("Abstract out support for locating an EFI config table") Signed-off-by: Hans de Goede Acked-By: Matthew Garrett Reviewed-by: Ard Biesheuvel Acked-by: Jarkko Sakkinen Signed-off-by: Ard Biesheuvel commit 4eaefe8c621c6195c91044396ed8060c179f7aae Author: Rafael J. Wysocki Date: Thu Aug 8 23:58:38 2019 +0200 nvme-pci: Allow PCI bus-level PM to be used if ASPM is disabled One of the modifications made by commit d916b1be94b6 ("nvme-pci: use host managed power state for suspend") was adding a pci_save_state() call to nvme_suspend() so as to instruct the PCI bus type to leave devices handled by the nvme driver in D0 during suspend-to-idle. That was done with the assumption that ASPM would transition the device's PCIe link into a low-power state when the device became inactive. However, if ASPM is disabled for the device, its PCIe link will stay in L0 and in that case commit d916b1be94b6 is likely to cause the energy used by the system while suspended to increase. Namely, if the device in question works in accordance with the PCIe specification, putting it into D3hot causes its PCIe link to go to L1 or L2/L3 Ready, which is lower-power than L0. Since the energy used by the system while suspended depends on the state of its PCIe link (as a general rule, the lower-power the state of the link, the less energy the system will use), putting the device into D3hot during suspend-to-idle should be more energy-efficient that leaving it in D0 with disabled ASPM. For this reason, avoid leaving NVMe devices with disabled ASPM in D0 during suspend-to-idle. Instead, shut them down entirely and let the PCI bus type put them into D3. Fixes: d916b1be94b6 ("nvme-pci: use host managed power state for suspend") Link: https://lore.kernel.org/linux-pm/2763495.NmdaWeg79L@kreacher/T/#t Signed-off-by: Rafael J. Wysocki Reviewed-by: Keith Busch commit accd2dd72c8f087441d725dd916688171519e4e6 Author: Rafael J. Wysocki Date: Fri Aug 9 10:23:57 2019 +0200 PCI/ASPM: Add pcie_aspm_enabled() Add a function checking whether or not PCIe ASPM has been enabled for a given device. It will be used by the NVMe driver to decide how to handle the device during system suspend. Signed-off-by: Rafael J. Wysocki Reviewed-by: Keith Busch Acked-by: Bjorn Helgaas commit b421d83a3947369fd5718824aecfaebe1efbf7ed Author: Ben Segal Date: Wed Aug 7 13:54:54 2019 +0000 habanalabs: fix device IRQ unmasking for BE host When unmasking IRQs inside the ASIC, the driver passes an array of all the IRQ to unmask. The ASIC's CPU is working in LE so when running in a BE host, the driver needs to do the proper endianness swapping when preparing this array. In addition, this patch also fixes the endianness of a couple of kernel log debug messages that print values of packets Signed-off-by: Ben Segal Reviewed-by: Oded Gabbay Signed-off-by: Oded Gabbay commit b9040c99414ba5b85090595a61abc686a5dbb388 Author: Oded Gabbay Date: Thu Aug 8 15:45:58 2019 +0300 habanalabs: fix endianness handling for internal QMAN submission The PQs of internal H/W queues (QMANs) can be located in different memory areas for different ASICs. Therefore, when writing PQEs, we need to use the correct function according to the location of the PQ. e.g. if the PQ is located in the device's memory (SRAM or DRAM), we need to use memcpy_toio() so it would work in architectures that have separate address ranges for IO memory. This patch makes the code that writes the PQE to be ASIC-specific so we can handle this properly per ASIC. Signed-off-by: Oded Gabbay Tested-by: Ben Segal commit 4e87334a0ef43663019dbaf3638ad10fd8c3320c Author: Ben Segal Date: Thu Aug 1 23:22:20 2019 +0000 habanalabs: fix completion queue handling when host is BE This patch fix the CQ irq handler to work in hosts with BE architecture. It adds the correct endian-swapping macros around the relevant memory accesses. Signed-off-by: Ben Segal Reviewed-by: Oded Gabbay Signed-off-by: Oded Gabbay commit 213ad5ad016a0da975b35f54e8cd236c3b04724b Author: Ben Segal Date: Thu Aug 1 23:20:32 2019 +0000 habanalabs: fix endianness handling for packets from user Packets that arrive from the user and need to be parsed by the driver are assumed to be in LE format. This patch fix all the places where the code handles these packets and use the correct endianness macros to handle them, as the driver handles the packets in CPU format (LE or BE depending on the arch). Signed-off-by: Ben Segal Reviewed-by: Oded Gabbay Signed-off-by: Oded Gabbay commit c8113756ba27298d6e95403c087dc5881b419a99 Author: Tomer Tayar Date: Sun Aug 4 07:03:41 2019 +0000 habanalabs: fix DRAM usage accounting on context tear down The patch fix the DRAM usage accounting by adding a missing update of the DRAM memory consumption, when a context is being torn down without an organized release of the allocated memory. Signed-off-by: Tomer Tayar Reviewed-by: Oded Gabbay Signed-off-by: Oded Gabbay commit 508c5849c62d009e03f37ad0f556071fac5112f0 Author: Tomer Tayar Date: Thu Aug 1 13:57:36 2019 +0000 habanalabs: Avoid double free in error flow In case kernel context init fails during device initialization, both hl_ctx_put() and kfree() are called, ending with a double free of the kernel context. Calling kfree() is needed only when a failure happens between the allocation of the kernel context and its initialization, so move it to there and remove it from the error flow. Signed-off-by: Tomer Tayar Reviewed-by: Oded Gabbay Signed-off-by: Oded Gabbay commit 4a56a478a525d6427be90753451c40e1327caa1a Author: Benjamin Herrenschmidt Date: Fri Jul 26 14:59:04 2019 +1000 usb: gadget: mass_storage: Fix races between fsg_disable and fsg_set_alt If fsg_disable() and fsg_set_alt() are called too closely to each other (for example due to a quick reset/reconnect), what can happen is that fsg_set_alt sets common->new_fsg from an interrupt while handle_exception is trying to process the config change caused by fsg_disable(): fsg_disable() ... handle_exception() sets state back to FSG_STATE_NORMAL hasn't yet called do_set_interface() or is inside it. ---> interrupt fsg_set_alt sets common->new_fsg queues a new FSG_STATE_CONFIG_CHANGE <--- Now, the first handle_exception can "see" the updated new_fsg, treats it as if it was a fsg_set_alt() response, call usb_composite_setup_continue() etc... But then, the thread sees the second FSG_STATE_CONFIG_CHANGE, and goes back down the same path, wipes and reattaches a now active fsg, and .. calls usb_composite_setup_continue() which at this point is wrong. Not only we get a backtrace, but I suspect the second set_interface wrecks some state causing the host to get upset in my case. This fixes it by replacing "new_fsg" by a "state argument" (same principle) which is set in the same lock section as the state update, and retrieved similarly. That way, there is never any discrepancy between the dequeued state and the observed value of it. We keep the ability to have the latest reconfig operation take precedence, but we guarantee that once "dequeued" the argument (new_fsg) will not be clobbered by any new event. Signed-off-by: Benjamin Herrenschmidt Acked-by: Alan Stern Signed-off-by: Felipe Balbi commit 602fda17c7356bb7ae98467d93549057481d11dd Author: Benjamin Herrenschmidt Date: Fri Jul 26 14:59:03 2019 +1000 usb: gadget: composite: Clear "suspended" on reset/disconnect In some cases, one can get out of suspend with a reset or a disconnect followed by a reconnect. Previously we would leave a stale suspended flag set. Signed-off-by: Benjamin Herrenschmidt Signed-off-by: Felipe Balbi commit 5dac665cf403967bb79a7aeb8c182a621fe617ff Author: Yoshihiro Shimoda Date: Wed Jul 31 19:15:43 2019 +0900 usb: gadget: udc: renesas_usb3: Fix sysfs interface of "role" Since the role_store() uses strncmp(), it's possible to refer out-of-memory if the sysfs data size is smaller than strlen("host"). This patch fixes it by using sysfs_streq() instead of strncmp(). Fixes: cc995c9ec118 ("usb: gadget: udc: renesas_usb3: add support for usb role swap") Cc: # v4.12+ Reviewed-by: Geert Uytterhoeven Signed-off-by: Yoshihiro Shimoda Signed-off-by: Felipe Balbi commit 125b7e0949d4e72b15c2b1a1590f8cece985a918 Author: Nathan Chancellor Date: Sun Aug 11 20:13:45 2019 -0700 net: tc35815: Explicitly check NET_IP_ALIGN is not zero in tc35815_rx clang warns: drivers/net/ethernet/toshiba/tc35815.c:1507:30: warning: use of logical '&&' with constant operand [-Wconstant-logical-operand] if (!HAVE_DMA_RXALIGN(lp) && NET_IP_ALIGN) ^ ~~~~~~~~~~~~ drivers/net/ethernet/toshiba/tc35815.c:1507:30: note: use '&' for a bitwise operation if (!HAVE_DMA_RXALIGN(lp) && NET_IP_ALIGN) ^~ & drivers/net/ethernet/toshiba/tc35815.c:1507:30: note: remove constant to silence this warning if (!HAVE_DMA_RXALIGN(lp) && NET_IP_ALIGN) ~^~~~~~~~~~~~~~~ 1 warning generated. Explicitly check that NET_IP_ALIGN is not zero, which matches how this is checked in other parts of the tree. Because NET_IP_ALIGN is a build time constant, this check will be constant folded away during optimization. Fixes: 82a9928db560 ("tc35815: Enable StripCRC feature") Link: https://github.com/ClangBuiltLinux/linux/issues/608 Signed-off-by: Nathan Chancellor Signed-off-by: David S. Miller commit 8874ecae2977e5a2d4f0ba301364435b81c05938 Author: Chris Packham Date: Mon Aug 12 08:18:25 2019 +1200 tipc: initialise addr_trail_end when setting node addresses We set the field 'addr_trial_end' to 'jiffies', instead of the current value 0, at the moment the node address is initialized. This guarantees we don't inadvertently enter an address trial period when the node address is explicitly set by the user. Signed-off-by: Chris Packham Acked-by: Jon Maloy Signed-off-by: David S. Miller commit 58799865be84e2a895dab72de0e1b996ed943f22 Author: Chen-Yu Tsai Date: Sun Aug 11 22:18:25 2019 +0800 net: dsa: Check existence of .port_mdb_add callback before calling it The dsa framework has optional .port_mdb_{prepare,add,del} callback fields for drivers to handle multicast database entries. When adding an entry, the framework goes through a prepare phase, then a commit phase. Drivers not providing these callbacks should be detected in the prepare phase. DSA core may still bypass the bridge layer and call the dsa_port_mdb_add function directly with no prepare phase or no switchdev trans object, and the framework ends up calling an undefined .port_mdb_add callback. This results in a NULL pointer dereference, as shown in the log below. The other functions seem to be properly guarded. Do the same for .port_mdb_add in dsa_switch_mdb_add_bitmap() as well. 8<--- cut here --- Unable to handle kernel NULL pointer dereference at virtual address 00000000 pgd = (ptrval) [00000000] *pgd=00000000 Internal error: Oops: 80000005 [#1] SMP ARM Modules linked in: rtl8xxxu rtl8192cu rtl_usb rtl8192c_common rtlwifi mac80211 cfg80211 CPU: 1 PID: 134 Comm: kworker/1:2 Not tainted 5.3.0-rc1-00247-gd3519030752a #1 Hardware name: Allwinner sun7i (A20) Family Workqueue: events switchdev_deferred_process_work PC is at 0x0 LR is at dsa_switch_event+0x570/0x620 pc : [<00000000>] lr : [] psr: 80070013 sp : ee871db8 ip : 00000000 fp : ee98d0a4 r10: 0000000c r9 : 00000008 r8 : ee89f710 r7 : ee98d040 r6 : ee98d088 r5 : c0f04c48 r4 : ee98d04c r3 : 00000000 r2 : ee89f710 r1 : 00000008 r0 : ee98d040 Flags: Nzcv IRQs on FIQs on Mode SVC_32 ISA ARM Segment none Control: 10c5387d Table: 6deb406a DAC: 00000051 Process kworker/1:2 (pid: 134, stack limit = 0x(ptrval)) Stack: (0xee871db8 to 0xee872000) 1da0: ee871e14 103ace2d 1dc0: 00000000 ffffffff 00000000 ee871e14 00000005 00000000 c08524a0 00000000 1de0: ffffe000 c014bdfc c0f04c48 ee871e98 c0f04c48 ee9e5000 c0851120 c014bef0 1e00: 00000000 b643aea2 ee9b4068 c08509a8 ee2bf940 ee89f710 ee871ecb 00000000 1e20: 00000008 103ace2d 00000000 c087e248 ee29c868 103ace2d 00000001 ffffffff 1e40: 00000000 ee871e98 00000006 00000000 c0fb2a50 c087e2d0 ffffffff c08523c4 1e60: ffffffff c014bdfc 00000006 c0fad2d0 ee871e98 ee89f710 00000000 c014c500 1e80: 00000000 ee89f3c0 c0f04c48 00000000 ee9e5000 c087dfb4 ee9e5000 00000000 1ea0: ee89f710 ee871ecb 00000001 103ace2d 00000000 c0f04c48 00000000 c087e0a8 1ec0: 00000000 efd9a3e0 0089f3c0 103ace2d ee89f700 ee89f710 ee9e5000 00000122 1ee0: 00000100 c087e130 ee89f700 c0fad2c8 c1003ef0 c087de4c 2e928000 c0fad2ec 1f00: c0fad2ec ee839580 ef7a62c0 ef7a9400 00000000 c087def8 c0fad2ec c01447dc 1f20: ef315640 ef7a62c0 00000008 ee839580 ee839594 ef7a62c0 00000008 c0f03d00 1f40: ef7a62d8 ef7a62c0 ffffe000 c0145b84 ffffe000 c0fb2420 c0bfaa8c 00000000 1f60: ffffe000 ee84b600 ee84b5c0 00000000 ee870000 ee839580 c0145b40 ef0e5ea4 1f80: ee84b61c c014a6f8 00000001 ee84b5c0 c014a5b0 00000000 00000000 00000000 1fa0: 00000000 00000000 00000000 c01010e8 00000000 00000000 00000000 00000000 1fc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 1fe0: 00000000 00000000 00000000 00000000 00000013 00000000 00000000 00000000 [] (dsa_switch_event) from [] (notifier_call_chain+0x48/0x84) [] (notifier_call_chain) from [] (raw_notifier_call_chain+0x18/0x20) [] (raw_notifier_call_chain) from [] (dsa_port_mdb_add+0x48/0x74) [] (dsa_port_mdb_add) from [] (__switchdev_handle_port_obj_add+0x54/0xd4) [] (__switchdev_handle_port_obj_add) from [] (switchdev_handle_port_obj_add+0x8/0x14) [] (switchdev_handle_port_obj_add) from [] (dsa_slave_switchdev_blocking_event+0x94/0xa4) [] (dsa_slave_switchdev_blocking_event) from [] (notifier_call_chain+0x48/0x84) [] (notifier_call_chain) from [] (blocking_notifier_call_chain+0x50/0x68) [] (blocking_notifier_call_chain) from [] (switchdev_port_obj_notify+0x44/0xa8) [] (switchdev_port_obj_notify) from [] (switchdev_port_obj_add_now+0x90/0x104) [] (switchdev_port_obj_add_now) from [] (switchdev_port_obj_add_deferred+0x14/0x5c) [] (switchdev_port_obj_add_deferred) from [] (switchdev_deferred_process+0x64/0x104) [] (switchdev_deferred_process) from [] (switchdev_deferred_process_work+0xc/0x14) [] (switchdev_deferred_process_work) from [] (process_one_work+0x218/0x50c) [] (process_one_work) from [] (worker_thread+0x44/0x5bc) [] (worker_thread) from [] (kthread+0x148/0x150) [] (kthread) from [] (ret_from_fork+0x14/0x2c) Exception stack(0xee871fb0 to 0xee871ff8) 1fa0: 00000000 00000000 00000000 00000000 1fc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 1fe0: 00000000 00000000 00000000 00000000 00000013 00000000 Code: bad PC value ---[ end trace 1292c61abd17b130 ]--- [] (dsa_switch_event) from [] (notifier_call_chain+0x48/0x84) corresponds to $ arm-linux-gnueabihf-addr2line -C -i -e vmlinux c08533ec linux/net/dsa/switch.c:156 linux/net/dsa/switch.c:178 linux/net/dsa/switch.c:328 Fixes: e6db98db8a95 ("net: dsa: add switch mdb bitmap functions") Signed-off-by: Chen-Yu Tsai Reviewed-by: Vivien Didelot Signed-off-by: David S. Miller commit 8028ccda39bb440d86aee6948405c8337afbed8b Author: Petr Machata Date: Sun Aug 11 10:48:37 2019 +0300 mlxsw: spectrum_ptp: Keep unmatched entries in a linked list To identify timestamps for matching with their packets, Spectrum-1 uses a five-tuple of (port, direction, domain number, message type, sequence ID). If there are several clients from the same domain behind a single port sending Delay_Req's, the only thing differentiating these packets, as far as Spectrum-1 is concerned, is the sequence ID. Should sequence IDs between individual clients be similar, conflicts may arise. That is not a problem to hardware, which will simply deliver timestamps on a first comes, first served basis. However the driver uses a simple hash table to store the unmatched pieces. When a new conflicting piece arrives, it pushes out the previously stored one, which if it is a packet, is delivered without timestamp. Later on as the corresponding timestamps arrive, the first one is mismatched to the second packet, and the second one is never matched and eventually is GCd. To correct this issue, instead of using a simple rhashtable, use rhltable to keep the unmatched entries. Previously, a found unmatched entry would always be removed from the hash table. That is not the case anymore--an incompatible entry is left in the hash table. Therefore removal from the hash table cannot be used to confirm the validity of the looked-up pointer, instead the lookup would simply need to be redone. Therefore move it inside the critical section. This simplifies a lot of the code. Fixes: 8748642751ed ("mlxsw: spectrum: PTP: Support SIOCGHWTSTAMP, SIOCSHWTSTAMP ioctls") Reported-by: Alex Veber Signed-off-by: Petr Machata Signed-off-by: Ido Schimmel Signed-off-by: David S. Miller commit d81f41411c2549b0ae42f23140d9589172096759 Author: Jonathan Neuschäfer Date: Sat Aug 10 13:11:56 2019 +0200 net: nps_enet: Fix function names in doc comments Adjust the function names in two doc comments to match the corresponding functions. Signed-off-by: Jonathan Neuschäfer Signed-off-by: David S. Miller commit 68553f1a6f746bf860bce3eb42d78c26a717d9c0 Author: David Howells Date: Fri Aug 9 22:47:47 2019 +0100 rxrpc: Fix local refcounting Fix rxrpc_unuse_local() to handle a NULL local pointer as it can be called on an unbound socket on which rx->local is not yet set. The following reproduced (includes omitted): int main(void) { socket(AF_RXRPC, SOCK_DGRAM, AF_INET); return 0; } causes the following oops to occur: BUG: kernel NULL pointer dereference, address: 0000000000000010 ... RIP: 0010:rxrpc_unuse_local+0x8/0x1b ... Call Trace: rxrpc_release+0x2b5/0x338 __sock_release+0x37/0xa1 sock_close+0x14/0x17 __fput+0x115/0x1e9 task_work_run+0x72/0x98 do_exit+0x51b/0xa7a ? __context_tracking_exit+0x4e/0x10e do_group_exit+0xab/0xab __x64_sys_exit_group+0x14/0x17 do_syscall_64+0x89/0x1d4 entry_SYSCALL_64_after_hwframe+0x49/0xbe Reported-by: syzbot+20dee719a2e090427b5f@syzkaller.appspotmail.com Fixes: 730c5fd42c1e ("rxrpc: Fix local endpoint refcounting") Signed-off-by: David Howells cc: Jeffrey Altman Signed-off-by: David S. Miller commit 59c84b9fcf42c99a945d5fdc49220d854e539690 Author: David Ahern Date: Tue Aug 6 12:15:17 2019 -0700 netdevsim: Restore per-network namespace accounting for fib entries Prior to the commit in the fixes tag, the resource controller in netdevsim tracked fib entries and rules per network namespace. Restore that behavior. Fixes: 5fc494225c1e ("netdevsim: create devlink instance per netdevsim instance") Signed-off-by: David Ahern Signed-off-by: David S. Miller commit 9481382b36fe1dbdada9303ebd6b9dba915da989 Merge: 57c722e932cf 4f7aafd78aea Author: David S. Miller Date: Sun Aug 11 14:49:34 2019 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf Daniel Borkmann says: ==================== pull-request: bpf 2019-08-11 The following pull-request contains BPF updates for your *net* tree. The main changes are: 1) x64 JIT code generation fix for backward-jumps to 1st insn, from Alexei. 2) Fix buggy multi-closing of BTF file descriptor in libbpf, from Andrii. 3) Fix libbpf_num_possible_cpus() to make it thread safe, from Takshak. 4) Fix bpftool to dump an error if pinning fails, from Jakub. ==================== Signed-off-by: David S. Miller commit 1ee1119d184bb06af921b48c3021d921bbd85bac Author: Gustavo A. R. Silva Date: Fri Aug 9 23:43:56 2019 -0500 sh: kernel: hw_breakpoint: Fix missing break in switch statement Add missing break statement in order to prevent the code from falling through to case SH_BREAKPOINT_WRITE. Fixes: 09a072947791 ("sh: hw-breakpoints: Add preliminary support for SH-4A UBC.") Cc: stable@vger.kernel.org Reviewed-by: Geert Uytterhoeven Reviewed-by: Guenter Roeck Tested-by: Guenter Roeck Signed-off-by: Gustavo A. R. Silva commit 54b13723f765122f3f5f49d07f3e48fa9fcf8c7c Author: Gustavo A. R. Silva Date: Sat Aug 10 00:19:11 2019 -0500 sh: kernel: disassemble: Mark expected switch fall-throughs Remove logically dead code and mark switch cases where we are expecting to fall through. Fix the following warnings (Building: defconfig sh): arch/sh/kernel/disassemble.c:478:8: warning: this statement may fall through [-Wimplicit-fallthrough=] arch/sh/kernel/disassemble.c:487:8: warning: this statement may fall through [-Wimplicit-fallthrough=] arch/sh/kernel/disassemble.c:496:8: warning: this statement may fall through [-Wimplicit-fallthrough=] Reviewed-by: Geert Uytterhoeven Reviewed-by: Guenter Roeck Tested-by: Guenter Roeck Signed-off-by: Gustavo A. R. Silva commit d45331b00ddb179e291766617259261c112db872 Author: Linus Torvalds Date: Sun Aug 11 13:26:41 2019 -0700 Linux 5.3-rc4 commit b6c0649caf351d39e1dfb5698d7b3bb7536850b1 Merge: f6192cb74292 06282373ff57 Author: Linus Torvalds Date: Sun Aug 11 13:15:10 2019 -0700 Merge tag 'dax-fixes-5.3-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm Pull dax fixes from Dan Williams: "A filesystem-dax and device-dax fix for v5.3. The filesystem-dax fix is tagged for stable as the implementation has been mistakenly throwing away all cow pages on any truncate or hole punch operation as part of the solution to coordinate device-dma vs truncate to dax pages. The device-dax change fixes up a regression this cycle from the introduction of a common 'internal per-cpu-ref' implementation. Summary: - Fix dax_layout_busy_page() to not discard private cow pages of fs/dax private mappings. - Update the memremap_pages core to properly cleanup on behalf of internal reference-count users like device-dax" * tag 'dax-fixes-5.3-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm: mm/memremap: Fix reuse of pgmap instances with internal references dax: dax_layout_busy_page() should not unmap cow pages commit f6192cb7429211bfaac1178c35607b0c989900b8 Merge: 296d05cb0d3c 49da065f7b1f Author: Linus Torvalds Date: Sun Aug 11 10:13:53 2019 -0700 Merge tag 'ntb-5.3-bugfixes' of git://github.com/jonmason/ntb Pull NTB fix from Jon Mason: "Bug fix for NTB MSI kernel compile warning" * tag 'ntb-5.3-bugfixes' of git://github.com/jonmason/ntb: NTB/msi: remove incorrect MODULE defines commit 0c9c83043d4957092f74173cfeeb5bc63e7a70e7 Merge: 20621fedb2a6 bd46a9063430 Author: Jens Axboe Date: Sat Aug 10 21:41:41 2019 -0600 Merge branch 'nvme-5.3-rc' of git://git.infradead.org/nvme into for-linus Pull NVMe fixes from Sagi: "Few nvme fixes for the next rc round. - detect capacity changes on the mpath disk from Anthony - probe/remove fix from Keith - various fixes to pass blktests from Logan - deadlock in reset/scan race fix - nvme-rdma use-after-free fix - deadlock fix when passthru commands race mpath disk info update" * 'nvme-5.3-rc' of git://git.infradead.org/nvme: nvme-pci: Fix async probe remove race nvme: fix controller removal race with scan work nvme-rdma: fix possible use-after-free in connect error flow nvme: fix a possible deadlock when passthru commands sent to a multipath device nvme-core: Fix extra device_put() call on error path nvmet-file: fix nvmet_file_flush() always returning an error nvmet-loop: Flush nvme_delete_wq when removing the port nvmet: Fix use-after-free bug when a port is removed nvme-multipath: revalidate nvme_ns_head gendisk in nvme_validate_ns commit 296d05cb0d3c9f4648e31abb8ce404ac6915d66c Merge: 6d8f809cb55a b390e0bfd299 Author: Linus Torvalds Date: Sat Aug 10 16:31:47 2019 -0700 Merge tag 'riscv/for-v5.3-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux Pull RISC-V updates from Paul Walmsley: "A few minor RISC-V updates for v5.3-rc4: - Remove __udivdi3() from the 32-bit Linux port, converting the only upstream user to use do_div(), per Linux policy - Convert the RISC-V standard clocksource away from per-cpu data structures, since only one is used by Linux, even on a multi-CPU system - A set of DT binding updates that remove an obsolete text binding in favor of a YAML binding, fix a bogus compatible string in the schema (thus fixing a "make dtbs_check" warning), and clarifies the future values expected in one of the RISC-V CPU properties" * tag 'riscv/for-v5.3-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux: dt-bindings: riscv: fix the schema compatible string for the HiFive Unleashed board dt-bindings: riscv: remove obsolete cpus.txt RISC-V: Remove udivdi3 riscv: delay: use do_div() instead of __udivdi3() dt-bindings: Update the riscv,isa string description RISC-V: Remove per cpu clocksource commit 6d8f809cb55a8fc0ebfae27984215e4a0b201984 Merge: d2359a5153eb 04f5bda84b07 Author: Linus Torvalds Date: Sat Aug 10 16:24:03 2019 -0700 Merge branch 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 fixes from Thomas Gleixner: "A few fixes for x86: - Don't reset the carefully adjusted build flags for the purgatory and remove the unwanted flags instead. The 'reset all' approach led to build fails under certain circumstances. - Unbreak CLANG build of the purgatory by avoiding the builtin memcpy/memset implementations. - Address missing prototype warnings by including the proper header - Fix yet more fall-through issues" * 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/lib/cpu: Address missing prototypes warning x86/purgatory: Use CFLAGS_REMOVE rather than reset KBUILD_CFLAGS x86/purgatory: Do not use __builtin_memcpy and __builtin_memset x86: mtrr: cyrix: Mark expected switch fall-through x86/ptrace: Mark expected switch fall-through commit d2359a5153ebb16412daedd8f104b886643cbd1a Merge: dcbb4a153971 d7731b8133ad Author: Linus Torvalds Date: Sat Aug 10 16:19:02 2019 -0700 Merge branch 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull perf tooling fixes from Thomas Gleixner: "Perf tooling fixes all over the place: - Fix the selection of the main thread COMM in db-export - Fix the disassemmbly display for BPF in annotate - Fix cpumap mask setup in perf ftrace when only one CPU is present - Add the missing 'cpu_clk_unhalted.core' event - Fix CPU 0 bindings in NUMA benchmarks - Fix the module size calculations for s390 - Handle the gap between kernel end and module start on s390 correctly - Build and typo fixes" * 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: perf pmu-events: Fix missing "cpu_clk_unhalted.core" event perf annotate: Fix s390 gap between kernel end and module start perf record: Fix module size on s390 perf tools: Fix include paths in ui directory perf tools: Fix a typo in a variable name in the Documentation Makefile perf cpumap: Fix writing to illegal memory in handling cpumap mask perf ftrace: Fix failure to set cpumask when only one cpu is present perf db-export: Fix thread__exec_comm() perf annotate: Fix printing of unaugmented disassembled instructions from BPF perf bench numa: Fix cpu0 binding commit dcbb4a153971ff8646af0c963f5698bf21bfbfdc Merge: ed254bb54fed 04e048cf09d7 Author: Linus Torvalds Date: Sat Aug 10 15:48:02 2019 -0700 Merge branch 'sched-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull scheduler fixes from Thomas Gleixner: "Three fixlets for the scheduler: - Avoid double bandwidth accounting in the push & pull code - Use a sane FIFO priority for the Pressure Stall Information (PSI) thread. - Avoid permission checks when setting the scheduler params for the PSI thread" * 'sched-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: sched/psi: Do not require setsched permission from the trigger creator sched/psi: Reduce psimon FIFO priority sched/deadline: Fix double accounting of rq/running bw in push & pull commit ed254bb54fed18549b96285cfdadd69780f52c14 Merge: 6054f4ecdc11 491beed3b102 Author: Linus Torvalds Date: Sat Aug 10 15:46:25 2019 -0700 Merge branch 'irq-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull irq fix from Thomas Gleixner: "A small fix for the affinity spreading code. It failed to handle situations where a single vector was requested either due to only one CPU being available or vector exhaustion causing only a single interrupt to be granted. The fix is to simply remove the requirement in the affinity spreading code for more than one interrupt being available" * 'irq-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: genirq/affinity: Create affinity mask for single vector commit 6054f4ecdc116ce64bd5c50df8edd01d2c105e69 Merge: 829890d266e3 e6a9522ac3ff Author: Linus Torvalds Date: Sat Aug 10 15:44:09 2019 -0700 Merge branch 'core-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull objtool warning fix from Thomas Gleixner: "The recent objtool fixes/enhancements unearthed a unbalanced CLAC in the i915 driver. Chris asked me to pick the fix up and route it through" * 'core-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: drm/i915: Remove redundant user_access_end() from __copy_from_user() error path commit 829890d266e37d368a404b5ecc8575aceae23a3f Merge: bfd77145f35c a27a0c9b6a20 Author: Linus Torvalds Date: Sat Aug 10 15:41:15 2019 -0700 Merge tag 'gfs2-v5.3-rc3.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/gfs2/linux-gfs2 Pull gfs2 fix from Andreas Gruenbacher: "Fix incorrect lseek / fiemap results" * tag 'gfs2-v5.3-rc3.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/gfs2/linux-gfs2: gfs2: gfs2_walk_metadata fix commit bfd77145f35c3deafe57e9eb67fff4ccffdaef6e Author: Joe Perches Date: Mon Aug 5 15:11:15 2019 -0700 Makefile: Convert -Wimplicit-fallthrough=3 to just -Wimplicit-fallthrough for clang A compilation -Wimplicit-fallthrough warning was enabled by commit a035d552a93b ("Makefile: Globally enable fall-through warning") Even though clang 10.0.0 does not currently support this warning without a patch, clang currently does not support a value for this option. Link: https://bugs.llvm.org/show_bug.cgi?id=39382 The gcc default for this warning is 3 so removing the =3 has no effect for gcc and enables the warning for patched versions of clang. Also remove the =3 from an existing use in a parisc Makefile: arch/parisc/math-emu/Makefile Signed-off-by: Joe Perches Reviewed-and-tested-by: Nathan Chancellor Cc: Gustavo A. R. Silva Signed-off-by: Linus Torvalds commit 5aa910073744e5ed6d79410d81fa44149b2deeb7 Merge: 36e630ed98d5 5511c0c309db Author: Linus Torvalds Date: Sat Aug 10 12:24:20 2019 -0700 Merge tag 'char-misc-5.3-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc Pull char/misc driver fixes Greg KH: "Here are some small char/misc driver fixes for 5.3-rc4. Two of these are for the habanalabs driver for issues found when running on a big-endian system (are they still alive?) The others are tiny fixes reported by people, and a MAINTAINERS update about the location of the fpga development tree. All of these have been in linux-next for a while with no reported issues" * tag 'char-misc-5.3-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: coresight: Fix DEBUG_LOCKS_WARN_ON for uninitialized attribute MAINTAINERS: Move linux-fpga tree to new location nvmem: Use the same permissions for eeprom as for nvmem habanalabs: fix host memory polling in BE architecture habanalabs: fix F/W download in BE architecture commit 36e630ed98d5daa628368121f74bf37bead9206b Merge: c13f86701e1e 8097c43bcbec Author: Linus Torvalds Date: Sat Aug 10 12:20:02 2019 -0700 Merge tag 'driver-core-5.3-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core Pull driver core fixes from Greg KH: "Here are two small fixes for some driver core issues that have been reported. There is also a kernfs "fix" here, which was then reverted because it was found to cause problems in linux-next. The driver core fixes both resolve reported issues, one with gpioint stuff that showed up in 5.3-rc1, and the other finally (and hopefully) resolves a very long standing race when removing glue directories. It's nice to get that issue finally resolved and the developers involved should be applauded for the persistence it took to get this patch finally accepted. All of these have been in linux-next for a while with no reported issues. Well, the one reported issue, hence the revert :)" * tag 'driver-core-5.3-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core: Revert "kernfs: fix memleak in kernel_ops_readdir()" kernfs: fix memleak in kernel_ops_readdir() driver core: Fix use-after-free and double free on glue directory driver core: platform: return -ENXIO for missing GpioInt commit c13f86701e1e03fa3f94165d46425ead51a191c8 Merge: 15fa98e40e0c 81eaadcae81b Author: Linus Torvalds Date: Sat Aug 10 12:17:12 2019 -0700 Merge tag 'tty-5.3-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty Pull tty fix from Greg KH: "Here is a single tty kgdb fix for 5.3-rc4. It fixes an annoying log message that has caused kdb to become useless. It's another fallout from commit ddde3c18b700 ("vt: More locking checks") which tries to enforce locking checks more strictly in the tty layer, unfortunatly when kdb is stopped, there's no need for locks :) This patch has been linux-next for a while with no reported issues" * tag 'tty-5.3-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty: kgdboc: disable the console lock when in kgdb commit 15fa98e40e0c305145da9a95f8ac6dc0bda64884 Merge: 1041f5092179 09f6109ff4f8 Author: Linus Torvalds Date: Sat Aug 10 12:13:39 2019 -0700 Merge tag 'staging-5.3-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging Pull staging / IIO driver fixes from Greg KH: "Here are some small staging and IIO driver fixes for 5.3-rc4. Nothing major, just resolutions for a number of small reported issues, full details in the shortlog. All have been in linux-next for a while with no reported issues" * tag 'staging-5.3-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging: iio: adc: gyroadc: fix uninitialized return code docs: generic-counter.rst: fix broken references for ABI file staging: android: ion: Bail out upon SIGKILL when allocating memory. Staging: fbtft: Fix GPIO handling staging: unisys: visornic: Update the description of 'poll_for_irq()' staging: wilc1000: flush the workqueue before deinit the host staging: gasket: apex: fix copy-paste typo Staging: fbtft: Fix reset assertion when using gpio descriptor Staging: fbtft: Fix probing of gpio descriptor iio: imu: mpu6050: add missing available scan masks iio: cros_ec_accel_legacy: Fix incorrect channel setting IIO: Ingenic JZ47xx: Set clock divider on probe iio: adc: max9611: Fix misuse of GENMASK macro commit 1041f5092179ab3dfb8ceb8f1f54bc07d4ba3399 Merge: 97946f59fe7f 27709ae4e2fe Author: Linus Torvalds Date: Sat Aug 10 11:59:57 2019 -0700 Merge tag 'usb-5.3-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb Pull USB fixes from Greg KH: "Here are some small USB fixes for 5.3-rc4. The "biggest" one here is moving code from one file to another in order to fix a long-standing race condition with the creation of sysfs files for USB devices. Turns out that there are now userspace tools out there that are hitting this long-known bug, so it's time to fix them. Thankfully the tool-maker in this case fixed the issue :) The other patches in here are all fixes for reported issues. Now that syzbot knows how to fuzz USB drivers better, and is starting to now fuzz the userspace facing side of them at the same time, there will be more and more small fixes like these coming, which is a good thing. All of these have been in linux-next with no reported issues" * tag 'usb-5.3-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: usb: setup authorized_default attributes using usb_bus_notify usb: iowarrior: fix deadlock on disconnect Revert "USB: rio500: simplify locking" usb: usbfs: fix double-free of usb memory upon submiturb error usb: yurex: Fix use-after-free in yurex_delete usb: typec: tcpm: Ignore unsupported/unknown alternate mode requests xhci: Fix NULL pointer dereference at endpoint zero reset. usb: host: xhci-rcar: Fix timeout in xhci_suspend() usb: typec: ucsi: ccg: Fix uninitilized symbol error usb: typec: tcpm: remove tcpm dir if no children usb: typec: tcpm: free log buf memory when remove debug file usb: typec: tcpm: Add NULL check before dereferencing config commit 33dcb37cef741294b481f4d889a465b8091f11bf Author: Christoph Hellwig Date: Fri Jul 26 09:26:40 2019 +0200 dma-mapping: fix page attributes for dma_mmap_* All the way back to introducing dma_common_mmap we've defaulted to mark the pages as uncached. But this is wrong for DMA coherent devices. Later on DMA_ATTR_WRITE_COMBINE also got incorrect treatment as that flag is only treated special on the alloc side for non-coherent devices. Introduce a new dma_pgprot helper that deals with the check for coherent devices so that only the remapping cases ever reach arch_dma_mmap_pgprot and we thus ensure no aliasing of page attributes happens, which makes the powerpc version of arch_dma_mmap_pgprot obsolete and simplifies the remaining ones. Note that this means arch_dma_mmap_pgprot is a bit misnamed now, but we'll phase it out soon. Fixes: 64ccc9c033c6 ("common: dma-mapping: add support for generic dma_mmap_* calls") Reported-by: Shawn Anastasio Reported-by: Gavin Li Signed-off-by: Christoph Hellwig Acked-by: Catalin Marinas # arm64 commit d8ad55538abe443919e20e0bb996561bca9cad84 Author: Lucas Stach Date: Mon Aug 5 17:51:53 2019 +0200 dma-direct: don't truncate dma_required_mask to bus addressing capabilities The dma required_mask needs to reflect the actual addressing capabilities needed to handle the whole system RAM. When truncated down to the bus addressing capabilities dma_addressing_limited() will incorrectly signal no limitations for devices which are restricted by the bus_dma_mask. Fixes: b4ebe6063204 (dma-direct: implement complete bus_dma_mask handling) Signed-off-by: Lucas Stach Tested-by: Atish Patra Signed-off-by: Christoph Hellwig commit cf14be0b41c659ede89abef3f7ec0e98e6cfea5b Author: Christoph Hellwig Date: Tue Aug 6 14:33:23 2019 +0300 dma-direct: fix DMA_ATTR_NO_KERNEL_MAPPING The new DMA_ATTR_NO_KERNEL_MAPPING needs to actually assign a dma_addr to work. Also skip it if the architecture needs forced decryption handling, as that needs a kernel virtual address. Fixes: d98849aff879 (dma-direct: handle DMA_ATTR_NO_KERNEL_MAPPING in common code) Signed-off-by: Christoph Hellwig Reviewed-by: Lucas Stach commit 97946f59fe7fecff44032f8e775975991a612d18 Merge: 23df57afe8ee 8c4407de3be4 Author: Linus Torvalds Date: Sat Aug 10 10:21:25 2019 -0700 Merge tag 'pinctrl-v5.3-2' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl Pull pin control fixes from Linus Walleij: - Delay acquisition of regmaps in the Aspeed G5 driver. - Make a symbol static to reduce compiler noise. * tag 'pinctrl-v5.3-2' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl: pinctrl: aspeed: Make aspeed_pinmux_ips static pinctrl: aspeed-g5: Delay acquisition of regmaps commit 23df57afe8eebff6ece05a815934f2f70a851e0a Merge: bf1881cf484d ed4289e8b488 Author: Linus Torvalds Date: Sat Aug 10 10:17:19 2019 -0700 Merge tag 'powerpc-5.3-4' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux Pull powerpc fix from Michael Ellerman: "Just one fix, a revert of a commit that was meant to be a minor improvement to some inline asm, but ended up having no real benefit with GCC and broke booting 32-bit machines when using Clang. Thanks to: Arnd Bergmann, Christophe Leroy, Nathan Chancellor, Nick Desaulniers, Segher Boessenkool" * tag 'powerpc-5.3-4' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux: Revert "powerpc: slightly improve cache helpers" commit bf1881cf484dd96a97606a804553019f8f08f0d4 Merge: 451577f3e3a9 1f7585f30a3a Author: Linus Torvalds Date: Sat Aug 10 10:10:33 2019 -0700 Merge tag 'Wimplicit-fallthrough-5.3-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gustavoars/linux Pull fall-through fixes from Gustavo A. R. Silva: "Mark more switch cases where we are expecting to fall through, fixing fall-through warnings in arm, sparc64, mips, i386 and s390" * tag 'Wimplicit-fallthrough-5.3-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gustavoars/linux: ARM: ep93xx: Mark expected switch fall-through scsi: fas216: Mark expected switch fall-throughs pcmcia: db1xxx_ss: Mark expected switch fall-throughs video: fbdev: omapfb_main: Mark expected switch fall-throughs watchdog: riowd: Mark expected switch fall-through s390/net: Mark expected switch fall-throughs crypto: ux500/crypt: Mark expected switch fall-throughs watchdog: wdt977: Mark expected switch fall-through watchdog: scx200_wdt: Mark expected switch fall-through watchdog: Mark expected switch fall-throughs ARM: signal: Mark expected switch fall-through mfd: omap-usb-host: Mark expected switch fall-throughs mfd: db8500-prcmu: Mark expected switch fall-throughs ARM: OMAP: dma: Mark expected switch fall-throughs ARM: alignment: Mark expected switch fall-throughs ARM: tegra: Mark expected switch fall-through ARM/hw_breakpoint: Mark expected switch fall-throughs commit 600f5badb78c316146d062cfd7af4a2cfb655baa Author: Viresh Kumar Date: Wed Aug 7 12:36:01 2019 +0530 cpufreq: schedutil: Don't skip freq update when limits change To avoid reducing the frequency of a CPU prematurely, we skip reducing the frequency if the CPU had been busy recently. This should not be done when the limits of the policy are changed, for example due to thermal throttling. We should always get the frequency within the new limits as soon as possible. Trying to fix this by using only one flag, i.e. need_freq_update, can lead to a race condition where the flag gets cleared without forcing us to change the frequency at least once. And so this patch introduces another flag to avoid that race condition. Fixes: ecd288429126 ("cpufreq: schedutil: Don't set next_freq to UINT_MAX") Cc: v4.18+ # v4.18+ Reported-by: Doug Smythies Tested-by: Doug Smythies Signed-off-by: Viresh Kumar Signed-off-by: Rafael J. Wysocki commit e61a41256edf9f425039129757af4a80b5ed8162 Author: Viresh Kumar Date: Fri Aug 9 08:01:17 2019 +0530 cpufreq: dev_pm_qos_update_request() can return 1 on success dev_pm_qos_update_request() can return 1 on success, so don't treat it as an error. Fixes: 18c49926c4bf ("cpufreq: Add QoS requests for userspace constraints") Signed-off-by: Viresh Kumar Signed-off-by: Rafael J. Wysocki commit cfef67f016e4c00a2f423256fc678a6967a9fc09 Author: Wenwen Wang Date: Fri Aug 9 23:29:48 2019 -0500 ALSA: hda - Fix a memory leak bug In snd_hda_parse_generic_codec(), 'spec' is allocated through kzalloc(). Then, the pin widgets in 'codec' are parsed. However, if the parsing process fails, 'spec' is not deallocated, leading to a memory leak. To fix the above issue, free 'spec' before returning the error. Fixes: 352f7f914ebb ("ALSA: hda - Merge Realtek parser code to generic parser") Signed-off-by: Wenwen Wang Cc: Signed-off-by: Takashi Iwai commit 451577f3e3a9bf1861218641dbbf98e214e77851 Merge: 7f20fd23377a c07d8d47bca1 Author: Linus Torvalds Date: Fri Aug 9 20:31:04 2019 -0700 Merge tag 'kbuild-fixes-v5.3-3' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild Pull Kbuild fixes from Masahiro Yamada: - revive single target %.ko - do not create built-in.a where it is unneeded - do not create modules.order where it is unneeded - show a warning if subdir-y/m is used to visit a module Makefile * tag 'kbuild-fixes-v5.3-3' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild: kbuild: show hint if subdir-y/m is used to visit module Makefile kbuild: generate modules.order only in directories visited by obj-y/m kbuild: fix false-positive need-builtin calculation kbuild: revive single target %.ko commit 57c722e932cfb82e9820bbaae1b1f7222ea97b52 Author: Jakub Kicinski Date: Fri Aug 9 18:36:23 2019 -0700 net/tls: swap sk_write_space on close Now that we swap the original proto and clear the ULP pointer on close we have to make sure no callback will try to access the freed state. sk_write_space is not part of sk_prot, remember to swap it. Reported-by: syzbot+dcdc9deefaec44785f32@syzkaller.appspotmail.com Fixes: 95fa145479fb ("bpf: sockmap/tls, close can race with map free") Signed-off-by: Jakub Kicinski Signed-off-by: David S. Miller commit 1f7585f30a3af595ac07f610b807c738c9e3baab Author: Gustavo A. R. Silva Date: Wed Aug 7 21:34:48 2019 -0500 ARM: ep93xx: Mark expected switch fall-through Mark switch cases where we are expecting to fall through. Fix the following warnings (Building: arm-ep93xx_defconfig arm): arch/arm/mach-ep93xx/crunch.c: In function 'crunch_do': arch/arm/mach-ep93xx/crunch.c:46:3: warning: this statement may fall through [-Wimplicit-fallthrough=] memset(crunch_state, 0, sizeof(*crunch_state)); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ arch/arm/mach-ep93xx/crunch.c:53:2: note: here case THREAD_NOTIFY_EXIT: ^~~~ Notice that, in this particular case, the code comment is modified in accordance with what GCC is expecting to find. Reported-by: kbuild test robot Signed-off-by: Gustavo A. R. Silva commit fccf01b6473c68692579bc008c1d38d6c3fcb276 Author: Gustavo A. R. Silva Date: Tue Aug 6 03:26:15 2019 -0500 scsi: fas216: Mark expected switch fall-throughs Mark switch cases where we are expecting to fall through. Fix the following warnings (Building: rpc_defconfig arm): drivers/scsi/arm/fas216.c: In function ‘fas216_disconnect_intr’: drivers/scsi/arm/fas216.c:913:6: warning: this statement may fall through [-Wimplicit-fallthrough=] if (fas216_get_last_msg(info, info->scsi.msgin_fifo) == ABORT) { ^ drivers/scsi/arm/fas216.c:919:2: note: here default: /* huh? */ ^~~~~~~ drivers/scsi/arm/fas216.c: In function ‘fas216_kick’: drivers/scsi/arm/fas216.c:1959:3: warning: this statement may fall through [-Wimplicit-fallthrough=] fas216_allocate_tag(info, SCpnt); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/scsi/arm/fas216.c:1960:2: note: here case TYPE_OTHER: ^~~~ drivers/scsi/arm/fas216.c: In function ‘fas216_busservice_intr’: drivers/scsi/arm/fas216.c:1413:3: warning: this statement may fall through [-Wimplicit-fallthrough=] fas216_stoptransfer(info); ^~~~~~~~~~~~~~~~~~~~~~~~~ drivers/scsi/arm/fas216.c:1414:2: note: here case STATE(STAT_STATUS, PHASE_SELSTEPS):/* Sel w/ steps -> Status */ ^~~~ drivers/scsi/arm/fas216.c:1424:3: warning: this statement may fall through [-Wimplicit-fallthrough=] fas216_stoptransfer(info); ^~~~~~~~~~~~~~~~~~~~~~~~~ drivers/scsi/arm/fas216.c:1425:2: note: here case STATE(STAT_MESGIN, PHASE_COMMAND): /* Command -> Message In */ ^~~~ drivers/scsi/arm/fas216.c: In function ‘fas216_funcdone_intr’: drivers/scsi/arm/fas216.c:1573:6: warning: this statement may fall through [-Wimplicit-fallthrough=] if ((stat & STAT_BUSMASK) == STAT_MESGIN) { ^ drivers/scsi/arm/fas216.c:1579:2: note: here default: ^~~~~~~ drivers/scsi/arm/fas216.c: In function ‘fas216_handlesync’: drivers/scsi/arm/fas216.c:605:20: warning: this statement may fall through [-Wimplicit-fallthrough=] info->scsi.phase = PHASE_MSGOUT_EXPECT; ~~~~~~~~~~~~~~~~~^~~~~~~~~~~~~~~~~~~~~ drivers/scsi/arm/fas216.c:607:2: note: here case async: ^~~~ Signed-off-by: Gustavo A. R. Silva commit 5f163f331b645106d548f3fcddfa1f92c1af60d0 Author: Gustavo A. R. Silva Date: Mon Aug 5 14:47:35 2019 -0500 pcmcia: db1xxx_ss: Mark expected switch fall-throughs Mark switch cases where we are expecting to fall through. This patch fixes the following warnings (Building: db1xxx_defconfig mips): drivers/pcmcia/db1xxx_ss.c:257:3: warning: this statement may fall through [-Wimplicit-fallthrough=] drivers/pcmcia/db1xxx_ss.c:269:3: warning: this statement may fall through [-Wimplicit-fallthrough=] Reviewed-by: Kees Cook Signed-off-by: Gustavo A. R. Silva commit 70a2783c1893a7e485b3be1c2ef23286fa252493 Author: Gustavo A. R. Silva Date: Fri Aug 2 14:10:29 2019 -0500 video: fbdev: omapfb_main: Mark expected switch fall-throughs Mark switch cases where we are expecting to fall through. This patch fixes the following warning (Building: omap1_defconfig arm): drivers/watchdog/wdt285.c:170:3: warning: this statement may fall through [-Wimplicit-fallthrough=] drivers/watchdog/ar7_wdt.c:237:3: warning: this statement may fall through [-Wimplicit-fallthrough=] drivers/video/fbdev/omap/omapfb_main.c:449:23: warning: this statement may fall through [-Wimplicit-fallthrough=] drivers/video/fbdev/omap/omapfb_main.c:1549:6: warning: this statement may fall through [-Wimplicit-fallthrough=] drivers/video/fbdev/omap/omapfb_main.c:1547:3: warning: this statement may fall through [-Wimplicit-fallthrough=] drivers/video/fbdev/omap/omapfb_main.c:1545:3: warning: this statement may fall through [-Wimplicit-fallthrough=] drivers/video/fbdev/omap/omapfb_main.c:1543:3: warning: this statement may fall through [-Wimplicit-fallthrough=] drivers/video/fbdev/omap/omapfb_main.c:1540:6: warning: this statement may fall through [-Wimplicit-fallthrough=] drivers/video/fbdev/omap/omapfb_main.c:1538:3: warning: this statement may fall through [-Wimplicit-fallthrough=] drivers/video/fbdev/omap/omapfb_main.c:1535:3: warning: this statement may fall through [-Wimplicit-fallthrough=] Reviewed-by: Kees Cook Signed-off-by: Gustavo A. R. Silva commit 40ad2de37f2a6be5726eb40ed085dff60df3099b Author: Gustavo A. R. Silva Date: Mon Jul 29 20:45:29 2019 -0500 watchdog: riowd: Mark expected switch fall-through Mark switch cases where we are expecting to fall through. This patch fixes the following warnings (Building: sparc64): drivers/watchdog/riowd.c: In function ‘riowd_ioctl’: drivers/watchdog/riowd.c:136:3: warning: this statement may fall through [-Wimplicit-fallthrough=] riowd_writereg(p, riowd_timeout, WDTO_INDEX); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/watchdog/riowd.c:139:2: note: here case WDIOC_GETTIMEOUT: ^~~~ Reviewed-by: Kees Cook Reviewed-by: Guenter Roeck Signed-off-by: Gustavo A. R. Silva commit 7b7331511e66cfe671e88daa7133f6597a86aced Author: Gustavo A. R. Silva Date: Mon Jul 29 19:13:54 2019 -0500 s390/net: Mark expected switch fall-throughs Mark switch cases where we are expecting to fall through. This patch fixes the following warnings (Building: s390): drivers/s390/net/ctcm_fsms.c: In function ‘ctcmpc_chx_attnbusy’: drivers/s390/net/ctcm_fsms.c:1703:6: warning: this statement may fall through [-Wimplicit-fallthrough=] if (grp->changed_side == 1) { ^ drivers/s390/net/ctcm_fsms.c:1707:2: note: here case MPCG_STATE_XID0IOWAIX: ^~~~ drivers/s390/net/ctcm_mpc.c: In function ‘ctc_mpc_alloc_channel’: drivers/s390/net/ctcm_mpc.c:358:6: warning: this statement may fall through [-Wimplicit-fallthrough=] if (callback) ^ drivers/s390/net/ctcm_mpc.c:360:2: note: here case MPCG_STATE_XID0IOWAIT: ^~~~ drivers/s390/net/ctcm_mpc.c: In function ‘mpc_action_timeout’: drivers/s390/net/ctcm_mpc.c:1469:6: warning: this statement may fall through [-Wimplicit-fallthrough=] if ((fsm_getstate(rch->fsm) == CH_XID0_PENDING) && ^ drivers/s390/net/ctcm_mpc.c:1472:2: note: here default: ^~~~~~~ drivers/s390/net/ctcm_mpc.c: In function ‘mpc_send_qllc_discontact’: drivers/s390/net/ctcm_mpc.c:2087:6: warning: this statement may fall through [-Wimplicit-fallthrough=] if (grp->estconnfunc) { ^ drivers/s390/net/ctcm_mpc.c:2092:2: note: here case MPCG_STATE_FLOWC: ^~~~ drivers/s390/net/qeth_l2_main.c: In function ‘qeth_l2_process_inbound_buffer’: drivers/s390/net/qeth_l2_main.c:328:7: warning: this statement may fall through [-Wimplicit-fallthrough=] if (IS_OSN(card)) { ^ drivers/s390/net/qeth_l2_main.c:337:3: note: here default: ^~~~~~~ Reviewed-by: Kees Cook Signed-off-by: Gustavo A. R. Silva commit 3d86c7ad56a9b1109a705a100990f1e7be1d3d43 Author: Gustavo A. R. Silva Date: Mon Jul 29 17:35:45 2019 -0500 crypto: ux500/crypt: Mark expected switch fall-throughs Mark switch cases where we are expecting to fall through. This patch fixes the following warning (Building: arm): drivers/crypto/ux500/cryp/cryp.c: In function ‘cryp_save_device_context’: drivers/crypto/ux500/cryp/cryp.c:316:16: warning: this statement may fall through [-Wimplicit-fallthrough=] ctx->key_4_r = readl_relaxed(&src_reg->key_4_r); drivers/crypto/ux500/cryp/cryp.c:318:2: note: here case CRYP_KEY_SIZE_192: ^~~~ drivers/crypto/ux500/cryp/cryp.c:320:16: warning: this statement may fall through [-Wimplicit-fallthrough=] ctx->key_3_r = readl_relaxed(&src_reg->key_3_r); drivers/crypto/ux500/cryp/cryp.c:322:2: note: here case CRYP_KEY_SIZE_128: ^~~~ drivers/crypto/ux500/cryp/cryp.c:324:16: warning: this statement may fall through [-Wimplicit-fallthrough=] ctx->key_2_r = readl_relaxed(&src_reg->key_2_r); drivers/crypto/ux500/cryp/cryp.c:326:2: note: here default: ^~~~~~~ In file included from ./include/linux/io.h:13:0, from drivers/crypto/ux500/cryp/cryp_p.h:14, from drivers/crypto/ux500/cryp/cryp.c:15: drivers/crypto/ux500/cryp/cryp.c: In function ‘cryp_restore_device_context’: ./arch/arm/include/asm/io.h:92:22: warning: this statement may fall through [-Wimplicit-fallthrough=] #define __raw_writel __raw_writel ^ ./arch/arm/include/asm/io.h:299:29: note: in expansion of macro ‘__raw_writel’ #define writel_relaxed(v,c) __raw_writel((__force u32) cpu_to_le32(v),c) ^~~~~~~~~~~~ drivers/crypto/ux500/cryp/cryp.c:363:3: note: in expansion of macro ‘writel_relaxed’ writel_relaxed(ctx->key_4_r, ®->key_4_r); ^~~~~~~~~~~~~~ drivers/crypto/ux500/cryp/cryp.c:365:2: note: here case CRYP_KEY_SIZE_192: ^~~~ In file included from ./include/linux/io.h:13:0, from drivers/crypto/ux500/cryp/cryp_p.h:14, from drivers/crypto/ux500/cryp/cryp.c:15: ./arch/arm/include/asm/io.h:92:22: warning: this statement may fall through [-Wimplicit-fallthrough=] #define __raw_writel __raw_writel ^ ./arch/arm/include/asm/io.h:299:29: note: in expansion of macro ‘__raw_writel’ #define writel_relaxed(v,c) __raw_writel((__force u32) cpu_to_le32(v),c) ^~~~~~~~~~~~ drivers/crypto/ux500/cryp/cryp.c:367:3: note: in expansion of macro ‘writel_relaxed’ writel_relaxed(ctx->key_3_r, ®->key_3_r); ^~~~~~~~~~~~~~ drivers/crypto/ux500/cryp/cryp.c:369:2: note: here case CRYP_KEY_SIZE_128: ^~~~ In file included from ./include/linux/io.h:13:0, from drivers/crypto/ux500/cryp/cryp_p.h:14, from drivers/crypto/ux500/cryp/cryp.c:15: ./arch/arm/include/asm/io.h:92:22: warning: this statement may fall through [-Wimplicit-fallthrough=] #define __raw_writel __raw_writel ^ ./arch/arm/include/asm/io.h:299:29: note: in expansion of macro ‘__raw_writel’ #define writel_relaxed(v,c) __raw_writel((__force u32) cpu_to_le32(v),c) ^~~~~~~~~~~~ drivers/crypto/ux500/cryp/cryp.c:371:3: note: in expansion of macro ‘writel_relaxed’ writel_relaxed(ctx->key_2_r, ®->key_2_r); ^~~~~~~~~~~~~~ drivers/crypto/ux500/cryp/cryp.c:373:2: note: here default: ^~~~~~~ Signed-off-by: Gustavo A. R. Silva commit d51c61637b4aca6c06015a34063e41279c32b8e8 Author: Gustavo A. R. Silva Date: Mon Jul 29 17:30:57 2019 -0500 watchdog: wdt977: Mark expected switch fall-through Mark switch cases where we are expecting to fall through. This patch fixes the following warning (Building: arm): drivers/watchdog/wdt977.c: In function ‘wdt977_ioctl’: LD [M] drivers/media/platform/vicodec/vicodec.o drivers/watchdog/wdt977.c:400:3: warning: this statement may fall through [-Wimplicit-fallthrough=] wdt977_keepalive(); ^~~~~~~~~~~~~~~~~~ drivers/watchdog/wdt977.c:403:2: note: here case WDIOC_GETTIMEOUT: ^~~~ Reviewed-by: Kees Cook Reviewed-by: Guenter Roeck Signed-off-by: Gustavo A. R. Silva commit 24f2161887c90ca3791f0224933642b6da7f9573 Author: Gustavo A. R. Silva Date: Mon Jul 29 15:03:49 2019 -0500 watchdog: scx200_wdt: Mark expected switch fall-through Mark switch cases where we are expecting to fall through. This patch fixes the following warning (Building: i386): drivers/watchdog/scx200_wdt.c: In function ‘scx200_wdt_ioctl’: drivers/watchdog/scx200_wdt.c:188:3: warning: this statement may fall through [-Wimplicit-fallthrough=] scx200_wdt_ping(); ^~~~~~~~~~~~~~~~~ drivers/watchdog/scx200_wdt.c:189:2: note: here case WDIOC_GETTIMEOUT: ^~~~ Reviewed-by: Kees Cook Reviewed-by: Guenter Roeck Signed-off-by: Gustavo A. R. Silva commit d259f94f7265065b5c2b2bd5bbe4fa9b76504440 Author: Gustavo A. R. Silva Date: Mon Jul 29 10:08:05 2019 -0500 watchdog: Mark expected switch fall-throughs Mark switch cases where we are expecting to fall through. This patch fixes the following warnings: drivers/watchdog/ar7_wdt.c: warning: this statement may fall through [-Wimplicit-fallthrough=]: => 237:3 drivers/watchdog/pcwd.c: warning: this statement may fall through [-Wimplicit-fallthrough=]: => 653:3 drivers/watchdog/sb_wdog.c: warning: this statement may fall through [-Wimplicit-fallthrough=]: => 204:3 drivers/watchdog/wdt.c: warning: this statement may fall through [-Wimplicit-fallthrough=]: => 391:3 Reported-by: Geert Uytterhoeven Reviewed-by: Kees Cook Reviewed-by: Guenter Roeck Signed-off-by: Gustavo A. R. Silva commit e9d81fc5b2014eb17d45ba4940bfb603d57bbcb3 Author: Gustavo A. R. Silva Date: Sun Jul 28 19:11:11 2019 -0500 ARM: signal: Mark expected switch fall-through Mark switch cases where we are expecting to fall through. This patch fixes the following warning: arch/arm/kernel/signal.c: In function 'do_signal': arch/arm/kernel/signal.c:598:12: warning: this statement may fall through [-Wimplicit-fallthrough=] restart -= 2; ~~~~~~~~^~~~ arch/arm/kernel/signal.c:599:3: note: here case -ERESTARTNOHAND: ^~~~ Reported-by: Stephen Rothwell Reviewed-by: Kees Cook Signed-off-by: Gustavo A. R. Silva commit 9039782047e769bd446667a9c14c0d3b8948ae51 Author: Gustavo A. R. Silva Date: Sun Jul 28 18:57:05 2019 -0500 mfd: omap-usb-host: Mark expected switch fall-throughs Mark switch cases where we are expecting to fall through. This patch fixes the following warnings: drivers/mfd/omap-usb-host.c: In function 'usbhs_runtime_resume': drivers/mfd/omap-usb-host.c:303:7: warning: this statement may fall through [-Wimplicit-fallthrough=] if (!IS_ERR(omap->hsic480m_clk[i])) { ^ drivers/mfd/omap-usb-host.c:313:3: note: here case OMAP_EHCI_PORT_MODE_TLL: ^~~~ drivers/mfd/omap-usb-host.c: In function 'usbhs_runtime_suspend': drivers/mfd/omap-usb-host.c:345:7: warning: this statement may fall through [-Wimplicit-fallthrough=] if (!IS_ERR(omap->hsic480m_clk[i])) ^ drivers/mfd/omap-usb-host.c:349:3: note: here case OMAP_EHCI_PORT_MODE_TLL: ^~~~ Reported-by: Stephen Rothwell Reviewed-by: Kees Cook Signed-off-by: Gustavo A. R. Silva commit 795952d9f40c451a8b22c6610df1d59f57ce2046 Author: Gustavo A. R. Silva Date: Sun Jul 28 18:53:15 2019 -0500 mfd: db8500-prcmu: Mark expected switch fall-throughs Mark switch cases where we are expecting to fall through. This patch fixes the following warnings: drivers/mfd/db8500-prcmu.c: In function 'dsiclk_rate': drivers/mfd/db8500-prcmu.c:1592:7: warning: this statement may fall through [-Wimplicit-fallthrough=] div *= 2; ~~~~^~~~ drivers/mfd/db8500-prcmu.c:1593:2: note: here case PRCM_DSI_PLLOUT_SEL_PHI_2: ^~~~ drivers/mfd/db8500-prcmu.c:1594:7: warning: this statement may fall through [-Wimplicit-fallthrough=] div *= 2; ~~~~^~~~ drivers/mfd/db8500-prcmu.c:1595:2: note: here case PRCM_DSI_PLLOUT_SEL_PHI: ^~~~ Reported-by: Stephen Rothwell Reviewed-by: Kees Cook Reviewed-by: Linus Walleij Signed-off-by: Gustavo A. R. Silva commit 3da6bd945b71c5fdd5db7b19224b8fc0b4d78ed8 Author: Gustavo A. R. Silva Date: Sun Jul 28 18:19:41 2019 -0500 ARM: OMAP: dma: Mark expected switch fall-throughs Mark switch cases where we are expecting to fall through. This patch fixes the following warnings: arch/arm/plat-omap/dma.c: In function 'omap_set_dma_src_burst_mode': arch/arm/plat-omap/dma.c:384:6: warning: this statement may fall through [-Wimplicit-fallthrough=] if (dma_omap2plus()) { ^ arch/arm/plat-omap/dma.c:393:2: note: here case OMAP_DMA_DATA_BURST_16: ^~~~ arch/arm/plat-omap/dma.c:394:6: warning: this statement may fall through [-Wimplicit-fallthrough=] if (dma_omap2plus()) { ^ arch/arm/plat-omap/dma.c:402:2: note: here default: ^~~~~~~ arch/arm/plat-omap/dma.c: In function 'omap_set_dma_dest_burst_mode': arch/arm/plat-omap/dma.c:473:6: warning: this statement may fall through [-Wimplicit-fallthrough=] if (dma_omap2plus()) { ^ arch/arm/plat-omap/dma.c:481:2: note: here default: ^~~~~~~ Notice that, in this particular case, the code comment is modified in accordance with what GCC is expecting to find. Reported-by: Stephen Rothwell Reviewed-by: Kees Cook Signed-off-by: Gustavo A. R. Silva commit e7c0c9f6028dfa09ea9f20c5f1d387e5858afede Author: Gustavo A. R. Silva Date: Sun Jul 28 18:17:18 2019 -0500 ARM: alignment: Mark expected switch fall-throughs Mark switch cases where we are expecting to fall through. This patch fixes the following warnings: arch/arm/mm/alignment.c: In function 'thumb2arm': arch/arm/mm/alignment.c:688:6: warning: this statement may fall through [-Wimplicit-fallthrough=] if ((tinstr & (3 << 9)) == 0x0400) { ^ arch/arm/mm/alignment.c:700:2: note: here default: ^~~~~~~ arch/arm/mm/alignment.c: In function 'do_alignment_t32_to_handler': arch/arm/mm/alignment.c:753:15: warning: this statement may fall through [-Wimplicit-fallthrough=] poffset->un = (tinst2 & 0xff) << 2; ~~~~~~~~~~~~^~~~~~~~~~~~~~~~~~~~~~ arch/arm/mm/alignment.c:754:2: note: here case 0xe940: ^~~~ Reported-by: Stephen Rothwell Reviewed-by: Kees Cook Signed-off-by: Gustavo A. R. Silva commit 9b76ad3a9cc5ebb1dde650c8a9937f045e2707a2 Author: Gustavo A. R. Silva Date: Sun Jul 28 18:10:21 2019 -0500 ARM: tegra: Mark expected switch fall-through Mark switch cases where we are expecting to fall through. This patch fixes the following warning: arch/arm/mach-tegra/reset.c: In function 'tegra_cpu_reset_handler_enable': arch/arm/mach-tegra/reset.c:72:3: warning: this statement may fall through [-Wimplicit-fallthrough=] tegra_cpu_reset_handler_set(reset_address); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ arch/arm/mach-tegra/reset.c:74:2: note: here case 0: ^~~~ Reported-by: Stephen Rothwell Reviewed-by: Kees Cook Signed-off-by: Gustavo A. R. Silva commit 2d0e988d8427b7b9c6d5c7835b6944405c038011 Author: Gustavo A. R. Silva Date: Sun Jul 28 18:02:41 2019 -0500 ARM/hw_breakpoint: Mark expected switch fall-throughs Mark switch cases where we are expecting to fall through. This patch fixes the following warnings: arch/arm/kernel/hw_breakpoint.c: In function 'hw_breakpoint_arch_parse': arch/arm/kernel/hw_breakpoint.c:609:6: warning: this statement may fall through [-Wimplicit-fallthrough=] if (hw->ctrl.len == ARM_BREAKPOINT_LEN_2) ^ arch/arm/kernel/hw_breakpoint.c:611:2: note: here case 3: ^~~~ arch/arm/kernel/hw_breakpoint.c:613:6: warning: this statement may fall through [-Wimplicit-fallthrough=] if (hw->ctrl.len == ARM_BREAKPOINT_LEN_1) ^ arch/arm/kernel/hw_breakpoint.c:615:2: note: here default: ^~~~~~~ arch/arm/kernel/hw_breakpoint.c: In function 'arch_build_bp_info': arch/arm/kernel/hw_breakpoint.c:544:6: warning: this statement may fall through [-Wimplicit-fallthrough=] if ((hw->ctrl.type != ARM_BREAKPOINT_EXECUTE) ^ arch/arm/kernel/hw_breakpoint.c:547:2: note: here default: ^~~~~~~ In file included from include/linux/kernel.h:11, from include/linux/list.h:9, from include/linux/preempt.h:11, from include/linux/hardirq.h:5, from arch/arm/kernel/hw_breakpoint.c:16: arch/arm/kernel/hw_breakpoint.c: In function 'hw_breakpoint_pending': include/linux/compiler.h:78:22: warning: this statement may fall through [-Wimplicit-fallthrough=] # define unlikely(x) __builtin_expect(!!(x), 0) ^~~~~~~~~~~~~~~~~~~~~~~~~~ include/asm-generic/bug.h:136:2: note: in expansion of macro 'unlikely' unlikely(__ret_warn_on); \ ^~~~~~~~ arch/arm/kernel/hw_breakpoint.c:863:3: note: in expansion of macro 'WARN' WARN(1, "Asynchronous watchpoint exception taken. Debugging results may be unreliable\n"); ^~~~ arch/arm/kernel/hw_breakpoint.c:864:2: note: here case ARM_ENTRY_SYNC_WATCHPOINT: ^~~~ arch/arm/kernel/hw_breakpoint.c: In function 'core_has_os_save_restore': arch/arm/kernel/hw_breakpoint.c:910:6: warning: this statement may fall through [-Wimplicit-fallthrough=] if (oslsr & ARM_OSLSR_OSLM0) ^ arch/arm/kernel/hw_breakpoint.c:912:2: note: here default: ^~~~~~~ Reported-by: Stephen Rothwell Reviewed-by: Kees Cook Signed-off-by: Gustavo A. R. Silva commit 7f20fd23377ac3356657ce35fcaf19ee2fea8345 Merge: 15abf14202a2 a738b5e75b4c Author: Linus Torvalds Date: Fri Aug 9 15:46:29 2019 -0700 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm Pull kvm fixes from Paolo Bonzini: "Bugfixes (arm and x86) and cleanups" * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: selftests: kvm: Adding config fragments KVM: selftests: Update gitignore file for latest changes kvm: remove unnecessary PageReserved check KVM: arm/arm64: vgic: Reevaluate level sensitive interrupts on enable KVM: arm: Don't write junk to CP15 registers on reset KVM: arm64: Don't write junk to sysregs on reset KVM: arm/arm64: Sync ICH_VMCR_EL2 back when about to block x86: kvm: remove useless calls to kvm_para_available KVM: no need to check return value of debugfs_create functions KVM: remove kvm_arch_has_vcpu_debugfs() KVM: Fix leak vCPU's VMCS value into other pCPU KVM: Check preempted_in_kernel for involuntary preemption KVM: LAPIC: Don't need to wakeup vCPU twice afer timer fire arm64: KVM: hyp: debug-sr: Mark expected switch fall-through KVM: arm64: Update kvm_arm_exception_class and esr_class_str for new EC KVM: arm: vgic-v3: Mark expected switch fall-through arm64: KVM: regmap: Fix unexpected switch fall-through KVM: arm/arm64: Introduce kvm_pmu_vcpu_init() to setup PMU counter index commit 15abf14202a2fe7e5c5fc0e815587f45de4fd500 Merge: 2226fb57a908 849f5ae3a513 Author: Linus Torvalds Date: Fri Aug 9 15:31:19 2019 -0700 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input Pull input updates from Dmitry Torokhov: - newer systems with Elan touchpads will be switched over to SMBus - HP Spectre X360 will be using SMbus/RMI4 - checks for invalid USB descriptors in kbtab and iforce - build fixes for applespi driver (misconfigs) * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: Input: iforce - add sanity checks Input: applespi - use struct_size() helper Input: kbtab - sanity check for endpoint type Input: usbtouchscreen - initialize PM mutex before using it Input: applespi - add dependency on LEDS_CLASS Input: synaptics - enable RMI mode for HP Spectre X360 Input: elantech - annotate fall-through case in elantech_use_host_notify() Input: elantech - enable SMBus on new (2018+) systems Input: applespi - fix trivial typo in struct description Input: applespi - select CRC16 module Input: applespi - fix warnings detected by sparse commit 06282373ff57a2b82621be4f84f981e1b0a4eb28 Author: Dan Williams Date: Thu Aug 8 14:43:49 2019 -0700 mm/memremap: Fix reuse of pgmap instances with internal references Currently, attempts to shutdown and re-enable a device-dax instance trigger: Missing reference count teardown definition WARNING: CPU: 37 PID: 1608 at mm/memremap.c:211 devm_memremap_pages+0x234/0x850 [..] RIP: 0010:devm_memremap_pages+0x234/0x850 [..] Call Trace: dev_dax_probe+0x66/0x190 [device_dax] really_probe+0xef/0x390 driver_probe_device+0xb4/0x100 device_driver_attach+0x4f/0x60 Given that the setup path initializes pgmap->ref, arrange for it to be also torn down so devm_memremap_pages() is ready to be called again and not be mistaken for the 3rd-party per-cpu-ref case. Fixes: 24917f6b1041 ("memremap: provide an optional internal refcount in struct dev_pagemap") Reported-by: Fan Du Tested-by: Vishal Verma Cc: Andrew Morton Cc: Christoph Hellwig Cc: Ira Weiny Cc: Jason Gunthorpe Reviewed-by: Christoph Hellwig Link: https://lore.kernel.org/r/156530042781.2068700.8733813683117819799.stgit@dwillia2-desk3.amr.corp.intel.com Signed-off-by: Dan Williams commit e6a9522ac3ff59980ea00e070b6b8573aface36a Author: Josh Poimboeuf Date: Thu Jul 25 15:29:57 2019 -0500 drm/i915: Remove redundant user_access_end() from __copy_from_user() error path Objtool reports: drivers/gpu/drm/i915/gem/i915_gem_execbuffer.o: warning: objtool: .altinstr_replacement+0x36: redundant UACCESS disable __copy_from_user() already does both STAC and CLAC, so the user_access_end() in its error path adds an extra unnecessary CLAC. Fixes: 0b2c8f8b6b0c ("i915: fix missing user_access_end() in page fault exception case") Reported-by: Thomas Gleixner Reported-by: Sedat Dilek Signed-off-by: Josh Poimboeuf Signed-off-by: Thomas Gleixner Tested-by: Nick Desaulniers Tested-by: Sedat Dilek Acked-by: Peter Zijlstra (Intel) Acked-by: Chris Wilson Link: https://github.com/ClangBuiltLinux/linux/issues/617 Link: https://lkml.kernel.org/r/51a4155c5bc2ca847a9cbe85c1c11918bb193141.1564086017.git.jpoimboe@redhat.com commit 6d0d779dca73cd5acb649c54f81401f93098b298 Author: Dexuan Cui Date: Fri Aug 9 01:58:08 2019 +0000 hv_netvsc: Fix a warning of suspicious RCU usage This fixes a warning of "suspicious rcu_dereference_check() usage" when nload runs. Fixes: 776e726bfb34 ("netvsc: fix RCU warning in get_stats") Signed-off-by: Dexuan Cui Signed-off-by: David S. Miller commit 9566e650bf7fdf58384bb06df634f7531ca3a97e Merge: 8b6381600d59 a4e508cab623 Author: David S. Miller Date: Fri Aug 9 13:23:33 2019 -0700 Merge tag 'mlx5-fixes-2019-08-08' of git://git.kernel.org/pub/scm/linux/kernel/git/saeed/linux Saeed Mahameed says: ==================== Mellanox, mlx5 fixes 2019-08-08 This series introduces some fixes to mlx5 driver. Highlights: 1) From Tariq, Critical mlx5 kTLS fixes to better align with hw specs. 2) From Aya, Fixes to mlx5 tx devlink health reporter. 3) From Maxim, aRFs parsing to use flow dissector to avoid relying on invalid skb fields. Please pull and let me know if there is any problem. For -stable v4.3 ('net/mlx5e: Only support tx/rx pause setting for port owner') For -stable v4.9 ('net/mlx5e: Use flow keys dissector to parse packets for ARFS') For -stable v5.1 ('net/mlx5e: Fix false negative indication on tx reporter CQE recovery') ('net/mlx5e: Remove redundant check in CQE recovery flow of tx reporter') ('net/mlx5e: ethtool, Avoid setting speed to 56GBASE when autoneg off') Note: when merged with net-next this minor conflict will pop up: ++<<<<<<< (net-next) + if (is_eswitch_flow) { + flow->esw_attr->match_level = match_level; + flow->esw_attr->tunnel_match_level = tunnel_match_level; ++======= + if (flow->flags & MLX5E_TC_FLOW_ESWITCH) { + flow->esw_attr->inner_match_level = inner_match_level; + flow->esw_attr->outer_match_level = outer_match_level; ++>>>>>>> (net) To resolve, use hunks from net (2nd) and replace: if (flow->flags & MLX5E_TC_FLOW_ESWITCH) with if (is_eswitch_flow) ==================== Signed-off-by: David S. Miller commit 8b6381600d59871fbe44d36522272f961ab42410 Author: Taehee Yoo Date: Thu Aug 8 09:37:56 2019 -0700 ixgbe: fix possible deadlock in ixgbe_service_task() ixgbe_service_task() calls unregister_netdev() under rtnl_lock(). But unregister_netdev() internally calls rtnl_lock(). So deadlock would occur. Fixes: 59dd45d550c5 ("ixgbe: firmware recovery mode") Signed-off-by: Taehee Yoo Tested-by: Andrew Bowers Signed-off-by: Jeff Kirsher Signed-off-by: David S. Miller commit 703acf62596589acba6bfa31ab5573d1e8e4afa6 Merge: 7bac762d8da3 609a2ca57afc Author: David S. Miller Date: Fri Aug 9 13:14:46 2019 -0700 Merge branch 'Fix-collisions-in-socket-cookie-generation' Daniel Borkmann says: ==================== Fix collisions in socket cookie generation This change makes the socket cookie generator as a global counter instead of per netns in order to fix cookie collisions for BPF use cases we ran into. See main patch #1 for more details. Given the change is small/trivial and fixes an issue we're seeing my preference would be net tree (though it cleanly applies to net-next as well). Went for net tree instead of bpf tree here given the main change is in net/core/sock_diag.c, but either way would be fine with me. v1 -> v2: - Fix up commit description in patch #1, thanks Eric! ==================== Signed-off-by: David S. Miller commit 609a2ca57afc467fbc46b7f3453de4e1811456c5 Author: Daniel Borkmann Date: Thu Aug 8 13:57:26 2019 +0200 bpf: sync bpf.h to tools infrastructure Pull in updates in BPF helper function description. Signed-off-by: Daniel Borkmann Signed-off-by: David S. Miller commit cd48bdda4fb82c2fe569d97af4217c530168c99c Author: Daniel Borkmann Date: Thu Aug 8 13:57:25 2019 +0200 sock: make cookie generation global instead of per netns Generating and retrieving socket cookies are a useful feature that is exposed to BPF for various program types through bpf_get_socket_cookie() helper. The fact that the cookie counter is per netns is quite a limitation for BPF in practice in particular for programs in host namespace that use socket cookies as part of a map lookup key since they will be causing socket cookie collisions e.g. when attached to BPF cgroup hooks or cls_bpf on tc egress in host namespace handling container traffic from veth or ipvlan devices with peer in different netns. Change the counter to be global instead. Socket cookie consumers must assume the value as opqaue in any case. Not every socket must have a cookie generated and knowledge of the counter value itself does not provide much value either way hence conversion to global is fine. Signed-off-by: Daniel Borkmann Cc: Eric Dumazet Cc: Alexei Starovoitov Cc: Willem de Bruijn Cc: Martynas Pumputis Signed-off-by: David S. Miller commit 45f5d5a9e34d3fe4140a9a3b5f7ebe86c252440a Author: Geert Uytterhoeven Date: Wed Jul 31 09:48:01 2019 +0200 arm64: dts: renesas: r8a77995: draak: Fix backlight regulator name Currently there are two nodes named "regulator1" in the Draak DTS: a 3.3V regulator for the eMMC and the LVDS decoder, and a 12V regulator for the backlight. This causes the former to be overwritten by the latter. Fix this by renaming all regulators with numerical suffixes to use named suffixes, which are less likely to conflict. Fixes: 4fbd4158fe8967e9 ("arm64: dts: renesas: r8a77995: draak: Add backlight") Signed-off-by: Geert Uytterhoeven Signed-off-by: Simon Horman commit 7bac762d8da39ae215171bfa93c6662894ce17dc Merge: 8c25d0887a8b e8c3af6bb33a Author: David S. Miller Date: Fri Aug 9 11:27:17 2019 -0700 Merge tag 'rxrpc-fixes-20190809' of git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs David Howells says: ==================== Here's a couple of fixes for rxrpc: (1) Fix refcounting of the local endpoint. (2) Don't calculate or report packet skew information. This has been obsolete since AFS 3.1 and so is a waste of resources. ==================== Signed-off-by: David S. Miller commit c07d8d47bca1b325102fa2be3a463075f7b051d9 Author: Masahiro Yamada Date: Thu Aug 8 20:21:11 2019 +0900 kbuild: show hint if subdir-y/m is used to visit module Makefile Since commit ff9b45c55b26 ("kbuild: modpost: read modules.order instead of $(MODVERDIR)/*.mod"), a module is no longer built in the following pattern: [Makefile] subdir-y := some-module [some-module/Makefile] obj-m := some-module.o You cannot write Makefile this way in upstream because modules.order is not correctly generated. subdir-y is used to descend to a sub-directory that builds tools, device trees, etc. For external modules, the modules order does not matter. So, the Makefile above was known to work. I believe the Makefile should be re-written as follows: [Makefile] obj-m := some-module/ [some-module/Makefile] obj-m := some-module.o However, people will have no idea if their Makefile suddenly stops working. In fact, I received questions from multiple people. Show a warning for a while if obj-m is specified in a Makefile visited by subdir-y or subdir-m. I touched the %/ rule to avoid false-positive warnings for the single target. Cc: Jan Kiszka Cc: Tom Stonecypher Signed-off-by: Masahiro Yamada Tested-by: Jan Kiszka commit 4f2c8f3089f538f556c86f26603a062865e4aa94 Author: Masahiro Yamada Date: Tue Aug 6 19:03:22 2019 +0900 kbuild: generate modules.order only in directories visited by obj-y/m The modules.order files in directories visited by the chain of obj-y or obj-m are merged to the upper-level ones, and become parts of the top-level modules.order. On the other hand, there is no need to generate modules.order in directories visited by subdir-y or subdir-m since they would become orphan anyway. Signed-off-by: Masahiro Yamada commit d9f78edfd81b9e484423534360350ef7253cc888 Author: Masahiro Yamada Date: Tue Aug 6 19:03:21 2019 +0900 kbuild: fix false-positive need-builtin calculation The current implementation of need-builtin is false-positive, for example, in the following Makefile: obj-m := foo/ obj-y := foo/bar/ ..., where foo/built-in.a is not required. Signed-off-by: Masahiro Yamada commit 47801c97deb71b9e279c15a02a44cf00aa11e7d9 Author: Masahiro Yamada Date: Fri Aug 2 19:23:58 2019 +0900 kbuild: revive single target %.ko I removed the single target %.ko in commit ff9b45c55b26 ("kbuild: modpost: read modules.order instead of $(MODVERDIR)/*.mod") because the modpost stage does not work reliably. For instance, the module dependency, modversion, etc. do not work if we lack symbol information from the other modules. Yet, some people still want to build only one module in their interest, and it may be still useful if it is used within those limitations. Fixes: ff9b45c55b26 ("kbuild: modpost: read modules.order instead of $(MODVERDIR)/*.mod") Reported-by: Don Brace Reported-by: Arend Van Spriel Signed-off-by: Masahiro Yamada commit 2226fb57a908330c7e2b83d363d450f2000de837 Merge: 15a555a4b8be a111ef6b0822 Author: Linus Torvalds Date: Fri Aug 9 09:35:23 2019 -0700 Merge tag 'drm-fixes-2019-08-09' of git://anongit.freedesktop.org/drm/drm Pull drm fixes from Dave Airlie: "Usual fixes roundup. Nothing too crazy or serious, one non-released ioctl is removed in the amdkfd driver. core: - mode parser strncpy fix i915: - GLK DSI escape clock setting - HDCP memleak fix tegra: - one gpiod/of regression fix amdgpu: - fix VCN to handle the latest navi10 firmware - fix for fan control on navi10 - properly handle SMU metrics table on navi10 - fix a resume regression on Stoney - kfd revert a GWS ioctl vmwgfx: - memory leak fix rockchip: - suspend fix" * tag 'drm-fixes-2019-08-09' of git://anongit.freedesktop.org/drm/drm: drm/vmwgfx: fix memory leak when too many retries have occurred Revert "drm/amdkfd: New IOCTL to allocate queue GWS" Revert "drm/amdgpu: fix transform feedback GDS hang on gfx10 (v2)" drm/amdgpu: pin the csb buffer on hw init for gfx v8 drm/rockchip: Suspend DP late drm/i915: Fix wrong escape clock divisor init for GLK drm/i915: fix possible memory leak in intel_hdcp_auth_downstream() drm/modes: Fix unterminated strncpy drm/amd/powerplay: correct navi10 vcn powergate drm/amd/powerplay: honor hw limit on fetching metrics data for navi10 drm/amd/powerplay: Allow changing of fan_control in smu_v11_0 drm/amd/amdgpu/vcn_v2_0: Move VCN 2.0 specific dec ring test to vcn_v2_0 drm/amd/amdgpu/vcn_v2_0: Mark RB commands as KMD commands drm/tegra: Fix gpiod_get_from_of_node() regression commit 15a555a4b8be26683d77df8d5dbe8ac83f5ec3a6 Merge: cb7ef4bc9272 30e235389faa Author: Linus Torvalds Date: Fri Aug 9 09:31:40 2019 -0700 Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux Pull arm64 fix from Catalin Marinas: "Fix bad_pte warning caused by pte_mkdevmap() not setting PTE_SPECIAL" * tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux: arm64: mm: add missing PTE_SPECIAL in pte_mkdevmap on arm64 commit cb7ef4bc927233304aeeeb891c1cfc5ad6f87975 Merge: 50e73a4a4159 404861e15b5f Author: Linus Torvalds Date: Fri Aug 9 09:30:00 2019 -0700 Merge tag 's390-5.3-5' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux Pull s390 fixes from Vasily Gorbik: - Map vdso also for statically linked binaries like all other architectures. - Fix no .bss usage compile-time check to account common objects with the help of binutils size tool. Top level Makefile change acked-by Masahiro. - A fix to make perf happy with _etext symbol type. - Fix dump_pagetables which is broken since p*d_offset implementation change to comply with mm/gup.c expectations. - Revert memory sharing for diag calls in protected virtualization, since this is not required after all. - Couple of other minor code cleanups. * tag 's390-5.3-5' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux: s390/vdso: map vdso also for statically linked binaries s390/build: use size command to perform empty .bss check kbuild: add OBJSIZE variable for the size tool s390: put _stext and _etext into .text section s390/head64: cleanup unused labels s390/unwind: remove stack recursion warning s390/setup: adjust start_code of init_mm to _text s390/mm: fix dump_pagetables top level page table walking s390/protvirt: avoid memory sharing for diag 308 set/store commit 50e73a4a41598f9a785a986d25b731d3968dedb1 Merge: 461d2815ac9e 20621fedb2a6 Author: Linus Torvalds Date: Fri Aug 9 09:28:18 2019 -0700 Merge tag 'for-linus-20190809' of git://git.kernel.dk/linux-block Pull block fixes from Jens Axboe: - Revert of a bcache patch that caused an oops for some (Coly) - ata rb532 unused warning fix (Gustavo) - AoE kernel crash fix (He) - Error handling fixup for blkdev_get() (Jan) - libata read/write translation and SFF PIO fix (me) - Use after free and error handling fix for O_DIRECT fragments. There's still a nowait + sync oddity in there, we'll nail that start next week. If all else fails, I'll queue a revert of the NOWAIT change. (me) - Loop GFP_KERNEL -> GFP_NOIO deadlock fix (Mikulas) - Two BFQ regression fixes that caused crashes (Paolo) * tag 'for-linus-20190809' of git://git.kernel.dk/linux-block: bcache: Revert "bcache: use sysfs_match_string() instead of __sysfs_match_string()" loop: set PF_MEMALLOC_NOIO for the worker thread bdev: Fixup error handling in blkdev_get() block, bfq: handle NULL return value by bfq_init_rq() block, bfq: move update of waker and woken list to queue freeing block, bfq: reset last_completed_rq_bfqq if the pointed queue is freed block: aoe: Fix kernel crash due to atomic sleep when exiting libata: add SG safety checks in SFF pio transfers libata: have ata_scsi_rw_xlat() fail invalid passthrough requests block: fix O_DIRECT error handling for bio fragments ata: rb532_cf: Fix unused variable warning in rb532_pata_driver_probe commit 461d2815ac9ec1b3f66fc243cc39bd2374facafa Merge: ec4c99ad7bd2 b803974a8603 Author: Linus Torvalds Date: Fri Aug 9 09:26:47 2019 -0700 Merge tag 'mmc-v5.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc Pull MMC fixes from Ulf Hansson: - cavium: Fix DMA support - sdhci-sprd: Fix soft reset when runtime resuming" * tag 'mmc-v5.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc: mmc: cavium: Add the missing dma unmap when the dma has finished. mmc: cavium: Set the correct dma max segment size for mmc_host mmc: sdhci-sprd: Fix the incorrect soft reset operation when runtime resuming commit ec4c99ad7bd23dd39ffb1381136cefa4bb632e31 Merge: c808f2ad8fcd 6a7553e8d84d Author: Linus Torvalds Date: Fri Aug 9 09:24:49 2019 -0700 Merge tag 'fbdev-v5.3-rc4' of git://github.com/bzolnier/linux Pull fbdev fix from Bartlomiej Zolnierkiewicz: "fbdev patches will now go to upstream through drm-misc tree for improved maintainership and better integration testing so update MAINTAINERS file accordingly" * tag 'fbdev-v5.3-rc4' of git://github.com/bzolnier/linux: MAINTAINERS: handle fbdev changes through drm-misc tree commit c808f2ad8fcddb856ce42901cd5b4f06f9da9184 Merge: cb42f06c9f41 6cf9481b440d Author: Linus Torvalds Date: Fri Aug 9 09:23:23 2019 -0700 Merge tag 'pwm/for-5.3-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/thierry.reding/linux-pwm Pull pwm fix from Thierry Reding: "A single fix for a backlight brightness regression introduced in this merge window" * tag 'pwm/for-5.3-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/thierry.reding/linux-pwm: pwm: Fallback to the static lookup-list when acpi_pwm_get fails commit cb42f06c9f418ec2ee56667d01e9ba965a4c61c9 Merge: 6c02b6300fec 1be3c1fae6c1 Author: Linus Torvalds Date: Fri Aug 9 09:21:27 2019 -0700 Merge tag 'sound-5.3-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "Lots of small fixes at this time since we've received the ASoC fix batch now. - Some coverage in ASoC core mostly for minor issues like NULL checks for DPCM and proper error handling in DAI instantiation - A collection of small device-specific changes in various ASoC codec and platform drivers - OF-tree refcount fixes in a few ASoC drivers - Fixes of memory leaks in the error paths of various ASoC / ALSA drivers - A workaround for a long-standing issue on AMD HD-audio device - Updates of MAINTAINERS, mail addresses, file permission fixups" * tag 'sound-5.3-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (38 commits) ALSA: firewire: fix a memory leak bug sound: fix a memory leak bug ALSA: hda - Workaround for crackled sound on AMD controller (1022:1457) ALSA: hiface: fix multiple memory leak bugs ALSA: hda - Don't override global PCM hw info flag ALSA: usb-audio: fix a memory leak bug ASoC: max98373: Remove executable bits ASoC: amd: acp3x: use dma address for acp3x dma driver ASoC: amd: acp3x: use dma_ops of parent device for acp3x dma driver ASoC: max98373: add 88200 and 96000 sampling rate support ASoC: sun4i-i2s: Incorrect SR and WSS computation MAINTAINERS: Update Intel ASoC drivers maintainers ASoC: ti: davinci-mcasp: Correct slot_width posed constraint ASoC: rockchip: Fix mono capture ASoC: Intel: Fix some acpi vs apci typo in somme comments ASoC: ti: davinci-mcasp: Fix clk PDIR handling for i2s master mode ASoC: Fail card instantiation if DAI format setup fails ASoC: SOF: Intel: hda: remove misleading error trace from IRQ thread ASoC: qcom: apq8016_sbc: Fix oops with multiple DAI links ASoC: dapm: fix a memory leak bug ... commit 6c02b6300fec062405ed0215e8ed1ed2b690da55 Merge: 0acf5676dc0f 92f5b0313e37 Author: Linus Torvalds Date: Fri Aug 9 09:19:53 2019 -0700 Merge tag 'media/v5.3-3' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media Pull media fix from Mauro Carvalho Chehab: "A fix at the vivid CEC support" * tag 'media/v5.3-3' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: media: vivid: fix missing cec adapter name commit 0acf5676dc0ffe0683543a20d5ecbd112af5b8ee Merge: e577dc152e23 0617bdede511 Author: Linus Torvalds Date: Fri Aug 9 09:18:36 2019 -0700 Merge tag 'pm-5.3-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull power management fix from Rafael Wysocki: "Revert a recent PCI power management change that caused problems to occur on multiple systems (Mika Westerberg)" * tag 'pm-5.3-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: Revert "PCI: Add missing link delays required by the PCIe spec" commit e577dc152e232c78e5774e4c9b5486a04561920b Merge: b678c568c561 e2664ecbb2f2 Author: Linus Torvalds Date: Fri Aug 9 09:17:05 2019 -0700 Merge branch 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 Pull crypto fixes from Herbert Xu: "Fix a number of bugs in the ccp driver" * 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6: crypto: ccp - Ignore tag length when decrypting GCM ciphertext crypto: ccp - Add support for valid authsize values less than 16 crypto: ccp - Fix oops by properly managing allocated structures commit a27a0c9b6a208722016c8ec5ad31ec96082b91ec Author: Andreas Gruenbacher Date: Mon Aug 5 12:22:03 2019 +0100 gfs2: gfs2_walk_metadata fix It turns out that the current version of gfs2_metadata_walker suffers from multiple problems that can cause gfs2_hole_size to report an incorrect size. This will confuse fiemap as well as lseek with the SEEK_DATA flag. Fix that by changing gfs2_hole_walker to compute the metapath to the first data block after the hole (if any), and compute the hole size based on that. Fixes xfstest generic/490. Signed-off-by: Andreas Gruenbacher Reviewed-by: Bob Peterson Cc: stable@vger.kernel.org # v4.18+ commit 4f7aafd78aeaf18a4f6dea9415df60e745c9dfa7 Merge: f1fc7249dddc 3c7be384fe6d Author: Daniel Borkmann Date: Fri Aug 9 17:38:53 2019 +0200 Merge branch 'bpf-bpftool-pinning-error-msg' Jakub Kicinski says: ==================== First make sure we don't use "prog" in error messages because the pinning operation could be performed on a map. Second add back missing error message if pin syscall failed. ==================== Acked-by: Yonghong Song Signed-off-by: Daniel Borkmann commit 3c7be384fe6da0d7b1d6fc0ad6b4a33edb73aad5 Author: Jakub Kicinski Date: Tue Aug 6 17:19:23 2019 -0700 tools: bpftool: add error message on pin failure No error message is currently printed if the pin syscall itself fails. It got lost in the loadall refactoring. Fixes: 77380998d91d ("bpftool: add loadall command") Reported-by: Andy Lutomirski Signed-off-by: Jakub Kicinski Reviewed-by: Quentin Monnet Acked-by: Andrii Nakryiko Signed-off-by: Daniel Borkmann commit b3e78adcbf991a4e8b2ebb23c9889e968ec76c5f Author: Jakub Kicinski Date: Tue Aug 6 17:19:22 2019 -0700 tools: bpftool: fix error message (prog -> object) Change an error message to work for any object being pinned not just programs. Fixes: 71bb428fe2c1 ("tools: bpf: add bpftool") Signed-off-by: Jakub Kicinski Reviewed-by: Quentin Monnet Signed-off-by: Daniel Borkmann commit 3a18844dcf89e636b2d0cbf577e3963b0bcb6d23 Author: Lu Baolu Date: Tue Aug 6 08:14:09 2019 +0800 iommu/vt-d: Fix possible use-after-free of private domain Multiple devices might share a private domain. One real example is a pci bridge and all devices behind it. When remove a private domain, make sure that it has been detached from all devices to avoid use-after-free case. Cc: Ashok Raj Cc: Jacob Pan Cc: Kevin Tian Cc: Alex Williamson Fixes: 942067f1b6b97 ("iommu/vt-d: Identify default domains replaced with private") Signed-off-by: Lu Baolu Tested-by: Alex Williamson Signed-off-by: Joerg Roedel commit ae23bfb68f2896835e54a137688906713cb607e7 Author: Lu Baolu Date: Tue Aug 6 08:14:08 2019 +0800 iommu/vt-d: Detach domain before using a private one When the default domain of a group doesn't work for a device, the iommu driver will try to use a private domain. The domain which was previously attached to the device must be detached. Cc: Ashok Raj Cc: Jacob Pan Cc: Kevin Tian Cc: Alex Williamson Fixes: 942067f1b6b97 ("iommu/vt-d: Identify default domains replaced with private") Reported-by: Alex Williamson Link: https://lkml.org/lkml/2019/8/2/1379 Signed-off-by: Lu Baolu Tested-by: Alex Williamson Signed-off-by: Joerg Roedel commit ab2cbeb0ed301a9f0460078e91b09f39958212ef Author: Robin Murphy Date: Mon Jul 29 17:46:00 2019 +0100 iommu/dma: Handle SG length overflow better Since scatterlist dimensions are all unsigned ints, in the relatively rare cases where a device's max_segment_size is set to UINT_MAX, then the "cur_len + s_length <= max_len" check in __finalise_sg() will always return true. As a result, the corner case of such a device mapping an excessively large scatterlist which is mergeable to or beyond a total length of 4GB can lead to overflow and a bogus truncated dma_length in the resulting segment. As we already assume that any single segment must be no longer than max_len to begin with, this can easily be addressed by reshuffling the comparison. Fixes: 809eac54cdd6 ("iommu/dma: Implement scatterlist segment merging") Reported-by: Nicolin Chen Tested-by: Nicolin Chen Signed-off-by: Robin Murphy Signed-off-by: Joerg Roedel commit bfeaec7f7d2f6b09764a1b48e88e9ca3d5076419 Author: Lu Baolu Date: Sat Jul 20 10:01:26 2019 +0800 iommu/vt-d: Correctly check format of page table in debugfs PASID support and enable bit in the context entry isn't the right indicator for the type of tables (legacy or scalable mode). Check the DMA_RTADDR_SMT bit in the root context pointer instead. Cc: Ashok Raj Cc: Jacob Pan Cc: Kevin Tian Cc: Sai Praneeth Fixes: dd5142ca5d24b ("iommu/vt-d: Add debugfs support to show scalable mode DMAR table internals") Signed-off-by: Lu Baolu Signed-off-by: Joerg Roedel commit a738b5e75b4c13be3485c82eb62c30047aa9f164 Merge: 0e1c438c44dd 16e604a437c8 Author: Paolo Bonzini Date: Fri Aug 9 16:53:50 2019 +0200 Merge tag 'kvmarm-fixes-for-5.3-2' of git://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm into HEAD KVM/arm fixes for 5.3, take #2 - Fix our system register reset so that we stop writing non-sensical values to them, and track which registers get reset instead. - Sync VMCR back from the GIC on WFI so that KVM has an exact vue of PMR. - Reevaluate state of HW-mapped, level triggered interrupts on enable. commit 0e1c438c44dd9cde56effb44c5f1cfeda72e108d Merge: c096397c78f7 cdb2d3ee0436 Author: Paolo Bonzini Date: Fri Aug 9 16:53:39 2019 +0200 Merge tag 'kvmarm-fixes-for-5.3' of git://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm into HEAD KVM/arm fixes for 5.3 - A bunch of switch/case fall-through annotation, fixing one actual bug - Fix PMU reset bug - Add missing exception class debug strings commit c096397c78f766db972f923433031f2dec01cae0 Author: Naresh Kamboju Date: Wed Aug 7 13:58:14 2019 +0000 selftests: kvm: Adding config fragments selftests kvm test cases need pre-required kernel configs for the test to get pass. Signed-off-by: Naresh Kamboju Signed-off-by: Paolo Bonzini commit e2c26537ea7652d123ddb01ceb1aa0e2a5edb7ad Author: Thomas Huth Date: Wed Jul 31 16:28:51 2019 +0200 KVM: selftests: Update gitignore file for latest changes The kvm_create_max_vcpus test has been moved to the main directory, and sync_regs_test is now available on s390x, too. Signed-off-by: Thomas Huth Acked-by: Shuah Khan Signed-off-by: Paolo Bonzini commit 8f946da73aaa1c3f609bd14d1193f39afa6830c7 Author: Paolo Bonzini Date: Mon Aug 5 11:11:08 2019 +0200 kvm: remove unnecessary PageReserved check The same check is already done in kvm_is_reserved_pfn. Reviewed-by: Sean Christopherson Signed-off-by: Paolo Bonzini commit e8c3af6bb33a9e4b56920ee00aef92eb5e4cf485 Author: David Howells Date: Fri Aug 9 15:20:41 2019 +0100 rxrpc: Don't bother generating maxSkew in the ACK packet Don't bother generating maxSkew in the ACK packet as it has been obsolete since AFS 3.1. Signed-off-by: David Howells Reviewed-by: Jeffrey Altman commit 730c5fd42c1e3652a065448fd235cb9fafb2bd10 Author: David Howells Date: Fri Aug 9 15:20:41 2019 +0100 rxrpc: Fix local endpoint refcounting The object lifetime management on the rxrpc_local struct is broken in that the rxrpc_local_processor() function is expected to clean up and remove an object - but it may get requeued by packets coming in on the backing UDP socket once it starts running. This may result in the assertion in rxrpc_local_rcu() firing because the memory has been scheduled for RCU destruction whilst still queued: rxrpc: Assertion failed ------------[ cut here ]------------ kernel BUG at net/rxrpc/local_object.c:468! Note that if the processor comes around before the RCU free function, it will just do nothing because ->dead is true. Fix this by adding a separate refcount to count active users of the endpoint that causes the endpoint to be destroyed when it reaches 0. The original refcount can then be used to refcount objects through the work processor and cause the memory to be rcu freed when that reaches 0. Fixes: 4f95dd78a77e ("rxrpc: Rework local endpoint management") Reported-by: syzbot+1e0edc4b8b7494c28450@syzkaller.appspotmail.com Signed-off-by: David Howells commit 6a7553e8d84d5322d883cb83bb9888c49a0f04e0 Author: Bartlomiej Zolnierkiewicz Date: Fri Aug 9 15:46:40 2019 +0200 MAINTAINERS: handle fbdev changes through drm-misc tree fbdev patches will now go to upstream through drm-misc tree (IOW starting with v5.4 merge window fbdev changes will be included in DRM pull request) for improved maintainership and better integration testing. Update MAINTAINERS file accordingly. Acked-by: Daniel Vetter Signed-off-by: Bartlomiej Zolnierkiewicz commit 20621fedb2a696e4dc60bc1c5de37cf21976abcb Author: Coly Li Date: Fri Aug 9 14:14:05 2019 +0800 bcache: Revert "bcache: use sysfs_match_string() instead of __sysfs_match_string()" This reverts commit 89e0341af082dbc170019f908846f4a424efc86b. In drivers/md/bcache/sysfs.c:bch_snprint_string_list(), NULL pointer at the end of list is necessary. Remove the NULL from last element of each lists will cause the following panic, [ 4340.455652] bcache: register_cache() registered cache device nvme0n1 [ 4340.464603] bcache: register_bdev() registered backing device sdk [ 4421.587335] bcache: bch_cached_dev_run() cached dev sdk is running already [ 4421.587348] bcache: bch_cached_dev_attach() Caching sdk as bcache0 on set 354e1d46-d99f-4d8b-870b-078b80dc88a6 [ 5139.247950] general protection fault: 0000 [#1] SMP NOPTI [ 5139.247970] CPU: 9 PID: 5896 Comm: cat Not tainted 4.12.14-95.29-default #1 SLE12-SP4 [ 5139.247988] Hardware name: HPE ProLiant DL380 Gen10/ProLiant DL380 Gen10, BIOS U30 04/18/2019 [ 5139.248006] task: ffff888fb25c0b00 task.stack: ffff9bbacc704000 [ 5139.248021] RIP: 0010:string+0x21/0x70 [ 5139.248030] RSP: 0018:ffff9bbacc707bf0 EFLAGS: 00010286 [ 5139.248043] RAX: ffffffffa7e432e3 RBX: ffff8881c20da02a RCX: ffff0a00ffffff04 [ 5139.248058] RDX: 3f00656863616362 RSI: ffff8881c20db000 RDI: ffffffffffffffff [ 5139.248075] RBP: ffff8881c20db000 R08: 0000000000000000 R09: ffff8881c20da02a [ 5139.248090] R10: 0000000000000004 R11: 0000000000000000 R12: ffff9bbacc707c48 [ 5139.248104] R13: 0000000000000fd6 R14: ffffffffc0665855 R15: ffffffffc0665855 [ 5139.248119] FS: 00007faf253b8700(0000) GS:ffff88903f840000(0000) knlGS:0000000000000000 [ 5139.248137] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 5139.248149] CR2: 00007faf25395008 CR3: 0000000f72150006 CR4: 00000000007606e0 [ 5139.248164] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 5139.248179] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 5139.248193] PKRU: 55555554 [ 5139.248200] Call Trace: [ 5139.248210] vsnprintf+0x1fb/0x510 [ 5139.248221] snprintf+0x39/0x40 [ 5139.248238] bch_snprint_string_list.constprop.15+0x5b/0x90 [bcache] [ 5139.248256] __bch_cached_dev_show+0x44d/0x5f0 [bcache] [ 5139.248270] ? __alloc_pages_nodemask+0xb2/0x210 [ 5139.248284] bch_cached_dev_show+0x2c/0x50 [bcache] [ 5139.248297] sysfs_kf_seq_show+0xbb/0x190 [ 5139.248308] seq_read+0xfc/0x3c0 [ 5139.248317] __vfs_read+0x26/0x140 [ 5139.248327] vfs_read+0x87/0x130 [ 5139.248336] SyS_read+0x42/0x90 [ 5139.248346] do_syscall_64+0x74/0x160 [ 5139.248358] entry_SYSCALL_64_after_hwframe+0x3d/0xa2 [ 5139.248370] RIP: 0033:0x7faf24eea370 [ 5139.248379] RSP: 002b:00007fff82d03f38 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 5139.248395] RAX: ffffffffffffffda RBX: 0000000000020000 RCX: 00007faf24eea370 [ 5139.248411] RDX: 0000000000020000 RSI: 00007faf25396000 RDI: 0000000000000003 [ 5139.248426] RBP: 00007faf25396000 R08: 00000000ffffffff R09: 0000000000000000 [ 5139.248441] R10: 000000007c9d4d41 R11: 0000000000000246 R12: 00007faf25396000 [ 5139.248456] R13: 0000000000000003 R14: 0000000000000000 R15: 0000000000000fff [ 5139.248892] Code: ff ff ff 0f 1f 80 00 00 00 00 49 89 f9 48 89 cf 48 c7 c0 e3 32 e4 a7 48 c1 ff 30 48 81 fa ff 0f 00 00 48 0f 46 d0 48 85 ff 74 45 <44> 0f b6 02 48 8d 42 01 45 84 c0 74 38 48 01 fa 4c 89 cf eb 0e The simplest way to fix is to revert commit 89e0341af082 ("bcache: use sysfs_match_string() instead of __sysfs_match_string()"). This bug was introduced in Linux v5.2, so this fix only applies to Linux v5.2 is enough for stable tree maintainer. Fixes: 89e0341af082 ("bcache: use sysfs_match_string() instead of __sysfs_match_string()") Cc: stable@vger.kernel.org Cc: Alexandru Ardelean Reported-by: Peifeng Lin Acked-by: Alexandru Ardelean Signed-off-by: Coly Li Signed-off-by: Jens Axboe commit 1e5b2471bcc4838df298080ae1ec042c2cbc9ce9 Author: Pablo Neira Ayuso Date: Fri Aug 9 11:01:35 2019 +0200 netfilter: nf_flow_table: teardown flow timeout race Flows that are in teardown state (due to RST / FIN TCP packet) still have their offload flag set on. Hence, the conntrack garbage collector may race to undo the timeout adjustment that the fixup routine performs, leaving the conntrack entry in place with the internal offload timeout (one day). Update teardown flow state to ESTABLISHED and set tracking to liberal, then once the offload bit is cleared, adjust timeout if it is more than the default fixup timeout (conntrack might already have set a lower timeout from the packet path). Fixes: da5984e51063 ("netfilter: nf_flow_table: add support for sending flows back to the slow path") Signed-off-by: Pablo Neira Ayuso commit 3e68db2f6422d711550a32cbc87abd97bb6efab3 Author: Pablo Neira Ayuso Date: Fri Aug 9 11:01:33 2019 +0200 netfilter: nf_flow_table: conntrack picks up expired flows Update conntrack entry to pick up expired flows, otherwise the conntrack entry gets stuck with the internal offload timeout (one day). The TCP state also needs to be adjusted to ESTABLISHED state and tracking is set to liberal mode in order to give conntrack a chance to pick up the expired flow. Fixes: ac2a66665e23 ("netfilter: add generic flow table infrastructure") Signed-off-by: Pablo Neira Ayuso commit 6a0a8d10a3661a036b55af695542a714c429ab7c Author: Pablo Neira Ayuso Date: Fri Aug 9 11:01:27 2019 +0200 netfilter: nf_tables: use-after-free in failing rule with bound set If a rule that has already a bound anonymous set fails to be added, the preparation phase releases the rule and the bound set. However, the transaction object from the abort path still has a reference to the set object that is stale, leading to a use-after-free when checking for the set->bound field. Add a new field to the transaction that specifies if the set is bound, so the abort path can skip releasing it since the rule command owns it and it takes care of releasing it. After this update, the set->bound field is removed. [ 24.649883] Unable to handle kernel paging request at virtual address 0000000000040434 [ 24.657858] Mem abort info: [ 24.660686] ESR = 0x96000004 [ 24.663769] Exception class = DABT (current EL), IL = 32 bits [ 24.669725] SET = 0, FnV = 0 [ 24.672804] EA = 0, S1PTW = 0 [ 24.675975] Data abort info: [ 24.678880] ISV = 0, ISS = 0x00000004 [ 24.682743] CM = 0, WnR = 0 [ 24.685723] user pgtable: 4k pages, 48-bit VAs, pgdp=0000000428952000 [ 24.692207] [0000000000040434] pgd=0000000000000000 [ 24.697119] Internal error: Oops: 96000004 [#1] SMP [...] [ 24.889414] Call trace: [ 24.891870] __nf_tables_abort+0x3f0/0x7a0 [ 24.895984] nf_tables_abort+0x20/0x40 [ 24.899750] nfnetlink_rcv_batch+0x17c/0x588 [ 24.904037] nfnetlink_rcv+0x13c/0x190 [ 24.907803] netlink_unicast+0x18c/0x208 [ 24.911742] netlink_sendmsg+0x1b0/0x350 [ 24.915682] sock_sendmsg+0x4c/0x68 [ 24.919185] ___sys_sendmsg+0x288/0x2c8 [ 24.923037] __sys_sendmsg+0x7c/0xd0 [ 24.926628] __arm64_sys_sendmsg+0x2c/0x38 [ 24.930744] el0_svc_common.constprop.0+0x94/0x158 [ 24.935556] el0_svc_handler+0x34/0x90 [ 24.939322] el0_svc+0x8/0xc [ 24.942216] Code: 37280300 f9404023 91014262 aa1703e0 (f9401863) [ 24.948336] ---[ end trace cebbb9dcbed3b56f ]--- Fixes: f6ac85858976 ("netfilter: nf_tables: unbind set in rule from commit path") Signed-off-by: Pablo Neira Ayuso commit d555c34338cae844b207564c482e5a3fb089d25e Author: Hans Verkuil Date: Fri Aug 9 10:32:40 2019 +0200 omap-dma/omap_vout_vrfb: fix off-by-one fi value The OMAP 4 TRM specifies that when using double-index addressing the address increases by the ES plus the EI value minus 1 within a frame. When a full frame is transferred, the address increases by the ES plus the frame index (FI) value minus 1. The omap-dma code didn't account for the 'minus 1' in the FI register. To get correct addressing, add 1 to the src_icg value. This was found when testing a hacked version of the media m2m-deinterlace.c driver on a Pandaboard. The only other source that uses this feature is omap_vout_vrfb.c, and that adds a + 1 when setting the dst_icg. This is a workaround for the broken omap-dma.c behavior. So remove the workaround at the same time that we fix omap-dma.c. I tested the omap_vout driver with a Beagle XM board to check that the '+ 1' in omap_vout_vrfb.c was indeed a workaround for the omap-dma bug. Signed-off-by: Hans Verkuil Reviewed-by: Laurent Pinchart Acked-by: Peter Ujfalusi Acked-by: Mauro Carvalho Chehab Link: https://lore.kernel.org/r/952e7f51-f208-9333-6f58-b7ed20d2ea0b@xs4all.nl Signed-off-by: Vinod Koul commit de768ce45466f3009809719eb7b1f6f5277d9373 Author: Takashi Iwai Date: Fri Aug 9 11:23:00 2019 +0200 ALSA: hda - Apply workaround for another AMD chip 1022:1487 MSI MPG X570 board is with another AMD HD-audio controller (PCI ID 1022:1487) and it requires the same workaround applied for X370, etc (PCI ID 1022:1457). BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=195303 Cc: Signed-off-by: Takashi Iwai commit 404861e15b5fa7edbab22400f9174c1a21fde731 Author: Heiko Carstens Date: Wed Aug 7 14:31:59 2019 +0200 s390/vdso: map vdso also for statically linked binaries s390 does not map the vdso for statically linked binaries, assuming that this doesn't make sense. See commit fc5243d98ac2 ("[S390] arch_setup_additional_pages arguments"). However with glibc commit d665367f596d ("linux: Enable vDSO for static linking as default (BZ#19767)") and commit 5e855c895401 ("s390: Enable VDSO for static linking") the vdso is also used for statically linked binaries - if the kernel would make it available. Therefore map the vdso always, just like all other architectures. Reported-by: Stefan Liebler Signed-off-by: Heiko Carstens Signed-off-by: Vasily Gorbik commit eac4471d0882da14be652ef0a55b914145fab15a Author: Dan Carpenter Date: Thu Aug 8 13:32:36 2019 +0300 drm/i915: Use after free in error path in intel_vgpu_create_workload() We can't free "workload" until after the printk or it's a use after free. Fixes: 2089a76ade90 ("drm/i915/gvt: Checking workload's gma earlier") Signed-off-by: Dan Carpenter Reviewed-by: Chris Wilson Signed-off-by: Zhenyu Wang commit 16e604a437c89751dc626c9e90cf88ba93c5be64 Author: Alexandru Elisei Date: Wed Aug 7 10:53:20 2019 +0100 KVM: arm/arm64: vgic: Reevaluate level sensitive interrupts on enable A HW mapped level sensitive interrupt asserted by a device will not be put into the ap_list if it is disabled at the VGIC level. When it is enabled again, it will be inserted into the ap_list and written to a list register on guest entry regardless of the state of the device. We could argue that this can also happen on real hardware, when the command to enable the interrupt reached the GIC before the device had the chance to de-assert the interrupt signal; however, we emulate the distributor and redistributors in software and we can do better than that. Signed-off-by: Alexandru Elisei Signed-off-by: Marc Zyngier commit c69509c70aa45a8c4954c88c629a64acf4ee4a36 Author: Marc Zyngier Date: Mon Aug 5 10:34:51 2019 +0100 KVM: arm: Don't write junk to CP15 registers on reset At the moment, the way we reset CP15 registers is mildly insane: We write junk to them, call the reset functions, and then check that we have something else in them. The "fun" thing is that this can happen while the guest is running (PSCI, for example). If anything in KVM has to evaluate the state of a CP15 register while junk is in there, bad thing may happen. Let's stop doing that. Instead, we track that we have called a reset function for that register, and assume that the reset function has done something. In the end, the very need of this reset check is pretty dubious, as it doesn't check everything (a lot of the CP15 reg leave outside of the cp15_regs[] array). It may well be axed in the near future. Signed-off-by: Marc Zyngier commit 03fdfb2690099c19160a3f2c5b77db60b3afeded Author: Marc Zyngier Date: Mon Aug 5 10:34:51 2019 +0100 KVM: arm64: Don't write junk to sysregs on reset At the moment, the way we reset system registers is mildly insane: We write junk to them, call the reset functions, and then check that we have something else in them. The "fun" thing is that this can happen while the guest is running (PSCI, for example). If anything in KVM has to evaluate the state of a system register while junk is in there, bad thing may happen. Let's stop doing that. Instead, we track that we have called a reset function for that register, and assume that the reset function has done something. This requires fixing a couple of sysreg refinition in the trap table. In the end, the very need of this reset check is pretty dubious, as it doesn't check everything (a lot of the sysregs leave outside of the sys_regs[] array). It may well be axed in the near future. Tested-by: Zenghui Yu Signed-off-by: Marc Zyngier commit 1109635b292c82e7a2aa15e38edb7c389e34b693 Author: Lowry Li (Arm Technology China) Date: Fri Aug 2 08:07:52 2019 +0000 drm/komeda: Initialize and enable output polling on Komeda Initialize and enable output polling on Komeda. Changes since v1: 1. Enable the polling before registering the driver; 2. Disable the polling after unregistering the driver. Changes since v2: 1. If driver register failed, disable the polling. Signed-off-by: Lowry Li (Arm Technology China) Reviewed-by: James Qian Wang (Arm Technology China) Signed-off-by: james qian wang (Arm Technology China) Link: https://patchwork.freedesktop.org/patch/msgid/1564733249-24329-1-git-send-email-lowry.li@arm.com commit a111ef6b082270f6cbeea5556caf1cbb0143b812 Merge: 359f1dcbae12 73a0ff0b30af Author: Dave Airlie Date: Fri Aug 9 15:46:09 2019 +1000 Merge tag 'drm-intel-fixes-2019-08-08' of git://anongit.freedesktop.org/drm/drm-intel into drm-fixes drm/i915 fixes for v5.3-rc4: - Fix GLK DSI escape clock setting - Fix a memleak on HDCP revoked Ksv error path Signed-off-by: Dave Airlie From: Jani Nikula Link: https://patchwork.freedesktop.org/patch/msgid/87pnlghz79.fsf@intel.com commit 359f1dcbae12b691fa40aae912fab4c129cb7561 Merge: 6ca847a947d9 f7ccbed656f7 Author: Dave Airlie Date: Fri Aug 9 15:45:02 2019 +1000 Merge tag 'drm-misc-fixes-2019-08-08' of git://anongit.freedesktop.org/drm/drm-misc into drm-fixes drm-misc-fixes for v5.3-rc4: - Suspend fix for rockchip - Fix unterminated strncpy cmdline mode parser Signed-off-by: Dave Airlie From: Maarten Lankhorst Link: https://patchwork.freedesktop.org/patch/msgid/ace294a6-6bb2-d9b1-695d-3260e1d60831@linux.intel.com commit 8c25d0887a8bd0e1ca2074ac0c6dff173787a83b Author: Fuqian Huang Date: Fri Aug 9 13:35:39 2019 +0800 net: tundra: tsi108: use spin_lock_irqsave instead of spin_lock_irq in IRQ context As spin_unlock_irq will enable interrupts. Function tsi108_stat_carry is called from interrupt handler tsi108_irq. Interrupts are enabled in interrupt handler. Use spin_lock_irqsave/spin_unlock_irqrestore instead of spin_(un)lock_irq in IRQ context to avoid this. Signed-off-by: Fuqian Huang Signed-off-by: David S. Miller commit 227f2f030e28d8783c3d10ce70ff4ba79cad653f Author: YueHaibing Date: Thu Aug 8 14:22:47 2019 +0800 team: Add vlan tx offload to hw_enc_features We should also enable team's vlan tx offload in hw_enc_features, pass the vlan packets to the slave devices with vlan tci, let the slave handle vlan tunneling offload implementation. Fixes: 3268e5cb494d ("team: Advertise tunneling offload features") Signed-off-by: YueHaibing Signed-off-by: David S. Miller commit 6ca847a947d9da958047dba570d4727069a4861b Merge: f536579c1482 6b7c3b86f0b6 Author: Dave Airlie Date: Fri Aug 9 15:40:06 2019 +1000 Merge branch 'vmwgfx-fixes-5.3' of git://people.freedesktop.org/~thomash/linux into drm-fixes One single memory leak fix. Signed-off-by: Dave Airlie From: Thomas Hellstrom "VMware" Link: https://patchwork.freedesktop.org/patch/msgid/20190808094615.31040-1-thomas@shipmail.org commit 414776621d1006e57e80e6db7fdc3837897aaa64 Author: Jakub Kicinski Date: Wed Aug 7 17:03:59 2019 -0700 net/tls: prevent skb_orphan() from leaking TLS plain text with offload sk_validate_xmit_skb() and drivers depend on the sk member of struct sk_buff to identify segments requiring encryption. Any operation which removes or does not preserve the original TLS socket such as skb_orphan() or skb_clone() will cause clear text leaks. Make the TCP socket underlying an offloaded TLS connection mark all skbs as decrypted, if TLS TX is in offload mode. Then in sk_validate_xmit_skb() catch skbs which have no socket (or a socket with no validation) and decrypted flag set. Note that CONFIG_SOCK_VALIDATE_XMIT, CONFIG_TLS_DEVICE and sk->sk_validate_xmit_skb are slightly interchangeable right now, they all imply TLS offload. The new checks are guarded by CONFIG_TLS_DEVICE because that's the option guarding the sk_buff->decrypted member. Second, smaller issue with orphaning is that it breaks the guarantee that packets will be delivered to device queues in-order. All TLS offload drivers depend on that scheduling property. This means skb_orphan_partial()'s trick of preserving partial socket references will cause issues in the drivers. We need a full orphan, and as a result netem delay/throttling will cause all TLS offload skbs to be dropped. Reusing the sk_buff->decrypted flag also protects from leaking clear text when incoming, decrypted skb is redirected (e.g. by TC). See commit 0608c69c9a80 ("bpf: sk_msg, sock{map|hash} redirect through ULP") for justification why the internal flag is safe. The only location which could leak the flag in is tcp_bpf_sendmsg(), which is taken care of by clearing the previously unused bit. v2: - remove superfluous decrypted mark copy (Willem); - remove the stale doc entry (Boris); - rely entirely on EOR marking to prevent coalescing (Boris); - use an internal sendpages flag instead of marking the socket (Boris). v3 (Willem): - reorganize the can_skb_orphan_partial() condition; - fix the flag leak-in through tcp_bpf_sendmsg. Signed-off-by: Jakub Kicinski Acked-by: Willem de Bruijn Reviewed-by: Boris Pismenny Signed-off-by: David S. Miller commit 0de94de18027540200f2f193be6a2fa749cb7ebe Merge: e3e3af9aa29a 7bc161846dcf Author: David S. Miller Date: Thu Aug 8 22:37:06 2019 -0700 Merge branch 'skbedit-batch-fixes' Roman Mashak says: ==================== Fix batched event generation for skbedit action When adding or deleting a batch of entries, the kernel sends up to TCA_ACT_MAX_PRIO (defined to 32 in kernel) entries in an event to user space. However it does not consider that the action sizes may vary and require different skb sizes. For example, consider the following script adding 32 entries with all supported skbedit parameters and cookie (in order to maximize netlink messages size): % cat tc-batch.sh TC="sudo /mnt/iproute2.git/tc/tc" $TC actions flush action skbedit for i in `seq 1 $1`; do cmd="action skbedit queue_mapping 2 priority 10 mark 7/0xaabbccdd \ ptype host inheritdsfield \ index $i cookie aabbccddeeff112233445566778800a1 " args=$args$cmd done $TC actions add $args % % ./tc-batch.sh 32 Error: Failed to fill netlink attributes while adding TC action. We have an error talking to the kernel % patch 1 adds callback in tc_action_ops of skbedit action, which calculates the action size, and passes size to tcf_add_notify()/tcf_del_notify(). patch 2 updates the TDC test suite with relevant skbedit test cases. ==================== Signed-off-by: David S. Miller commit 7bc161846dcf4af0485f260930d17fdd892a4980 Author: Roman Mashak Date: Wed Aug 7 15:57:29 2019 -0400 tc-testing: updated skbedit action tests with batch create/delete Update TDC tests with cases varifying ability of TC to install or delete batches of skbedit actions. Signed-off-by: Roman Mashak Signed-off-by: David S. Miller commit e1fea322fc6d4075254ca9c5f2afdace0281da2a Author: Roman Mashak Date: Wed Aug 7 15:57:28 2019 -0400 net sched: update skbedit action for batched events operations Add get_fill_size() routine used to calculate the action size when building a batch of events. Fixes: ca9b0e27e ("pkt_action: add new action skbedit") Signed-off-by: Roman Mashak Signed-off-by: David S. Miller commit e3e3af9aa29a2ada43d5c27b47ea320415cd5bb3 Author: YueHaibing Date: Wed Aug 7 21:08:56 2019 +0800 net: dsa: sja1105: remove set but not used variables 'tx_vid' and 'rx_vid' Fixes gcc '-Wunused-but-set-variable' warning: drivers/net/dsa/sja1105/sja1105_main.c: In function sja1105_fdb_dump: drivers/net/dsa/sja1105/sja1105_main.c:1226:14: warning: variable tx_vid set but not used [-Wunused-but-set-variable] drivers/net/dsa/sja1105/sja1105_main.c:1226:6: warning: variable rx_vid set but not used [-Wunused-but-set-variable] They are not used since commit 6d7c7d948a2e ("net: dsa: sja1105: Fix broken learning with vlan_filtering disabled") Reported-by: Hulk Robot Signed-off-by: YueHaibing Reviewed-by: Vladimir Oltean Reviewed-by: Vivien Didelot Signed-off-by: David S. Miller commit d595b03de2cb0bdf9bcdf35ff27840cc3a37158f Author: YueHaibing Date: Wed Aug 7 10:19:59 2019 +0800 bonding: Add vlan tx offload to hw_enc_features As commit 30d8177e8ac7 ("bonding: Always enable vlan tx offload") said, we should always enable bonding's vlan tx offload, pass the vlan packets to the slave devices with vlan tci, let them to handle vlan implementation. Now if encapsulation protocols like VXLAN is used, skb->encapsulation may be set, then the packet is passed to vlan device which based on bonding device. However in netif_skb_features(), the check of hw_enc_features: if (skb->encapsulation) features &= dev->hw_enc_features; clears NETIF_F_HW_VLAN_CTAG_TX/NETIF_F_HW_VLAN_STAG_TX. This results in same issue in commit 30d8177e8ac7 like this: vlan_dev_hard_start_xmit -->dev_queue_xmit -->validate_xmit_skb -->netif_skb_features //NETIF_F_HW_VLAN_CTAG_TX is cleared -->validate_xmit_vlan -->__vlan_hwaccel_push_inside //skb->tci is cleared ... --> bond_start_xmit --> bond_xmit_hash //BOND_XMIT_POLICY_ENCAP34 --> __skb_flow_dissect // nhoff point to IP header --> case htons(ETH_P_8021Q) // skb_vlan_tag_present is false, so vlan = __skb_header_pointer(skb, nhoff, sizeof(_vlan), //vlan point to ip header wrongly Fixes: b2a103e6d0af ("bonding: convert to ndo_fix_features") Signed-off-by: YueHaibing Acked-by: Jay Vosburgh Signed-off-by: David S. Miller commit 51650d33b2771acd505068da669cf85cffac369a Author: Ivan Khoronzhuk Date: Wed Aug 7 01:45:40 2019 +0300 net: sched: sch_taprio: fix memleak in error path for sched list parse In error case, all entries should be freed from the sched list before deleting it. For simplicity use rcu way. Fixes: 5a781ccbd19e46 ("tc: Add support for configuring the taprio scheduler") Acked-by: Vinicius Costa Gomes Signed-off-by: Ivan Khoronzhuk Signed-off-by: David S. Miller commit 8676b3ca4673517650fd509d7fa586aff87b3c28 Author: Pierre-Louis Bossart Date: Thu Jul 18 18:02:15 2019 -0500 soundwire: fix regmap dependencies and align with other serial links The existing code has a mixed select/depend usage which makes no sense. config SOUNDWIRE_BUS tristate select REGMAP_SOUNDWIRE config REGMAP_SOUNDWIRE tristate depends on SOUNDWIRE_BUS Let's remove one layer of Kconfig definitions and align with the solutions used by all other serial links. Signed-off-by: Pierre-Louis Bossart Link: https://lore.kernel.org/r/20190718230215.18675-1-pierre-louis.bossart@linux.intel.com Signed-off-by: Vinod Koul commit fe90689fed119cb55ff04e6a1df0817f0a3e9d32 Author: Stephen Hemminger Date: Mon Aug 5 15:30:03 2019 -0700 net: docs: replace IPX in tuntap documentation IPX is no longer supported, but the example in the documentation might useful. Replace it with IPv6. Signed-off-by: Stephen Hemminger Signed-off-by: David S. Miller commit 7e7c076e123ae8c4faa1966fc0da64f6e24eb57e Author: Stephen Hemminger Date: Mon Aug 5 15:30:02 2019 -0700 docs: admin-guide: remove references to IPX and token-ring Both IPX and TR have not been supported for a while now. Remove them from the /proc/sys/net documentation. Signed-off-by: Stephen Hemminger Signed-off-by: David S. Miller commit 3a0233ddec554b886298de2428edb5c50a20e694 Author: Ross Lagerwall Date: Mon Aug 5 16:34:34 2019 +0100 xen/netback: Reset nr_frags before freeing skb At this point nr_frags has been incremented but the frag does not yet have a page assigned so freeing the skb results in a crash. Reset nr_frags before freeing the skb to prevent this. Signed-off-by: Ross Lagerwall Signed-off-by: David S. Miller commit b390e0bfd2996f1215231395f4e25a4c011eeaf9 Author: Paul Walmsley Date: Thu Aug 8 15:36:44 2019 -0700 dt-bindings: riscv: fix the schema compatible string for the HiFive Unleashed board The YAML binding document for SiFive boards has an incorrect compatible string for the HiFive Unleashed board. Change it to match the name of the board on the SiFive web site: https://www.sifive.com/boards/hifive-unleashed which also matches the contents of the board DT data file: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/arch/riscv/boot/dts/sifive/hifive-unleashed-a00.dts#n13 Signed-off-by: Paul Walmsley Acked-by: Rob Herring commit 8e5e72e3314021a3d166c1d19a991a0870568856 Author: Paul Walmsley Date: Thu Aug 8 14:46:58 2019 -0700 dt-bindings: riscv: remove obsolete cpus.txt Remove the now-obsolete riscv/cpus.txt DT binding document, since we are using YAML binding documentation instead. While doing so, transfer the explanatory text about 'harts' (with some edits) into the YAML file, at Rob's request. Link: https://lore.kernel.org/linux-riscv/CAL_JsqJs6MtvmuyAknsUxQymbmoV=G+=JfS1PQj9kNHV7fjC9g@mail.gmail.com/ Signed-off-by: Paul Walmsley Cc: Rob Herring Reviewed-by: Rob Herring commit 81a48ee417387bef9cb720ca75980ee11ae9c901 Author: Palmer Dabbelt Date: Tue Aug 6 17:05:08 2019 -0700 RISC-V: Remove udivdi3 This should never have landed in the first place: it was added as part of 64-bit divide support for 32-bit systems, but the kernel doesn't allow this sort of division. I must have forgotten to remove it. This patch removes the support. Since this routine only worked on 64-bit platforms but was only built on 32-bit platforms, it's essentially just nonsense anyway. Signed-off-by: Palmer Dabbelt Acked-by: Nicolas Pitre Link: https://lore.kernel.org/linux-riscv/nycvar.YSQ.7.76.1908061413360.19480@knanqh.ubzr/T/#t Reported-by: Eric Lin Signed-off-by: Paul Walmsley commit 66cc016ab7c780d53450fd1648010da02ddf2770 Author: Paul Walmsley Date: Tue Aug 6 18:28:33 2019 -0700 riscv: delay: use do_div() instead of __udivdi3() In preparation for removing __udivdi3() from the RISC-V architecture-specific files, convert its one user to use do_div(). This avoids breaking the RV32 build after __udivdi3() is removed. This second version removes the assignment of the remainder to an unused temporary variable. Thanks to Nicolas Pitre for the suggestion. Signed-off-by: Paul Walmsley Cc: Nicolas Pitre commit 94ed3fde38c7c1347cd82b945553905cfd992ab9 Author: Atish Patra Date: Fri Aug 2 21:27:23 2019 -0700 dt-bindings: Update the riscv,isa string description Since the RISC-V specification states that ISA description strings are case-insensitive, there's no functional difference between mixed-case, upper-case, and lower-case ISA strings. Thus, to simplify parsing, specify that the letters present in "riscv,isa" must be all lowercase. Suggested-by: Paul Walmsley Signed-off-by: Atish Patra Signed-off-by: Paul Walmsley commit 891584f48a9084ba462f10da4c6bb28b6181b543 Author: Guillaume Nault Date: Fri Aug 2 17:15:03 2019 +0200 inet: frags: re-introduce skb coalescing for local delivery Before commit d4289fcc9b16 ("net: IP6 defrag: use rbtrees for IPv6 defrag"), a netperf UDP_STREAM test[0] using big IPv6 datagrams (thus generating many fragments) and running over an IPsec tunnel, reported more than 6Gbps throughput. After that patch, the same test gets only 9Mbps when receiving on a be2net nic (driver can make a big difference here, for example, ixgbe doesn't seem to be affected). By reusing the IPv4 defragmentation code, IPv6 lost fragment coalescing (IPv4 fragment coalescing was dropped by commit 14fe22e33462 ("Revert "ipv4: use skb coalescing in defragmentation"")). Without fragment coalescing, be2net runs out of Rx ring entries and starts to drop frames (ethtool reports rx_drops_no_frags errors). Since the netperf traffic is only composed of UDP fragments, any lost packet prevents reassembly of the full datagram. Therefore, fragments which have no possibility to ever get reassembled pile up in the reassembly queue, until the memory accounting exeeds the threshold. At that point no fragment is accepted anymore, which effectively discards all netperf traffic. When reassembly timeout expires, some stale fragments are removed from the reassembly queue, so a few packets can be received, reassembled and delivered to the netperf receiver. But the nic still drops frames and soon the reassembly queue gets filled again with stale fragments. These long time frames where no datagram can be received explain why the performance drop is so significant. Re-introducing fragment coalescing is enough to get the initial performances again (6.6Gbps with be2net): driver doesn't drop frames anymore (no more rx_drops_no_frags errors) and the reassembly engine works at full speed. This patch is quite conservative and only coalesces skbs for local IPv4 and IPv6 delivery (in order to avoid changing skb geometry when forwarding). Coalescing could be extended in the future if need be, as more scenarios would probably benefit from it. [0]: Test configuration Sender: ip xfrm policy flush ip xfrm state flush ip xfrm state add src fc00:1::1 dst fc00:2::1 proto esp spi 0x1000 aead 'rfc4106(gcm(aes))' 0x0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b 96 mode transport sel src fc00:1::1 dst fc00:2::1 ip xfrm policy add src fc00:1::1 dst fc00:2::1 dir in tmpl src fc00:1::1 dst fc00:2::1 proto esp mode transport action allow ip xfrm state add src fc00:2::1 dst fc00:1::1 proto esp spi 0x1001 aead 'rfc4106(gcm(aes))' 0x0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b 96 mode transport sel src fc00:2::1 dst fc00:1::1 ip xfrm policy add src fc00:2::1 dst fc00:1::1 dir out tmpl src fc00:2::1 dst fc00:1::1 proto esp mode transport action allow netserver -D -L fc00:2::1 Receiver: ip xfrm policy flush ip xfrm state flush ip xfrm state add src fc00:2::1 dst fc00:1::1 proto esp spi 0x1001 aead 'rfc4106(gcm(aes))' 0x0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b 96 mode transport sel src fc00:2::1 dst fc00:1::1 ip xfrm policy add src fc00:2::1 dst fc00:1::1 dir in tmpl src fc00:2::1 dst fc00:1::1 proto esp mode transport action allow ip xfrm state add src fc00:1::1 dst fc00:2::1 proto esp spi 0x1000 aead 'rfc4106(gcm(aes))' 0x0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b 96 mode transport sel src fc00:1::1 dst fc00:2::1 ip xfrm policy add src fc00:1::1 dst fc00:2::1 dir out tmpl src fc00:1::1 dst fc00:2::1 proto esp mode transport action allow netperf -H fc00:2::1 -f k -P 0 -L fc00:1::1 -l 60 -t UDP_STREAM -I 99,5 -i 5,5 -T5,5 -6 Signed-off-by: Guillaume Nault Acked-by: Florian Westphal Signed-off-by: David S. Miller commit b678c568c561cf7e4ed40f4bcc3e85d2b50310a2 Merge: 518a1c2f0912 67e7b52d44e3 Author: Linus Torvalds Date: Thu Aug 8 14:47:19 2019 -0700 Merge tag 'nfs-for-5.3-2' of git://git.linux-nfs.org/projects/trondmy/linux-nfs Pull NFS client fixes from Trond Myklebust: "Highlights include: Stable fixes: - NFSv4: Ensure we check the return value of update_open_stateid() so we correctly track active open state. - NFSv4: Fix for delegation state recovery to ensure we recover all open modes that are active. - NFSv4: Fix an Oops in nfs4_do_setattr Fixes: - NFS: Fix regression whereby fscache errors are appearing on 'nofsc' mounts - NFSv4: Fix a potential sleep while atomic in nfs4_do_reclaim() - NFSv4: Fix a credential refcount leak in nfs41_check_delegation_stateid - pNFS: Report errors from the call to nfs4_select_rw_stateid() - NFSv4: Various other delegation and open stateid recovery fixes - NFSv4: Fix state recovery behaviour when server connection times out" * tag 'nfs-for-5.3-2' of git://git.linux-nfs.org/projects/trondmy/linux-nfs: NFSv4: Ensure state recovery handles ETIMEDOUT correctly NFS: Fix regression whereby fscache errors are appearing on 'nofsc' mounts NFSv4: Fix an Oops in nfs4_do_setattr NFSv4: Fix a potential sleep while atomic in nfs4_do_reclaim() NFSv4: Check the return value of update_open_stateid() NFSv4.1: Only reap expired delegations NFSv4.1: Fix open stateid recovery NFSv4: Report the error from nfs4_select_rw_stateid() NFSv4: When recovering state fails with EAGAIN, retry the same recovery NFSv4: Print an error in the syslog when state is marked as irrecoverable NFSv4: Fix delegation state recovery NFSv4: Fix a credential refcount leak in nfs41_check_delegation_stateid commit baf7b79e1ad79a41fafd8ab8597b9a96962d822d Author: Marek Szyprowski Date: Thu Aug 8 14:18:39 2019 +0200 clk: samsung: exynos542x: Move MSCL subsystem clocks to its sub-CMU M2M scaler clocks require special handling of their parent bus clock during power domain on/off sequences. MSCL clocks were not initially added to the sub-CMU handler, because that time there was no driver for the M2M scaler device and it was not possible to test it. This patch fixes this issue. Parent clock for M2M scaler devices is now properly preserved during MSC power domain on/off sequence. This gives M2M scaler devices proper performance: fullHD XRGB32 image 1000 rotations test takes 3.17s instead of 45.08s. Fixes: b06a532bf1fa ("clk: samsung: Add Exynos5 sub-CMU clock driver") Signed-off-by: Marek Szyprowski Link: https://lkml.kernel.org/r/20190808121839.23892-1-m.szyprowski@samsung.com Acked-by: Sylwester Nawrocki Signed-off-by: Stephen Boyd commit b6adeb6bc61c2567b9efd815d61a61b34a2e51a6 Author: Sylwester Nawrocki Date: Thu Aug 8 16:49:29 2019 +0200 clk: samsung: exynos5800: Move MAU subsystem clocks to MAU sub-CMU This patch fixes broken sound on Exynos5422/5800 platforms after system/suspend resume cycle in cases where the audio root clock is derived from MAU_EPLL_CLK. In order to preserve state of the USER_MUX_MAU_EPLL_CLK clock mux during system suspend/resume cycle for Exynos5800 we group the MAU block input clocks in "MAU" sub-CMU and add the clock mux control bit to .suspend_regs. This ensures that user configuration of the mux is not lost after the PMU block changes the mux setting to OSC_DIV when switching off the MAU power domain. Adding the SRC_TOP9 register to exynos5800_clk_regs[] array is not sufficient as at the time of the syscore_ops suspend call MAU power domain is already turned off and we already save and subsequently restore an incorrect register's value. Fixes: b06a532bf1fa ("clk: samsung: Add Exynos5 sub-CMU clock driver") Reported-by: Jaafar Ali Suggested-by: Marek Szyprowski Tested-by: Jaafar Ali Signed-off-by: Sylwester Nawrocki Link: https://lkml.kernel.org/r/20190808144929.18685-2-s.nawrocki@samsung.com Signed-off-by: Stephen Boyd commit bf32e7dbfce87d518c0ca77af890eae9ab8d6ab9 Author: Sylwester Nawrocki Date: Thu Aug 8 16:49:28 2019 +0200 clk: samsung: Change signature of exynos5_subcmus_init() function In order to make it easier in subsequent patch to create different subcmu lists for exynos5420 and exynos5800 SoCs the code is rewritten so we pass an array of pointers to the subcmus initialization function. Fixes: b06a532bf1fa ("clk: samsung: Add Exynos5 sub-CMU clock driver") Tested-by: Jaafar Ali Signed-off-by: Sylwester Nawrocki Link: https://lkml.kernel.org/r/20190808144929.18685-1-s.nawrocki@samsung.com Reviewed-by: Marek Szyprowski Signed-off-by: Stephen Boyd commit d7731b8133ad64cd98bf34a33dcf810df4410308 Merge: b3c303be4c35 8e6e5bea2e34 Author: Thomas Gleixner Date: Thu Aug 8 22:12:01 2019 +0200 Merge tag 'perf-urgent-for-mingo-5.3-20190808' of git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux into perf/urgent perf/urgent fixes: db-export: Adrian Hunter: - Fix thread__exec_comm() picking of main thread COMM for pre-existing, synthesized from /proc data records. annotate: Arnaldo Carvalho de Melo: - Fix printing of unaugmented disassembled instructions from BPF, some lines were leaving leftovers from the previous screen, due to use of newlines by binutils's libopcode disassembler. perf ftrace: He Zhe: - Fix cpumask problems when only one CPU is present. PMU events: Jin Yao: - Add missing "cpu_clk_unhalted.core" event. perf bench: Jiri Olsa: - Fix cpu0 binding in the NUMA benchmarks. s390: Thomas Richter: - Fix module size calculations. build system: Masanari Iida: - Fix a typo in a variable name in the Documentation Makefile misc: Ian Rogers: - Fix include paths in ui directory. Signed-off-by: Arnaldo Carvalho de Melo commit a4e508cab623951dc4754f346e5673714f3bbade Author: Aya Levin Date: Thu Aug 8 15:55:48 2019 +0300 net/mlx5e: Remove redundant check in CQE recovery flow of tx reporter Remove check of recovery bit, in the beginning of the CQE recovery function. This test is already performed right before the reporter is invoked, when CQE error is detected. Fixes: de8650a82071 ("net/mlx5e: Add tx reporter support") Signed-off-by: Aya Levin Signed-off-by: Saeed Mahameed commit 276d197e70bcc47153592f4384675b51c7d83aba Author: Aya Levin Date: Tue Aug 6 15:19:19 2019 +0300 net/mlx5e: Fix error flow of CQE recovery on tx reporter CQE recovery function begins with test and set of recovery bit. Add an error flow which ensures clearing of this bit when leaving the recovery function, to allow further recoveries to take place. This allows removal of clearing recovery bit on sq activate. Fixes: de8650a82071 ("net/mlx5e: Add tx reporter support") Signed-off-by: Aya Levin Reviewed-by: Tariq Toukan Signed-off-by: Saeed Mahameed commit d9a2fcf53c76a7edb2bcf99e94507935561a83d5 Author: Aya Levin Date: Wed Aug 7 15:59:06 2019 +0300 net/mlx5e: Fix false negative indication on tx reporter CQE recovery Remove wrong error return value when SQ is not in error state. CQE recovery on TX reporter queries the sq state. If the sq is not in error state, the sq is either in ready or reset state. Ready state is good state which doesn't require recovery and reset state is a temporal state which ends in ready state. With this patch, CQE recovery in this scenario is successful. Fixes: de8650a82071 ("net/mlx5e: Add tx reporter support") Signed-off-by: Aya Levin Reviewed-by: Tariq Toukan Signed-off-by: Saeed Mahameed commit b86f1abe2c275e6f9abf7e2669ccc318b7ef7bb9 Author: Tariq Toukan Date: Tue Jul 30 13:45:42 2019 +0300 net/mlx5e: kTLS, Fix tisn field placement Shift the tisn field in the WQE control segment, per the HW specification. Fixes: d2ead1f360e8 ("net/mlx5e: Add kTLS TX HW offload support") Signed-off-by: Tariq Toukan Signed-off-by: Saeed Mahameed commit f1897b3cd1af1dce8d6c06b06f02551c71112003 Author: Tariq Toukan Date: Thu Aug 8 12:26:57 2019 +0300 net/mlx5e: kTLS, Fix tisn field name Use the proper tisn field name from the union in struct mlx5_wqe_ctrl_seg. Fixes: d2ead1f360e8 ("net/mlx5e: Add kTLS TX HW offload support") Signed-off-by: Tariq Toukan Signed-off-by: Saeed Mahameed commit a9bc3390327317345dd4683b70970c83ab400ea3 Author: Tariq Toukan Date: Tue Jul 30 11:55:25 2019 +0300 net/mlx5e: kTLS, Fix progress params context WQE layout The TLS progress params context WQE should not include an Eth segment, drop it. In addition, align the tls_progress_params layout with the HW specification document: - fix the tisn field name. - remove the valid bit. Fixes: a12ff35e0fb7 ("net/mlx5: Introduce TLS TX offload hardware bits and structures") Fixes: d2ead1f360e8 ("net/mlx5e: Add kTLS TX HW offload support") Signed-off-by: Tariq Toukan Signed-off-by: Saeed Mahameed commit 26149e3e1f44d27897d0af9ca4bcd723674bad44 Author: Tariq Toukan Date: Sun Jul 21 14:18:42 2019 +0300 net/mlx5: kTLS, Fix wrong TIS opmod constants Fix the used constants for TLS TIS opmods, per the HW specification. Fixes: a12ff35e0fb7 ("net/mlx5: Introduce TLS TX offload hardware bits and structures") Signed-off-by: Tariq Toukan Signed-off-by: Saeed Mahameed commit 55c9bd37ef5a0bd79c80c8eb418ce162bbc65590 Author: Tariq Toukan Date: Sun Jul 21 14:13:15 2019 +0300 net/mlx5: crypto, Fix wrong offset in encryption key command Fix the 128b key offset in key encryption key creation command, per the HW specification. Fixes: 45d3b55dc665 ("net/mlx5: Add crypto library to support create/destroy encryption key") Signed-off-by: Tariq Toukan Signed-off-by: Saeed Mahameed commit 5faf5b70c51dd9c9905bf8209e33cbd867486607 Author: Mohamad Heib Date: Tue Apr 23 21:13:48 2019 +0300 net/mlx5e: ethtool, Avoid setting speed to 56GBASE when autoneg off Setting speed to 56GBASE is allowed only with auto-negotiation enabled. This patch prevent setting speed to 56GBASE when auto-negotiation disabled. Fixes: f62b8bb8f2d3 ("net/mlx5: Extend mlx5_core to support ConnectX-4 Ethernet functionality") Signed-off-by: Mohamad Heib Signed-off-by: Saeed Mahameed commit 466df6eb4a9e813b3cfc674363316450c57a89c5 Author: Huy Nguyen Date: Thu Aug 1 11:10:19 2019 -0500 net/mlx5e: Only support tx/rx pause setting for port owner Only support changing tx/rx pause frame setting if the net device is the vport group manager. Fixes: 3c2d18ef22df ("net/mlx5e: Support ethtool get/set_pauseparam") Signed-off-by: Huy Nguyen Reviewed-by: Parav Pandit Signed-off-by: Saeed Mahameed commit 93b3586e070b14704dd7bff81fbcefd64663f3c2 Author: Huy Nguyen Date: Wed Jul 17 14:04:31 2019 -0500 net/mlx5: Support inner header match criteria for non decap flow action We have an issue that OVS application creates an offloaded drop rule that drops VXLAN traffic with both inner and outer header match criteria. mlx5_core driver detects correctly the inner and outer header match criteria but does not enable the inner header match criteria due to an incorrect assumption in mlx5_eswitch_add_offloaded_rule that only decap rule needs inner header criteria. Solution: Remove mlx5_esw_flow_attr's match_level and tunnel_match_level and add two new members: inner_match_level and outer_match_level. inner/outer_match_level is set to NONE if the inner/outer match criteria is not specified in the tc rule creation request. The decap assumption is removed and the code just needs to check for inner/outer_match_level to enable the corresponding bit in firmware's match_criteria_enable value. Fixes: 6363651d6dd7 ("net/mlx5e: Properly set steering match levels for offloaded TC decap rules") Signed-off-by: Huy Nguyen Reviewed-by: Roi Dayan Signed-off-by: Saeed Mahameed commit 405b93eb764367a670e729da18e54dc42db32620 Author: Maxim Mikityanskiy Date: Fri Jul 5 17:59:28 2019 +0300 net/mlx5e: Use flow keys dissector to parse packets for ARFS The current ARFS code relies on certain fields to be set in the SKB (e.g. transport_header) and extracts IP addresses and ports by custom code that parses the packet. The necessary SKB fields, however, are not always set at that point, which leads to an out-of-bounds access. Use skb_flow_dissect_flow_keys() to get the necessary information reliably, fix the out-of-bounds access and reuse the code. Fixes: 18c908e477dc ("net/mlx5e: Add accelerated RFS support") Signed-off-by: Maxim Mikityanskiy Reviewed-by: Tariq Toukan Signed-off-by: Saeed Mahameed commit 7352e72a513fd2757b2fda695a349d86faa4c94e Author: Dan Carpenter Date: Thu Aug 8 13:33:35 2019 +0300 regulator: slg51000: Fix a couple NULL vs IS_ERR() checks The devm_gpiod_get_from_of_node() function never returns NULL, it returns error pointers on error. Fixes: a867bde3dd03 ("regulator: slg51000: add slg51000 regulator driver") Signed-off-by: Dan Carpenter Link: https://lore.kernel.org/r/20190808103335.GD30506@mwanda Signed-off-by: Mark Brown commit 8e6e5bea2e34c61291d00cb3f47560341aa84bc3 Author: Jin Yao Date: Mon Jul 29 15:27:55 2019 +0800 perf pmu-events: Fix missing "cpu_clk_unhalted.core" event The events defined in pmu-events JSON are parsed and added into perf tool. For fixed counters, we handle the encodings between JSON and perf by using a static array fixed[]. But the fixed[] has missed an important event "cpu_clk_unhalted.core". For example, on the Tremont platform, [root@localhost ~]# perf stat -e cpu_clk_unhalted.core -a event syntax error: 'cpu_clk_unhalted.core' \___ parser error With this patch, the event cpu_clk_unhalted.core can be parsed. [root@localhost perf]# ./perf stat -e cpu_clk_unhalted.core -a -vvv ------------------------------------------------------------ perf_event_attr: type 4 size 112 config 0x3c sample_type IDENTIFIER read_format TOTAL_TIME_ENABLED|TOTAL_TIME_RUNNING disabled 1 inherit 1 exclude_guest 1 ------------------------------------------------------------ ... Signed-off-by: Jin Yao Cc: Alexander Shishkin Cc: Andi Kleen Cc: Jin Yao Cc: Jiri Olsa Cc: Kan Liang Cc: Peter Zijlstra Link: http://lkml.kernel.org/r/20190729072755.2166-1-yao.jin@linux.intel.com Signed-off-by: Arnaldo Carvalho de Melo commit b9c0a64901d5bdec6eafd38d1dc8fa0e2974fccb Author: Thomas Richter Date: Wed Jul 24 14:27:03 2019 +0200 perf annotate: Fix s390 gap between kernel end and module start During execution of command 'perf top' the error message: Not enough memory for annotating '__irf_end' symbol!) is emitted from this call sequence: __cmd_top perf_top__mmap_read perf_top__mmap_read_idx perf_event__process_sample hist_entry_iter__add hist_iter__top_callback perf_top__record_precise_ip hist_entry__inc_addr_samples symbol__inc_addr_samples symbol__get_annotation symbol__alloc_hist In this function the size of symbol __irf_end is calculated. The size of a symbol is the difference between its start and end address. When the symbol was read the first time, its start and end was set to: symbol__new: __irf_end 0xe954d0-0xe954d0 which is correct and maps with /proc/kallsyms: root@s8360046:~/linux-4.15.0/tools/perf# fgrep _irf_end /proc/kallsyms 0000000000e954d0 t __irf_end root@s8360046:~/linux-4.15.0/tools/perf# In function symbol__alloc_hist() the end of symbol __irf_end is symbol__alloc_hist sym:__irf_end start:0xe954d0 end:0x3ff80045a8 which is identical with the first module entry in /proc/kallsyms This results in a symbol size of __irf_req for histogram analyses of 70334140059072 bytes and a malloc() for this requested size fails. The root cause of this is function __dso__load_kallsyms() +-> symbols__fixup_end() Function symbols__fixup_end() enlarges the last symbol in the kallsyms map: # fgrep __irf_end /proc/kallsyms 0000000000e954d0 t __irf_end # to the start address of the first module: # cat /proc/kallsyms | sort | egrep ' [tT] ' .... 0000000000e952d0 T __security_initcall_end 0000000000e954d0 T __initramfs_size 0000000000e954d0 t __irf_end 000003ff800045a8 T fc_get_event_number [scsi_transport_fc] 000003ff800045d0 t store_fc_vport_disable [scsi_transport_fc] 000003ff800046a8 T scsi_is_fc_rport [scsi_transport_fc] 000003ff800046d0 t fc_target_setup [scsi_transport_fc] On s390 the kernel is located around memory address 0x200, 0x10000 or 0x100000, depending on linux version. Modules however start some- where around 0x3ff xxxx xxxx. This is different than x86 and produces a large gap for which histogram allocation fails. Fix this by detecting the kernel's last symbol and do no adjustment for it. Introduce a weak function and handle s390 specifics. Reported-by: Klaus Theurich Signed-off-by: Thomas Richter Acked-by: Heiko Carstens Cc: Hendrik Brueckner Cc: Vasily Gorbik Cc: stable@vger.kernel.org Link: http://lkml.kernel.org/r/20190724122703.3996-2-tmricht@linux.ibm.com Signed-off-by: Arnaldo Carvalho de Melo commit 12a6d2940b5f02b4b9f71ce098e3bb02bc24a9ea Author: Thomas Richter Date: Wed Jul 24 14:27:02 2019 +0200 perf record: Fix module size on s390 On s390 the modules loaded in memory have the text segment located after the GOT and Relocation table. This can be seen with this output: [root@m35lp76 perf]# fgrep qeth /proc/modules qeth 151552 1 qeth_l2, Live 0x000003ff800b2000 ... [root@m35lp76 perf]# cat /sys/module/qeth/sections/.text 0x000003ff800b3990 [root@m35lp76 perf]# There is an offset of 0x1990 bytes. The size of the qeth module is 151552 bytes (0x25000 in hex). The location of the GOT/relocation table at the beginning of a module is unique to s390. commit 203d8a4aa6ed ("perf s390: Fix 'start' address of module's map") adjusts the start address of a module in the map structures, but does not adjust the size of the modules. This leads to overlapping of module maps as this example shows: [root@m35lp76 perf] # ./perf report -D 0 0 0xfb0 [0xa0]: PERF_RECORD_MMAP -1/0: [0x3ff800b3990(0x25000) @ 0]: x /lib/modules/.../qeth.ko.xz 0 0 0x1050 [0xb0]: PERF_RECORD_MMAP -1/0: [0x3ff800d85a0(0x8000) @ 0]: x /lib/modules/.../ip6_tables.ko.xz The module qeth.ko has an adjusted start address modified to b3990, but its size is unchanged and the module ends at 0x3ff800d8990. This end address overlaps with the next modules start address of 0x3ff800d85a0. When the size of the leading GOT/Relocation table stored in the beginning of the text segment (0x1990 bytes) is subtracted from module qeth end address, there are no overlaps anymore: 0x3ff800d8990 - 0x1990 = 0x0x3ff800d7000 which is the same as 0x3ff800b2000 + 0x25000 = 0x0x3ff800d7000. To fix this issue, also adjust the modules size in function arch__fix_module_text_start(). Add another function parameter named size and reduce the size of the module when the text segment start address is changed. Output after: 0 0 0xfb0 [0xa0]: PERF_RECORD_MMAP -1/0: [0x3ff800b3990(0x23670) @ 0]: x /lib/modules/.../qeth.ko.xz 0 0 0x1050 [0xb0]: PERF_RECORD_MMAP -1/0: [0x3ff800d85a0(0x7a60) @ 0]: x /lib/modules/.../ip6_tables.ko.xz Reported-by: Stefan Liebler Signed-off-by: Thomas Richter Acked-by: Heiko Carstens Cc: Hendrik Brueckner Cc: Vasily Gorbik Cc: stable@vger.kernel.org Fixes: 203d8a4aa6ed ("perf s390: Fix 'start' address of module's map") Link: http://lkml.kernel.org/r/20190724122703.3996-1-tmricht@linux.ibm.com Signed-off-by: Arnaldo Carvalho de Melo commit fa37bab6d7154658d8a35920513f9396587754cc Author: Ian Rogers Date: Wed Jul 31 15:54:41 2019 -0700 perf tools: Fix include paths in ui directory These paths point to the wrong location but still work because they get picked up by a -I flag that happens to direct to the correct file. Fix paths to point to the correct location without -I flags. Signed-off-by: Ian Rogers Cc: Alexander Shishkin Cc: Andi Kleen Cc: Jiri Olsa Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Stephane Eranian Link: http://lkml.kernel.org/r/20190731225441.233800-1-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit 89b66500f739e0033ef59011e3df694f2053679d Author: Masanari Iida Date: Thu Aug 1 12:28:12 2019 +0900 perf tools: Fix a typo in a variable name in the Documentation Makefile This patch fix a spelling typo in a variable name in the Documentation Makefile. Signed-off-by: Masanari Iida Reviewed-by: Mukesh Ojha Cc: Alexander Shishkin Cc: Namhyung Kim Cc: Peter Zijlstra Link: http://lkml.kernel.org/r/20190801032812.25018-1-standby24x7@gmail.com Signed-off-by: Arnaldo Carvalho de Melo commit 5f5e25f1c7933a6e1673515c0b1d5acd82fea1ed Author: He Zhe Date: Fri Aug 2 16:29:52 2019 +0800 perf cpumap: Fix writing to illegal memory in handling cpumap mask cpu_map__snprint_mask() would write to illegal memory pointed by zalloc(0) when there is only one cpu. This patch fixes the calculation and adds sanity check against the input parameters. Signed-off-by: He Zhe Cc: Alexander Shishkin Cc: Alexey Budankov Cc: Jiri Olsa Cc: Kan Liang Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Stephane Eranian Fixes: 4400ac8a9a90 ("perf cpumap: Introduce cpu_map__snprint_mask()") Link: http://lkml.kernel.org/r/1564734592-15624-2-git-send-email-zhe.he@windriver.com Signed-off-by: Arnaldo Carvalho de Melo commit cf30ae726c011e0372fd4c2d588466c8b50a8907 Author: He Zhe Date: Fri Aug 2 16:29:51 2019 +0800 perf ftrace: Fix failure to set cpumask when only one cpu is present The buffer containing the string used to set cpumask is overwritten at the end of the string later in cpu_map__snprint_mask due to not enough memory space, when there is only one cpu. And thus causes the following failure: $ perf ftrace ls failed to reset ftrace $ This patch fixes the calculation of the cpumask string size. Signed-off-by: He Zhe Tested-by: Arnaldo Carvalho de Melo Cc: Alexander Shishkin Cc: Alexey Budankov Cc: Jiri Olsa Cc: Kan Liang Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Stephane Eranian Fixes: dc23103278c5 ("perf ftrace: Add support for -a and -C option") Link: http://lkml.kernel.org/r/1564734592-15624-1-git-send-email-zhe.he@windriver.com Signed-off-by: Arnaldo Carvalho de Melo commit 3de7ae0b2a1d86dbb23d0cb135150534fdb2e836 Author: Adrian Hunter Date: Thu Aug 8 09:48:23 2019 +0300 perf db-export: Fix thread__exec_comm() Threads synthesized from /proc have comms with a start time of zero, and not marked as "exec". Currently, there can be 2 such comms. The first is created by processing a synthesized fork event and is set to the parent's comm string, and the second by processing a synthesized comm event set to the thread's current comm string. In the absence of an "exec" comm, thread__exec_comm() picks the last (oldest) comm, which, in the case above, is the parent's comm string. For a main thread, that is very probably wrong. Use the second-to-last in that case. This affects only db-export because it is the only user of thread__exec_comm(). Example: $ sudo perf record -a -o pt-a-sleep-1 -e intel_pt//u -- sleep 1 $ sudo chown ahunter pt-a-sleep-1 Before: $ perf script -i pt-a-sleep-1 --itrace=bep -s tools/perf/scripts/python/export-to-sqlite.py pt-a-sleep-1.db branches calls $ sqlite3 -header -column pt-a-sleep-1.db 'select * from comm_threads_view' comm_id command thread_id pid tid ---------- ---------- ---------- ---------- ---------- 1 swapper 1 0 0 2 rcu_sched 2 10 10 3 kthreadd 3 78 78 5 sudo 4 15180 15180 5 sudo 5 15180 15182 7 kworker/4: 6 10335 10335 8 kthreadd 7 55 55 10 systemd 8 865 865 10 systemd 9 865 875 13 perf 10 15181 15181 15 sleep 10 15181 15181 16 kworker/3: 11 14179 14179 17 kthreadd 12 29376 29376 19 systemd 13 746 746 21 systemd 14 401 401 23 systemd 15 879 879 23 systemd 16 879 945 25 kthreadd 17 556 556 27 kworker/u1 18 14136 14136 28 kworker/u1 19 15021 15021 29 kthreadd 20 509 509 31 systemd 21 836 836 31 systemd 22 836 967 33 systemd 23 1148 1148 33 systemd 24 1148 1163 35 kworker/2: 25 17988 17988 36 kworker/0: 26 13478 13478 After: $ perf script -i pt-a-sleep-1 --itrace=bep -s tools/perf/scripts/python/export-to-sqlite.py pt-a-sleep-1b.db branches calls $ sqlite3 -header -column pt-a-sleep-1b.db 'select * from comm_threads_view' comm_id command thread_id pid tid ---------- ---------- ---------- ---------- ---------- 1 swapper 1 0 0 2 rcu_sched 2 10 10 3 kswapd0 3 78 78 4 perf 4 15180 15180 4 perf 5 15180 15182 6 kworker/4: 6 10335 10335 7 kcompactd0 7 55 55 8 accounts-d 8 865 865 8 accounts-d 9 865 875 10 perf 10 15181 15181 12 sleep 10 15181 15181 13 kworker/3: 11 14179 14179 14 kworker/1: 12 29376 29376 15 haveged 13 746 746 16 systemd-jo 14 401 401 17 NetworkMan 15 879 879 17 NetworkMan 16 879 945 19 irq/131-iw 17 556 556 20 kworker/u1 18 14136 14136 21 kworker/u1 19 15021 15021 22 kworker/u1 20 509 509 23 thermald 21 836 836 23 thermald 22 836 967 25 unity-sett 23 1148 1148 25 unity-sett 24 1148 1163 27 kworker/2: 25 17988 17988 28 kworker/0: 26 13478 13478 Signed-off-by: Adrian Hunter Cc: Jiri Olsa Cc: stable@vger.kernel.org Fixes: 65de51f93ebf ("perf tools: Identify which comms are from exec") Link: http://lkml.kernel.org/r/20190808064823.14846-1-adrian.hunter@intel.com Signed-off-by: Arnaldo Carvalho de Melo commit 85127775a65fc58e69af0c44513937d471ccbe7b Author: Arnaldo Carvalho de Melo Date: Tue Aug 6 11:24:09 2019 -0300 perf annotate: Fix printing of unaugmented disassembled instructions from BPF The code to disassemble BPF programs uses binutil's disassembling routines, and those use in turn fprintf to print to a memstream FILE, adding a newline at the end of each line, which ends up confusing the TUI routines called from: annotate_browser__write() annotate_line__write() annotate_browser__printf() ui_browser__vprintf() SLsmg_vprintf() The SLsmg_vprintf() function in the slang library gets confused with the terminating newline, so make the disasm_line__parse() function that parses the lines produced by the BPF specific disassembler (that uses binutil's libopcodes) and the lines produced by the objdump based disassembler used for everything else (and that doesn't adds this terminating newline) trim the end of the line in addition of the beginning. This way when disasm_line->ops.raw, i.e. for instructions without a special scnprintf() method, we'll not have that \n getting in the way of filling the screen right after the instruction with spaces to avoid leaving what was on the screen before and thus garbling the annotation screen, breaking scrolling, etc. Cc: Adrian Hunter Cc: Jiri Olsa Cc: Namhyung Kim Cc: Song Liu Fixes: 6987561c9e86 ("perf annotate: Enable annotation of BPF programs") Link: https://lkml.kernel.org/n/tip-unbr5a5efakobfr6rhxq99ta@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit f6649feb264ed10ce425455df48242c0e704cba2 Merge: 33920f1ec5bf f7af86ccf188 Author: David S. Miller Date: Thu Aug 8 11:25:39 2019 -0700 Merge tag 'batadv-net-for-davem-20190808' of git://git.open-mesh.org/linux-merge Simon Wunderlich says: ==================== Here are some batman-adv bugfixes: - Fix netlink dumping of all mcast_flags buckets, by Sven Eckelmann - Fix deletion of RTR(4|6) mcast list entries, by Sven Eckelmann ==================== Signed-off-by: David S. Miller commit 6c4d6bc5486466e3a67cc47270001d0b4a26eed4 Author: Masanari Iida Date: Tue Aug 6 23:23:28 2019 +0900 auxdisplay: Fix a typo in cfag12864b-example.c This patch fix a spelling typo in cfag12864b-example.c Signed-off-by: Masanari Iida Signed-off-by: Miguel Ojeda commit 390235c3e66036351e2a89b925843a741c8afd6c Author: Masahiro Yamada Date: Tue Aug 6 16:14:45 2019 +0900 auxdisplay: charlcd: add include guard to charlcd.h Add a header include guard just in case. Signed-off-by: Masahiro Yamada Signed-off-by: Miguel Ojeda commit 75354284cc3aa58f7e54d479d9bee69bd2ca828f Author: Masahiro Yamada Date: Tue Aug 6 16:14:44 2019 +0900 auxdisplay: charlcd: move charlcd.h to drivers/auxdisplay This header is included in drivers/auxdisplay/. Make it a local header. Reviewed-by: Geert Uytterhoeven Signed-off-by: Masahiro Yamada Signed-off-by: Miguel Ojeda commit 30e235389faadb9e3d918887b1f126155d7d761d Author: Jia He Date: Wed Aug 7 12:58:51 2019 +0800 arm64: mm: add missing PTE_SPECIAL in pte_mkdevmap on arm64 Without this patch, the MAP_SYNC test case will cause a print_bad_pte warning on arm64 as follows: [ 25.542693] BUG: Bad page map in process mapdax333 pte:2e8000448800f53 pmd:41ff5f003 [ 25.546360] page:ffff7e0010220000 refcount:1 mapcount:-1 mapping:ffff8003e29c7440 index:0x0 [ 25.550281] ext4_dax_aops [ 25.550282] name:"__aaabbbcccddd__" [ 25.551553] flags: 0x3ffff0000001002(referenced|reserved) [ 25.555802] raw: 03ffff0000001002 ffff8003dfffa908 0000000000000000 ffff8003e29c7440 [ 25.559446] raw: 0000000000000000 0000000000000000 00000001fffffffe 0000000000000000 [ 25.563075] page dumped because: bad pte [ 25.564938] addr:0000ffffbe05b000 vm_flags:208000fb anon_vma:0000000000000000 mapping:ffff8003e29c7440 index:0 [ 25.574272] file:__aaabbbcccddd__ fault:ext4_dax_fault mmmmap:ext4_file_mmap readpage:0x0 [ 25.578799] CPU: 1 PID: 1180 Comm: mapdax333 Not tainted 5.2.0+ #21 [ 25.581702] Hardware name: QEMU KVM Virtual Machine, BIOS 0.0.0 02/06/2015 [ 25.585624] Call trace: [ 25.587008] dump_backtrace+0x0/0x178 [ 25.588799] show_stack+0x24/0x30 [ 25.590328] dump_stack+0xa8/0xcc [ 25.591901] print_bad_pte+0x18c/0x218 [ 25.593628] unmap_page_range+0x778/0xc00 [ 25.595506] unmap_single_vma+0x94/0xe8 [ 25.597304] unmap_vmas+0x90/0x108 [ 25.598901] unmap_region+0xc0/0x128 [ 25.600566] __do_munmap+0x284/0x3f0 [ 25.602245] __vm_munmap+0x78/0xe0 [ 25.603820] __arm64_sys_munmap+0x34/0x48 [ 25.605709] el0_svc_common.constprop.0+0x78/0x168 [ 25.607956] el0_svc_handler+0x34/0x90 [ 25.609698] el0_svc+0x8/0xc [...] The root cause is in _vm_normal_page, without the PTE_SPECIAL bit, the return value will be incorrectly set to pfn_to_page(pfn) instead of NULL. Besides, this patch also rewrite the pmd_mkdevmap to avoid setting PTE_SPECIAL for pmd The MAP_SYNC test case is as follows(Provided by Yibo Cai) $#include $#include $#include $#include $#include $#ifndef MAP_SYNC $#define MAP_SYNC 0x80000 $#endif /* mount -o dax /dev/pmem0 /mnt */ $#define F "/mnt/__aaabbbcccddd__" int main(void) { int fd; char buf[4096]; void *addr; if ((fd = open(F, O_CREAT|O_TRUNC|O_RDWR, 0644)) < 0) { perror("open1"); return 1; } if (write(fd, buf, 4096) != 4096) { perror("lseek"); return 1; } addr = mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_SHARED|MAP_SYNC, fd, 0); if (addr == MAP_FAILED) { perror("mmap"); printf("did you mount with '-o dax'?\n"); return 1; } memset(addr, 0x55, 4096); if (munmap(addr, 4096) == -1) { perror("munmap"); return 1; } close(fd); return 0; } Fixes: 73b20c84d42d ("arm64: mm: implement pte_devmap support") Reported-by: Yibo Cai Acked-by: Will Deacon Acked-by: Robin Murphy Signed-off-by: Jia He Signed-off-by: Catalin Marinas commit 518a1c2f091290219783d5624284c140544a261e Merge: ecb095bff5d4 ee9d66182392 Author: Linus Torvalds Date: Thu Aug 8 09:57:50 2019 -0700 Merge tag '5.3-rc3-smb3-fixes' of git://git.samba.org/sfrench/cifs-2.6 Pull cifs fixes from Steve French: "Six small SMB3 fixes, two for stable" * tag '5.3-rc3-smb3-fixes' of git://git.samba.org/sfrench/cifs-2.6: SMB3: Kernel oops mounting a encryptData share with CONFIG_DEBUG_VIRTUAL smb3: update TODO list of missing features smb3: send CAP_DFS capability during session setup SMB3: Fix potential memory leak when processing compound chain SMB3: Fix deadlock in validate negotiate hits reconnect cifs: fix rmmod regression in cifs.ko caused by force_sig changes commit d0a255e795ab976481565f6ac178314b34fbf891 Author: Mikulas Patocka Date: Thu Aug 8 11:17:01 2019 -0400 loop: set PF_MEMALLOC_NOIO for the worker thread A deadlock with this stacktrace was observed. The loop thread does a GFP_KERNEL allocation, it calls into dm-bufio shrinker and the shrinker depends on I/O completion in the dm-bufio subsystem. In order to fix the deadlock (and other similar ones), we set the flag PF_MEMALLOC_NOIO at loop thread entry. PID: 474 TASK: ffff8813e11f4600 CPU: 10 COMMAND: "kswapd0" #0 [ffff8813dedfb938] __schedule at ffffffff8173f405 #1 [ffff8813dedfb990] schedule at ffffffff8173fa27 #2 [ffff8813dedfb9b0] schedule_timeout at ffffffff81742fec #3 [ffff8813dedfba60] io_schedule_timeout at ffffffff8173f186 #4 [ffff8813dedfbaa0] bit_wait_io at ffffffff8174034f #5 [ffff8813dedfbac0] __wait_on_bit at ffffffff8173fec8 #6 [ffff8813dedfbb10] out_of_line_wait_on_bit at ffffffff8173ff81 #7 [ffff8813dedfbb90] __make_buffer_clean at ffffffffa038736f [dm_bufio] #8 [ffff8813dedfbbb0] __try_evict_buffer at ffffffffa0387bb8 [dm_bufio] #9 [ffff8813dedfbbd0] dm_bufio_shrink_scan at ffffffffa0387cc3 [dm_bufio] #10 [ffff8813dedfbc40] shrink_slab at ffffffff811a87ce #11 [ffff8813dedfbd30] shrink_zone at ffffffff811ad778 #12 [ffff8813dedfbdc0] kswapd at ffffffff811ae92f #13 [ffff8813dedfbec0] kthread at ffffffff810a8428 #14 [ffff8813dedfbf50] ret_from_fork at ffffffff81745242 PID: 14127 TASK: ffff881455749c00 CPU: 11 COMMAND: "loop1" #0 [ffff88272f5af228] __schedule at ffffffff8173f405 #1 [ffff88272f5af280] schedule at ffffffff8173fa27 #2 [ffff88272f5af2a0] schedule_preempt_disabled at ffffffff8173fd5e #3 [ffff88272f5af2b0] __mutex_lock_slowpath at ffffffff81741fb5 #4 [ffff88272f5af330] mutex_lock at ffffffff81742133 #5 [ffff88272f5af350] dm_bufio_shrink_count at ffffffffa03865f9 [dm_bufio] #6 [ffff88272f5af380] shrink_slab at ffffffff811a86bd #7 [ffff88272f5af470] shrink_zone at ffffffff811ad778 #8 [ffff88272f5af500] do_try_to_free_pages at ffffffff811adb34 #9 [ffff88272f5af590] try_to_free_pages at ffffffff811adef8 #10 [ffff88272f5af610] __alloc_pages_nodemask at ffffffff811a09c3 #11 [ffff88272f5af710] alloc_pages_current at ffffffff811e8b71 #12 [ffff88272f5af760] new_slab at ffffffff811f4523 #13 [ffff88272f5af7b0] __slab_alloc at ffffffff8173a1b5 #14 [ffff88272f5af880] kmem_cache_alloc at ffffffff811f484b #15 [ffff88272f5af8d0] do_blockdev_direct_IO at ffffffff812535b3 #16 [ffff88272f5afb00] __blockdev_direct_IO at ffffffff81255dc3 #17 [ffff88272f5afb30] xfs_vm_direct_IO at ffffffffa01fe3fc [xfs] #18 [ffff88272f5afb90] generic_file_read_iter at ffffffff81198994 #19 [ffff88272f5afc50] __dta_xfs_file_read_iter_2398 at ffffffffa020c970 [xfs] #20 [ffff88272f5afcc0] lo_rw_aio at ffffffffa0377042 [loop] #21 [ffff88272f5afd70] loop_queue_work at ffffffffa0377c3b [loop] #22 [ffff88272f5afe60] kthread_worker_fn at ffffffff810a8a0c #23 [ffff88272f5afec0] kthread at ffffffff810a8428 #24 [ffff88272f5aff50] ret_from_fork at ffffffff81745242 Signed-off-by: Mikulas Patocka Cc: stable@vger.kernel.org Signed-off-by: Jens Axboe commit 27709ae4e2fe6cf7da2ae45e718e190c5433342b Author: Thiébaud Weksteen Date: Tue Aug 6 13:00:50 2019 +0200 usb: setup authorized_default attributes using usb_bus_notify Currently, the authorized_default and interface_authorized_default attributes for HCD are set up after the uevent has been sent to userland. This creates a race condition where userland may fail to access this file when processing the event. Move the appending of these attributes earlier relying on the usb_bus_notify dispatcher. Signed-off-by: Thiébaud Weksteen Cc: stable Link: https://lore.kernel.org/r/20190806110050.38918-1-tweek@google.com Signed-off-by: Greg Kroah-Hartman commit e91455bad5cff40a8c232f2204a5104127e3fec2 Author: Jan Kara Date: Wed Aug 7 11:36:47 2019 +0200 bdev: Fixup error handling in blkdev_get() Commit 89e524c04fa9 ("loop: Fix mount(2) failure due to race with LOOP_SET_FD") converted blkdev_get() to use the new helpers for finishing claiming of a block device. However the conversion botched the error handling in blkdev_get() and thus the bdev has been marked as held even in case __blkdev_get() returned error. This led to occasional warnings with block/001 test from blktests like: kernel: WARNING: CPU: 5 PID: 907 at fs/block_dev.c:1899 __blkdev_put+0x396/0x3a0 Correct the error handling. CC: stable@vger.kernel.org Fixes: 89e524c04fa9 ("loop: Fix mount(2) failure due to race with LOOP_SET_FD") Signed-off-by: Jan Kara Signed-off-by: Jens Axboe commit 39c71a5b8212f4b502d9a630c6706ac723abd422 Author: Jia-Ju Bai Date: Mon Jul 29 10:08:49 2019 +0800 dmaengine: stm32-mdma: Fix a possible null-pointer dereference in stm32_mdma_irq_handler() In stm32_mdma_irq_handler(), chan is checked on line 1368. When chan is NULL, it is still used on line 1369: dev_err(chan2dev(chan), "MDMA channel not initialized\n"); Thus, a possible null-pointer dereference may occur. To fix this bug, "dev_dbg(mdma2dev(dmadev), ...)" is used instead. Signed-off-by: Jia-Ju Bai Fixes: a4ffb13c8946 ("dmaengine: Add STM32 MDMA driver") Link: https://lore.kernel.org/r/20190729020849.17971-1-baijiaju1990@gmail.com Signed-off-by: Vinod Koul commit fd03177c33b287c6541f4048f1d67b7b45a1abc9 Author: Paolo Valente Date: Wed Aug 7 19:21:11 2019 +0200 block, bfq: handle NULL return value by bfq_init_rq() As reported in [1], the call bfq_init_rq(rq) may return NULL in case of OOM (in particular, if rq->elv.icq is NULL because memory allocation failed in failed in ioc_create_icq()). This commit handles this circumstance. [1] https://lkml.org/lkml/2019/7/22/824 Cc: Hsin-Yi Wang Cc: Nicolas Boichat Cc: Doug Anderson Reported-by: Guenter Roeck Reported-by: Hsin-Yi Wang Reviewed-by: Guenter Roeck Signed-off-by: Paolo Valente Signed-off-by: Jens Axboe commit 3f758e844aa9800eb660d60ee10226fa802594d4 Author: Paolo Valente Date: Wed Aug 7 16:17:54 2019 +0200 block, bfq: move update of waker and woken list to queue freeing Since commit 13a857a4c4e8 ("block, bfq: detect wakers and unconditionally inject their I/O"), every bfq_queue has a pointer to a waker bfq_queue and a list of the bfq_queues it may wake. In this respect, when a bfq_queue, say Q, remains with no I/O source attached to it, Q cannot be woken by any other bfq_queue, and cannot wake any other bfq_queue. Then Q must be removed from the woken list of its possible waker bfq_queue, and all bfq_queues in the woken list of Q must stop having a waker bfq_queue. Q remains with no I/O source in two cases: when the last process associated with Q exits or when such a process gets associated with a different bfq_queue. Unfortunately, commit 13a857a4c4e8 ("block, bfq: detect wakers and unconditionally inject their I/O") performed the above updates only in the first case. This commit fixes this bug by moving these updates to when Q gets freed. This is a simple and safe way to handle all cases, as both the above events, process exit and re-association, lead to Q being freed soon, and because dangling references would come out only after Q gets freed (if no update were performed). Fixes: 13a857a4c4e8 ("block, bfq: detect wakers and unconditionally inject their I/O") Reported-by: Douglas Anderson Tested-by: Douglas Anderson Signed-off-by: Paolo Valente Signed-off-by: Jens Axboe commit 08d383a74948b43eb6e96c86153e63cbf276f1fa Author: Paolo Valente Date: Wed Aug 7 16:17:53 2019 +0200 block, bfq: reset last_completed_rq_bfqq if the pointed queue is freed Since commit 13a857a4c4e8 ("block, bfq: detect wakers and unconditionally inject their I/O"), BFQ stores, in a per-device pointer last_completed_rq_bfqq, the last bfq_queue that had an I/O request completed. If some bfq_queue receives new I/O right after the last request of last_completed_rq_bfqq has been completed, then last_completed_rq_bfqq may be a waker bfq_queue. But if the bfq_queue last_completed_rq_bfqq points to is freed, then last_completed_rq_bfqq becomes a dangling reference. This commit resets last_completed_rq_bfqq if the pointed bfq_queue is freed. Fixes: 13a857a4c4e8 ("block, bfq: detect wakers and unconditionally inject their I/O") Reported-by: Douglas Anderson Tested-by: Douglas Anderson Signed-off-by: Paolo Valente Signed-off-by: Jens Axboe commit 430380b4637aec646996b4aef67ad417593923b2 Author: He Zhe Date: Thu Aug 8 11:09:54 2019 +0800 block: aoe: Fix kernel crash due to atomic sleep when exiting Since commit 3582dd291788 ("aoe: convert aoeblk to blk-mq"), aoedev_downdev has had the possibility of sleeping and causing the following crash. BUG: scheduling while atomic: rmmod/2242/0x00000003 Modules linked in: aoe Preemption disabled at: [] flush+0x95/0x4a0 [aoe] CPU: 7 PID: 2242 Comm: rmmod Tainted: G I 5.2.3 #1 Hardware name: Intel Corporation S5520HC/S5520HC, BIOS S5500.86B.01.10.0025.030220091519 03/02/2009 Call Trace: dump_stack+0x4f/0x6a ? flush+0x95/0x4a0 [aoe] __schedule_bug.cold+0x44/0x54 __schedule+0x44f/0x680 schedule+0x44/0xd0 blk_mq_freeze_queue_wait+0x46/0xb0 ? wait_woken+0x80/0x80 blk_mq_freeze_queue+0x1b/0x20 aoedev_downdev+0x111/0x160 [aoe] flush+0xff/0x4a0 [aoe] aoedev_exit+0x23/0x30 [aoe] aoe_exit+0x35/0x948 [aoe] __se_sys_delete_module+0x183/0x210 __x64_sys_delete_module+0x16/0x20 do_syscall_64+0x4d/0x130 entry_SYSCALL_64_after_hwframe+0x44/0xa9 RIP: 0033:0x7f24e0043b07 Code: 73 01 c3 48 8b 0d 89 73 0b 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 b0 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 59 73 0b 00 f7 d8 64 89 01 48 RSP: 002b:00007ffe18f7f1e8 EFLAGS: 00000206 ORIG_RAX: 00000000000000b0 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f24e0043b07 RDX: 000000000000000a RSI: 0000000000000800 RDI: 0000555c3ecf87c8 RBP: 00007ffe18f7f1f0 R08: 0000000000000000 R09: 0000000000000000 R10: 00007f24e00b4ac0 R11: 0000000000000206 R12: 00007ffe18f7f238 R13: 00007ffe18f7f410 R14: 00007ffe18f80e73 R15: 0000555c3ecf8760 This patch, handling in the same way of pass two, unlocks the locks and restart pass one after aoedev_downdev is done. Fixes: 3582dd291788 ("aoe: convert aoeblk to blk-mq") Signed-off-by: He Zhe Signed-off-by: Jens Axboe commit 739bacbf7aa2c44bb25d9ad5f7d5b256082c5e66 Author: Vasily Gorbik Date: Mon Jan 21 13:54:53 2019 +0100 s390/build: use size command to perform empty .bss check Currently empty .bss checks performed do not pay attention to "common objects" in object files which end up in .bss section eventually. The "size" tool is a part of binutils and since version 2.18 provides "--common" command line option, which allows to account "common objects" sizes in .bss section size. Utilize "size --common" to perform accurate check that .bss section is unused. Besides that the size tool handles object files without .bss section gracefully and doesn't require additional objdump run. The linux kernel requires binutils 2.20 since 4.13. Kbuild exports OBJSIZE to reference the right size tool. Link: http://lkml.kernel.org/r/patch-2.thread-2257a1.git-2257a1c53d4a.your-ad-here.call-01565088755-ext-5120@work.hours Reported-and-tested-by: Heiko Carstens Acked-by: Heiko Carstens Signed-off-by: Vasily Gorbik commit 7bac98707f65b93bf994ef4e99b1eb9e7dbb9c32 Author: Vasily Gorbik Date: Mon Jan 21 13:54:39 2019 +0100 kbuild: add OBJSIZE variable for the size tool Define and export OBJSIZE variable for "size" tool from binutils to be used in architecture specific Makefiles (naming the variable just "SIZE" would be too risky). In particular this tool is useful to perform checks that early boot code is not using bss section (which might have not been zeroed yet or intersects with initrd or other files boot loader might have put right after the linux kernel). Link: http://lkml.kernel.org/r/patch-1.thread-2257a1.git-188f5a3d81d5.your-ad-here.call-01565088755-ext-5120@work.hours Acked-by: Masahiro Yamada Signed-off-by: Vasily Gorbik commit 6cf9481b440da6d6d86bd8e4c99a8b553b9d1271 Author: Hans de Goede Date: Tue Jul 30 17:48:48 2019 +0200 pwm: Fallback to the static lookup-list when acpi_pwm_get fails Commit 4a6ef8e37c4d ("pwm: Add support referencing PWMs from ACPI") made pwm_get unconditionally return the acpi_pwm_get return value if the device passed to pwm_get has an ACPI fwnode. But even if the passed in device has an ACPI fwnode, it does not necessarily have the necessary ACPI package defining its pwm bindings, especially since the binding / API of this ACPI package has only been introduced very recently. Up until now X86/ACPI devices which use a separate pwm controller for controlling their LCD screen's backlight brightness have been relying on the static lookup-list to get their pwm. pwm_get unconditionally returning the acpi_pwm_get return value breaks this, breaking backlight control on these devices. This commit fixes this by making pwm_get fall back to the static lookup-list if acpi_pwm_get returns -ENOENT. BugLink: https://bugs.freedesktop.org/show_bug.cgi?id=96571 Reported-by: youling257@gmail.com Fixes: 4a6ef8e37c4d ("pwm: Add support referencing PWMs from ACPI") Cc: Nikolaus Voss Signed-off-by: Hans de Goede Reviewed-by: Andy Shevchenko Acked-by: Nikolaus Voss Signed-off-by: Thierry Reding commit c468a8aa790e0dfe0a7f8a39db282d39c2c00b46 Author: Oliver Neukum Date: Thu Aug 8 11:27:28 2019 +0200 usb: iowarrior: fix deadlock on disconnect We have to drop the mutex before we close() upon disconnect() as close() needs the lock. This is safe to do by dropping the mutex as intfdata is already set to NULL, so open() will fail. Fixes: 03f36e885fc26 ("USB: open disconnect race in iowarrior") Reported-by: syzbot+a64a382964bf6c71a9c0@syzkaller.appspotmail.com Cc: stable Signed-off-by: Oliver Neukum Link: https://lore.kernel.org/r/20190808092728.23417-1-oneukum@suse.com Signed-off-by: Greg Kroah-Hartman commit 2ca359f4f8b954b3a9d15a89f22a8b7283e7669f Author: Oliver Neukum Date: Thu Aug 8 11:28:54 2019 +0200 Revert "USB: rio500: simplify locking" This reverts commit d710734b06770814de2bfa2819420fb5df7f3a81. This simplification causes a deadlock. Reported-by: syzbot+7bbcbe9c9ff0cd49592a@syzkaller.appspotmail.com Fixes: d710734b0677 ("USB: rio500: simplify locking") Cc: stable Signed-off-by: Oliver Neukum Link: https://lore.kernel.org/r/20190808092854.23519-1-oneukum@suse.com Signed-off-by: Greg Kroah-Hartman commit 6b7c3b86f0b63134b2ab56508921a0853ffa687a Author: Colin Ian King Date: Mon Jun 24 09:39:59 2019 -0700 drm/vmwgfx: fix memory leak when too many retries have occurred Currently when too many retries have occurred there is a memory leak on the allocation for reply on the error return path. Fix this by kfree'ing reply before returning. Addresses-Coverity: ("Resource leak") Fixes: a9cd9c044aa9 ("drm/vmwgfx: Add a check to handle host message failure") Signed-off-by: Colin Ian King Reviewed-by: Deepak Rawat Signed-off-by: Deepak Rawat Signed-off-by: Thomas Hellstrom commit 1be3c1fae6c1e1f5bb982b255d2034034454527a Author: Wenwen Wang Date: Thu Aug 8 00:50:58 2019 -0500 ALSA: firewire: fix a memory leak bug In iso_packets_buffer_init(), 'b->packets' is allocated through kmalloc_array(). Then, the aligned packet size is checked. If it is larger than PAGE_SIZE, -EINVAL will be returned to indicate the error. However, the allocated 'b->packets' is not deallocated on this path, leading to a memory leak. To fix the above issue, free 'b->packets' before returning the error code. Fixes: 31ef9134eb52 ("ALSA: add LaCie FireWire Speakers/Griffin FireWave Surround driver") Signed-off-by: Wenwen Wang Reviewed-by: Takashi Sakamoto Cc: # v2.6.39+ Signed-off-by: Takashi Iwai commit 491beed3b102b6e6c0e7734200661242226e3933 Author: Ming Lei Date: Mon Aug 5 09:19:06 2019 +0800 genirq/affinity: Create affinity mask for single vector Since commit c66d4bd110a1f8 ("genirq/affinity: Add new callback for (re)calculating interrupt sets"), irq_create_affinity_masks() returns NULL in case of single vector. This change has caused regression on some drivers, such as lpfc. The problem is that single vector requests can happen in some generic cases: 1) kdump kernel 2) irq vectors resource is close to exhaustion. If in that situation the affinity mask for a single vector is not created, every caller has to handle the special case. There is no reason why the mask cannot be created, so remove the check for a single vector and create the mask. Fixes: c66d4bd110a1f8 ("genirq/affinity: Add new callback for (re)calculating interrupt sets") Signed-off-by: Ming Lei Signed-off-by: Thomas Gleixner Cc: stable@vger.kernel.org Link: https://lkml.kernel.org/r/20190805011906.5020-1-ming.lei@redhat.com commit 8097c43bcbec56fbd0788d99e1e236c0e0d4013f Author: Greg Kroah-Hartman Date: Thu Aug 8 08:39:35 2019 +0200 Revert "kernfs: fix memleak in kernel_ops_readdir()" This reverts commit cc798c83898ea0a77fcaa1a92afda35c3c3ded74. Tony writes: Somehow this causes a regression in Linux next for me where I'm seeing lots of sysfs entries now missing under /sys/bus/platform/devices. For example, I now only see one .serial entry show up in sysfs. Things work again if I revert commit cc798c83898e ("kernfs: fix memleak inkernel_ops_readdir()"). Any ideas why that would be? Tejun says: Ugh, you're right. It can get double-put cuz ctx->pos is put by release too. So reverting it for now. Reported-by: Tony Lindgren Cc: Andrea Arcangeli Cc: Tejun Heo Fixes: cc798c83898e ("kernfs: fix memleak in kernel_ops_readdir()") Cc: stable Signed-off-by: Greg Kroah-Hartman commit 04f5bda84b0712d6f172556a7e8dca9ded5e73b9 Author: Valdis Klētnieks Date: Wed Aug 7 23:27:17 2019 -0400 x86/lib/cpu: Address missing prototypes warning When building with W=1, warnings about missing prototypes are emitted: CC arch/x86/lib/cpu.o arch/x86/lib/cpu.c:5:14: warning: no previous prototype for 'x86_family' [-Wmissing-prototypes] 5 | unsigned int x86_family(unsigned int sig) | ^~~~~~~~~~ arch/x86/lib/cpu.c:18:14: warning: no previous prototype for 'x86_model' [-Wmissing-prototypes] 18 | unsigned int x86_model(unsigned int sig) | ^~~~~~~~~ arch/x86/lib/cpu.c:33:14: warning: no previous prototype for 'x86_stepping' [-Wmissing-prototypes] 33 | unsigned int x86_stepping(unsigned int sig) | ^~~~~~~~~~~~ Add the proper include file so the prototypes are there. Signed-off-by: Valdis Kletnieks Signed-off-by: Thomas Gleixner Link: https://lkml.kernel.org/r/42513.1565234837@turing-police commit b059f801a937d164e03b33c1848bb3dca67c0b04 Author: Nick Desaulniers Date: Wed Aug 7 15:15:33 2019 -0700 x86/purgatory: Use CFLAGS_REMOVE rather than reset KBUILD_CFLAGS KBUILD_CFLAGS is very carefully built up in the top level Makefile, particularly when cross compiling or using different build tools. Resetting KBUILD_CFLAGS via := assignment is an antipattern. The comment above the reset mentions that -pg is problematic. Other Makefiles use `CFLAGS_REMOVE_file.o = $(CC_FLAGS_FTRACE)` when CONFIG_FUNCTION_TRACER is set. Prefer that pattern to wiping out all of the important KBUILD_CFLAGS then manually having to re-add them. Seems also that __stack_chk_fail references are generated when using CONFIG_STACKPROTECTOR or CONFIG_STACKPROTECTOR_STRONG. Fixes: 8fc5b4d4121c ("purgatory: core purgatory functionality") Reported-by: Vaibhav Rustagi Suggested-by: Peter Zijlstra Suggested-by: Thomas Gleixner Signed-off-by: Nick Desaulniers Signed-off-by: Thomas Gleixner Tested-by: Vaibhav Rustagi Cc: stable@vger.kernel.org Link: https://lkml.kernel.org/r/20190807221539.94583-2-ndesaulniers@google.com commit 4ce97317f41d38584fb93578e922fcd19e535f5b Author: Nick Desaulniers Date: Wed Aug 7 15:15:32 2019 -0700 x86/purgatory: Do not use __builtin_memcpy and __builtin_memset Implementing memcpy and memset in terms of __builtin_memcpy and __builtin_memset is problematic. GCC at -O2 will replace calls to the builtins with calls to memcpy and memset (but will generate an inline implementation at -Os). Clang will replace the builtins with these calls regardless of optimization level. $ llvm-objdump -dr arch/x86/purgatory/string.o | tail 0000000000000339 memcpy: 339: 48 b8 00 00 00 00 00 00 00 00 movabsq $0, %rax 000000000000033b: R_X86_64_64 memcpy 343: ff e0 jmpq *%rax 0000000000000345 memset: 345: 48 b8 00 00 00 00 00 00 00 00 movabsq $0, %rax 0000000000000347: R_X86_64_64 memset 34f: ff e0 Such code results in infinite recursion at runtime. This is observed when doing kexec. Instead, reuse an implementation from arch/x86/boot/compressed/string.c. This requires to implement a stub function for warn(). Also, Clang may lower memcmp's that compare against 0 to bcmp's, so add a small definition, too. See also: commit 5f074f3e192f ("lib/string.c: implement a basic bcmp") Fixes: 8fc5b4d4121c ("purgatory: core purgatory functionality") Reported-by: Vaibhav Rustagi Debugged-by: Vaibhav Rustagi Debugged-by: Manoj Gupta Suggested-by: Alistair Delva Signed-off-by: Nick Desaulniers Signed-off-by: Thomas Gleixner Tested-by: Vaibhav Rustagi Cc: stable@vger.kernel.org Link: https://bugs.chromium.org/p/chromium/issues/detail?id=984056 Link: https://lkml.kernel.org/r/20190807221539.94583-1-ndesaulniers@google.com commit c7cd7c748a3250ca33509f9235efab9c803aca09 Author: Wenwen Wang Date: Thu Aug 8 00:15:21 2019 -0500 sound: fix a memory leak bug In sound_insert_unit(), the controlling structure 's' is allocated through kmalloc(). Then it is added to the sound driver list by invoking __sound_insert_unit(). Later on, if __register_chrdev() fails, 's' is removed from the list through __sound_remove_unit(). If 'index' is not less than 0, -EBUSY is returned to indicate the error. However, 's' is not deallocated on this execution path, leading to a memory leak bug. To fix the above issue, free 's' before -EBUSY is returned. Signed-off-by: Wenwen Wang Cc: Signed-off-by: Takashi Iwai commit f536579c148249505b388d525ac1866e080fd66a Merge: abffedaaa770 4b3e30ed3ec7 Author: Dave Airlie Date: Thu Aug 8 13:25:49 2019 +1000 Merge tag 'drm-fixes-5.3-2019-08-07' of git://people.freedesktop.org/~agd5f/linux into drm-fixes drm-fixes-5.3-2019-08-07: amdgpu: - Fixes VCN to handle the latest navi10 firmware - Fixes for fan control on navi10 - Properly handle SMU metrics table on navi10 - Fix a resume regression on Stoney amdkfd: - Revert new GWS ioctl. It's not ready. Signed-off-by: Dave Airlie From: Alex Deucher Link: https://patchwork.freedesktop.org/patch/msgid/20190807184221.3323-1-alexander.deucher@amd.com commit abffedaaa7702d1194934169fe65553804a2b064 Merge: e21a712a9685 2a6fc3cb5cb6 Author: Dave Airlie Date: Thu Aug 8 13:21:46 2019 +1000 Merge tag 'drm/tegra/for-5.3-rc4' of git://anongit.freedesktop.org/tegra/linux into drm-fixes drm/tegra: Fixes for v5.3-rc4 This contains a single fix for a regression introduced by a combination of a GPIO and a drm/tegra patch merged in v5.3-rc1. Signed-off-by: Dave Airlie From: Thierry Reding Link: https://patchwork.freedesktop.org/patch/msgid/20190807140634.29166-1-thierry.reding@gmail.com commit a86c71ba3022331f79662d7f12d1b25188c7e377 Author: James Smart Date: Fri Aug 2 13:26:12 2019 -0700 scsi: lpfc: Fix crash when cpu count is 1 and null irq affinity mask When a configurations runs with a single cpu (such as a kdump kernel), which causes the driver to request a single vector, when the driver subsequently requests an irq affinity mask, the mask comes back null. The driver currently does nothing in this scenario, which leaves mappings to hardware queues incomplete and crashes the system. Fix by recognizing the null mask and assigning the vector to the first cpu in the system. Signed-off-by: Dick Kennedy Signed-off-by: James Smart Signed-off-by: Martin K. Petersen commit ecb095bff5d4b8711a81968625b3b4a235d3e477 Merge: 33920f1ec5bf a95a4f3f2702 Author: Linus Torvalds Date: Wed Aug 7 15:06:31 2019 -0700 Merge tag 'hwmon-for-v5.3-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging Pull hwmon fixes from Guenter Roeck: "Fixes to lm75 and nct7802 drivers In the lm75 driver, fix TMP75B chip description to ensure correct initialization. In the nct7802 driver, fix in4 presence detection" * tag 'hwmon-for-v5.3-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging: hwmon: (lm75) Fixup tmp75b clr_mask hwmon: (nct7802) Fix wrong detection of in4 presence commit a95a4f3f2702b55a89393bf0f1b2b3d79e0f7da2 Author: Iker Perez del Palomar Sustatxa Date: Thu Aug 1 08:53:24 2019 +0100 hwmon: (lm75) Fixup tmp75b clr_mask The configuration register of the tmp75b sensor is 16bit long, however the first byte is reserved, so there is not no need to take care of it. Because the order of the bytes is little endian and it is only necessary to write one byte, the desired bits must be shifted into a 8 bit range. Fixes: 39abe9d88b30 ("hwmon: (lm75) Add support for TMP75B") Cc: stable@vger.kernel.org Signed-off-by: Iker Perez del Palomar Sustatxa Link: https://lore.kernel.org/r/20190801075324.4638-1-iker.perez@codethink.co.uk Signed-off-by: Guenter Roeck commit 38ada2f406a9b81fb1249c5c9227fa657e7d5671 Author: Guenter Roeck Date: Fri Jul 26 08:00:49 2019 -0700 hwmon: (nct7802) Fix wrong detection of in4 presence The code to detect if in4 is present is wrong; if in4 is not present, the in4_input sysfs attribute is still present. In detail: - Ihen RTD3_MD=11 (VSEN3 present), everything is as expected (no bug). - If we have RTD3_MD!=11 (no VSEN3), we unexpectedly have a in4_input file under /sys and the "sensors" command displays in4_input. But as expected, we have no in4_min, in4_max, in4_alarm, in4_beep. Fix is_visible function to detect and report in4_input visibility as expected. Reported-by: Gilles Buloz Cc: Gilles Buloz Cc: stable@vger.kernel.org Fixes: 3434f37835804 ("hwmon: Driver for Nuvoton NCT7802Y") Signed-off-by: Guenter Roeck commit e7e6c6320c8c9ed923250cd019e5f9ca0f59b4b8 Author: Dan Carpenter Date: Wed Aug 7 15:32:36 2019 +0300 IB/mlx5: Check the correct variable in error handling code The code accidentally checks "event_sub" instead of "event_sub->eventfd". Fixes: 759738537142 ("IB/mlx5: Enable subscription for device events over DEVX") Signed-off-by: Dan Carpenter Reviewed-by: Jason Gunthorpe Acked-by: Leon Romanovsky Link: https://lore.kernel.org/r/20190807123236.GA11452@mwanda Signed-off-by: Doug Ledford commit d97de8887a12c598abc4d2e4e57a54c1f030e112 Author: Mark Zhang Date: Wed Aug 7 13:18:19 2019 +0300 RDMA/counter: Prevent QP counter binding if counters unsupported In case of rdma_counter_init() fails, counter allocation and QP bind should not be allowed. Fixes: 413d3347503b ("RDMA/counter: Add set/clear per-port auto mode support") Fixes: 1bd8e0a9d0fd ("RDMA/counter: Allow manual mode configuration support") Signed-off-by: Mark Zhang Reviewed-by: Parav Pandit Signed-off-by: Leon Romanovsky Link: https://lore.kernel.org/r/20190807101819.7581-1-leon@kernel.org Signed-off-by: Doug Ledford commit f591822c3cf314442819486f45ff7dc1f690e0c0 Author: Yishai Hadas Date: Mon Aug 5 11:30:10 2019 +0300 IB/mlx5: Fix implicit MR release flow Once implicit MR is being called to be released by ib_umem_notifier_release() its leaves were marked as "dying". However, when dereg_mr()->mlx5_ib_free_implicit_mr()->mr_leaf_free() is called, it skips running the mr_leaf_free_action (i.e. umem_odp->work) when those leaves were marked as "dying". As such ib_umem_release() for the leaves won't be called and their MRs will be leaked as well. When an application exits/killed without calling dereg_mr we might hit the above flow. This fatal scenario is reported by WARN_ON() upon mlx5_ib_dealloc_ucontext() as ibcontext->per_mm_list is not empty, the call trace can be seen below. Originally the "dying" mark as part of ib_umem_notifier_release() was introduced to prevent pagefault_mr() from returning a success response once this happened. However, we already have today the completion mechanism so no need for that in those flows any more. Even in case a success response will be returned the firmware will not find the pages and an error will be returned in the following call as a released mm will cause ib_umem_odp_map_dma_pages() to permanently fail mmget_not_zero(). Fix the above issue by dropping the "dying" from the above flows. The other flows that are using "dying" are still needed it for their synchronization purposes. WARNING: CPU: 1 PID: 7218 at drivers/infiniband/hw/mlx5/main.c:2004 mlx5_ib_dealloc_ucontext+0x84/0x90 [mlx5_ib] CPU: 1 PID: 7218 Comm: ibv_rc_pingpong Tainted: G E 5.2.0-rc6+ #13 Call Trace: uverbs_destroy_ufile_hw+0xb5/0x120 [ib_uverbs] ib_uverbs_close+0x1f/0x80 [ib_uverbs] __fput+0xbe/0x250 task_work_run+0x88/0xa0 do_exit+0x2cb/0xc30 ? __fput+0x14b/0x250 do_group_exit+0x39/0xb0 get_signal+0x191/0x920 ? _raw_spin_unlock_bh+0xa/0x20 ? inet_csk_accept+0x229/0x2f0 do_signal+0x36/0x5e0 ? put_unused_fd+0x5b/0x70 ? __sys_accept4+0x1a6/0x1e0 ? inet_hash+0x35/0x40 ? release_sock+0x43/0x90 ? _raw_spin_unlock_bh+0xa/0x20 ? inet_listen+0x9f/0x120 exit_to_usermode_loop+0x5c/0xc6 do_syscall_64+0x182/0x1b0 entry_SYSCALL_64_after_hwframe+0x44/0xa9 Fixes: 81713d3788d2 ("IB/mlx5: Add implicit MR support") Link: https://lore.kernel.org/r/20190805083010.21777-1-leon@kernel.org Signed-off-by: Yishai Hadas Reviewed-by: Artemy Kovalyov Signed-off-by: Leon Romanovsky Reviewed-by: Jason Gunthorpe Signed-off-by: Jason Gunthorpe commit 752ead44491e8c91e14d7079625c5916b30921c5 Author: Jens Axboe Date: Wed Aug 7 12:23:57 2019 -0600 libata: add SG safety checks in SFF pio transfers Abort processing of a command if we run out of mapped data in the SG list. This should never happen, but a previous bug caused it to be possible. Play it safe and attempt to abort nicely if we don't have more SG segments left. Reviewed-by: Kees Cook Signed-off-by: Jens Axboe commit 2d7271501720038381d45fb3dcbe4831228fc8cc Author: Jens Axboe Date: Wed Aug 7 12:20:52 2019 -0600 libata: have ata_scsi_rw_xlat() fail invalid passthrough requests For passthrough requests, libata-scsi takes what the user passes in as gospel. This can be problematic if the user fills in the CDB incorrectly. One example of that is in request sizes. For read/write commands, the CDB contains fields describing the transfer length of the request. These should match with the SG_IO header fields, but libata-scsi currently does no validation of that. Check that the number of blocks in the CDB for passthrough requests matches what was mapped into the request. If the CDB asks for more data then the validated SG_IO header fields, error it. Reported-by: Krishna Ram Prakash R Reviewed-by: Kees Cook Signed-off-by: Jens Axboe commit e15c2ffa1091c4f72370f01af4de8f9dddeb17a6 Author: Jens Axboe Date: Tue Aug 6 13:34:31 2019 -0600 block: fix O_DIRECT error handling for bio fragments 0eb6ddfb865c tried to fix this up, but introduced a use-after-free of dio. Additionally, we still had an issue with error handling, as reported by Darrick: "I noticed a regression in xfs/747 (an unreleased xfstest for the xfs_scrub media scanning feature) on 5.3-rc3. I'll condense that down to a simpler reproducer: error-test: 0 209 linear 8:48 0 error-test: 209 1 error error-test: 210 6446894 linear 8:48 210 Basically we have a ~3G /dev/sdd and we set up device mapper to fail IO for sector 209 and to pass the io to the scsi device everywhere else. On 5.3-rc3, performing a directio pread of this range with a < 1M buffer (in other words, a request for fewer than MAX_BIO_PAGES bytes) yields EIO like you'd expect: pread64(3, 0x7f880e1c7000, 1048576, 0) = -1 EIO (Input/output error) pread: Input/output error +++ exited with 0 +++ But doing it with a larger buffer succeeds(!): pread64(3, "XFSB\0\0\20\0\0\0\0\0\0\fL\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 1146880, 0) = 1146880 read 1146880/1146880 bytes at offset 0 1 MiB, 1 ops; 0.0009 sec (1.124 GiB/sec and 1052.6316 ops/sec) +++ exited with 0 +++ (Note that the part of the buffer corresponding to the dm-error area is uninitialized) On 5.3-rc2, both commands would fail with EIO like you'd expect. The only change between rc2 and rc3 is commit 0eb6ddfb865c ("block: Fix __blkdev_direct_IO() for bio fragments"). AFAICT we end up in __blkdev_direct_IO with a 1120K buffer, which gets split into two bios: one for the first BIO_MAX_PAGES worth of data (1MB) and a second one for the 96k after that." Fix this by noting that it's always safe to dereference dio if we get BLK_QC_T_EAGAIN returned, as end_io hasn't been run for that case. So we can safely increment the dio size before calling submit_bio(), and then decrement it on failure (not that it really matters, as the bio and dio are going away). For error handling, return to the original method of just using 'ret' for tracking the error, and the size tracking in dio->size. Fixes: 0eb6ddfb865c ("block: Fix __blkdev_direct_IO() for bio fragments") Fixes: 6a43074e2f46 ("block: properly handle IOCB_NOWAIT for async O_DIRECT IO") Reported-by: Darrick J. Wong Signed-off-by: Jens Axboe commit 67e7b52d44e3d539dfbfcd866c3d3d69da23a909 Author: Trond Myklebust Date: Wed Aug 7 07:31:27 2019 -0400 NFSv4: Ensure state recovery handles ETIMEDOUT correctly Ensure that the state recovery code handles ETIMEDOUT correctly, and also that we set RPC_TASK_TIMEOUT when recovering open state. Signed-off-by: Trond Myklebust commit 4b3e30ed3ec7864e798403a63ff2e96bd0c19ab0 Author: Alex Deucher Date: Wed Aug 7 00:23:07 2019 -0500 Revert "drm/amdkfd: New IOCTL to allocate queue GWS" This reverts commit 1a058c3376765ee31d65e28cbbb9d4ff15120056. This interface is still in too much flux. Revert until it's sorted out. Acked-by: Oak Zeng Signed-off-by: Alex Deucher commit 07301df7d2fc220d3de5f7ad804dcb941400cb00 Author: Qu Wenruo Date: Tue May 28 16:21:54 2019 +0800 btrfs: trim: Check the range passed into to prevent overflow Normally the range->len is set to default value (U64_MAX), but when it's not default value, we should check if the range overflows. And if it overflows, return -EINVAL before doing anything. Reviewed-by: Nikolay Borisov Reviewed-by: Anand Jain Signed-off-by: Qu Wenruo Signed-off-by: David Sterba commit d7cd4dd907c19c0295829c947d79afa290b6fc24 Author: Filipe Manana Date: Wed Aug 7 11:21:46 2019 +0100 Btrfs: fix sysfs warning and missing raid sysfs directories In the 5.3 merge window, commit 7c7e301406d0a9 ("btrfs: sysfs: Replace default_attrs in ktypes with groups"), we started using the member "defaults_groups" for the kobject type "btrfs_raid_ktype". That leads to a series of warnings when running some test cases of fstests, such as btrfs/027, btrfs/124 and btrfs/176. The traces produced by those warnings are like the following: [116648.059212] kernfs: can not remove 'total_bytes', no directory [116648.060112] WARNING: CPU: 3 PID: 28500 at fs/kernfs/dir.c:1504 kernfs_remove_by_name_ns+0x75/0x80 (...) [116648.066482] CPU: 3 PID: 28500 Comm: umount Tainted: G W 5.3.0-rc3-btrfs-next-54 #1 (...) [116648.069376] RIP: 0010:kernfs_remove_by_name_ns+0x75/0x80 (...) [116648.072385] RSP: 0018:ffffabfd0090bd08 EFLAGS: 00010282 [116648.073437] RAX: 0000000000000000 RBX: ffffffffc0c11998 RCX: 0000000000000000 [116648.074201] RDX: ffff9fff603a7a00 RSI: ffff9fff603978a8 RDI: ffff9fff603978a8 [116648.074956] RBP: ffffffffc0b9ca2f R08: 0000000000000000 R09: 0000000000000001 [116648.075708] R10: ffff9ffe1f72e1c0 R11: 0000000000000000 R12: ffffffffc0b94120 [116648.076434] R13: ffffffffb3d9b4e0 R14: 0000000000000000 R15: dead000000000100 [116648.077143] FS: 00007f9cdc78a2c0(0000) GS:ffff9fff60380000(0000) knlGS:0000000000000000 [116648.077852] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [116648.078546] CR2: 00007f9fc4747ab4 CR3: 00000005c7832003 CR4: 00000000003606e0 [116648.079235] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [116648.079907] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [116648.080585] Call Trace: [116648.081262] remove_files+0x31/0x70 [116648.081929] sysfs_remove_group+0x38/0x80 [116648.082596] sysfs_remove_groups+0x34/0x70 [116648.083258] kobject_del+0x20/0x60 [116648.083933] btrfs_free_block_groups+0x405/0x430 [btrfs] [116648.084608] close_ctree+0x19a/0x380 [btrfs] [116648.085278] generic_shutdown_super+0x6c/0x110 [116648.085951] kill_anon_super+0xe/0x30 [116648.086621] btrfs_kill_super+0x12/0xa0 [btrfs] [116648.087289] deactivate_locked_super+0x3a/0x70 [116648.087956] cleanup_mnt+0xb4/0x160 [116648.088620] task_work_run+0x7e/0xc0 [116648.089285] exit_to_usermode_loop+0xfa/0x100 [116648.089933] do_syscall_64+0x1cb/0x220 [116648.090567] entry_SYSCALL_64_after_hwframe+0x49/0xbe [116648.091197] RIP: 0033:0x7f9cdc073b37 (...) [116648.100046] ---[ end trace 22e24db328ccadf8 ]--- [116648.100618] ------------[ cut here ]------------ [116648.101175] kernfs: can not remove 'used_bytes', no directory [116648.101731] WARNING: CPU: 3 PID: 28500 at fs/kernfs/dir.c:1504 kernfs_remove_by_name_ns+0x75/0x80 (...) [116648.105649] CPU: 3 PID: 28500 Comm: umount Tainted: G W 5.3.0-rc3-btrfs-next-54 #1 (...) [116648.107461] RIP: 0010:kernfs_remove_by_name_ns+0x75/0x80 (...) [116648.109336] RSP: 0018:ffffabfd0090bd08 EFLAGS: 00010282 [116648.109979] RAX: 0000000000000000 RBX: ffffffffc0c119a0 RCX: 0000000000000000 [116648.110625] RDX: ffff9fff603a7a00 RSI: ffff9fff603978a8 RDI: ffff9fff603978a8 [116648.111283] RBP: ffffffffc0b9ca41 R08: 0000000000000000 R09: 0000000000000001 [116648.111940] R10: ffff9ffe1f72e1c0 R11: 0000000000000000 R12: ffffffffc0b94120 [116648.112603] R13: ffffffffb3d9b4e0 R14: 0000000000000000 R15: dead000000000100 [116648.113268] FS: 00007f9cdc78a2c0(0000) GS:ffff9fff60380000(0000) knlGS:0000000000000000 [116648.113939] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [116648.114607] CR2: 00007f9fc4747ab4 CR3: 00000005c7832003 CR4: 00000000003606e0 [116648.115286] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [116648.115966] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [116648.116649] Call Trace: [116648.117326] remove_files+0x31/0x70 [116648.117997] sysfs_remove_group+0x38/0x80 [116648.118671] sysfs_remove_groups+0x34/0x70 [116648.119342] kobject_del+0x20/0x60 [116648.120022] btrfs_free_block_groups+0x405/0x430 [btrfs] [116648.120707] close_ctree+0x19a/0x380 [btrfs] [116648.121396] generic_shutdown_super+0x6c/0x110 [116648.122057] kill_anon_super+0xe/0x30 [116648.122702] btrfs_kill_super+0x12/0xa0 [btrfs] [116648.123335] deactivate_locked_super+0x3a/0x70 [116648.123961] cleanup_mnt+0xb4/0x160 [116648.124586] task_work_run+0x7e/0xc0 [116648.125210] exit_to_usermode_loop+0xfa/0x100 [116648.125830] do_syscall_64+0x1cb/0x220 [116648.126463] entry_SYSCALL_64_after_hwframe+0x49/0xbe [116648.127080] RIP: 0033:0x7f9cdc073b37 (...) [116648.135923] ---[ end trace 22e24db328ccadf9 ]--- These happen because, during the unmount path, we call kobject_del() for raid kobjects that are not fully initialized, meaning that we set their ktype (as btrfs_raid_ktype) through link_block_group() but we didn't set their parent kobject, which is done through btrfs_add_raid_kobjects(). We have this split raid kobject setup since commit 75cb379d263521 ("btrfs: defer adding raid type kobject until after chunk relocation") in order to avoid triggering reclaim during contextes where we can not (either we are holding a transaction handle or some lock required by the transaction commit path), so that we do the calls to kobject_add(), which triggers GFP_KERNEL allocations, through btrfs_add_raid_kobjects() in contextes where it is safe to trigger reclaim. That change expected that a new raid kobject can only be created either when mounting the filesystem or after raid profile conversion through the relocation path. However, we can have new raid kobject created in other two cases at least: 1) During device replace (or scrub) after adding a device a to the filesystem. The replace procedure (and scrub) do calls to btrfs_inc_block_group_ro() which can allocate a new block group with a new raid profile (because we now have more devices). This can be triggered by test cases btrfs/027 and btrfs/176. 2) During a degraded mount trough any write path. This can be triggered by test case btrfs/124. Fixing this by adding extra calls to btrfs_add_raid_kobjects(), not only makes things more complex and fragile, can also introduce deadlocks with reclaim the following way: 1) Calling btrfs_add_raid_kobjects() at btrfs_inc_block_group_ro() or anywhere in the replace/scrub path will cause a deadlock with reclaim because if reclaim happens and a transaction commit is triggered, the transaction commit path will block at btrfs_scrub_pause(). 2) During degraded mounts it is essentially impossible to figure out where to add extra calls to btrfs_add_raid_kobjects(), because allocation of a block group with a new raid profile can happen anywhere, which means we can't safely figure out which contextes are safe for reclaim, as we can either hold a transaction handle or some lock needed by the transaction commit path. So it is too complex and error prone to have this split setup of raid kobjects. So fix the issue by consolidating the setup of the kobjects in a single place, at link_block_group(), and setup a nofs context there in order to prevent reclaim being triggered by the memory allocations done through the call chain of kobject_add(). Besides fixing the sysfs warnings during kobject_del(), this also ensures the sysfs directories for the new raid profiles end up created and visible to users (a bug that existed before the 5.3 commit 7c7e301406d0a9 ("btrfs: sysfs: Replace default_attrs in ktypes with groups")). Fixes: 75cb379d263521 ("btrfs: defer adding raid type kobject until after chunk relocation") Fixes: 7c7e301406d0a9 ("btrfs: sysfs: Replace default_attrs in ktypes with groups") Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 7468a4eae541ce5aff65595aa502aa0a4def6615 Author: Gustavo A. R. Silva Date: Mon Aug 5 15:17:12 2019 -0500 x86: mtrr: cyrix: Mark expected switch fall-through Mark switch cases where we are expecting to fall through. Fix the following warning (Building: i386_defconfig i386): arch/x86/kernel/cpu/mtrr/cyrix.c:99:6: warning: this statement may fall through [-Wimplicit-fallthrough=] Signed-off-by: Gustavo A. R. Silva Signed-off-by: Thomas Gleixner Reviewed-by: Kees Cook Link: https://lkml.kernel.org/r/20190805201712.GA19927@embeddedor commit 4ab9ab656a6cea5257bfa31f00c922d68f7a5c2f Author: Gustavo A. R. Silva Date: Mon Aug 5 14:56:54 2019 -0500 x86/ptrace: Mark expected switch fall-through Mark switch cases where we are expecting to fall through. Fix the following warning (Building: allnoconfig i386): arch/x86/kernel/ptrace.c:202:6: warning: this statement may fall through [-Wimplicit-fallthrough=] if (unlikely(value == 0)) ^ arch/x86/kernel/ptrace.c:206:2: note: here default: ^~~~~~~ Signed-off-by: Gustavo A. R. Silva Signed-off-by: Thomas Gleixner Reviewed-by: Kees Cook Link: https://lkml.kernel.org/r/20190805195654.GA17831@embeddedor commit c02f77d32d2c45cfb1b2bb99eabd8a78f5ecc7db Author: Takashi Iwai Date: Tue Aug 6 17:31:48 2019 +0200 ALSA: hda - Workaround for crackled sound on AMD controller (1022:1457) A long-time problem on the recent AMD chip (X370, X470, B450, etc with PCI ID 1022:1457) with Realtek codecs is the crackled or distorted sound for capture streams, as well as occasional playback hiccups. After lengthy debugging sessions, the workarounds we've found are like the following: - Set up the proper driver caps for this controller, similar as the other AMD controller. - Correct the DMA position reporting with the fixed FIFO size, which is similar like as workaround used for VIA chip set. - Even after the position correction, PulseAudio still shows mysterious stalls of playback streams when a capture is triggered in timer-scheduled mode. Since we have no clear way to eliminate the stall, pass the BATCH PCM flag for PA to suppress the tsched mode as a temporary workaround. This patch implements the workarounds. For the driver caps, it defines a new preset, AXZ_DCAPS_PRESET_AMD_SB. It enables the FIFO- corrected position reporting (corresponding to the new position_fix=6) and enforces the SNDRV_PCM_INFO_BATCH flag. Note that the current implementation is merely a workaround. Hopefully we'll find a better alternative in future, especially about removing the BATCH flag hack again. BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=195303 Cc: Signed-off-by: Takashi Iwai commit 0617bdede5114a0002298b12cd0ca2b0cfd0395d Author: Mika Westerberg Date: Wed Aug 7 13:57:18 2019 +0300 Revert "PCI: Add missing link delays required by the PCIe spec" Commit c2bf1fc212f7 ("PCI: Add missing link delays required by the PCIe spec") turned out causing issues with some systems either by making them unresponsive or slowing down runtime and system wide resume of PCIe devices. While root cause for the unresponsiveness is still under investigation given the amount of issues reported better to revert it for now. Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=204413 Link: https://lore.kernel.org/linux-pci/SL2P216MB01878BBCD75F21D882AEEA2880C60@SL2P216MB0187.KORP216.PROD.OUTLOOK.COM/ Link: https://lore.kernel.org/linux-pci/2857501d-c167-547d-c57d-d5d24ea1f1dc@molgen.mpg.de/ Reported-by: Matthias Andree Reported-by: Paul Menzel Reported-by: Nicholas Johnson Signed-off-by: Mika Westerberg Signed-off-by: Rafael J. Wysocki commit 3d92aa45fbfd7319e3a19f4ec59fd32b3862b723 Author: Wenwen Wang Date: Wed Aug 7 04:08:51 2019 -0500 ALSA: hiface: fix multiple memory leak bugs In hiface_pcm_init(), 'rt' is firstly allocated through kzalloc(). Later on, hiface_pcm_init_urb() is invoked to initialize 'rt->out_urbs[i]'. In hiface_pcm_init_urb(), 'rt->out_urbs[i].buffer' is allocated through kzalloc(). However, if hiface_pcm_init_urb() fails, both 'rt' and 'rt->out_urbs[i].buffer' are not deallocated, leading to memory leak bugs. Also, 'rt->out_urbs[i].buffer' is not deallocated if snd_pcm_new() fails. To fix the above issues, free 'rt' and 'rt->out_urbs[i].buffer'. Fixes: a91c3fb2f842 ("Add M2Tech hiFace USB-SPDIF driver") Signed-off-by: Wenwen Wang Cc: Signed-off-by: Takashi Iwai commit d9dfe768b3f30faa8340cbf34196668714780c3c Author: Marek Olšák Date: Fri Aug 2 17:44:06 2019 -0400 Revert "drm/amdgpu: fix transform feedback GDS hang on gfx10 (v2)" This reverts commit 9ed2c993d723129f85101e51b2ccc36ef5400a67. SET_CONFIG_REG writes to memory if register shadowing is enabled, causing a VM fault. NGG streamout is unstable anyway, so all UMDs should use legacy streamout. I think Mesa is the only driver using NGG streamout. Signed-off-by: Marek Olšák Reviewed-by: Le Ma Signed-off-by: Alex Deucher commit 33920f1ec5bf47c5c0a1d2113989bdd9dfb3fae9 Merge: 76d7961ff4ee feac1d680233 Author: Linus Torvalds Date: Tue Aug 6 17:11:59 2019 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from David Miller: "Yeah I should have sent a pull request last week, so there is a lot more here than usual: 1) Fix memory leak in ebtables compat code, from Wenwen Wang. 2) Several kTLS bug fixes from Jakub Kicinski (circular close on disconnect etc.) 3) Force slave speed check on link state recovery in bonding 802.3ad mode, from Thomas Falcon. 4) Clear RX descriptor bits before assigning buffers to them in stmmac, from Jose Abreu. 5) Several missing of_node_put() calls, mostly wrt. for_each_*() OF loops, from Nishka Dasgupta. 6) Double kfree_skb() in peak_usb can driver, from Stephane Grosjean. 7) Need to hold sock across skb->destructor invocation, from Cong Wang. 8) IP header length needs to be validated in ipip tunnel xmit, from Haishuang Yan. 9) Use after free in ip6 tunnel driver, also from Haishuang Yan. 10) Do not use MSI interrupts on r8169 chips before RTL8168d, from Heiner Kallweit. 11) Upon bridge device init failure, we need to delete the local fdb. From Nikolay Aleksandrov. 12) Handle erros from of_get_mac_address() properly in stmmac, from Martin Blumenstingl. 13) Handle concurrent rename vs. dump in netfilter ipset, from Jozsef Kadlecsik. 14) Setting NETIF_F_LLTX on mac80211 causes complete breakage with some devices, so revert. From Johannes Berg. 15) Fix deadlock in rxrpc, from David Howells. 16) Fix Kconfig deps of enetc driver, we must have PHYLIB. From Yue Haibing. 17) Fix mvpp2 crash on module removal, from Matteo Croce. 18) Fix race in genphy_update_link, from Heiner Kallweit. 19) bpf_xdp_adjust_head() stopped working with generic XDP when we fixes generic XDP to support stacked devices properly, fix from Jesper Dangaard Brouer. 20) Unbalanced RCU locking in rt6_update_exception_stamp_rt(), from David Ahern. 21) Several memory leaks in new sja1105 driver, from Vladimir Oltean" * git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (214 commits) net: dsa: sja1105: Fix memory leak on meta state machine error path net: dsa: sja1105: Fix memory leak on meta state machine normal path net: dsa: sja1105: Really fix panic on unregistering PTP clock net: dsa: sja1105: Use the LOCKEDS bit for SJA1105 E/T as well net: dsa: sja1105: Fix broken learning with vlan_filtering disabled net: dsa: qca8k: Add of_node_put() in qca8k_setup_mdio_bus() net: sched: sample: allow accessing psample_group with rtnl net: sched: police: allow accessing police->params with rtnl net: hisilicon: Fix dma_map_single failed on arm64 net: hisilicon: fix hip04-xmit never return TX_BUSY net: hisilicon: make hip04_tx_reclaim non-reentrant tc-testing: updated vlan action tests with batch create/delete net sched: update vlan action for batched events operations net: stmmac: tc: Do not return a fragment entry net: stmmac: Fix issues when number of Queues >= 4 net: stmmac: xgmac: Fix XGMAC selftests be2net: disable bh with spin_lock in be_process_mcc net: cxgb3_main: Fix a resource leak in a error path in 'init_one()' net: ethernet: sun4i-emac: Support phy-handle property for finding PHYs net: bridge: move default pvid init/deinit to NETDEV_REGISTER/UNREGISTER ... commit 713203e303ca9f75be8c729b533bf1559e442f6e Author: Atish Patra Date: Fri Aug 2 21:27:20 2019 -0700 RISC-V: Remove per cpu clocksource There is only one clocksource in RISC-V. The boot cpu initializes that clocksource. No need to keep a percpu data structure. Signed-off-by: Atish Patra Signed-off-by: Paul Walmsley Acked-by: Daniel Lezcano commit feac1d680233a48603213d52230f92222462a1c8 Merge: f26e0cca14c9 93fa8587b253 Author: David S. Miller Date: Tue Aug 6 14:37:02 2019 -0700 Merge branch 'sja1105-fixes' Vladimir Oltean says: ==================== Fixes for SJA1105 DSA: FDBs, Learning and PTP This is an assortment of functional fixes for the sja1105 switch driver targeted for the "net" tree (although they apply on net-next just as well). Patch 1/5 ("net: dsa: sja1105: Fix broken learning with vlan_filtering disabled") repairs a breakage introduced in the early development stages of the driver: support for traffic from the CPU has broken "normal" frame forwarding (based on DMAC) - there is connectivity through the switch only because all frames are flooded. I debated whether this patch qualifies as a fix, since it puts the switch into a mode it has never operated in before (aka SVL). But "normal" forwarding did use to work before the "Traffic support for SJA1105 DSA driver" patchset, and arguably this patch should have been part of that. Also, it would be strange for this feature to be broken in the 5.2 LTS. Patch 2/5 ("net: dsa: sja1105: Use the LOCKEDS bit for SJA1105 E/T as well") is a simplification of a previous FDB-related patch that is currently in the 5.3 rc's. Patches 3/5 - 5/5 fix various crashes found while running linuxptp over the switch ports for extended periods of time, or in conjunction with other error conditions. The fixed-up commits were all introduced in 5.2. ==================== Signed-off-by: David S. Miller commit 93fa8587b25356382a39f1ca3a81d6c1b42ac731 Author: Vladimir Oltean Date: Mon Aug 5 01:38:48 2019 +0300 net: dsa: sja1105: Fix memory leak on meta state machine error path When RX timestamping is enabled and two link-local (non-meta) frames are received in a row, this constitutes an error. The tagger is always caching the last link-local frame, in an attempt to merge it with the meta follow-up frame when that arrives. To recover from the above error condition, the initial cached link-local frame is dropped and the second frame in a row is cached (in expectance of the second meta frame). However, when dropping the initial link-local frame, its backing memory was being leaked. Fixes: f3097be21bf1 ("net: dsa: sja1105: Add a state machine for RX timestamping") Signed-off-by: Vladimir Oltean Signed-off-by: David S. Miller commit f163fed2764e66511fb5c489bf87e532ad7606fb Author: Vladimir Oltean Date: Mon Aug 5 01:38:47 2019 +0300 net: dsa: sja1105: Fix memory leak on meta state machine normal path After a meta frame is received, it is associated with the cached sp->data->stampable_skb from the DSA tagger private structure. Cached means its refcount is incremented with skb_get() in order for dsa_switch_rcv() to not free it when the tagger .rcv returns NULL. The mistake is that skb_unref() is not the correct function to use. It will correctly decrement the refcount (which will go back to zero) but the skb memory will not be freed. That is the job of kfree_skb(), which also calls skb_unref(). But it turns out that freeing the cached stampable_skb is in fact not necessary. It is still a perfectly valid skb, and now it is even annotated with the partial RX timestamp. So remove the skb_copy() altogether and simply pass the stampable_skb with a refcount of 1 (incremented by us, decremented by dsa_switch_rcv) up the stack. Fixes: f3097be21bf1 ("net: dsa: sja1105: Add a state machine for RX timestamping") Signed-off-by: Vladimir Oltean Signed-off-by: David S. Miller commit 6cb0abbdf90c180e1310976c47399f57477e0e53 Author: Vladimir Oltean Date: Mon Aug 5 01:38:46 2019 +0300 net: dsa: sja1105: Really fix panic on unregistering PTP clock The IS_ERR_OR_NULL(priv->clock) check inside sja1105_ptp_clock_unregister() is preventing cancel_delayed_work_sync from actually being run. Additionally, sja1105_ptp_clock_unregister() does not actually get run, when placed in sja1105_remove(). The DSA switch gets torn down, but the sja1105 module does not get unregistered. So sja1105_ptp_clock_unregister needs to be moved to sja1105_teardown, to be symmetrical with sja1105_ptp_clock_register which is called from the DSA sja1105_setup. It is strange to fix a "fixes" patch, but the probe failure can only be seen when the attached PHY does not respond to MDIO (issue which I can't pinpoint the reason to) and it goes away after I power-cycle the board. This time the patch was validated on a failing board, and the kernel panic from the fixed commit's message can no longer be seen. Fixes: 29dd908d355f ("net: dsa: sja1105: Cancel PTP delayed work on unregister") Signed-off-by: Vladimir Oltean Signed-off-by: David S. Miller commit 4b7da3d808f91cdad3e34059cd68ba3dfe4c3695 Author: Vladimir Oltean Date: Mon Aug 5 01:38:45 2019 +0300 net: dsa: sja1105: Use the LOCKEDS bit for SJA1105 E/T as well It looks like the FDB dump taken from first-generation switches also contains information on whether entries are static or not. So use that instead of searching through the driver's tables. Fixes: d763778224ea ("net: dsa: sja1105: Implement is_static for FDB entries on E/T") Signed-off-by: Vladimir Oltean Signed-off-by: David S. Miller commit 6d7c7d948a2e9f87b4e7726dee94c59300e1786b Author: Vladimir Oltean Date: Mon Aug 5 01:38:44 2019 +0300 net: dsa: sja1105: Fix broken learning with vlan_filtering disabled When put under a bridge with vlan_filtering 0, the SJA1105 ports will flood all traffic as if learning was broken. This is because learning interferes with the rx_vid's configured by dsa_8021q as unique pvid's. So learning technically still *does* work, it's just that the learnt entries never get matched due to their unique VLAN ID. The setting that saves the day is Shared VLAN Learning, which on this switch family works exactly as desired: VLAN tagging still works (untagged traffic gets the correct pvid) and FDB entries are still populated with the correct contents including VID. Also, a frame cannot violate the forwarding domain restrictions enforced by its classified VLAN. It is just that the VID is ignored when looking up the FDB for taking a forwarding decision (selecting the egress port). This patch activates SVL, and the result is that frames with a learnt DMAC are no longer flooded in the scenario described above. Now exactly *because* SVL works as desired, we have to revisit some earlier patches: - It is no longer necessary to manipulate the VID of the 'bridge fdb {add,del}' command when vlan_filtering is off. This is because now, SVL is enabled for that case, so the actual VID does not matter*. - It is still desirable to hide dsa_8021q VID's in the FDB dump callback. But right now the dump callback should no longer hide duplicates (one per each front panel port's pvid, plus one for the VLAN that the CPU port is going to tag a TX frame with), because there shouldn't be any (the switch will match a single FDB entry no matter its VID anyway). * Not really... It's no longer necessary to transform a 'bridge fdb add' into 5 fdb add operations, but the user might still add a fdb entry with any vid, and all of them would appear as duplicates in 'bridge fdb show'. So force a 'bridge fdb add' to insert the VID of 0**, so that we can prune the duplicates at insertion time. ** The VID of 0 is better than 1 because it is always guaranteed to be in the ports' hardware filter. DSA also avoids putting the VID inside the netlink response message towards the bridge driver when we return this particular VID, which makes it suitable for FDB entries learnt with vlan_filtering off. Fixes: 227d07a07ef1 ("net: dsa: sja1105: Add support for traffic through standalone ports") Signed-off-by: Vladimir Oltean Signed-off-by: Georg Waibel Signed-off-by: David S. Miller commit f26e0cca14c9494c863d8fa6825b10bd12dc9eaa Author: Nishka Dasgupta Date: Sun Aug 4 21:00:18 2019 +0530 net: dsa: qca8k: Add of_node_put() in qca8k_setup_mdio_bus() Each iteration of for_each_available_child_of_node() puts the previous node, but in the case of a return from the middle of the loop, there is no put, thus causing a memory leak. Hence add an of_node_put() before the return. Additionally, the local variable ports in the function qca8k_setup_mdio_bus() takes the return value of of_get_child_by_name(), which gets a node but does not put it. If the function returns without putting ports, it may cause a memory leak. Hence put ports before the mid-loop return statement, and also outside the loop after its last usage in this function. Issues found with Coccinelle. Signed-off-by: Nishka Dasgupta Signed-off-by: David S. Miller commit 443bfb4acb83a6f0b7d9b11ac32f17c67f14e995 Merge: 2b0dfc175333 67cbf7dedd03 Author: David S. Miller Date: Tue Aug 6 14:15:39 2019 -0700 Merge branch 'flow_offload-action-fixes' Vlad Buslov says: ==================== action fixes for flow_offload infra compatibility Fix rcu warnings due to usage of action helpers that expect rcu read lock protection from rtnl-protected context of flow_offload infra. ==================== Signed-off-by: David S. Miller commit 67cbf7dedd03a63ca2fbd9df2049eabba7a37edf Author: Vlad Buslov Date: Sat Aug 3 16:36:19 2019 +0300 net: sched: sample: allow accessing psample_group with rtnl Recently implemented support for sample action in flow_offload infra leads to following rcu usage warning: [ 1938.234856] ============================= [ 1938.234858] WARNING: suspicious RCU usage [ 1938.234863] 5.3.0-rc1+ #574 Not tainted [ 1938.234866] ----------------------------- [ 1938.234869] include/net/tc_act/tc_sample.h:47 suspicious rcu_dereference_check() usage! [ 1938.234872] other info that might help us debug this: [ 1938.234875] rcu_scheduler_active = 2, debug_locks = 1 [ 1938.234879] 1 lock held by tc/19540: [ 1938.234881] #0: 00000000b03cb918 (rtnl_mutex){+.+.}, at: tc_new_tfilter+0x47c/0x970 [ 1938.234900] stack backtrace: [ 1938.234905] CPU: 2 PID: 19540 Comm: tc Not tainted 5.3.0-rc1+ #574 [ 1938.234908] Hardware name: Supermicro SYS-2028TP-DECR/X10DRT-P, BIOS 2.0b 03/30/2017 [ 1938.234911] Call Trace: [ 1938.234922] dump_stack+0x85/0xc0 [ 1938.234930] tc_setup_flow_action+0xed5/0x2040 [ 1938.234944] fl_hw_replace_filter+0x11f/0x2e0 [cls_flower] [ 1938.234965] fl_change+0xd24/0x1b30 [cls_flower] [ 1938.234990] tc_new_tfilter+0x3e0/0x970 [ 1938.235021] ? tc_del_tfilter+0x720/0x720 [ 1938.235028] rtnetlink_rcv_msg+0x389/0x4b0 [ 1938.235038] ? netlink_deliver_tap+0x95/0x400 [ 1938.235044] ? rtnl_dellink+0x2d0/0x2d0 [ 1938.235053] netlink_rcv_skb+0x49/0x110 [ 1938.235063] netlink_unicast+0x171/0x200 [ 1938.235073] netlink_sendmsg+0x224/0x3f0 [ 1938.235091] sock_sendmsg+0x5e/0x60 [ 1938.235097] ___sys_sendmsg+0x2ae/0x330 [ 1938.235111] ? __handle_mm_fault+0x12cd/0x19e0 [ 1938.235125] ? __handle_mm_fault+0x12cd/0x19e0 [ 1938.235138] ? find_held_lock+0x2b/0x80 [ 1938.235147] ? do_user_addr_fault+0x22d/0x490 [ 1938.235160] __sys_sendmsg+0x59/0xa0 [ 1938.235178] do_syscall_64+0x5c/0xb0 [ 1938.235187] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 1938.235192] RIP: 0033:0x7ff9a4d597b8 [ 1938.235197] Code: 89 02 48 c7 c0 ff ff ff ff eb bb 0f 1f 80 00 00 00 00 f3 0f 1e fa 48 8d 05 65 8f 0c 00 8b 00 85 c0 75 17 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 58 c3 0f 1f 80 00 00 00 00 48 83 ec 28 89 54 [ 1938.235200] RSP: 002b:00007ffcfe381c48 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1938.235205] RAX: ffffffffffffffda RBX: 000000005d4497f9 RCX: 00007ff9a4d597b8 [ 1938.235208] RDX: 0000000000000000 RSI: 00007ffcfe381cb0 RDI: 0000000000000003 [ 1938.235211] RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000006 [ 1938.235214] R10: 0000000000404ec2 R11: 0000000000000246 R12: 0000000000000001 [ 1938.235217] R13: 0000000000480640 R14: 0000000000000012 R15: 0000000000000001 Change tcf_sample_psample_group() helper to allow using it from both rtnl and rcu protected contexts. Fixes: a7a7be6087b0 ("net/sched: add sample action to the hardware intermediate representation") Signed-off-by: Vlad Buslov Reviewed-by: Pieter Jansen van Vuuren Signed-off-by: David S. Miller commit c4bd48699beb92d6bb99d6139d1e9737cca73480 Author: Vlad Buslov Date: Sat Aug 3 16:36:18 2019 +0300 net: sched: police: allow accessing police->params with rtnl Recently implemented support for police action in flow_offload infra leads to following rcu usage warning: [ 1925.881092] ============================= [ 1925.881094] WARNING: suspicious RCU usage [ 1925.881098] 5.3.0-rc1+ #574 Not tainted [ 1925.881100] ----------------------------- [ 1925.881104] include/net/tc_act/tc_police.h:57 suspicious rcu_dereference_check() usage! [ 1925.881106] other info that might help us debug this: [ 1925.881109] rcu_scheduler_active = 2, debug_locks = 1 [ 1925.881112] 1 lock held by tc/18591: [ 1925.881115] #0: 00000000b03cb918 (rtnl_mutex){+.+.}, at: tc_new_tfilter+0x47c/0x970 [ 1925.881124] stack backtrace: [ 1925.881127] CPU: 2 PID: 18591 Comm: tc Not tainted 5.3.0-rc1+ #574 [ 1925.881130] Hardware name: Supermicro SYS-2028TP-DECR/X10DRT-P, BIOS 2.0b 03/30/2017 [ 1925.881132] Call Trace: [ 1925.881138] dump_stack+0x85/0xc0 [ 1925.881145] tc_setup_flow_action+0x1771/0x2040 [ 1925.881155] fl_hw_replace_filter+0x11f/0x2e0 [cls_flower] [ 1925.881175] fl_change+0xd24/0x1b30 [cls_flower] [ 1925.881200] tc_new_tfilter+0x3e0/0x970 [ 1925.881231] ? tc_del_tfilter+0x720/0x720 [ 1925.881243] rtnetlink_rcv_msg+0x389/0x4b0 [ 1925.881250] ? netlink_deliver_tap+0x95/0x400 [ 1925.881257] ? rtnl_dellink+0x2d0/0x2d0 [ 1925.881264] netlink_rcv_skb+0x49/0x110 [ 1925.881275] netlink_unicast+0x171/0x200 [ 1925.881284] netlink_sendmsg+0x224/0x3f0 [ 1925.881299] sock_sendmsg+0x5e/0x60 [ 1925.881305] ___sys_sendmsg+0x2ae/0x330 [ 1925.881309] ? task_work_add+0x43/0x50 [ 1925.881314] ? fput_many+0x45/0x80 [ 1925.881329] ? __lock_acquire+0x248/0x1930 [ 1925.881342] ? find_held_lock+0x2b/0x80 [ 1925.881347] ? task_work_run+0x7b/0xd0 [ 1925.881359] __sys_sendmsg+0x59/0xa0 [ 1925.881375] do_syscall_64+0x5c/0xb0 [ 1925.881381] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 1925.881384] RIP: 0033:0x7feb245047b8 [ 1925.881388] Code: 89 02 48 c7 c0 ff ff ff ff eb bb 0f 1f 80 00 00 00 00 f3 0f 1e fa 48 8d 05 65 8f 0c 00 8b 00 85 c0 75 17 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 58 c3 0f 1f 80 00 00 00 00 48 83 ec 28 89 54 [ 1925.881391] RSP: 002b:00007ffc2d2a5788 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1925.881395] RAX: ffffffffffffffda RBX: 000000005d4497ed RCX: 00007feb245047b8 [ 1925.881398] RDX: 0000000000000000 RSI: 00007ffc2d2a57f0 RDI: 0000000000000003 [ 1925.881400] RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000006 [ 1925.881403] R10: 0000000000404ec2 R11: 0000000000000246 R12: 0000000000000001 [ 1925.881406] R13: 0000000000480640 R14: 0000000000000012 R15: 0000000000000001 Change tcf_police_rate_bytes_ps() and tcf_police_tcfp_burst() helpers to allow using them from both rtnl and rcu protected contexts. Fixes: 8c8cfc6ed274 ("net/sched: add police action to the hardware intermediate representation") Signed-off-by: Vlad Buslov Reviewed-by: Pieter Jansen van Vuuren Signed-off-by: David S. Miller commit 2b0dfc1753332d81d8e6654d682d8740aed4dec9 Merge: 5b0bce247cc2 96a50c0d907a Author: David S. Miller Date: Tue Aug 6 14:14:01 2019 -0700 Merge branch 'hisilicon-fixes' Jiangfeng Xiao says: ==================== net: hisilicon: Fix a few problems with hip04_eth During the use of the hip04_eth driver, several problems were found, which solved the hip04_tx_reclaim reentry problem, fixed the problem that hip04_mac_start_xmit never returns NETDEV_TX_BUSY and the dma_map_single failed on the arm64 platform. ==================== Signed-off-by: David S. Miller commit 96a50c0d907ac8f5c3d6b051031a19eb8a2b53e3 Author: Jiangfeng Xiao Date: Sat Aug 3 20:31:41 2019 +0800 net: hisilicon: Fix dma_map_single failed on arm64 On the arm64 platform, executing "ifconfig eth0 up" will fail, returning "ifconfig: SIOCSIFFLAGS: Input/output error." ndev->dev is not initialized, dma_map_single->get_dma_ops-> dummy_dma_ops->__dummy_map_page will return DMA_ERROR_CODE directly, so when we use dma_map_single, the first parameter is to use the device of platform_device. Signed-off-by: Jiangfeng Xiao Signed-off-by: David S. Miller commit f2243b82785942be519016067ee6c55a063bbfe2 Author: Jiangfeng Xiao Date: Sat Aug 3 20:31:40 2019 +0800 net: hisilicon: fix hip04-xmit never return TX_BUSY TX_DESC_NUM is 256, in tx_count, the maximum value of mod(TX_DESC_NUM - 1) is 254, the variable "count" in the hip04_mac_start_xmit function is never equal to (TX_DESC_NUM - 1), so hip04_mac_start_xmit never return NETDEV_TX_BUSY. tx_count is modified to mod(TX_DESC_NUM) so that the maximum value of tx_count can reach (TX_DESC_NUM - 1), then hip04_mac_start_xmit can reurn NETDEV_TX_BUSY. Signed-off-by: Jiangfeng Xiao Signed-off-by: David S. Miller commit 1a2c070ae805910a853b4a14818481ed2e17c727 Author: Jiangfeng Xiao Date: Sat Aug 3 20:31:39 2019 +0800 net: hisilicon: make hip04_tx_reclaim non-reentrant If hip04_tx_reclaim is interrupted while it is running and then __napi_schedule continues to execute hip04_rx_poll->hip04_tx_reclaim, reentrancy occurs and oops is generated. So you need to mask the interrupt during the hip04_tx_reclaim run. The kernel oops exception stack is as follows: Unable to handle kernel NULL pointer dereference at virtual address 00000050 pgd = c0003000 [00000050] *pgd=80000000a04003, *pmd=00000000 Internal error: Oops: 206 [#1] SMP ARM Modules linked in: hip04_eth mtdblock mtd_blkdevs mtd ohci_platform ehci_platform ohci_hcd ehci_hcd vfat fat sd_mod usb_storage scsi_mod usbcore usb_common CPU: 0 PID: 0 Comm: swapper/0 Tainted: G O 4.4.185 #1 Hardware name: Hisilicon A15 task: c0a250e0 task.stack: c0a00000 PC is at hip04_tx_reclaim+0xe0/0x17c [hip04_eth] LR is at hip04_tx_reclaim+0x30/0x17c [hip04_eth] pc : [] lr : [] psr: 600e0313 sp : c0a01d88 ip : 00000000 fp : c0601f9c r10: 00000000 r9 : c3482380 r8 : 00000001 r7 : 00000000 r6 : 000000e1 r5 : c3482000 r4 : 0000000c r3 : f2209800 r2 : 00000000 r1 : 00000000 r0 : 00000000 Flags: nZCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment kernel Control: 32c5387d Table: 03d28c80 DAC: 55555555 Process swapper/0 (pid: 0, stack limit = 0xc0a00190) Stack: (0xc0a01d88 to 0xc0a02000) [] (hip04_tx_reclaim [hip04_eth]) from [] (hip04_rx_poll+0x88/0x368 [hip04_eth]) [] (hip04_rx_poll [hip04_eth]) from [] (net_rx_action+0x114/0x34c) [] (net_rx_action) from [] (__do_softirq+0x218/0x318) [] (__do_softirq) from [] (irq_exit+0x88/0xac) [] (irq_exit) from [] (msa_irq_exit+0x11c/0x1d4) [] (msa_irq_exit) from [] (__handle_domain_irq+0x110/0x148) [] (__handle_domain_irq) from [] (gic_handle_irq+0xd4/0x118) [] (gic_handle_irq) from [] (__irq_svc+0x40/0x58) Exception stack(0xc0a01f30 to 0xc0a01f78) 1f20: c0ae8b40 00000000 00000000 00000000 1f40: 00000002 ffffe000 c0601f9c 00000000 ffffffff c0a2257c c0a22440 c0831a38 1f60: c0a01ec4 c0a01f80 c0203714 c0203718 600e0213 ffffffff [] (__irq_svc) from [] (arch_cpu_idle+0x20/0x3c) [] (arch_cpu_idle) from [] (cpu_startup_entry+0x244/0x29c) [] (cpu_startup_entry) from [] (rest_init+0xc8/0x10c) [] (rest_init) from [] (start_kernel+0x468/0x514) Code: a40599e5 016086e2 018088e2 7660efe6 (503090e5) ---[ end trace 1db21d6d09c49d74 ]--- Kernel panic - not syncing: Fatal exception in interrupt CPU3: stopping CPU: 3 PID: 0 Comm: swapper/3 Tainted: G D O 4.4.185 #1 Signed-off-by: Jiangfeng Xiao Signed-off-by: David S. Miller commit 5b0bce247cc2423defedf289f8b84e22385426ee Merge: 3abd24a1831d 8571deb01381 Author: David S. Miller Date: Tue Aug 6 14:05:40 2019 -0700 Merge branch 'Fix-batched-event-generation-for-vlan-action' Roman Mashak says: ==================== Fix batched event generation for vlan action When adding or deleting a batch of entries, the kernel sends up to TCA_ACT_MAX_PRIO (defined to 32 in kernel) entries in an event to user space. However it does not consider that the action sizes may vary and require different skb sizes. For example, consider the following script adding 32 entries with all supported vlan parameters (in order to maximize netlink messages size): % cat tc-batch.sh TC="sudo /mnt/iproute2.git/tc/tc" $TC actions flush action vlan for i in `seq 1 $1`; do cmd="action vlan push protocol 802.1q id 4094 priority 7 pipe \ index $i cookie aabbccddeeff112233445566778800a1 " args=$args$cmd done $TC actions add $args % % ./tc-batch.sh 32 Error: Failed to fill netlink attributes while adding TC action. We have an error talking to the kernel % patch 1 adds callback in tc_action_ops of vlan action, which calculates the action size, and passes size to tcf_add_notify()/tcf_del_notify(). patch 2 updates the TDC test suite with relevant vlan test cases. ==================== Acked-by: Jamal Hadi Salim Signed-off-by: David S. Miller commit 8571deb013812f35260b2b7152a522eacfa9ccf9 Author: Roman Mashak Date: Fri Aug 2 15:16:47 2019 -0400 tc-testing: updated vlan action tests with batch create/delete Update TDC tests with cases varifying ability of TC to install or delete batches of vlan actions. Signed-off-by: Roman Mashak Signed-off-by: David S. Miller commit b35475c5491a14c8ce7a5046ef7bcda8a860581a Author: Roman Mashak Date: Fri Aug 2 15:16:46 2019 -0400 net sched: update vlan action for batched events operations Add get_fill_size() routine used to calculate the action size when building a batch of events. Fixes: c7e2b9689 ("sched: introduce vlan action") Signed-off-by: Roman Mashak Signed-off-by: David S. Miller commit 76d7961ff4ee02cc70365600a52fb59ca544dc7c Merge: f4eb1423e433 74034a09267c Author: Linus Torvalds Date: Tue Aug 6 14:01:08 2019 -0700 Merge tag 'mips_fixes_5.3_1' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux Pull MIPS fixes from Paul Burton: "A few MIPS fixes for 5.3: - Various switch fall through annotations to fixup warnings & errors resulting from -Wimplicit-fallthrough. - A fix for systems (at least jazz) using an i8253 PIT as clocksource when it's not suitably configured. - Set struct cacheinfo's cpu_map_populated field to true, indicating that we filled in cache info detected from cop0 registers & avoiding complaints about that info being (intentionally) missing in devicetree" * tag 'mips_fixes_5.3_1' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux: MIPS: BCM63XX: Mark expected switch fall-through MIPS: OProfile: Mark expected switch fall-throughs MIPS: Annotate fall-through in Cavium Octeon code MIPS: Annotate fall-through in kvm/emulate.c mips: fix cacheinfo MIPS: kernel: only use i8253 clocksource with periodic clockevent commit 72cda9bb5e219aea0f2f62f56ae05198c59022a7 Author: Likun Gao Date: Fri Aug 2 15:18:57 2019 +0800 drm/amdgpu: pin the csb buffer on hw init for gfx v8 Without this pin, the csb buffer will be filled with inconsistent data after S3 resume. And that will causes gfx hang on gfxoff exit since this csb will be executed then. Signed-off-by: Likun Gao Tested-by: Paul Gover Reviewed-by: Feifei Xu Reviewed-by: Xiaojie Yuan Signed-off-by: Alex Deucher commit 3abd24a1831d0507e15702184c6319c253145a6c Merge: 0574f2ed3060 4a6a1385a4db Author: David S. Miller Date: Tue Aug 6 12:26:11 2019 -0700 Merge branch 'stmmac-fixes' Jose Abreu says: ==================== net: stmmac: Fixes for -net Couple of fixes for -net. More info in commit log. ==================== Signed-off-by: David S. Miller commit 4a6a1385a4db5f42258a40fcd497cbfd22075968 Author: Jose Abreu Date: Tue Aug 6 15:16:18 2019 +0200 net: stmmac: tc: Do not return a fragment entry Do not try to return a fragment entry from TC list. Otherwise we may not clean properly allocated entries. Signed-off-by: Jose Abreu Signed-off-by: David S. Miller commit e8df7e8c233a18d2704e37ecff47583b494789d3 Author: Jose Abreu Date: Tue Aug 6 15:16:17 2019 +0200 net: stmmac: Fix issues when number of Queues >= 4 When queues >= 4 we use different registers but we were not subtracting the offset of 4. Fix this. Found out by Coverity. Signed-off-by: Jose Abreu Signed-off-by: David S. Miller commit 0efedbf11f07adee555e0c4ba9c6eb58760aa94f Author: Jose Abreu Date: Tue Aug 6 15:16:16 2019 +0200 net: stmmac: xgmac: Fix XGMAC selftests Fixup the XGMAC selftests by correctly finishing the implementation of set_filter callback. Result: $ ethtool -t enp4s0 The test result is PASS The test extra info: 1. MAC Loopback 0 2. PHY Loopback -95 3. MMC Counters -95 4. EEE -95 5. Hash Filter MC 0 6. Perfect Filter UC 0 7. MC Filter 0 8. UC Filter 0 9. Flow Control 0 Signed-off-by: Jose Abreu Signed-off-by: David S. Miller commit 0574f2ed30609fd1720489a9dcb50a805958c796 Merge: d0d006a43e9a 1f6607250331 Author: David S. Miller Date: Tue Aug 6 11:48:48 2019 -0700 Merge tag 'wireless-drivers-for-davem-2019-08-06' of git://git.kernel.org/pub/scm/linux/kernel/git/kvalo/wireless-drivers Kalle Valo says: ==================== wireless-drivers fixes for 5.3 Second set of fixes for 5.3. Lots of iwlwifi fixes have accumulated which consists most of patches in this pull request. Only most notable iwlwifi fixes are listed below. mwifiex * fix a regression related to WPA1 networks since v5.3-rc1 iwlwifi * fix use-after-free issues * fix DMA mapping API usage errors * fix frame drop occurring due to reorder buffer handling in RSS in certain conditions * fix rate scale locking issues * disable TX A-MSDU on older NICs as it causes problems and was never supposed to be supported * new PCI IDs * GEO_TX_POWER_LIMIT API issue that many people were hitting ==================== Signed-off-by: David S. Miller commit f4eb1423e43376bec578c5696635b074c8bd2035 Merge: 4368c4bc9d36 e0f6974a54d3 Author: Linus Torvalds Date: Tue Aug 6 11:47:23 2019 -0700 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid Pull HID fixes from Jiri Kosina: - functional regression fix for some of the Logitech unifying devices, from Hans de Goede - race condition fix in hid-sony for bug severely affecting Valve/Android deployments, from Roderick Colenbrander - several fixes for issues found by syzbot/kasan, from Oliver Neukum and Hillf Danton - functional regression fix for Wacom Cintiq device, from Aaron Armstrong Skomra - a few other assorted device-specific quirks * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid: HID: sony: Fix race condition between rumble and device remove. HID: hiddev: do cleanup in failure of opening a device HID: hiddev: avoid opening a disconnected device HID: input: fix a4tech horizontal wheel custom usage HID: Add quirk for HP X1200 PIXART OEM mouse HID: holtek: test for sanity of intfdata HID: wacom: fix bit shift for Cintiq Companion 2 HID: quirks: Set the INCREMENT_USAGE_ON_DUPLICATE quirk on Saitek X52 HID: logitech-dj: Really fix return value of logi_dj_recv_query_hidpp_devices HID: Add 044f:b320 ThrustMaster, Inc. 2 in 1 DT HID: logitech-dj: add the Powerplay receiver HID: logitech-hidpp: add USB PID for a few more supported mice HID: logitech-dj: rename "gaming" receiver to "lightspeed" commit d0d006a43e9a7a796f6f178839c92fcc222c564d Author: Denis Kirjanov Date: Tue Aug 6 12:51:11 2019 +0200 be2net: disable bh with spin_lock in be_process_mcc be_process_mcc() is invoked in 3 different places and always with BHs disabled except the be_poll function but since it's invoked from softirq with BHs disabled it won't hurt. v1->v2: added explanation to the patch v2->v3: add a missing call from be_cmds.c Signed-off-by: Denis Kirjanov Signed-off-by: David S. Miller commit debea2cd3193ac868289e8893c3a719c265b0612 Author: Christophe JAILLET Date: Tue Aug 6 10:55:12 2019 +0200 net: cxgb3_main: Fix a resource leak in a error path in 'init_one()' A call to 'kfree_skb()' is missing in the error handling path of 'init_one()'. This is already present in 'remove_one()' but is missing here. Signed-off-by: Christophe JAILLET Signed-off-by: David S. Miller commit 5c4e2e1af345426f63410a50e2a678673574aa02 Author: Chen-Yu Tsai Date: Tue Aug 6 15:35:39 2019 +0800 net: ethernet: sun4i-emac: Support phy-handle property for finding PHYs The sun4i-emac uses the "phy" property to find the PHY it's supposed to use. This property was deprecated in favor of "phy-handle" in commit 8c5b09447625 ("dt-bindings: net: sun4i-emac: Convert the binding to a schemas"). Add support for this new property name, and fall back to the old one in case the device tree hasn't been updated. Signed-off-by: Chen-Yu Tsai Signed-off-by: David S. Miller commit 4368c4bc9d36821690d6bb2e743d5a075b6ddb55 Merge: 0eb0ce0a78e1 4c92057661a3 Author: Linus Torvalds Date: Tue Aug 6 11:22:22 2019 -0700 Merge branch 'x86/grand-schemozzle' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull pti updates from Thomas Gleixner: "The performance deterioration departement is not proud at all to present yet another set of speculation fences to mitigate the next chapter in the 'what could possibly go wrong' story. The new vulnerability belongs to the Spectre class and affects GS based data accesses and has therefore been dubbed 'Grand Schemozzle' for secret communication purposes. It's officially listed as CVE-2019-1125. Conditional branches in the entry paths which contain a SWAPGS instruction (interrupts and exceptions) can be mis-speculated which results in speculative accesses with a wrong GS base. This can happen on entry from user mode through a mis-speculated branch which takes the entry from kernel mode path and therefore does not execute the SWAPGS instruction. The following speculative accesses are done with user GS base. On entry from kernel mode the mis-speculated branch executes the SWAPGS instruction in the entry from user mode path which has the same effect that the following GS based accesses are done with user GS base. If there is a disclosure gadget available in these code paths the mis-speculated data access can be leaked through the usual side channels. The entry from user mode issue affects all CPUs which have speculative execution. The entry from kernel mode issue affects only Intel CPUs which can speculate through SWAPGS. On CPUs from other vendors SWAPGS has semantics which prevent that. SMAP migitates both problems but only when the CPU is not affected by the Meltdown vulnerability. The mitigation is to issue LFENCE instructions in the entry from kernel mode path for all affected CPUs and on the affected Intel CPUs also in the entry from user mode path unless PTI is enabled because the CR3 write is serializing. The fences are as usual enabled conditionally and can be completely disabled on the kernel command line. The Spectre V1 documentation is updated accordingly. A big "Thank You!" goes to Josh for doing the heavy lifting for this round of hardware misfeature 'repair'. Of course also "Thank You!" to everybody else who contributed in one way or the other" * 'x86/grand-schemozzle' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: Documentation: Add swapgs description to the Spectre v1 documentation x86/speculation/swapgs: Exclude ATOMs from speculation through SWAPGS x86/entry/64: Use JMP instead of JMPQ x86/speculation: Enable Spectre v1 swapgs mitigations x86/speculation: Prepare entry code for Spectre v1 swapgs mitigations commit b803974a86039913d5280add083d730b2b9ed8ec Author: Kevin Hao Date: Fri Jul 26 10:30:49 2019 +0800 mmc: cavium: Add the missing dma unmap when the dma has finished. This fixes the below calltrace when the CONFIG_DMA_API_DEBUG is enabled. DMA-API: thunderx_mmc 0000:01:01.4: cpu touching an active dma mapped cacheline [cln=0x000000002fdf9800] WARNING: CPU: 21 PID: 1 at kernel/dma/debug.c:596 debug_dma_assert_idle+0x1f8/0x270 Modules linked in: CPU: 21 PID: 1 Comm: init Not tainted 5.3.0-rc1-next-20190725-yocto-standard+ #64 Hardware name: Marvell OcteonTX CN96XX board (DT) pstate: 80400009 (Nzcv daif +PAN -UAO) pc : debug_dma_assert_idle+0x1f8/0x270 lr : debug_dma_assert_idle+0x1f8/0x270 sp : ffff0000113cfc10 x29: ffff0000113cfc10 x28: 0000ffff8c880000 x27: ffff800bc72a0000 x26: ffff000010ff8000 x25: ffff000010ff8940 x24: ffff000010ff8968 x23: 0000000000000000 x22: ffff000010e83700 x21: ffff000010ea2000 x20: ffff000010e835c8 x19: ffff800bc2c73300 x18: ffffffffffffffff x17: 0000000000000000 x16: 0000000000000000 x15: ffff000010e835c8 x14: 6d20616d64206576 x13: 69746361206e6120 x12: 676e696863756f74 x11: 20757063203a342e x10: 31303a31303a3030 x9 : 303020636d6d5f78 x8 : 3230303030303030 x7 : 00000000000002fd x6 : ffff000010fd57d0 x5 : 0000000000000000 x4 : ffff0000106c5210 x3 : 00000000ffffffff x2 : 0000800bee9c0000 x1 : 57d5843f4aa62800 x0 : 0000000000000000 Call trace: debug_dma_assert_idle+0x1f8/0x270 wp_page_copy+0xb0/0x688 do_wp_page+0xa8/0x5b8 __handle_mm_fault+0x600/0xd00 handle_mm_fault+0x118/0x1e8 do_page_fault+0x200/0x500 do_mem_abort+0x50/0xb0 el0_da+0x20/0x24 ---[ end trace a005534bd23e109f ]--- DMA-API: Mapped at: debug_dma_map_sg+0x94/0x350 cvm_mmc_request+0x3c4/0x988 __mmc_start_request+0x9c/0x1f8 mmc_start_request+0x7c/0xb0 mmc_blk_mq_issue_rq+0x5c4/0x7b8 Signed-off-by: Kevin Hao Fixes: ba3869ff32e4 ("mmc: cavium: Add core MMC driver for Cavium SOCs") Cc: stable@vger.kernel.org Signed-off-by: Ulf Hansson commit fa25eba6993b3750f417baabba169afaba076178 Author: Kevin Hao Date: Fri Jul 26 10:30:48 2019 +0800 mmc: cavium: Set the correct dma max segment size for mmc_host We have set the mmc_host.max_seg_size to 8M, but the dma max segment size of PCI device is set to 64K by default in function pci_device_add(). The mmc_host.max_seg_size is used to set the max segment size of the blk queue. Then this mismatch will trigger a calltrace like below when a bigger than 64K segment request arrives at mmc dev. So we should consider the limitation of the cvm_mmc_host when setting the mmc_host.max_seg_size. DMA-API: thunderx_mmc 0000:01:01.4: mapping sg segment longer than device claims to support [len=131072] [max=65536] WARNING: CPU: 6 PID: 238 at kernel/dma/debug.c:1221 debug_dma_map_sg+0x2b8/0x350 Modules linked in: CPU: 6 PID: 238 Comm: kworker/6:1H Not tainted 5.3.0-rc1-next-20190724-yocto-standard+ #62 Hardware name: Marvell OcteonTX CN96XX board (DT) Workqueue: kblockd blk_mq_run_work_fn pstate: 80c00009 (Nzcv daif +PAN +UAO) pc : debug_dma_map_sg+0x2b8/0x350 lr : debug_dma_map_sg+0x2b8/0x350 sp : ffff00001770f9e0 x29: ffff00001770f9e0 x28: ffffffff00000000 x27: 00000000ffffffff x26: ffff800bc2c73180 x25: ffff000010e83700 x24: 0000000000000002 x23: 0000000000000001 x22: 0000000000000001 x21: 0000000000000000 x20: ffff800bc48ba0b0 x19: ffff800bc97e8c00 x18: ffffffffffffffff x17: 0000000000000000 x16: 0000000000000000 x15: ffff000010e835c8 x14: 6874207265676e6f x13: 6c20746e656d6765 x12: 7320677320676e69 x11: 7070616d203a342e x10: 31303a31303a3030 x9 : 303020636d6d5f78 x8 : 35363d78616d5b20 x7 : 00000000000002fd x6 : ffff000010fd57dc x5 : 0000000000000000 x4 : ffff0000106c61f0 x3 : 00000000ffffffff x2 : 0000800bee060000 x1 : 7010678df3041a00 x0 : 0000000000000000 Call trace: debug_dma_map_sg+0x2b8/0x350 cvm_mmc_request+0x3c4/0x988 __mmc_start_request+0x9c/0x1f8 mmc_start_request+0x7c/0xb0 mmc_blk_mq_issue_rq+0x5c4/0x7b8 mmc_mq_queue_rq+0x11c/0x278 blk_mq_dispatch_rq_list+0xb0/0x568 blk_mq_do_dispatch_sched+0x6c/0x108 blk_mq_sched_dispatch_requests+0x110/0x1b8 __blk_mq_run_hw_queue+0xb0/0x118 blk_mq_run_work_fn+0x28/0x38 process_one_work+0x210/0x490 worker_thread+0x48/0x458 kthread+0x130/0x138 ret_from_fork+0x10/0x1c Signed-off-by: Kevin Hao Fixes: ba3869ff32e4 ("mmc: cavium: Add core MMC driver for Cavium SOCs") Cc: stable@vger.kernel.org Signed-off-by: Ulf Hansson commit c6303c5d52d5ec3e5bce2e6a5480fa2a1baa45e6 Author: Baolin Wang Date: Thu Jul 25 11:14:22 2019 +0800 mmc: sdhci-sprd: Fix the incorrect soft reset operation when runtime resuming The SD host controller specification defines 3 types software reset: software reset for data line, software reset for command line and software reset for all. Software reset for all means this reset affects the entire Host controller except for the card detection circuit. In sdhci_runtime_resume_host() we always do a software "reset for all", which causes the Spreadtrum variant controller to work abnormally after resuming. To fix the problem, let's do a software reset for the data and the command part, rather than "for all". However, as sdhci_runtime_resume() is a common sdhci function and we don't want to change the behaviour for other variants, let's introduce a new in-parameter for it. This enables the caller to decide if a "reset for all" shall be done or not. Signed-off-by: Baolin Wang Fixes: fb8bd90f83c4 ("mmc: sdhci-sprd: Add Spreadtrum's initial host controller") Cc: stable@vger.kernel.org Signed-off-by: Ulf Hansson commit 849f5ae3a513c550cad741c68dd3d7eb2bcc2a2c Author: Oliver Neukum Date: Tue Aug 6 09:05:55 2019 -0700 Input: iforce - add sanity checks The endpoint type should also be checked before a device is accepted. Reported-by: syzbot+5efc10c005014d061a74@syzkaller.appspotmail.com Signed-off-by: Oliver Neukum Signed-off-by: Dmitry Torokhov commit 37ad2e343449ced9e41505eae5494bf40f433181 Author: Gustavo A. R. Silva Date: Tue Aug 6 09:03:16 2019 -0700 Input: applespi - use struct_size() helper One of the more common cases of allocation size calculations is finding the size of a structure that has a zero-sized array at the end, along with memory for some number of elements for that array. For example: struct touchpad_protocol { ... struct tp_finger fingers[0]; }; Make use of the struct_size() helper instead of an open-coded version in order to avoid any potential type mistakes. So, replace the following form: sizeof(*tp) + tp->number_of_fingers * sizeof(tp->fingers[0]); with: struct_size(tp, fingers, tp->number_of_fingers) This code was detected with the help of Coccinelle. Signed-off-by: Gustavo A. R. Silva Signed-off-by: Dmitry Torokhov commit 458b7c8e0dde12d140e3472b80919cbb9ae793f4 Author: Lu Baolu Date: Thu Aug 1 11:14:58 2019 +0800 iommu/vt-d: Detach domain when move device out of group When removing a device from an iommu group, the domain should be detached from the device. Otherwise, the stale domain info will still be cached by the driver and the driver will refuse to attach any domain to the device again. Cc: Ashok Raj Cc: Jacob Pan Cc: Kevin Tian Fixes: b7297783c2bb6 ("iommu/vt-d: Remove duplicated code for device hotplug") Reported-and-tested-by: Vlad Buslov Suggested-by: Robin Murphy Link: https://lkml.org/lkml/2019/7/26/1133 Signed-off-by: Lu Baolu Signed-off-by: Joerg Roedel commit 11f4fe9ba3c85a4efac7ec25e75056a9b612d9da Author: Anders Roxell Date: Tue Jul 30 17:20:11 2019 +0200 iommu/arm-smmu: Mark expected switch fall-through Now that -Wimplicit-fallthrough is passed to GCC by default, the following warning shows up: ../drivers/iommu/arm-smmu-v3.c: In function ‘arm_smmu_write_strtab_ent’: ../drivers/iommu/arm-smmu-v3.c:1189:7: warning: this statement may fall through [-Wimplicit-fallthrough=] if (disable_bypass) ^ ../drivers/iommu/arm-smmu-v3.c:1191:3: note: here default: ^~~~~~~ Rework so that the compiler doesn't warn about fall-through. Make it clearer by calling 'BUG_ON()' when disable_bypass is set, and always 'break;' Signed-off-by: Anders Roxell Acked-by: Will Deacon Signed-off-by: Joerg Roedel commit 8af23fad626173eed7cc02733874d4124049bd5e Author: Robin Murphy Date: Mon Jul 29 16:32:38 2019 +0100 iommu/dma: Handle MSI mappings separately MSI pages must always be mapped into a device's *current* domain, which *might* be the default DMA domain, but might instead be a VFIO domain with its own MSI cookie. This subtlety got accidentally lost in the streamlining of __iommu_dma_map(), but rather than reintroduce more complexity and/or special-casing, it turns out neater to just split this path out entirely. Since iommu_dma_get_msi_page() already duplicates much of what __iommu_dma_map() does, it can easily just make the allocation and mapping calls directly as well. That way we can further streamline the helper back to exclusively operating on DMA domains. Fixes: b61d271e59d7 ("iommu/dma: Move domain lookup into __iommu_dma_{map,unmap}") Reported-by: Shameer Kolothum Reported-by: Andre Przywara Signed-off-by: Robin Murphy Tested-by: Marc Zyngier Tested-by: Andre Przywara Tested-by: Shameer Kolothum Signed-off-by: Joerg Roedel commit db341a049ec7e87053c91008cb452d0bfa6dde72 Author: Gustavo A. R. Silva Date: Tue Aug 6 03:08:08 2019 -0500 ata: rb532_cf: Fix unused variable warning in rb532_pata_driver_probe Fix the following warning (Building: rb532_defconfig mips): drivers/ata/pata_rb532_cf.c: In function ‘rb532_pata_driver_remove’: drivers/ata/pata_rb532_cf.c:161:24: warning: unused variable ‘info’ [-Wunused-variable] struct rb532_cf_info *info = ah->private_data; ^~~~ Fixes: cd56f35e52d9 ("ata: rb532_cf: Convert to use GPIO descriptors") Signed-off-by: Gustavo A. R. Silva Signed-off-by: Jens Axboe commit c1c6c877b0c79fd7e05c931435aa42211eaeebaf Author: Takashi Iwai Date: Tue Aug 6 14:03:56 2019 +0200 ALSA: hda - Don't override global PCM hw info flag The commit bfcba288b97f ("ALSA - hda: Add support for link audio time reporting") introduced the conditional PCM hw info setup, but it overwrites the global azx_pcm_hw object. This will cause a problem if any other HD-audio controller, as it'll inherit the same bit flag although another controller doesn't support that feature. Fix the bug by setting the PCM hw info flag locally. Fixes: bfcba288b97f ("ALSA - hda: Add support for link audio time reporting") Cc: Signed-off-by: Takashi Iwai commit 24350fdadbdec780406a1ef988e6cd3875e374a8 Author: Vasily Gorbik Date: Mon Aug 5 14:25:16 2019 +0200 s390: put _stext and _etext into .text section Perf relies on _etext and _stext symbols being one of 't', 'T', 'v' or 'V'. Put them into .text section to guarantee that. Also moves padding to page boundary inside .text which has an effect that .text section is now padded with nops rather than 0's, which apparently has been the initial intention for specifying 0x0700 fill expression. Reported-by: Thomas Richter Tested-by: Thomas Richter Suggested-by: Andreas Krebbel Signed-off-by: Vasily Gorbik commit b9f23b7376c21f5bf7f5e2b7dfcb82cc9ce92dfc Author: Vasily Gorbik Date: Mon Aug 5 16:36:56 2019 +0200 s390/head64: cleanup unused labels Cleanup labels in head64 some of which are not being used since git recorded history. Acked-by: Heiko Carstens Signed-off-by: Vasily Gorbik commit fd0c7435d7bfd46161ef43b185f55d759022238c Author: Vasily Gorbik Date: Mon Aug 5 15:07:19 2019 +0200 s390/unwind: remove stack recursion warning Remove pointless stack recursion on stack type ... warning, which only confuses people. There is no way to make backchain unwinder 100% reliable. When a task is interrupted in-between stack frame allocation and backchain write instructions new stack frame backchain pointer is left uninitialized (there are also sometimes additional instruction in-between stack frame allocation and backchain write instructions due to gcc shrink-wrapping). In attempt to unwind such stack the unwinder would still try to use that invalid backchain value and perform all kind of sanity checks on it to make sure we are not pointed out of stack. In some cases that invalid backchain value would be 0 and we would falsely treat next stackframe as pt_regs and again gprs[15] in those pt_regs might happen to point at some address within the task's stack. Acked-by: Heiko Carstens Signed-off-by: Vasily Gorbik commit 218ddd5acfeae9e19a2fa97c284bf3c2e9de8ebd Author: Vasily Gorbik Date: Fri Aug 2 17:44:29 2019 +0200 s390/setup: adjust start_code of init_mm to _text After some investigation it doesn't look like init_mm fields start_code/end_code are used anywhere besides potentially in dump_mm for debugging purposes. Originally the value of 0 for start_code reflected the presence of lowcore and early boot code. But with kaslr in place start_code/end_code range should not span over unoccupied by the code segment memory. So, adjust init_mm start_code to point at the beginning of the code segment like other architectures do it. Acked-by: Heiko Carstens Signed-off-by: Vasily Gorbik commit 8024b5a9fc2bed9a00f0bdba60b443fa3cc4bb5d Author: Vasily Gorbik Date: Fri Jul 26 08:23:20 2019 +0200 s390/mm: fix dump_pagetables top level page table walking Since commit d1874a0c2805 ("s390/mm: make the pxd_offset functions more robust") behaviour of p4d_offset, pud_offset and pmd_offset has been changed so that they cannot be used to iterate through top level page table, because the index for the top level page table is now calculated in pgd_offset. To avoid dumping the very first region/segment top level table entry 2048 times simply iterate entry pointer like it is already done in other page walking cases. Fixes: d1874a0c2805 ("s390/mm: make the pxd_offset functions more robust") Reported-by: Ilya Leoshkevich Reviewed-by: Heiko Carstens Signed-off-by: Vasily Gorbik commit a287a49e672d9762bb85de117b477bdf3ef20bd5 Author: Vasily Gorbik Date: Fri Aug 2 13:27:22 2019 +0200 s390/protvirt: avoid memory sharing for diag 308 set/store This reverts commit db9492cef45e ("s390/protvirt: add memory sharing for diag 308 set/store") which due to ultravisor implementation change is not needed after all. Fixes: db9492cef45e ("s390/protvirt: add memory sharing for diag 308 set/store") Reviewed-by: Janosch Frank Signed-off-by: Vasily Gorbik commit 04e048cf09d7b5fc995817cdc5ae1acd4482429c Author: Suren Baghdasaryan Date: Mon Jul 29 18:33:10 2019 -0700 sched/psi: Do not require setsched permission from the trigger creator When a process creates a new trigger by writing into /proc/pressure/* files, permissions to write such a file should be used to determine whether the process is allowed to do so or not. Current implementation would also require such a process to have setsched capability. Setting of psi trigger thread's scheduling policy is an implementation detail and should not be exposed to the user level. Remove the permission check by using _nocheck version of the function. Suggested-by: Nick Kralevich Signed-off-by: Suren Baghdasaryan Signed-off-by: Peter Zijlstra (Intel) Cc: lizefan@huawei.com Cc: mingo@redhat.com Cc: akpm@linux-foundation.org Cc: kernel-team@android.com Cc: dennisszhou@gmail.com Cc: dennis@kernel.org Cc: hannes@cmpxchg.org Cc: axboe@kernel.dk Link: https://lkml.kernel.org/r/20190730013310.162367-1-surenb@google.com commit 14f5c7b46a41a595fc61db37f55721714729e59e Author: Peter Zijlstra Date: Thu Aug 1 12:41:31 2019 +0200 sched/psi: Reduce psimon FIFO priority PSI defaults to a FIFO-99 thread, reduce this to FIFO-1. FIFO-99 is the very highest priority available to SCHED_FIFO and it not a suitable default; it would indicate the psi work is the most important work on the machine. Since Real-Time tasks will have pre-allocated memory and locked it in place, Real-Time tasks do not care about PSI. All it needs is to be above OTHER. Signed-off-by: Peter Zijlstra (Intel) Acked-by: Johannes Weiner Tested-by: Suren Baghdasaryan Cc: Thomas Gleixner commit f4904815f97a934258445a8f763f6b6c48f007e7 Author: Dietmar Eggemann Date: Fri Aug 2 15:59:43 2019 +0100 sched/deadline: Fix double accounting of rq/running bw in push & pull {push,pull}_dl_task() always calls {de,}activate_task() with .flags=0 which sets p->on_rq=TASK_ON_RQ_MIGRATING. {push,pull}_dl_task()->{de,}activate_task()->{de,en}queue_task()-> {de,en}queue_task_dl() calls {sub,add}_{running,rq}_bw() since p->on_rq==TASK_ON_RQ_MIGRATING. So {sub,add}_{running,rq}_bw() in {push,pull}_dl_task() is double-accounting for that task. Fix it by removing rq/running bw accounting in [push/pull]_dl_task(). Fixes: 7dd778841164 ("sched/core: Unify p->on_rq updates") Signed-off-by: Dietmar Eggemann Signed-off-by: Peter Zijlstra (Intel) Cc: Valentin Schneider Cc: Ingo Molnar Cc: Luca Abeni Cc: Daniel Bristot de Oliveira Cc: Juri Lelli Cc: Qais Yousef Link: https://lkml.kernel.org/r/20190802145945.18702-2-dietmar.eggemann@arm.com commit e0f6974a54d3f7f1b5fdf5a593bd43ce9206ec04 Author: Roderick Colenbrander Date: Fri Aug 2 15:50:19 2019 -0700 HID: sony: Fix race condition between rumble and device remove. Valve reported a kernel crash on Ubuntu 18.04 when disconnecting a DS4 gamepad while rumble is enabled. This issue is reproducible with a frequency of 1 in 3 times in the game Borderlands 2 when using an automatic weapon, which triggers many rumble operations. We found the issue to be a race condition between sony_remove and the final device destruction by the HID / input system. The problem was that sony_remove didn't clean some of its work_item state in "struct sony_sc". After sony_remove work, the corresponding evdev node was around for sufficient time for applications to still queue rumble work after "sony_remove". On pre-4.19 kernels the race condition caused a kernel crash due to a NULL-pointer dereference as "sc->output_report_dmabuf" got freed during sony_remove. On newer kernels this crash doesn't happen due the buffer now being allocated using devm_kzalloc. However we can still queue work, while the driver is an undefined state. This patch fixes the described problem, by guarding the work_item "state_worker" with an initialized variable, which we are setting back to 0 on cleanup. Signed-off-by: Roderick Colenbrander CC: stable@vger.kernel.org Signed-off-by: Jiri Kosina commit a67060201b746a308b1674f66bf289c9faef6d09 Author: Wenwen Wang Date: Tue Aug 6 03:00:27 2019 -0400 ALSA: usb-audio: fix a memory leak bug In snd_usb_get_audioformat_uac3(), a structure for channel maps 'chmap' is allocated through kzalloc() before the execution goto 'found_clock'. However, this structure is not deallocated if the memory allocation for 'pd' fails, leading to a memory leak bug. To fix the above issue, free 'fp->chmap' before returning NULL. Fixes: 7edf3b5e6a45 ("ALSA: usb-audio: AudioStreaming Power Domain parsing") Signed-off-by: Wenwen Wang Cc: Signed-off-by: Takashi Iwai commit 6d4472d7bec39917b54e4e80245784ea5d60ce49 Author: Hillf Danton Date: Tue Aug 6 16:40:15 2019 +0800 HID: hiddev: do cleanup in failure of opening a device Undo what we did for opening before releasing the memory slice. Reported-by: syzbot Cc: Andrey Konovalov Signed-off-by: Hillf Danton Signed-off-by: Jiri Kosina commit 9c09b214f30e3c11f9b0b03f89442df03643794d Author: Hillf Danton Date: Tue Aug 6 16:38:58 2019 +0800 HID: hiddev: avoid opening a disconnected device syzbot found the following crash on: HEAD commit: e96407b4 usb-fuzzer: main usb gadget fuzzer driver git tree: https://github.com/google/kasan.git usb-fuzzer console output: https://syzkaller.appspot.com/x/log.txt?x=147ac20c600000 kernel config: https://syzkaller.appspot.com/x/.config?x=792eb47789f57810 dashboard link: https://syzkaller.appspot.com/bug?extid=62a1e04fd3ec2abf099e compiler: gcc (GCC) 9.0.0 20181231 (experimental) ================================================================== BUG: KASAN: use-after-free in __lock_acquire+0x302a/0x3b50 kernel/locking/lockdep.c:3753 Read of size 8 at addr ffff8881cf591a08 by task syz-executor.1/26260 CPU: 1 PID: 26260 Comm: syz-executor.1 Not tainted 5.3.0-rc2+ #24 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0xca/0x13e lib/dump_stack.c:113 print_address_description+0x6a/0x32c mm/kasan/report.c:351 __kasan_report.cold+0x1a/0x33 mm/kasan/report.c:482 kasan_report+0xe/0x12 mm/kasan/common.c:612 __lock_acquire+0x302a/0x3b50 kernel/locking/lockdep.c:3753 lock_acquire+0x127/0x320 kernel/locking/lockdep.c:4412 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0x32/0x50 kernel/locking/spinlock.c:159 hiddev_release+0x82/0x520 drivers/hid/usbhid/hiddev.c:221 __fput+0x2d7/0x840 fs/file_table.c:280 task_work_run+0x13f/0x1c0 kernel/task_work.c:113 exit_task_work include/linux/task_work.h:22 [inline] do_exit+0x8ef/0x2c50 kernel/exit.c:878 do_group_exit+0x125/0x340 kernel/exit.c:982 get_signal+0x466/0x23d0 kernel/signal.c:2728 do_signal+0x88/0x14e0 arch/x86/kernel/signal.c:815 exit_to_usermode_loop+0x1a2/0x200 arch/x86/entry/common.c:159 prepare_exit_to_usermode arch/x86/entry/common.c:194 [inline] syscall_return_slowpath arch/x86/entry/common.c:274 [inline] do_syscall_64+0x45f/0x580 arch/x86/entry/common.c:299 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x459829 Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007f75b2a6ccf8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca RAX: fffffffffffffe00 RBX: 000000000075c078 RCX: 0000000000459829 RDX: 0000000000000000 RSI: 0000000000000080 RDI: 000000000075c078 RBP: 000000000075c070 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 000000000075c07c R13: 00007ffcdfe1023f R14: 00007f75b2a6d9c0 R15: 000000000075c07c Allocated by task 104: save_stack+0x1b/0x80 mm/kasan/common.c:69 set_track mm/kasan/common.c:77 [inline] __kasan_kmalloc mm/kasan/common.c:487 [inline] __kasan_kmalloc.constprop.0+0xbf/0xd0 mm/kasan/common.c:460 kmalloc include/linux/slab.h:552 [inline] kzalloc include/linux/slab.h:748 [inline] hiddev_connect+0x242/0x5b0 drivers/hid/usbhid/hiddev.c:900 hid_connect+0x239/0xbb0 drivers/hid/hid-core.c:1882 hid_hw_start drivers/hid/hid-core.c:1981 [inline] hid_hw_start+0xa2/0x130 drivers/hid/hid-core.c:1972 appleir_probe+0x13e/0x1a0 drivers/hid/hid-appleir.c:308 hid_device_probe+0x2be/0x3f0 drivers/hid/hid-core.c:2209 really_probe+0x281/0x650 drivers/base/dd.c:548 driver_probe_device+0x101/0x1b0 drivers/base/dd.c:709 __device_attach_driver+0x1c2/0x220 drivers/base/dd.c:816 bus_for_each_drv+0x15c/0x1e0 drivers/base/bus.c:454 __device_attach+0x217/0x360 drivers/base/dd.c:882 bus_probe_device+0x1e4/0x290 drivers/base/bus.c:514 device_add+0xae6/0x16f0 drivers/base/core.c:2114 hid_add_device+0x33c/0x990 drivers/hid/hid-core.c:2365 usbhid_probe+0xa81/0xfa0 drivers/hid/usbhid/hid-core.c:1386 usb_probe_interface+0x305/0x7a0 drivers/usb/core/driver.c:361 really_probe+0x281/0x650 drivers/base/dd.c:548 driver_probe_device+0x101/0x1b0 drivers/base/dd.c:709 __device_attach_driver+0x1c2/0x220 drivers/base/dd.c:816 bus_for_each_drv+0x15c/0x1e0 drivers/base/bus.c:454 __device_attach+0x217/0x360 drivers/base/dd.c:882 bus_probe_device+0x1e4/0x290 drivers/base/bus.c:514 device_add+0xae6/0x16f0 drivers/base/core.c:2114 usb_set_configuration+0xdf6/0x1670 drivers/usb/core/message.c:2023 generic_probe+0x9d/0xd5 drivers/usb/core/generic.c:210 usb_probe_device+0x99/0x100 drivers/usb/core/driver.c:266 really_probe+0x281/0x650 drivers/base/dd.c:548 driver_probe_device+0x101/0x1b0 drivers/base/dd.c:709 __device_attach_driver+0x1c2/0x220 drivers/base/dd.c:816 bus_for_each_drv+0x15c/0x1e0 drivers/base/bus.c:454 __device_attach+0x217/0x360 drivers/base/dd.c:882 bus_probe_device+0x1e4/0x290 drivers/base/bus.c:514 device_add+0xae6/0x16f0 drivers/base/core.c:2114 usb_new_device.cold+0x6a4/0xe79 drivers/usb/core/hub.c:2536 hub_port_connect drivers/usb/core/hub.c:5098 [inline] hub_port_connect_change drivers/usb/core/hub.c:5213 [inline] port_event drivers/usb/core/hub.c:5359 [inline] hub_event+0x1b5c/0x3640 drivers/usb/core/hub.c:5441 process_one_work+0x92b/0x1530 kernel/workqueue.c:2269 worker_thread+0x96/0xe20 kernel/workqueue.c:2415 kthread+0x318/0x420 kernel/kthread.c:255 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352 Freed by task 104: save_stack+0x1b/0x80 mm/kasan/common.c:69 set_track mm/kasan/common.c:77 [inline] __kasan_slab_free+0x130/0x180 mm/kasan/common.c:449 slab_free_hook mm/slub.c:1423 [inline] slab_free_freelist_hook mm/slub.c:1470 [inline] slab_free mm/slub.c:3012 [inline] kfree+0xe4/0x2f0 mm/slub.c:3953 hiddev_connect.cold+0x45/0x5c drivers/hid/usbhid/hiddev.c:914 hid_connect+0x239/0xbb0 drivers/hid/hid-core.c:1882 hid_hw_start drivers/hid/hid-core.c:1981 [inline] hid_hw_start+0xa2/0x130 drivers/hid/hid-core.c:1972 appleir_probe+0x13e/0x1a0 drivers/hid/hid-appleir.c:308 hid_device_probe+0x2be/0x3f0 drivers/hid/hid-core.c:2209 really_probe+0x281/0x650 drivers/base/dd.c:548 driver_probe_device+0x101/0x1b0 drivers/base/dd.c:709 __device_attach_driver+0x1c2/0x220 drivers/base/dd.c:816 bus_for_each_drv+0x15c/0x1e0 drivers/base/bus.c:454 __device_attach+0x217/0x360 drivers/base/dd.c:882 bus_probe_device+0x1e4/0x290 drivers/base/bus.c:514 device_add+0xae6/0x16f0 drivers/base/core.c:2114 hid_add_device+0x33c/0x990 drivers/hid/hid-core.c:2365 usbhid_probe+0xa81/0xfa0 drivers/hid/usbhid/hid-core.c:1386 usb_probe_interface+0x305/0x7a0 drivers/usb/core/driver.c:361 really_probe+0x281/0x650 drivers/base/dd.c:548 driver_probe_device+0x101/0x1b0 drivers/base/dd.c:709 __device_attach_driver+0x1c2/0x220 drivers/base/dd.c:816 bus_for_each_drv+0x15c/0x1e0 drivers/base/bus.c:454 __device_attach+0x217/0x360 drivers/base/dd.c:882 bus_probe_device+0x1e4/0x290 drivers/base/bus.c:514 device_add+0xae6/0x16f0 drivers/base/core.c:2114 usb_set_configuration+0xdf6/0x1670 drivers/usb/core/message.c:2023 generic_probe+0x9d/0xd5 drivers/usb/core/generic.c:210 usb_probe_device+0x99/0x100 drivers/usb/core/driver.c:266 really_probe+0x281/0x650 drivers/base/dd.c:548 driver_probe_device+0x101/0x1b0 drivers/base/dd.c:709 __device_attach_driver+0x1c2/0x220 drivers/base/dd.c:816 bus_for_each_drv+0x15c/0x1e0 drivers/base/bus.c:454 __device_attach+0x217/0x360 drivers/base/dd.c:882 bus_probe_device+0x1e4/0x290 drivers/base/bus.c:514 device_add+0xae6/0x16f0 drivers/base/core.c:2114 usb_new_device.cold+0x6a4/0xe79 drivers/usb/core/hub.c:2536 hub_port_connect drivers/usb/core/hub.c:5098 [inline] hub_port_connect_change drivers/usb/core/hub.c:5213 [inline] port_event drivers/usb/core/hub.c:5359 [inline] hub_event+0x1b5c/0x3640 drivers/usb/core/hub.c:5441 process_one_work+0x92b/0x1530 kernel/workqueue.c:2269 worker_thread+0x96/0xe20 kernel/workqueue.c:2415 kthread+0x318/0x420 kernel/kthread.c:255 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352 The buggy address belongs to the object at ffff8881cf591900 which belongs to the cache kmalloc-512 of size 512 The buggy address is located 264 bytes inside of 512-byte region [ffff8881cf591900, ffff8881cf591b00) The buggy address belongs to the page: page:ffffea00073d6400 refcount:1 mapcount:0 mapping:ffff8881da002500 index:0x0 compound_mapcount: 0 flags: 0x200000000010200(slab|head) raw: 0200000000010200 0000000000000000 0000000100000001 ffff8881da002500 raw: 0000000000000000 00000000000c000c 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff8881cf591900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff8881cf591980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb > ffff8881cf591a00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff8881cf591a80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff8881cf591b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ================================================================== In order to avoid opening a disconnected device, we need to check exist again after acquiring the existance lock, and bail out if necessary. Reported-by: syzbot Cc: Andrey Konovalov Signed-off-by: Hillf Danton Signed-off-by: Jiri Kosina commit d1d03306659d24cba3f594bbbb11a22ef32f45fe Merge: c2913b140f90 7c0767643f3b Author: Takashi Iwai Date: Tue Aug 6 12:28:28 2019 +0200 Merge tag 'asoc-fix-v5.3-rc3-2' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus ASoC: Fixes for v5.3 Incremental fix removing executable bits added in a prior patch accidentally. commit c2913b140f901a705809f8b6c83998cf8147f848 Merge: 5d78e1c2b7f4 30c21734d853 Author: Takashi Iwai Date: Tue Aug 6 12:28:08 2019 +0200 Merge tag 'asoc-fix-v5.3-rc3' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus ASoC: Fixes for v5.3 A relatively large batch of mostly unremarkable fixes here, a couple of small core fixes for fairly obscure issues, more comment/email updates with no code impact than usual and a bunch of small driver fixes. The support for new sample rates in the max98373 driver is a fix for the fact that the driver declared support for those rates but would in fact return an error if these rates were selected. commit 7c0767643f3b6b0dd2cda923ae37a18590d431cf Author: Mark Brown Date: Tue Aug 6 11:15:06 2019 +0100 ASoC: max98373: Remove executable bits Signed-off-by: Mark Brown commit e86d94fdda8e11a2acbe0a910e82f7519f6088b7 Author: Gustavo A. R. Silva Date: Mon Aug 5 14:32:32 2019 -0500 ARC: unwind: Mark expected switch fall-throughs Mark switch cases where we are expecting to fall through. This patch fixes the following warnings (Building: haps_hs_defconfig arc): arch/arc/kernel/unwind.c:827:20: warning: this statement may fall through [-Wimplicit-fallthrough=] arch/arc/kernel/unwind.c:836:20: warning: this statement may fall through [-Wimplicit-fallthrough=] Reviewed-by: Kees Cook Signed-off-by: Gustavo A. R. Silva Signed-off-by: Vineet Gupta commit ee9d66182392695535cc9fccfcb40c16f72de2a9 Author: Sebastien Tisserant Date: Thu Aug 1 12:06:08 2019 -0500 SMB3: Kernel oops mounting a encryptData share with CONFIG_DEBUG_VIRTUAL Fix kernel oops when mounting a encryptData CIFS share with CONFIG_DEBUG_VIRTUAL Signed-off-by: Sebastien Tisserant Reviewed-by: Pavel Shilovsky Signed-off-by: Steve French commit 108624eaff6f17f1966e4a94dc7bc5df2c5115ee Author: Steve French Date: Wed Jul 31 16:41:03 2019 -0500 smb3: update TODO list of missing features minor cleanup of documentation, updating to more current status. Signed-off-by: Steve French commit 8d33096a460d5b9bd13300f01615df5bb454db10 Author: Steve French Date: Thu Jul 25 18:13:10 2019 -0500 smb3: send CAP_DFS capability during session setup We had a report of a server which did not do a DFS referral because the session setup Capabilities field was set to 0 (unlike negotiate protocol where we set CAP_DFS). Better to send it session setup in the capabilities as well (this also more closely matches Windows client behavior). Signed-off-by: Steve French Reviewed-off-by: Ronnie Sahlberg Reviewed-by: Pavel Shilovsky CC: Stable commit 3edeb4a4146dc3b54d6fa71b7ee0585cb52ebfdf Author: Pavel Shilovsky Date: Mon Jul 22 11:38:22 2019 -0700 SMB3: Fix potential memory leak when processing compound chain When a reconnect happens in the middle of processing a compound chain the code leaks a buffer from the memory pool. Fix this by properly checking for a return code and freeing buffers in case of error. Also maintain a buf variable to be equal to either smallbuf or bigbuf depending on a response buffer size while parsing a chain and when returning to the caller. Signed-off-by: Pavel Shilovsky Reviewed-by: Ronnie Sahlberg Signed-off-by: Steve French commit e99c63e4d86d3a94818693147b469fa70de6f945 Author: Pavel Shilovsky Date: Mon Jul 22 11:34:59 2019 -0700 SMB3: Fix deadlock in validate negotiate hits reconnect Currently we skip SMB2_TREE_CONNECT command when checking during reconnect because Tree Connect happens when establishing an SMB session. For SMB 3.0 protocol version the code also calls validate negotiate which results in SMB2_IOCL command being sent over the wire. This may deadlock on trying to acquire a mutex when checking for reconnect. Fix this by skipping SMB2_IOCL command when doing the reconnect check. Signed-off-by: Pavel Shilovsky Signed-off-by: Steve French Reviewed-by: Ronnie Sahlberg CC: Stable commit 74034a09267c1f48d5ce7ae4c4a317fac7d43418 Author: Gustavo A. R. Silva Date: Mon Aug 5 13:55:33 2019 -0500 MIPS: BCM63XX: Mark expected switch fall-through Mark switch cases where we are expecting to fall through. This patch fixes the following warning (Building: bcm63xx_defconfig mips): arch/mips/pci/ops-bcm63xx.c: In function ‘bcm63xx_pcie_can_access’: arch/mips/pci/ops-bcm63xx.c:474:6: warning: this statement may fall through [-Wimplicit-fallthrough=] if (PCI_SLOT(devfn) == 0) ^ arch/mips/pci/ops-bcm63xx.c:477:2: note: here default: ^~~~~~~ Signed-off-by: Gustavo A. R. Silva Signed-off-by: Paul Burton Cc: Ralf Baechle Cc: James Hogan Cc: Florian Fainelli Cc: bcm-kernel-feedback-list@broadcom.com Cc: linux-mips@vger.kernel.org Cc: linux-arm-kernel@lists.infradead.org Cc: linux-kernel@vger.kernel.org commit d75996dd022b6d83bd14af59b2775b1aa639e4b9 Author: Vivek Goyal Date: Fri Aug 2 15:29:56 2019 -0400 dax: dax_layout_busy_page() should not unmap cow pages Vivek: "As of now dax_layout_busy_page() calls unmap_mapping_range() with last argument as 1, which says even unmap cow pages. I am wondering who needs to get rid of cow pages as well. I noticed one interesting side affect of this. I mount xfs with -o dax and mmaped a file with MAP_PRIVATE and wrote some data to a page which created cow page. Then I called fallocate() on that file to zero a page of file. fallocate() called dax_layout_busy_page() which unmapped cow pages as well and then I tried to read back the data I wrote and what I get is old data from persistent memory. I lost the data I had written. This read basically resulted in new fault and read back the data from persistent memory. This sounds wrong. Are there any users which need to unmap cow pages as well? If not, I am proposing changing it to not unmap cow pages. I noticed this while while writing virtio_fs code where when I tried to reclaim a memory range and that corrupted the executable and I was running from virtio-fs and program got segment violation." Dan: "In fact the unmap_mapping_range() in this path is only to synchronize against get_user_pages_fast() and force it to call back into the filesystem to re-establish the mapping. COW pages should be left untouched by dax_layout_busy_page()." Cc: Fixes: 5fac7408d828 ("mm, fs, dax: handle layout changes to pinned dax mappings") Signed-off-by: Vivek Goyal Link: https://lore.kernel.org/r/20190802192956.GA3032@redhat.com Signed-off-by: Dan Williams commit f7813d5c637e43209ffdc20a9b25a13fcbb86eef Merge: 091adf9ba6cd ead16e53c2f0 Author: David S. Miller Date: Mon Aug 5 14:44:53 2019 -0700 Merge tag 'linux-can-fixes-for-5.3-20190802' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can Marc Kleine-Budde says: ==================== pull-request: can 2019-08-02 this is a pull request of 4 patches for net/master. The first two patches are by Wang Xiayang, they force that the string buffer during a dev_info() is properly NULL terminated. The last two patches are by Tomas Bortoli and fix both a potential info leak of kernel memory to USB devices. ==================== Signed-off-by: David S. Miller commit dc7f2cb218b5ef65ab3d455a0e62d27e44075203 Author: Xavier Ruppen Date: Fri Jul 19 21:29:54 2019 +0200 arm64: dts: amlogic: odroid-n2: keep SD card regulator always on When powering off the Odroid N2, the tflash_vdd regulator is automatically turned off by the kernel. This is a problem when issuing the "reboot" command while using an SD card. The boot ROM does not power this regulator back on, blocking the reboot process at the boot ROM stage, preventing the SD card from being detected. Adding the "regulator-always-on" property fixes the problem. Signed-off-by: Xavier Ruppen Suggested-by: Martin Blumenstingl Reviewed-by: Neil Armstrong Reviewed-by: Martin Blumenstingl Fixes: c35f6dc5c377 ("arm64: dts: meson: Add minimal support for Odroid-N2") [khilman: minor subject change: s/meson/amlogic/] Signed-off-by: Kevin Hilman commit 54f374d1fd302fe6ca21220174c1dcb294049311 Author: Neil Armstrong Date: Mon Jul 1 13:57:24 2019 +0200 arm64: dts: meson-g12a-sei510: enable IR controller Enable the IR receiver controller on the SEI510 board. Signed-off-by: Neil Armstrong Signed-off-by: Kevin Hilman commit 3d4bacdc207a7b62941700b374e7199cbb184a43 Author: Neil Armstrong Date: Tue Jun 25 14:36:47 2019 +0200 arm64: dts: meson-g12a: add missing dwc2 phy-names The G12A USB2 OTG capable PHY uses a 8bit large UTMI bus, and the OTG controller gets the PHY but width by probing the associated phy. By default it will use 16bit wide settings if a phy is not specified, in our case we specified the phy, but not the phy-names. The dwc2 bindings specifies that if phys is present, phy-names shall be "usb2-phy". Adding phy-names = "usb2-phy" solves the OTG PHY bus configuration. Fixes: 9baf7d6be730 ("arm64: dts: meson: g12a: Add G12A USB nodes") Signed-off-by: Neil Armstrong Signed-off-by: Kevin Hilman commit ba2c1340d7c8e1ba5957d814ec18592b315fd4de Author: Mans Rullgard Date: Thu Jul 4 20:33:54 2019 +0100 auxdisplay: charlcd: add help text for backlight initial state While the individual CHARLCD_BL_xxx options have help texts, the menu itself does not. Fix this. Suggested-by: Linus Torvalds Signed-off-by: Mans Rullgard [Added a bit more text to address Linus' suggestion] Signed-off-by: Miguel Ojeda commit b33d567560c1aadf3033290d74d4fd67af47aa61 Author: zhengbin Date: Mon Jul 8 20:42:18 2019 +0800 auxdisplay: panel: need to delete scan_timer when misc_register fails in panel_attach In panel_attach, if misc_register fails, we need to delete scan_timer, which was setup in keypad_init->init_scan_timer. Reported-by: Hulk Robot Signed-off-by: zhengbin Signed-off-by: Miguel Ojeda commit 091adf9ba6cdb432cbcc217b47e4ffb8aa0d8865 Author: Nikolay Aleksandrov Date: Fri Aug 2 13:57:36 2019 +0300 net: bridge: move default pvid init/deinit to NETDEV_REGISTER/UNREGISTER Most of the bridge device's vlan init bugs come from the fact that its default pvid is created at the wrong time, way too early in ndo_init() before the device is even assigned an ifindex. It introduces a bug when the bridge's dev_addr is added as fdb during the initial default pvid creation the notification has ifindex/NDA_MASTER both equal to 0 (see example below) which really makes no sense for user-space[0] and is wrong. Usually user-space software would ignore such entries, but they are actually valid and will eventually have all necessary attributes. It makes much more sense to send a notification *after* the device has registered and has a proper ifindex allocated rather than before when there's a chance that the registration might still fail or to receive it with ifindex/NDA_MASTER == 0. Note that we can remove the fdb flush from br_vlan_flush() since that case can no longer happen. At NETDEV_REGISTER br->default_pvid is always == 1 as it's initialized by br_vlan_init() before that and at NETDEV_UNREGISTER it can be anything depending why it was called (if called due to NETDEV_REGISTER error it'll still be == 1, otherwise it could be any value changed during the device life time). For the demonstration below a small change to iproute2 for printing all fdb notifications is added, because it contained a workaround not to show entries with ifindex == 0. Command executed while monitoring: $ ip l add br0 type bridge Before (both ifindex and master == 0): $ bridge monitor fdb 36:7e:8a:b3:56:ba dev * vlan 1 master * permanent After (proper br0 ifindex): $ bridge monitor fdb e6:2a:ae:7a:b7:48 dev br0 vlan 1 master br0 permanent v4: move only the default pvid init/deinit to NETDEV_REGISTER/UNREGISTER v3: send the correct v2 patch with all changes (stub should return 0) v2: on error in br_vlan_init set br->vlgrp to NULL and return 0 in the br_vlan_bridge_event stub when bridge vlans are disabled [0] https://bugzilla.kernel.org/show_bug.cgi?id=204389 Reported-by: michael-dev Fixes: 5be5a2df40f0 ("bridge: Add filtering support for default_pvid") Signed-off-by: Nikolay Aleksandrov Acked-by: Roopa Prabhu Signed-off-by: David S. Miller commit d934423ac26ed373dfe089734d505dca5ff679b6 Author: Arnaud Patard (Rtp) Date: Fri Aug 2 10:32:40 2019 +0200 drivers/net/ethernet/marvell/mvmdio.c: Fix non OF case Orion5.x systems are still using machine files and not device-tree. Commit 96cb4342382290c9 ("net: mvmdio: allow up to three clocks to be specified for orion-mdio") has replaced devm_clk_get() with of_clk_get(), leading to a oops at boot and not working network, as reported in https://lists.debian.org/debian-arm/2019/07/msg00088.html and possibly in https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=908712. Link: https://lists.debian.org/debian-arm/2019/07/msg00088.html Fixes: 96cb4342382290c9 ("net: mvmdio: allow up to three clocks to be specified for orion-mdio") Signed-off-by: Arnaud Patard Reviewed-by: Andrew Lunn Signed-off-by: David S. Miller commit cd2063604ea6a8c2683b4eb9b5f4c4da74592d87 Author: Ursula Braun Date: Fri Aug 2 10:47:50 2019 +0200 net/smc: avoid fallback in case of non-blocking connect FASTOPEN is not possible with SMC. sendmsg() with msg_flag MSG_FASTOPEN triggers a fallback to TCP if the socket is in state SMC_INIT. But if a nonblocking connect is already started, fallback to TCP is no longer possible, even though the socket may still be in state SMC_INIT. And if a nonblocking connect is already started, a listen() call does not make sense. Reported-by: syzbot+bd8cc73d665590a1fcad@syzkaller.appspotmail.com Fixes: 50717a37db032 ("net/smc: nonblocking connect rework") Signed-off-by: Ursula Braun Signed-off-by: Karsten Graul Signed-off-by: David S. Miller commit f9cedf1a9b1cdcfb0c52edb391d01771e43994a4 Author: Ursula Braun Date: Fri Aug 2 10:16:38 2019 +0200 net/smc: do not schedule tx_work in SMC_CLOSED state The setsockopts options TCP_NODELAY and TCP_CORK may schedule the tx worker. Make sure the socket is not yet moved into SMC_CLOSED state (for instance by a shutdown SHUT_RDWR call). Reported-by: syzbot+92209502e7aab127c75f@syzkaller.appspotmail.com Reported-by: syzbot+b972214bb803a343f4fe@syzkaller.appspotmail.com Fixes: 01d2f7e2cdd31 ("net/smc: sockopts TCP_NODELAY and TCP_CORK") Signed-off-by: Ursula Braun Signed-off-by: Karsten Graul Signed-off-by: David S. Miller commit 438b43bdb95d3189e0098919f321c014ed71f410 Author: Catherine Sullivan Date: Thu Aug 1 16:07:31 2019 -0700 gve: Fix case where desc_cnt and data_cnt can get out of sync desc_cnt and data_cnt should always be equal. In the case of a dropped packet desc_cnt was still getting updated (correctly), data_cnt was not. To eliminate this bug and prevent it from recurring this patch combines them into one ring level cnt. Signed-off-by: Catherine Sullivan Reviewed-by: Sagi Shahar Signed-off-by: David S. Miller commit cff6a327d78b05c98e0d1c4be77225ea2c0bfe8e Author: David Ahern Date: Thu Aug 1 14:36:35 2019 -0700 ipv6: Fix unbalanced rcu locking in rt6_update_exception_stamp_rt The nexthop path in rt6_update_exception_stamp_rt needs to call rcu_read_unlock if it fails to find a fib6_nh match rather than just returning. Fixes: e659ba31d806 ("ipv6: Handle all fib6_nh in a nexthop in exception handling") Signed-off-by: David Ahern Signed-off-by: David S. Miller commit cd114d2e81f632104b3f1e804104060b97337410 Author: Jakub Kicinski Date: Thu Aug 1 14:36:02 2019 -0700 selftests/tls: add a litmus test for the socket reuse through shutdown Make sure that shutdown never works, and at the same time document how I tested to came to the conclusion that currently reuse is not possible. Signed-off-by: Jakub Kicinski Signed-off-by: David S. Miller commit 5d92e631b8be8965a90c144320f06e096081a551 Author: Jakub Kicinski Date: Thu Aug 1 14:36:01 2019 -0700 net/tls: partially revert fix transition through disconnect with close Looks like we were slightly overzealous with the shutdown() cleanup. Even though the sock->sk_state can reach CLOSED again, socket->state will not got back to SS_UNCONNECTED once connections is ESTABLISHED. Meaning we will see EISCONN if we try to reconnect, and EINVAL if we try to listen. Only listen sockets can be shutdown() and reused, but since ESTABLISHED sockets can never be re-connected() or used for listen() we don't need to try to clean up the ULP state early. Fixes: 32857cf57f92 ("net/tls: fix transition through disconnect with close") Signed-off-by: Jakub Kicinski Signed-off-by: David S. Miller commit 49da065f7b1f27be625de65d6d55bdd22ac6b5c2 Author: Logan Gunthorpe Date: Fri Jul 26 12:31:30 2019 -0600 NTB/msi: remove incorrect MODULE defines msi.c is not a module on its own right and should not have the MODULE_[LICENSE|VERSION|AUTHOR|DESCRIPTION] definitions. This caused a regression noticed by lkp with the following back trace: WARNING: CPU: 0 PID: 1 at kernel/params.c:861 param_sysfs_init+0xb1/0x20a Modules linked in: CPU: 0 PID: 1 Comm: swapper/0 Not tainted 5.2.0-rc1-00018-g26b3a37b928457 #2 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1 04/01/2014 RIP: 0010:param_sysfs_init+0xb1/0x20a Code: 24 38 e8 ec 17 2e fd 49 8b 7c 24 38 e8 76 fe ff ff 48 85 c0 48 89 c5 74 25 31 d2 4c 89 e6 48 89 c7 e8 6d 6f 3c fd 85 c0 74 02 <0f> 0b 48 89 ef 31 f6 e8 5d 70 a7 fe 48 89 ef e8 95 52 a7 fe 48 83 RSP: 0000:ffff88806b0ffe30 EFLAGS: 00010282 RAX: 00000000ffffffef RBX: ffffffff83774220 RCX: ffff88806a85e880 RDX: 00000000ffffffef RSI: ffff88806b000400 RDI: ffff88806a8608c0 RBP: ffff88806b392000 R08: ffffed100d61ff59 R09: ffffed100d61ff59 R10: 0000000000000001 R11: ffffed100d61ff58 R12: ffffffff83974bc0 R13: 0000000000000004 R14: 0000000000000028 R15: 00000000000003b9 FS: 0000000000000000(0000) GS:ffff88806b800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 000000000380e000 CR4: 00000000000406b0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: ? file_caps_disable+0x10/0x10 ? locate_module_kobject+0xf2/0xf2 do_one_initcall+0x47/0x1f0 kernel_init_freeable+0x1b1/0x243 ? rest_init+0xd0/0xd0 kernel_init+0xa/0x130 ? calculate_sigpending+0x63/0x80 ? rest_init+0xd0/0xd0 ret_from_fork+0x1f/0x30 ---[ end trace 78201497ae74cc91 ]--- Reported-by: kernel test robot Fixes: 26b3a37b9284 ("NTB: Introduce MSI library") Signed-off-by: Logan Gunthorpe Signed-off-by: Jon Mason commit 0eb0ce0a78e1f57082bca6cbdea6fd04feedb876 Merge: df9edcba0b11 a4127952859a Author: Linus Torvalds Date: Mon Aug 5 11:49:02 2019 -0700 Merge tag 'spi-fix-v5.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi Pull spi fixes from Mark Brown: "A bunch of small, device specific things here plus a DT bindings fix for the new validatable YAML binding format. The most notable thing is the fix for GPIO chip selects which fixes a corner case in updates of that code to modern APIs, unfortunately due to a historical mess the code around GPIO support is obscure, fragile and an ABI which makes and attempt to improve the situation painful" * tag 'spi-fix-v5.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: spi: pxa2xx: Add support for Intel Tiger Lake spi: bcm2835: Fix 3-wire mode if DMA is enabled spi: pxa2xx: Balance runtime PM enable/disable on error spi: gpio: Add SPI_MASTER_GPIO_SS flag spi: spi-fsl-qspi: change i.MX7D RX FIFO size spi: dt-bindings: spi-controller: remove unnecessary 'maxItems: 1' from reg commit df9edcba0b1146da5e4a2d1921bbc10c1a2fb55d Merge: 9e9671cea72e 811ba489fa52 Author: Linus Torvalds Date: Mon Aug 5 11:47:02 2019 -0700 Merge tag 'regulator-fix-v5.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator Pull regulator fixes from Mark Brown: "A few small driver specific fixes here plus one core fix for a refcounting problem with DT which will have little practical impact unless overlays are used" * tag 'regulator-fix-v5.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator: regulator: of: Add of_node_put() before return in function regulator: lp87565: Fix probe failure for "ti,lp87565" regulator: axp20x: fix DCDC5 and DCDC6 for AXP803 regulator: axp20x: fix DCDCA and DCDCD for AXP806 commit 9e9671cea72e0652a8a0d03b7c96a8a798470c43 Merge: e21a712a9685 fbb01c52471c Author: Linus Torvalds Date: Mon Aug 5 11:43:16 2019 -0700 Merge tag 'linux-kselftest-5.3-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest Pull kselftest fixes from Shuah Khan: "A fix to the Kselftest framework to save and restore errno and a fix to livepatch to push and pop dynamic debug config" * tag 'linux-kselftest-5.3-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest: selftests/livepatch: push and pop dynamic debug config kselftest: save-and-restore errno to allow for %m formatting commit cc798c83898ea0a77fcaa1a92afda35c3c3ded74 Author: Andrea Arcangeli Date: Mon Aug 5 10:34:04 2019 -0700 kernfs: fix memleak in kernel_ops_readdir() If getdents64 is killed or hits on segfault, it'll leave cgroups directories in sysfs pinned leaking memory because the kernfs node won't be freed on rmdir and the parent neither. Repro: # for i in `seq 1000`; do mkdir $i; done # rmdir * # for i in `seq 1000`; do mkdir $i; done # rmdir * # for i in `seq 1000`; do while :; do ls $i/ >/dev/null; done & done # while :; do killall ls; done kernfs_node_cache in /proc/slabinfo keeps going up as expected. Signed-off-by: Andrea Arcangeli Signed-off-by: Tejun Heo Cc: stable@vger.kernel.org # goes way back to original sysfs days Link: https://lore.kernel.org/r/20190805173404.GF136335@devbig004.ftw2.facebook.com Signed-off-by: Greg Kroah-Hartman commit 4130741736d4bc27add2ab4f7e53bc401846ce27 Merge: 60d60c8fbd8d 065af3554705 Author: David S. Miller Date: Mon Aug 5 11:17:40 2019 -0700 Merge branch 'net-fix-regressions-for-generic-XDP' Jesper Dangaard Brouer says: ==================== net: fix regressions for generic-XDP Thanks to Brandon Cazander, who wrote a very detailed bug report that even used perf probe's on xdp-newbies mailing list, we discovered that generic-XDP contains some regressions when using bpf_xdp_adjust_head(). First issue were that my selftests script, that use bpf_xdp_adjust_head(), by mistake didn't use generic-XDP any-longer. That selftest should have caught the real regression introduced in commit 458bf2f224f0 ("net: core: support XDP generic on stacked devices."). To verify this patchset fix the regressions, you can invoked manually via: cd tools/testing/selftests/bpf/ sudo ./test_xdp_vlan_mode_generic.sh sudo ./test_xdp_vlan_mode_native.sh ==================== Link: https://www.spinics.net/lists/xdp-newbies/msg01231.html Fixes: 458bf2f224f0 ("net: core: support XDP generic on stacked devices.") Reported by: Brandon Cazander Signed-off-by: Jesper Dangaard Brouer Signed-off-by: David S. Miller commit 065af355470519bd184019a93ac579f22b036045 Author: Jesper Dangaard Brouer Date: Thu Aug 1 20:00:31 2019 +0200 net: fix bpf_xdp_adjust_head regression for generic-XDP When generic-XDP was moved to a later processing step by commit 458bf2f224f0 ("net: core: support XDP generic on stacked devices.") a regression was introduced when using bpf_xdp_adjust_head. The issue is that after this commit the skb->network_header is now changed prior to calling generic XDP and not after. Thus, if the header is changed by XDP (via bpf_xdp_adjust_head), then skb->network_header also need to be updated again. Fix by calling skb_reset_network_header(). Fixes: 458bf2f224f0 ("net: core: support XDP generic on stacked devices.") Reported-by: Brandon Cazander Signed-off-by: Jesper Dangaard Brouer Signed-off-by: David S. Miller commit 13978d1e73d2fcfb6addcf3392707ad68fa88ccb Author: Jesper Dangaard Brouer Date: Thu Aug 1 20:00:26 2019 +0200 selftests/bpf: reduce time to execute test_xdp_vlan.sh Given the increasing number of BPF selftests, it makes sense to reduce the time to execute these tests. The ping parameters are adjusted to reduce the time from measures 9 sec to approx 2.8 sec. Signed-off-by: Jesper Dangaard Brouer Signed-off-by: David S. Miller commit d35661fcf95d8818c1f9acc818a1bad23dda4e1c Author: Jesper Dangaard Brouer Date: Thu Aug 1 20:00:21 2019 +0200 selftests/bpf: add wrapper scripts for test_xdp_vlan.sh In-order to test both native-XDP (xdpdrv) and generic-XDP (xdpgeneric) create two wrapper test scripts, that start the test_xdp_vlan.sh script with these modes. Signed-off-by: Jesper Dangaard Brouer Signed-off-by: David S. Miller commit 4de9c89a4982431c4a02739743fd360dc5581f22 Author: Jesper Dangaard Brouer Date: Thu Aug 1 20:00:16 2019 +0200 bpf: fix XDP vlan selftests test_xdp_vlan.sh Change BPF selftest test_xdp_vlan.sh to (default) use generic XDP. This selftest was created together with a fix for generic XDP, in commit 297249569932 ("net: fix generic XDP to handle if eth header was mangled"). And was suppose to catch if generic XDP was broken again. The tests are using veth and assumed that veth driver didn't support native driver XDP, thus it used the (ip link set) 'xdp' attach that fell back to generic-XDP. But veth gained native-XDP support in 948d4f214fde ("veth: Add driver XDP"), which caused this test script to use native-XDP. Fixes: 948d4f214fde ("veth: Add driver XDP") Fixes: 97396ff0bc2d ("selftests/bpf: add XDP selftests for modifying and popping VLAN headers") Signed-off-by: Jesper Dangaard Brouer Signed-off-by: David S. Miller commit 60d60c8fbd8d1acf25b041ecd72ae4fa16e9405b Author: Qian Cai Date: Thu Aug 1 09:52:54 2019 -0400 net/mlx5e: always initialize frag->last_in_page The commit 069d11465a80 ("net/mlx5e: RX, Enhance legacy Receive Queue memory scheme") introduced an undefined behaviour below due to "frag->last_in_page" is only initialized in mlx5e_init_frags_partition() when, if (next_frag.offset + frag_info[f].frag_stride > PAGE_SIZE) or after bailed out the loop, for (i = 0; i < mlx5_wq_cyc_get_size(&rq->wqe.wq); i++) As the result, there could be some "frag" have uninitialized value of "last_in_page". Later, get_frag() obtains those "frag" and check "frag->last_in_page" in mlx5e_put_rx_frag() and triggers the error during boot. Fix it by always initializing "frag->last_in_page" to "false" in mlx5e_init_frags_partition(). UBSAN: Undefined behaviour in drivers/net/ethernet/mellanox/mlx5/core/en_rx.c:325:12 load of value 170 is not a valid value for type 'bool' (aka '_Bool') Call trace: dump_backtrace+0x0/0x264 show_stack+0x20/0x2c dump_stack+0xb0/0x104 __ubsan_handle_load_invalid_value+0x104/0x128 mlx5e_handle_rx_cqe+0x8e8/0x12cc [mlx5_core] mlx5e_poll_rx_cq+0xca8/0x1a94 [mlx5_core] mlx5e_napi_poll+0x17c/0xa30 [mlx5_core] net_rx_action+0x248/0x940 __do_softirq+0x350/0x7b8 irq_exit+0x200/0x26c __handle_domain_irq+0xc8/0x128 gic_handle_irq+0x138/0x228 el1_irq+0xb8/0x140 arch_cpu_idle+0x1a4/0x348 do_idle+0x114/0x1b0 cpu_startup_entry+0x24/0x28 rest_init+0x1ac/0x1dc arch_call_rest_init+0x10/0x18 start_kernel+0x4d4/0x57c Fixes: 069d11465a80 ("net/mlx5e: RX, Enhance legacy Receive Queue memory scheme") Signed-off-by: Qian Cai Reviewed-by: Tariq Toukan Signed-off-by: David S. Miller commit 7be8ef2cdbfe41a2e524b7c6cc3f8e6cfaa906e4 Author: Dmytro Linkin Date: Thu Aug 1 13:02:51 2019 +0000 net: sched: use temporary variable for actions indexes Currently init call of all actions (except ipt) init their 'parm' structure as a direct pointer to nla data in skb. This leads to race condition when some of the filter actions were initialized successfully (and were assigned with idr action index that was written directly into nla data), but then were deleted and retried (due to following action module missing or classifier-initiated retry), in which case action init code tries to insert action to idr with index that was assigned on previous iteration. During retry the index can be reused by another action that was inserted concurrently, which causes unintended action sharing between filters. To fix described race condition, save action idr index to temporary stack-allocated variable instead on nla data. Fixes: 0190c1d452a9 ("net: sched: atomically check-allocate action") Signed-off-by: Dmytro Linkin Signed-off-by: Vlad Buslov Acked-by: Cong Wang Signed-off-by: David S. Miller commit 7fb5a711545d7d25fe9726a9ad277474dd83bd06 Author: Hubert Feurstein Date: Wed Jul 31 17:42:39 2019 +0200 net: dsa: mv88e6xxx: drop adjust_link to enabled phylink We have to drop the adjust_link callback in order to finally migrate to phylink. Otherwise we get the following warning during startup: "mv88e6xxx 2188000.ethernet-1:10: Using legacy PHYLIB callbacks. Please migrate to PHYLINK!" The warning is generated in the function dsa_port_link_register_of in dsa/port.c: int dsa_port_link_register_of(struct dsa_port *dp) { struct dsa_switch *ds = dp->ds; if (!ds->ops->adjust_link) return dsa_port_phylink_register(dp); dev_warn(ds->dev, "Using legacy PHYLIB callbacks. Please migrate to PHYLINK!\n"); [...] } Signed-off-by: Hubert Feurstein Reviewed-by: Andrew Lunn Reviewed-by: Vladimir Oltean Signed-off-by: David S. Miller commit c3953a3c2d3175d2f9f0304c9a1ba89e7743c5e4 Author: Johan Hovold Date: Mon Aug 5 12:00:55 2019 +0200 NFC: nfcmrvl: fix gpio-handling regression Fix two reset-gpio sanity checks which were never converted to use gpio_is_valid(), and make sure to use -EINVAL to indicate a missing reset line also for the UART-driver module parameter and for the USB driver. This specifically prevents the UART and USB drivers from incidentally trying to request and use gpio 0, and also avoids triggering a WARN() in gpio_to_desc() during probe when no valid reset line has been specified. Fixes: e33a3f84f88f ("NFC: nfcmrvl: allow gpio 0 for reset signalling") Reported-by: syzbot+cf35b76f35e068a1107f@syzkaller.appspotmail.com Tested-by: syzbot+cf35b76f35e068a1107f@syzkaller.appspotmail.com Signed-off-by: Johan Hovold commit b9ddd5091160793ee9fac10da765cf3f53d2aaf0 Author: Jacopo Mondi Date: Mon Aug 5 17:55:15 2019 +0200 iio: adc: max9611: Fix temperature reading in probe The max9611 driver reads the die temperature at probe time to validate the communication channel. Use the actual read value to perform the test instead of the read function return value, which was mistakenly used so far. The temperature reading test was only successful because the 0 return value is in the range of supported temperatures. Fixes: 69780a3bbc0b ("iio: adc: Add Maxim max9611 ADC driver") Signed-off-by: Jacopo Mondi Cc: Signed-off-by: Jonathan Cameron commit 82a5008a341d301da3ab529ca888c64f529bd075 Author: Nuno Sá Date: Mon Aug 5 15:37:16 2019 +0200 iio: frequency: adf4371: Fix output frequency setting The fract1 word was not being properly programmed on the device leading to wrong output frequencies. Fixes: 7f699bd14913 (iio: frequency: adf4371: Add support for ADF4371 PLL) Signed-off-by: Nuno Sá Reviewed-by: Stefan Popa Cc: Signed-off-by: Jonathan Cameron commit 0dda5907b0fc60f72f67f479f224e02c95d06e21 Author: Nishad Kamdar Date: Sat Aug 3 19:43:35 2019 +0530 i2c: stm32: Use the correct style for SPDX License Identifier This patch corrects the SPDX License Identifier style in header file related to STM32 Driver for I2C hardware bus support. For C header files Documentation/process/license-rules.rst mandates C-like comments (opposed to C source files where C++ style should be used) Changes made by using a script provided by Joe Perches here: https://lkml.org/lkml/2019/2/7/46 Suggested-by: Joe Perches Signed-off-by: Nishad Kamdar Signed-off-by: Greg Kroah-Hartman commit c43f28dfdc4654e738aa6d3fd08a105b2bee758d Author: Gavin Li Date: Sun Aug 4 16:50:44 2019 -0700 usb: usbfs: fix double-free of usb memory upon submiturb error Upon an error within proc_do_submiturb(), dec_usb_memory_use_count() gets called once by the error handling tail and again by free_async(). Remove the first call. Signed-off-by: Gavin Li Acked-by: Alan Stern Cc: stable Link: https://lore.kernel.org/r/20190804235044.22327-1-gavinli@thegavinli.com Signed-off-by: Greg Kroah-Hartman commit fc05481b2fcabaaeccf63e32ac1baab54e5b6963 Author: Suzuki K Poulose Date: Mon Aug 5 12:15:28 2019 +0100 usb: yurex: Fix use-after-free in yurex_delete syzbot reported the following crash [0]: BUG: KASAN: use-after-free in usb_free_coherent+0x79/0x80 drivers/usb/core/usb.c:928 Read of size 8 at addr ffff8881b18599c8 by task syz-executor.4/16007 CPU: 0 PID: 16007 Comm: syz-executor.4 Not tainted 5.3.0-rc2+ #23 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0xca/0x13e lib/dump_stack.c:113 print_address_description+0x6a/0x32c mm/kasan/report.c:351 __kasan_report.cold+0x1a/0x33 mm/kasan/report.c:482 kasan_report+0xe/0x12 mm/kasan/common.c:612 usb_free_coherent+0x79/0x80 drivers/usb/core/usb.c:928 yurex_delete+0x138/0x330 drivers/usb/misc/yurex.c:100 kref_put include/linux/kref.h:65 [inline] yurex_release+0x66/0x90 drivers/usb/misc/yurex.c:392 __fput+0x2d7/0x840 fs/file_table.c:280 task_work_run+0x13f/0x1c0 kernel/task_work.c:113 tracehook_notify_resume include/linux/tracehook.h:188 [inline] exit_to_usermode_loop+0x1d2/0x200 arch/x86/entry/common.c:163 prepare_exit_to_usermode arch/x86/entry/common.c:194 [inline] syscall_return_slowpath arch/x86/entry/common.c:274 [inline] do_syscall_64+0x45f/0x580 arch/x86/entry/common.c:299 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x413511 Code: 75 14 b8 03 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 04 1b 00 00 c3 48 83 ec 08 e8 0a fc ff ff 48 89 04 24 b8 03 00 00 00 0f 05 <48> 8b 3c 24 48 89 c2 e8 53 fc ff ff 48 89 d0 48 83 c4 08 48 3d 01 RSP: 002b:00007ffc424ea2e0 EFLAGS: 00000293 ORIG_RAX: 0000000000000003 RAX: 0000000000000000 RBX: 0000000000000007 RCX: 0000000000413511 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000006 RBP: 0000000000000001 R08: 0000000029a2fc22 R09: 0000000029a2fc26 R10: 00007ffc424ea3c0 R11: 0000000000000293 R12: 000000000075c9a0 R13: 000000000075c9a0 R14: 0000000000761938 R15: ffffffffffffffff Allocated by task 2776: save_stack+0x1b/0x80 mm/kasan/common.c:69 set_track mm/kasan/common.c:77 [inline] __kasan_kmalloc mm/kasan/common.c:487 [inline] __kasan_kmalloc.constprop.0+0xbf/0xd0 mm/kasan/common.c:460 kmalloc include/linux/slab.h:552 [inline] kzalloc include/linux/slab.h:748 [inline] usb_alloc_dev+0x51/0xf95 drivers/usb/core/usb.c:583 hub_port_connect drivers/usb/core/hub.c:5004 [inline] hub_port_connect_change drivers/usb/core/hub.c:5213 [inline] port_event drivers/usb/core/hub.c:5359 [inline] hub_event+0x15c0/0x3640 drivers/usb/core/hub.c:5441 process_one_work+0x92b/0x1530 kernel/workqueue.c:2269 worker_thread+0x96/0xe20 kernel/workqueue.c:2415 kthread+0x318/0x420 kernel/kthread.c:255 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352 Freed by task 16007: save_stack+0x1b/0x80 mm/kasan/common.c:69 set_track mm/kasan/common.c:77 [inline] __kasan_slab_free+0x130/0x180 mm/kasan/common.c:449 slab_free_hook mm/slub.c:1423 [inline] slab_free_freelist_hook mm/slub.c:1470 [inline] slab_free mm/slub.c:3012 [inline] kfree+0xe4/0x2f0 mm/slub.c:3953 device_release+0x71/0x200 drivers/base/core.c:1064 kobject_cleanup lib/kobject.c:693 [inline] kobject_release lib/kobject.c:722 [inline] kref_put include/linux/kref.h:65 [inline] kobject_put+0x171/0x280 lib/kobject.c:739 put_device+0x1b/0x30 drivers/base/core.c:2213 usb_put_dev+0x1f/0x30 drivers/usb/core/usb.c:725 yurex_delete+0x40/0x330 drivers/usb/misc/yurex.c:95 kref_put include/linux/kref.h:65 [inline] yurex_release+0x66/0x90 drivers/usb/misc/yurex.c:392 __fput+0x2d7/0x840 fs/file_table.c:280 task_work_run+0x13f/0x1c0 kernel/task_work.c:113 tracehook_notify_resume include/linux/tracehook.h:188 [inline] exit_to_usermode_loop+0x1d2/0x200 arch/x86/entry/common.c:163 prepare_exit_to_usermode arch/x86/entry/common.c:194 [inline] syscall_return_slowpath arch/x86/entry/common.c:274 [inline] do_syscall_64+0x45f/0x580 arch/x86/entry/common.c:299 entry_SYSCALL_64_after_hwframe+0x49/0xbe The buggy address belongs to the object at ffff8881b1859980 which belongs to the cache kmalloc-2k of size 2048 The buggy address is located 72 bytes inside of 2048-byte region [ffff8881b1859980, ffff8881b185a180) The buggy address belongs to the page: page:ffffea0006c61600 refcount:1 mapcount:0 mapping:ffff8881da00c000 index:0x0 compound_mapcount: 0 flags: 0x200000000010200(slab|head) raw: 0200000000010200 0000000000000000 0000000100000001 ffff8881da00c000 raw: 0000000000000000 00000000000f000f 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff8881b1859880: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff8881b1859900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc > ffff8881b1859980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff8881b1859a00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff8881b1859a80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ================================================================== A quick look at the yurex_delete() shows that we drop the reference to the usb_device before releasing any buffers associated with the device. Delay the reference drop until we have finished the cleanup. [0] https://lore.kernel.org/lkml/0000000000003f86d8058f0bd671@google.com/ Fixes: 6bc235a2e24a5e ("USB: add driver for Meywa-Denki & Kayac YUREX") Cc: Jiri Kosina Cc: Tomoki Sekiyama Cc: Oliver Neukum Cc: andreyknvl@google.com Cc: gregkh@linuxfoundation.org Cc: Alan Stern Cc: syzkaller-bugs@googlegroups.com Cc: dtor@chromium.org Reported-by: syzbot+d1fedb1c1fdb07fca507@syzkaller.appspotmail.com Signed-off-by: Suzuki K Poulose Cc: stable Link: https://lore.kernel.org/r/20190805111528.6758-1-suzuki.poulose@arm.com Signed-off-by: Greg Kroah-Hartman commit 5eeaf10eec394b28fad2c58f1f5c3a5da0e87d1c Author: Marc Zyngier Date: Fri Aug 2 10:28:32 2019 +0100 KVM: arm/arm64: Sync ICH_VMCR_EL2 back when about to block Since commit commit 328e56647944 ("KVM: arm/arm64: vgic: Defer touching GICH_VMCR to vcpu_load/put"), we leave ICH_VMCR_EL2 (or its GICv2 equivalent) loaded as long as we can, only syncing it back when we're scheduled out. There is a small snag with that though: kvm_vgic_vcpu_pending_irq(), which is indirectly called from kvm_vcpu_check_block(), needs to evaluate the guest's view of ICC_PMR_EL1. At the point were we call kvm_vcpu_check_block(), the vcpu is still loaded, and whatever changes to PMR is not visible in memory until we do a vcpu_put(). Things go really south if the guest does the following: mov x0, #0 // or any small value masking interrupts msr ICC_PMR_EL1, x0 [vcpu preempted, then rescheduled, VMCR sampled] mov x0, #ff // allow all interrupts msr ICC_PMR_EL1, x0 wfi // traps to EL2, so samping of VMCR [interrupt arrives just after WFI] Here, the hypervisor's view of PMR is zero, while the guest has enabled its interrupts. kvm_vgic_vcpu_pending_irq() will then say that no interrupts are pending (despite an interrupt being received) and we'll block for no reason. If the guest doesn't have a periodic interrupt firing once it has blocked, it will stay there forever. To avoid this unfortuante situation, let's resync VMCR from kvm_arch_vcpu_blocking(), ensuring that a following kvm_vcpu_check_block() will observe the latest value of PMR. This has been found by booting an arm64 Linux guest with the pseudo NMI feature, and thus using interrupt priorities to mask interrupts instead of the usual PSTATE masking. Cc: stable@vger.kernel.org # 4.12 Fixes: 328e56647944 ("KVM: arm/arm64: vgic: Defer touching GICH_VMCR to vcpu_load/put") Signed-off-by: Marc Zyngier commit f7ccbed656f78212593ca965d9a8f34bf24e0aab Author: Douglas Anderson Date: Fri Aug 2 11:46:16 2019 -0700 drm/rockchip: Suspend DP late In commit fe64ba5c6323 ("drm/rockchip: Resume DP early") we moved resume to be early but left suspend at its normal time. This seems like it could be OK, but casues problems if a suspend gets interrupted partway through. The OS only balances matching suspend/resume levels. ...so if suspend was called then resume will be called. If suspend late was called then resume early will be called. ...but if suspend was called resume early might not get called. This leads to an unbalance in the clock enables / disables. Lets take the simple fix and just move suspend to be late to match. This makes the PM core take proper care in keeping things balanced. Fixes: fe64ba5c6323 ("drm/rockchip: Resume DP early") Signed-off-by: Douglas Anderson Signed-off-by: Sean Paul Link: https://patchwork.freedesktop.org/patch/msgid/20190802184616.44822-1-dianders@chromium.org commit ce0eff0d9b4d37702df48a39e3fddb5e39b2c25b Author: Eugeniy Paltsev Date: Mon Jul 22 12:31:45 2019 +0300 ARC: [plat-hsdk]: allow to switch between AXI DMAC port configurations We want to use DW AXI DMAC on HSDK board in our automated verification to test cache & dma kernel code changes. This is perfect candidate as we don't depend on any external peripherals like MMC card / USB storage / etc. To increase test coverage we want to test both options: * DW AXI DMAC is connected through IOC port & dma direct ops used * DW AXI DMAC is connected to DDR port & dma noncoherent ops used Introduce 'arc_hsdk_axi_dmac_coherent' global variable which can be modified by debugger (same way as we patch 'ioc_enable') to switch between these options without recompiling the kernel. Depend on this value we tweak memory bridge configuration and "dma-coherent" DTS property of DW AXI DMAC. Signed-off-by: Eugeniy Paltsev Acked-by: Alexey Brodkin Signed-off-by: Vineet Gupta commit 1c703b53e5bfb5c2205c30f0fb157ce271fd42fb Author: Nicolas Saenz Julienne Date: Tue Jun 11 14:13:20 2019 +0200 HID: input: fix a4tech horizontal wheel custom usage Some a4tech mice use the 'GenericDesktop.00b8' usage to inform whether the previous wheel report was horizontal or vertical. Before c01908a14bf73 ("HID: input: add mapping for "Toggle Display" key") this usage was being mapped to 'Relative.Misc'. After the patch it's simply ignored (usage->type == 0 & usage->code == 0). Which ultimately makes hid-a4tech ignore the WHEEL/HWHEEL selection event, as it has no usage->type. We shouldn't rely on a mapping for that usage as it's nonstandard and doesn't really map to an input event. So we bypass the mapping and make sure the custom event handling properly handles both reports. Fixes: c01908a14bf73 ("HID: input: add mapping for "Toggle Display" key") Signed-off-by: Nicolas Saenz Julienne Signed-off-by: Jiri Kosina commit 49869d2ea9eecc105a10724c1abf035151a3c4e2 Author: Sebastian Parschauer Date: Wed Jul 24 20:40:03 2019 +0200 HID: Add quirk for HP X1200 PIXART OEM mouse The PixArt OEM mice are known for disconnecting every minute in runlevel 1 or 3 if they are not always polled. So add quirk ALWAYS_POLL for this one as well. Jonathan Teh (@jonathan-teh) reported and tested the quirk. Reference: https://github.com/sriemer/fix-linux-mouse/issues/15 Signed-off-by: Sebastian Parschauer CC: stable@vger.kernel.org Signed-off-by: Jiri Kosina commit 01ec0a5f19c8c82960a07f6c7410fc9e01d7fb51 Author: Oliver Neukum Date: Thu Jul 25 15:13:33 2019 +0200 HID: holtek: test for sanity of intfdata The ioctl handler uses the intfdata of a second interface, which may not be present in a broken or malicious device, hence the intfdata needs to be checked for NULL. [jkosina@suse.cz: fix newly added spurious space] Reported-by: syzbot+965152643a75a56737be@syzkaller.appspotmail.com Signed-off-by: Oliver Neukum Signed-off-by: Jiri Kosina commit 693c3dab4e50403f91bca4b52fc6d8562a3180f6 Author: Aaron Armstrong Skomra Date: Tue Jul 23 11:09:15 2019 -0700 HID: wacom: fix bit shift for Cintiq Companion 2 The bit indicating BTN_6 on this device is overshifted by 2 bits, resulting in the incorrect button being reported. Also fix copy-paste mistake in comments. Signed-off-by: Aaron Armstrong Skomra Reviewed-by: Ping Cheng Link: https://github.com/linuxwacom/xf86-input-wacom/issues/71 Fixes: c7f0522a1ad1 ("HID: wacom: Slim down wacom_intuos_pad processing") Cc: # v4.5+ Signed-off-by: Jiri Kosina commit 7bc74853fd61432ec59f812a40425bf6d8c986a4 Author: István Váradi Date: Wed Jul 24 20:09:18 2019 +0200 HID: quirks: Set the INCREMENT_USAGE_ON_DUPLICATE quirk on Saitek X52 The Saitek X52 joystick has a pair of axes that are originally (by the Windows driver) used as mouse pointer controls. The corresponding usage->hid values are 0x50024 and 0x50026. Thus they are handled as unknown axes and both get mapped to ABS_MISC. The quirk makes the second axis to be mapped to ABS_MISC1 and thus made available separately. [jkosina@suse.cz: squashed two patches into one] Signed-off-by: István Váradi Signed-off-by: Jiri Kosina commit 552573e42aab5f75aff9bab855a9677979d9a7d5 Author: Rogan Dawes Date: Wed Jul 17 11:11:34 2019 +0200 USB: serial: option: add D-Link DWM-222 device ID Add device id for D-Link DWM-222 A2. MI_00 D-Link HS-USB Diagnostics MI_01 D-Link HS-USB Modem MI_02 D-Link HS-USB AT Port MI_03 D-Link HS-USB NMEA MI_04 D-Link HS-USB WWAN Adapter (qmi_wwan) MI_05 USB Mass Storage Device Cc: stable@vger.kernel.org Signed-off-by: Rogan Dawes Signed-off-by: Johan Hovold commit 7e7ae38bf928c5cfa6dd6e9a2cf8b42c84a27c92 Author: Yoshiaki Okamoto Date: Sat Jul 20 22:23:18 2019 +0900 USB: serial: option: Add support for ZTE MF871A This patch adds support for MF871A USB modem (aka Speed USB STICK U03) to option driver. This modem is manufactured by ZTE corporation, and sold by KDDI. Interface layout: 0: AT 1: MODEM usb-devices output: T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 9 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=19d2 ProdID=1481 Rev=52.87 S: Manufacturer=ZTE,Incorporated S: Product=ZTE Technologies MSM S: SerialNumber=1234567890ABCDEF C: #Ifs= 2 Cfg#= 1 Atr=80 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option I: If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option Co-developed-by: Hiroyuki Yamamoto Signed-off-by: Hiroyuki Yamamoto Signed-off-by: Yoshiaki Okamoto Cc: stable Signed-off-by: Johan Hovold commit 57b76bdb20ecb05c87f4e12b7ced66bc03a976c3 Author: Paolo Bonzini Date: Thu Jul 25 12:59:40 2019 +0200 x86: kvm: remove useless calls to kvm_para_available Most code in arch/x86/kernel/kvm.c is called through x86_hyper_kvm, and thus only runs if KVM has been detected. There is no need to check again for the CPUID base. Cc: Sergio Lopez Cc: Jan Kiszka Signed-off-by: Paolo Bonzini commit 3e7093d045196b1016517631645e874fe903db7e Author: Greg KH Date: Wed Jul 31 20:56:20 2019 +0200 KVM: no need to check return value of debugfs_create functions When calling debugfs functions, there is no need to ever check the return value. The function can work or not, but the code logic should never do something different based on this. Also, when doing this, change kvm_arch_create_vcpu_debugfs() to return void instead of an integer, as we should not care at all about if this function actually does anything or not. Cc: Paolo Bonzini Cc: "Radim Krčmář" Cc: Thomas Gleixner Cc: Ingo Molnar Cc: Borislav Petkov Cc: "H. Peter Anvin" Cc: Cc: Signed-off-by: Greg Kroah-Hartman Signed-off-by: Paolo Bonzini commit 741cbbae0768b828be2d48331eb371a4f08bbea8 Author: Paolo Bonzini Date: Sat Aug 3 08:14:25 2019 +0200 KVM: remove kvm_arch_has_vcpu_debugfs() There is no need for this function as all arches have to implement kvm_arch_create_vcpu_debugfs() no matter what. A #define symbol let us actually simplify the code. Signed-off-by: Paolo Bonzini commit 17e433b54393a6269acbcb792da97791fe1592d8 Author: Wanpeng Li Date: Mon Aug 5 10:03:19 2019 +0800 KVM: Fix leak vCPU's VMCS value into other pCPU After commit d73eb57b80b (KVM: Boost vCPUs that are delivering interrupts), a five years old bug is exposed. Running ebizzy benchmark in three 80 vCPUs VMs on one 80 pCPUs Skylake server, a lot of rcu_sched stall warning splatting in the VMs after stress testing: INFO: rcu_sched detected stalls on CPUs/tasks: { 4 41 57 62 77} (detected by 15, t=60004 jiffies, g=899, c=898, q=15073) Call Trace: flush_tlb_mm_range+0x68/0x140 tlb_flush_mmu.part.75+0x37/0xe0 tlb_finish_mmu+0x55/0x60 zap_page_range+0x142/0x190 SyS_madvise+0x3cd/0x9c0 system_call_fastpath+0x1c/0x21 swait_active() sustains to be true before finish_swait() is called in kvm_vcpu_block(), voluntarily preempted vCPUs are taken into account by kvm_vcpu_on_spin() loop greatly increases the probability condition kvm_arch_vcpu_runnable(vcpu) is checked and can be true, when APICv is enabled the yield-candidate vCPU's VMCS RVI field leaks(by vmx_sync_pir_to_irr()) into spinning-on-a-taken-lock vCPU's current VMCS. This patch fixes it by checking conservatively a subset of events. Cc: Paolo Bonzini Cc: Radim Krčmář Cc: Christian Borntraeger Cc: Marc Zyngier Cc: stable@vger.kernel.org Fixes: 98f4a1467 (KVM: add kvm_arch_vcpu_runnable() test to kvm_vcpu_on_spin() loop) Signed-off-by: Wanpeng Li Signed-off-by: Paolo Bonzini commit 046ddeed0461b5d270470c253cbb321103d048b6 Author: Wanpeng Li Date: Thu Aug 1 11:30:14 2019 +0800 KVM: Check preempted_in_kernel for involuntary preemption preempted_in_kernel is updated in preempt_notifier when involuntary preemption ocurrs, it can be stale when the voluntarily preempted vCPUs are taken into account by kvm_vcpu_on_spin() loop. This patch lets it just check preempted_in_kernel for involuntary preemption. Cc: Paolo Bonzini Cc: Radim Krčmář Signed-off-by: Wanpeng Li Signed-off-by: Paolo Bonzini commit a48d06f9b7cedbb8ad7804d1720168b7ee6a34e7 Author: Wanpeng Li Date: Thu Aug 1 11:30:13 2019 +0800 KVM: LAPIC: Don't need to wakeup vCPU twice afer timer fire kvm_set_pending_timer() will take care to wake up the sleeping vCPU which has pending timer, don't need to check this in apic_timer_expired() again. Cc: Paolo Bonzini Cc: Radim Krčmář Signed-off-by: Wanpeng Li Signed-off-by: Paolo Bonzini commit 6fb08f1a5f7e5cdde1ce00104788e602f4299b99 Author: Hans de Goede Date: Mon Jul 29 17:50:36 2019 +0200 HID: logitech-dj: Really fix return value of logi_dj_recv_query_hidpp_devices Commit dbcbabf7da92 ("HID: logitech-dj: fix return value of logi_dj_recv_query_hidpp_devices") made logi_dj_recv_query_hidpp_devices return the return value of hid_hw_raw_request instead of unconditionally returning 0. But hid_hw_raw_request returns the report-size on a successful request (and a negative error-code on failure) where as the callers of logi_dj_recv_query_hidpp_devices expect a 0 return on success. This commit fixes things so that either the negative error gets returned or 0 on success, fixing HID++ receivers such as the Logitech nano receivers no longer working. Cc: YueHaibing Cc: Rafael J. Wysocki Cc: Lionel Landwerlin Fixes: dbcbabf7da92 ("HID: logitech-dj: fix return value of logi_dj_recv_query_hidpp_devices") Reported-by: Lionel Landwerlin Reported-by: Rafael J. Wysocki Signed-off-by: Hans de Goede Tested-by: Rafael J. Wysocki Reviewed-by: Petr Vorel Tested-by: Petr Vorel Reviewed-by: YueHaibing Signed-off-by: Jiri Kosina commit 589b474a4b7ce409d6821ef17234a995841bd131 Author: Florian Westphal Date: Tue Jul 30 14:57:19 2019 +0200 netfilter: nf_flow_table: fix offload for flows that are subject to xfrm This makes the previously added 'encap test' pass. Because its possible that the xfrm dst entry becomes stale while such a flow is offloaded, we need to call dst_check() -- the notifier that handles this for non-tunneled traffic isn't sufficient, because SA or or policies might have changed. If dst becomes stale the flow offload entry will be tagged for teardown and packets will be passed to 'classic' forwarding path. Removing the entry right away is problematic, as this would introduce a race condition with the gc worker. In case flow is long-lived, it could eventually be offloaded again once the gc worker removes the entry from the flow table. Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit 0ca1bbb7f4212aeef83a67a8aed9da1d84567fcc Author: Florian Westphal Date: Tue Jul 30 14:57:18 2019 +0200 selftests: netfilter: extend flowtable test script for ipsec 'flow offload' expression should not offload flows that will be subject to ipsec, but it does. This results in a connectivity blackhole for the affected flows -- first packets will go through (offload happens after established state is reached), but all remaining ones bypass ipsec encryption and are thus discarded by the peer. This can be worked around by adding "rt ipsec exists accept" before the 'flow offload' rule matches. This test case will fail, support for such flows is added in next patch. Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit 73a0ff0b30af79bf0303d557eb82f1d1945bb6ee Author: Stanislav Lisovskiy Date: Fri Jul 12 11:19:38 2019 +0300 drm/i915: Fix wrong escape clock divisor init for GLK According to Bspec clock divisor registers in GeminiLake should be initialized by shifting 1(<<) to amount of correspondent divisor. While i915 was writing all this time that value as is. Surprisingly that it by accident worked, until we met some issues with Microtech Etab. v2: Added Fixes tag and cc v3: Added stable to cc as well. Signed-off-by: Stanislav Lisovskiy Reviewed-by: Vandita Kulkarni Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=108826 Fixes: bcc657004841 ("drm/i915/glk: Program txesc clock divider for GLK") Cc: Deepak M Cc: Madhav Chauhan Cc: Jani Nikula Cc: Jani Nikula Cc: Joonas Lahtinen Cc: Rodrigo Vivi Cc: intel-gfx@lists.freedesktop.org Cc: stable@vger.kernel.org Signed-off-by: Jani Nikula Link: https://patchwork.freedesktop.org/patch/msgid/20190712081938.14185-1-stanislav.lisovskiy@intel.com (cherry picked from commit ce52ad5dd52cfaf3398058384e0ff94134bbd89c) Signed-off-by: Jani Nikula commit 0584674d7fe407c2db91a009294d5ec19f7cb1d5 Author: Wei Yongjun Date: Thu Jul 4 10:45:34 2019 +0000 drm/i915: fix possible memory leak in intel_hdcp_auth_downstream() 'ksv_fifo' is malloced in intel_hdcp_auth_downstream() and should be freed before leaving from the error handling cases, otherwise it will cause memory leak. Fixes: f26ae6a652f2 ("drm/i915: SRM revocation check for HDCP1.4 and 2.2") Signed-off-by: Wei Yongjun Signed-off-by: Jani Nikula Link: https://patchwork.freedesktop.org/patch/msgid/20190704104534.12508-1-weiyongjun1@huawei.com (cherry picked from commit de70fdd7d24cd07e51fbec420f8704d956a47949) Signed-off-by: Jani Nikula commit da31076f96fc41af41d64e94b9fefe0d21c8ee9c Author: Eugeniy Paltsev Date: Fri Jul 19 21:46:00 2019 +0300 ARC: fix typo in setup_dma_ops log message Signed-off-by: Eugeniy Paltsev Signed-off-by: Vineet Gupta commit 97abfd5d801abb6eac35e2d7d725123950e2153d Author: Alexey Brodkin Date: Tue Jul 16 23:50:34 2019 +0300 ARCv2: entry: early return from exception need not clear U & DE bits Exception handlers call FAKE_RET_FROM_EXCPN to - clear AE bit: drop down from exception active to pure kernel mode allowing further excptions - set IE bit: re-enable interrupts It additionally also clears U bit (user mode) and DE bit (delay slot execution) which is redundant as hardware does that already on any taken exception. Morevoer the current software clearing is bogus anyways as the KFLAG instruction being used for purpose can't possibly write those bits anyways. So don't pretend to clear them. Signed-off-by: Alexey Brodkin Signed-off-by: Vineet Gupta [vgupta: rewrote changelog] commit 247bc9470b1eeefc7b58cdf2c39f2866ba651509 Author: Steve French Date: Tue Jul 23 22:14:29 2019 -0500 cifs: fix rmmod regression in cifs.ko caused by force_sig changes Fixes: 72abe3bcf091 ("signal/cifs: Fix cifs_put_tcp_session to call send_sig instead of force_sig") The global change from force_sig caused module unloading of cifs.ko to fail (since the cifsd process could not be killed, "rmmod cifs" now would always fail) Signed-off-by: Steve French Reviewed-by: Ronnie Sahlberg CC: Eric W. Biederman commit dea1bb35c5f35e0577cfc61f79261d80b8715221 Author: Trond Myklebust Date: Sat Aug 3 13:39:24 2019 -0400 NFS: Fix regression whereby fscache errors are appearing on 'nofsc' mounts People are reporing seeing fscache errors being reported concerning duplicate cookies even in cases where they are not setting up fscache at all. The rule needs to be that if fscache is not enabled, then it should have no side effects at all. To ensure this is the case, we disable fscache completely on all superblocks for which the 'fsc' mount option was not set. In order to avoid issues with '-oremount', we also disable the ability to turn fscache on via remount. Fixes: f1fe29b4a02d ("NFS: Use i_writecount to control whether...") Link: https://bugzilla.kernel.org/show_bug.cgi?id=200145 Signed-off-by: Trond Myklebust Cc: Steve Dickson Cc: David Howells commit 09a54f0ebfe263bc27c90bbd80187b9a93283887 Author: Trond Myklebust Date: Sat Aug 3 10:28:18 2019 -0400 NFSv4: Fix an Oops in nfs4_do_setattr If the user specifies an open mode of 3, then we don't have a NFSv4 state attached to the context, and so we Oops when we try to dereference it. Reported-by: Olga Kornievskaia Fixes: 29b59f9416937 ("NFSv4: change nfs4_do_setattr to take...") Signed-off-by: Trond Myklebust Cc: stable@vger.kernel.org # v4.10: 991eedb1371dc: NFSv4: Only pass the... Cc: stable@vger.kernel.org # v4.10+ commit c77e22834ae9a11891cb613bd9a551be1b94f2bc Author: Trond Myklebust Date: Sat Aug 3 10:11:27 2019 -0400 NFSv4: Fix a potential sleep while atomic in nfs4_do_reclaim() John Hubbard reports seeing the following stack trace: nfs4_do_reclaim rcu_read_lock /* we are now in_atomic() and must not sleep */ nfs4_purge_state_owners nfs4_free_state_owner nfs4_destroy_seqid_counter rpc_destroy_wait_queue cancel_delayed_work_sync __cancel_work_timer __flush_work start_flush_work might_sleep: (kernel/workqueue.c:2975: BUG) The solution is to separate out the freeing of the state owners from nfs4_purge_state_owners(), and perform that outside the atomic context. Reported-by: John Hubbard Fixes: 0aaaf5c424c7f ("NFS: Cache state owners after files are closed") Signed-off-by: Trond Myklebust commit e3c8dc761ead061da2220ee8f8132f729ac3ddfe Author: Trond Myklebust Date: Mon Jul 29 18:25:00 2019 +0100 NFSv4: Check the return value of update_open_stateid() Ensure that we always check the return value of update_open_stateid() so that we can retry if the update of local state failed. This fixes infinite looping on state recovery. Fixes: e23008ec81ef3 ("NFSv4 reduce attribute requests for open reclaim") Signed-off-by: Trond Myklebust Cc: stable@vger.kernel.org # v3.7+ commit ad11408970df79d5f481aa9964e91f183133424c Author: Trond Myklebust Date: Fri Jul 26 14:40:53 2019 +0100 NFSv4.1: Only reap expired delegations Fix nfs_reap_expired_delegations() to ensure that we only reap delegations that are actually expired, rather than triggering on random errors. Fixes: 45870d6909d5a ("NFSv4.1: Test delegation stateids when server...") Signed-off-by: Trond Myklebust commit 27a30cf64a5cbe2105e4ff9613246b32d584766a Author: Trond Myklebust Date: Mon Jul 22 18:32:59 2019 +0100 NFSv4.1: Fix open stateid recovery The logic for checking in nfs41_check_open_stateid() whether the state is supported by a delegation is inverted. In addition, it makes more sense to perform that check before we check for expired locks. Fixes: 8a64c4ef106d1 ("NFSv4.1: Even if the stateid is OK,...") Signed-off-by: Trond Myklebust commit 731c74dd987e4f1f3179223314c039ce38dd4f19 Author: Trond Myklebust Date: Mon Jul 22 18:06:17 2019 +0100 NFSv4: Report the error from nfs4_select_rw_stateid() In pnfs_update_layout() ensure that we do report any fatal errors from nfs4_select_rw_stateid(). Fixes: d9aba2b40de6 ("NFSv4: Don't use the zero stateid with layoutget") Signed-off-by: Trond Myklebust commit c34fae003c79570b6c930b425fea3f0b7b1e7056 Author: Trond Myklebust Date: Mon Jul 22 09:54:29 2019 +0100 NFSv4: When recovering state fails with EAGAIN, retry the same recovery If the server returns with EAGAIN when we're trying to recover from a server reboot, we currently delay for 1 second, but then mark the stateid as needing recovery after the grace period has expired. Instead, we should just retry the same recovery process immediately after the 1 second delay. Break out of the loop after 10 retries. Fixes: 35a61606a612 ("NFS: Reduce indentation of the switch statement...") Signed-off-by: Trond Myklebust commit 86dbd08b32838dc8940ccab2eebd47cf80224494 Author: Trond Myklebust Date: Mon Jul 22 09:44:04 2019 +0100 NFSv4: Print an error in the syslog when state is marked as irrecoverable When error recovery fails due to a fatal error on the server, ensure we log it in the syslog. Signed-off-by: Trond Myklebust commit 5eb8d18ca0e001c6055da2b7f30d8f6dca23a44f Author: Trond Myklebust Date: Fri Jul 19 14:08:37 2019 -0400 NFSv4: Fix delegation state recovery Once we clear the NFS_DELEGATED_STATE flag, we're telling nfs_delegation_claim_opens() that we're done recovering all open state for that stateid, so we really need to ensure that we test for all open modes that are currently cached and recover them before exiting nfs4_open_delegation_recall(). Fixes: 24311f884189d ("NFSv4: Recovery of recalled read delegations...") Signed-off-by: Trond Myklebust Cc: stable@vger.kernel.org # v4.3+ commit 8c39a39e28b86a4021d9be314ce01019bafa5fdc Author: Trond Myklebust Date: Fri Jul 19 13:48:44 2019 -0400 NFSv4: Fix a credential refcount leak in nfs41_check_delegation_stateid It is unsafe to dereference delegation outside the rcu lock, and in any case, the refcount is guaranteed held if cred is non-zero. Signed-off-by: Trond Myklebust commit e21a712a9685488f5ce80495b37b9fdbe96c230d Author: Linus Torvalds Date: Sun Aug 4 18:40:12 2019 -0700 Linux 5.3-rc3 commit a6831a89bcaf351cf41b3a5922640c89beaaf9eb Merge: 62d1716304d1 fa4f99c05320 Author: Linus Torvalds Date: Sun Aug 4 16:39:07 2019 -0700 Merge tag 'tpmdd-next-20190805' of git://git.infradead.org/users/jjs/linux-tpmdd Pull tpm fixes from Jarkko Sakkinen: "Two bug fixes that did not make into my first pull request" * tag 'tpmdd-next-20190805' of git://git.infradead.org/users/jjs/linux-tpmdd: tpm: tpm_ibm_vtpm: Fix unallocated banks tpm: Fix null pointer dereference on chip register error path commit 62d1716304d1bb35ad9cdafe40efbbb6b3981cfe Merge: 4b6f23161b4e 2b372a9685a7 Author: Linus Torvalds Date: Sun Aug 4 16:37:08 2019 -0700 Merge tag 'mtd/fixes-for-5.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux Pull MTD fixes from Miquel Raynal: "NAND: - Fix Micron driver as some chips enable internal ECC correction during their discovery while they advertize they do not have any. Hyperbus: - Restrict the build to only ARM64 SoCs (and compile testing) which is what should have been done since the beginning. - Fix Kconfig issue by selection something instead of implying it" * tag 'mtd/fixes-for-5.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux: mtd: hyperbus: Add hardware dependency to AM654 driver mtd: hyperbus: Kconfig: Fix HBMC_AM654 dependencies mtd: rawnand: micron: handle on-die "ECC-off" devices correctly commit fa4f99c05320eb28bf6ba52a9adf64d888da1f9e Author: Nayna Jain Date: Thu Jul 11 12:13:35 2019 -0400 tpm: tpm_ibm_vtpm: Fix unallocated banks The nr_allocated_banks and allocated banks are initialized as part of tpm_chip_register. Currently, this is done as part of auto startup function. However, some drivers, like the ibm vtpm driver, do not run auto startup during initialization. This results in uninitialized memory issue and causes a kernel panic during boot. This patch moves the pcr allocation outside the auto startup function into tpm_chip_register. This ensures that allocated banks are initialized in any case. Fixes: 879b589210a9 ("tpm: retrieve digest size of unknown algorithms with PCR read") Reported-by: Michal Suchanek Signed-off-by: Nayna Jain Reviewed-by: Mimi Zohar Tested-by: Sachin Sant Tested-by: Michal Suchánek Reviewed-by: Jarkko Sakkinen Signed-off-by: Jarkko Sakkinen commit 1e5ac6300a07ceecfc70a893ebef3352be21e6f8 Author: Milan Broz Date: Thu Jul 4 09:26:15 2019 +0200 tpm: Fix null pointer dereference on chip register error path If clk_enable is not defined and chip initialization is canceled code hits null dereference. Easily reproducible with vTPM init fail: swtpm chardev --tpmstate dir=nonexistent_dir --tpm2 --vtpm-proxy BUG: kernel NULL pointer dereference, address: 00000000 ... Call Trace: tpm_chip_start+0x9d/0xa0 [tpm] tpm_chip_register+0x10/0x1a0 [tpm] vtpm_proxy_work+0x11/0x30 [tpm_vtpm_proxy] process_one_work+0x214/0x5a0 worker_thread+0x134/0x3e0 ? process_one_work+0x5a0/0x5a0 kthread+0xd4/0x100 ? process_one_work+0x5a0/0x5a0 ? kthread_park+0x90/0x90 ret_from_fork+0x19/0x24 Fixes: 719b7d81f204 ("tpm: introduce tpm_chip_start() and tpm_chip_stop()") Cc: stable@vger.kernel.org # v5.1+ Signed-off-by: Milan Broz Reviewed-by: Jarkko Sakkinen Signed-off-by: Jarkko Sakkinen commit 4b6f23161b4e888e72671e377c32eabe9a8e62fc Merge: 4c0d228c3bd4 d7e23b887f67 Author: Linus Torvalds Date: Sun Aug 4 10:30:47 2019 -0700 Merge tag 'powerpc-5.3-3' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux Pull powerpc fixes from Michael Ellerman: "Some more powerpc fixes for 5.3: - Wire up the new clone3 syscall. - A fix for the PAPR SCM nvdimm driver, to fix a crash when firmware gives us a device that's attached to a non-online NUMA node. - A fix for a boot failure on 32-bit with KASAN enabled. - Three fixes for implicit fall through warnings, some of which are errors for us due to -Werror. Thanks to: Aneesh Kumar K.V, Christophe Leroy, Kees Cook, Santosh Sivaraj, Stephen Rothwell" * tag 'powerpc-5.3-3' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux: powerpc/kasan: fix early boot failure on PPC32 drivers/macintosh/smu.c: Mark expected switch fall-through powerpc/spe: Mark expected switch fall-throughs powerpc/nvdimm: Pick nearby online node if the device node is not online powerpc/kvm: Fall through switch case explicitly powerpc: Wire up clone3 syscall commit 4c0d228c3bd498b3119d68eb41a17880f7728993 Author: Geert Uytterhoeven Date: Mon Jul 29 19:56:58 2019 +0200 MAINTAINERS: Add Geert as Renesas SoC Co-Maintainer At the end of the v5.3 upstream kernel development cycle, Simon will be stepping down from his role as Renesas SoC maintainer. Starting with the v5.4 development cycle, Geert is taking over this role. Add Geert as a co-maintainer, and add his git repository and branch. Signed-off-by: Geert Uytterhoeven Reviewed-by: Niklas Söderlund Acked-by: Simon Horman Signed-off-by: Linus Torvalds commit 05e4f88b7d25fa8bf65b846f05197c47ddece278 Merge: 8449c980c3cd 0c5b6c28ed68 Author: Linus Torvalds Date: Sun Aug 4 10:16:30 2019 -0700 Merge tag 'kbuild-fixes-v5.3-2' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild Pull Kbuild fixes from Masahiro Yamada: - detect missing missing "WITH Linux-syscall-note" for uapi headers - fix needless rebuild when using Clang - fix false-positive cc-option in Kconfig when using Clang - avoid including corrupted .*.cmd files in the modpost stage - fix warning of 'make vmlinux' - fix {m,n,x,g}config to not generate the broken .config on the second save operation. - some trivial Makefile fixes * tag 'kbuild-fixes-v5.3-2' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild: kconfig: Clear "written" flag to avoid data loss kbuild: Check for unknown options with cc-option usage in Kconfig and clang lib/raid6: fix unnecessary rebuild of vpermxor*.c kbuild: modpost: do not parse unnecessary rules for vmlinux modpost kbuild: modpost: remove unnecessary dependency for __modpost kbuild: modpost: handle KBUILD_EXTRA_SYMBOLS only for external modules kbuild: modpost: include .*.cmd files only when targets exist kbuild: initialize CLANG_FLAGS correctly in the top Makefile kbuild: detect missing "WITH Linux-syscall-note" for uapi headers commit 8449c980c3cd915cd436d0aa02c25693e1a0eed5 Merge: d8778f13b73f fc5b34a35458 Author: Linus Torvalds Date: Sun Aug 4 10:02:13 2019 -0700 Merge tag 'safesetid-maintainers-correction-5.3-rc2' of git://github.com/micah-morton/linux Pull SafeSetID maintainer update from Micah Morton: "Add entry in MAINTAINERS file for SafeSetID LSM" * tag 'safesetid-maintainers-correction-5.3-rc2' of git://github.com/micah-morton/linux: Add entry in MAINTAINERS file for SafeSetID LSM commit 0c5b6c28ed68becb692b43eae5e44d5aa7e160ce Author: M. Vefa Bicakci Date: Sat Aug 3 06:02:12 2019 -0400 kconfig: Clear "written" flag to avoid data loss Prior to this commit, starting nconfig, xconfig or gconfig, and saving the .config file more than once caused data loss, where a .config file that contained only comments would be written to disk starting from the second save operation. This bug manifests itself because the SYMBOL_WRITTEN flag is never cleared after the first call to conf_write, and subsequent calls to conf_write then skip all of the configuration symbols due to the SYMBOL_WRITTEN flag being set. This commit resolves this issue by clearing the SYMBOL_WRITTEN flag from all symbols before conf_write returns. Fixes: 8e2442a5f86e ("kconfig: fix missing choice values in auto.conf") Cc: linux-stable # 4.19+ Signed-off-by: M. Vefa Bicakci Signed-off-by: Masahiro Yamada commit d8778f13b73f1cde08be0ece18571dee495b92f1 Merge: cf6c8aef16cc e3cacb73e626 Author: Linus Torvalds Date: Sat Aug 3 18:50:52 2019 -0700 Merge tag 'xtensa-20190803' of git://github.com/jcmvbkbc/linux-xtensa Pull Xtensa fix from Max Filippov: "Fix build for xtensa cores with coprocessors that was broken by entry/return abstraction patch" * tag 'xtensa-20190803' of git://github.com/jcmvbkbc/linux-xtensa: xtensa: fix build for cores with coprocessors commit cf6c8aef16cc0cd15e91a930befd8e312d5703f5 Merge: 8b7fd679427c 8eb9a2dff019 Author: Linus Torvalds Date: Sat Aug 3 12:56:34 2019 -0700 Merge branch 'i2c/for-current-fixed' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux Pull i2c fixes from Wolfram Sang: "A set of driver fixes for the I2C subsystem" * 'i2c/for-current-fixed' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux: i2c: s3c2410: Mark expected switch fall-through i2c: at91: fix clk_offset for sama5d2 i2c: at91: disable TXRDY interrupt after sending data i2c: iproc: Fix i2c master read more than 63 bytes eeprom: at24: make spd world-readable again commit 4c92057661a3412f547ede95715641d7ee16ddac Author: Josh Poimboeuf Date: Sat Aug 3 21:21:54 2019 +0200 Documentation: Add swapgs description to the Spectre v1 documentation Add documentation to the Spectre document about the new swapgs variant of Spectre v1. Signed-off-by: Josh Poimboeuf Signed-off-by: Thomas Gleixner commit 5e5412c365a32e452daa762eac36121cb8a370bb Author: Qian Cai Date: Tue Jul 30 11:30:33 2019 -0400 net/socket: fix GCC8+ Wpacked-not-aligned warnings There are a lot of those warnings with GCC8+ 64-bit, In file included from ./include/linux/sctp.h:42, from net/core/skbuff.c:47: ./include/uapi/linux/sctp.h:395:1: warning: alignment 4 of 'struct sctp_paddr_change' is less than 8 [-Wpacked-not-aligned] } __attribute__((packed, aligned(4))); ^ ./include/uapi/linux/sctp.h:728:1: warning: alignment 4 of 'struct sctp_setpeerprim' is less than 8 [-Wpacked-not-aligned] } __attribute__((packed, aligned(4))); ^ ./include/uapi/linux/sctp.h:727:26: warning: 'sspp_addr' offset 4 in 'struct sctp_setpeerprim' isn't aligned to 8 [-Wpacked-not-aligned] struct sockaddr_storage sspp_addr; ^~~~~~~~~ ./include/uapi/linux/sctp.h:741:1: warning: alignment 4 of 'struct sctp_prim' is less than 8 [-Wpacked-not-aligned] } __attribute__((packed, aligned(4))); ^ ./include/uapi/linux/sctp.h:740:26: warning: 'ssp_addr' offset 4 in 'struct sctp_prim' isn't aligned to 8 [-Wpacked-not-aligned] struct sockaddr_storage ssp_addr; ^~~~~~~~ ./include/uapi/linux/sctp.h:792:1: warning: alignment 4 of 'struct sctp_paddrparams' is less than 8 [-Wpacked-not-aligned] } __attribute__((packed, aligned(4))); ^ ./include/uapi/linux/sctp.h:784:26: warning: 'spp_address' offset 4 in 'struct sctp_paddrparams' isn't aligned to 8 [-Wpacked-not-aligned] struct sockaddr_storage spp_address; ^~~~~~~~~~~ ./include/uapi/linux/sctp.h:905:1: warning: alignment 4 of 'struct sctp_paddrinfo' is less than 8 [-Wpacked-not-aligned] } __attribute__((packed, aligned(4))); ^ ./include/uapi/linux/sctp.h:899:26: warning: 'spinfo_address' offset 4 in 'struct sctp_paddrinfo' isn't aligned to 8 [-Wpacked-not-aligned] struct sockaddr_storage spinfo_address; ^~~~~~~~~~~~~~ This is because the commit 20c9c825b12f ("[SCTP] Fix SCTP socket options to work with 32-bit apps on 64-bit kernels.") added "packed, aligned(4)" GCC attributes to some structures but one of the members, i.e, "struct sockaddr_storage" in those structures has the attribute, "aligned(__alignof__ (struct sockaddr *)" which is 8-byte on 64-bit systems, so the commit overwrites the designed alignments for "sockaddr_storage". To fix this, "struct sockaddr_storage" needs to be aligned to 4-byte as it is only used in those packed sctp structure which is part of UAPI, and "struct __kernel_sockaddr_storage" is used in some other places of UAPI that need not to change alignments in order to not breaking userspace. Use an implicit alignment for "struct __kernel_sockaddr_storage" so it can keep the same alignments as a member in both packed and un-packed structures without breaking UAPI. Suggested-by: David Laight Signed-off-by: Qian Cai Signed-off-by: David S. Miller commit 8b7fd679427c571c34f61d9eafed3562c52424ae Merge: 0432a0a066b0 b3c303be4c35 Author: Linus Torvalds Date: Sat Aug 3 10:58:46 2019 -0700 Merge branch 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull perf tooling fixes from Thomas Gleixner: "A set of updates for perf tools and documentation: perf header: - Prevent a division by zero - Deal with an uninitialized warning proper libbpf: - Fix the missiong __WORDSIZE definition for musl & al UAPI headers: - Synchronize kernel headers Documentation: - Fix the memory units for perf.data size" * 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: libbpf: fix missing __WORDSIZE definition perf tools: Fix perf.data documentation units for memory size perf header: Fix use of unitialized value warning perf header: Fix divide by zero error if f_header.attr_size==0 tools headers UAPI: Sync if_link.h with the kernel tools headers UAPI: Sync sched.h with the kernel tools headers UAPI: Sync usbdevice_fs.h with the kernels to get new ioctl tools perf beauty: Fix usbdevfs_ioctl table generator to handle _IOC() tools headers UAPI: Update tools's copy of drm.h headers tools headers UAPI: Update tools's copy of mman.h headers tools headers UAPI: Update tools's copy of kvm.h headers tools include UAPI: Sync x86's syscalls_64.tbl and generic unistd.h to pick up clone3 and pidfd_open commit 0432a0a066b05361b6d4d26522233c3c76c9e5da Merge: af42e7450f4b 33a58980ff3c Author: Linus Torvalds Date: Sat Aug 3 10:51:29 2019 -0700 Merge branch 'timers-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull vdso timer fixes from Thomas Gleixner: "A series of commits to deal with the regression caused by the generic VDSO implementation. The usage of clock_gettime64() for 32bit compat fallback syscalls caused seccomp filters to kill innocent processes because they only allow clock_gettime(). Handle the compat syscalls with clock_gettime() as before, which is not a functional problem for the VDSO as the legacy compat application interface is not y2038 safe anyway. It's just extra fallback code which needs to be implemented on every architecture. It's opt in for now so that it does not break the compile of already converted architectures in linux-next. Once these are fixed, the #ifdeffery goes away. So much for trying to be smart and reuse code..." * 'timers-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: arm64: compat: vdso: Use legacy syscalls as fallback x86/vdso/32: Use 32bit syscall fallback lib/vdso/32: Provide legacy syscall fallbacks lib/vdso: Move fallback invocation to the callers lib/vdso/32: Remove inconsistent NULL pointer checks commit af42e7450f4b174a0a3f7611791ba73109997171 Merge: e12b243de76d a5dbba8f443e Author: Linus Torvalds Date: Sat Aug 3 10:49:45 2019 -0700 Merge branch 'irq-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull irq fixes from Thomas Gleixner: "A small bunch of fixes from the irqchip department: - Fix a couple of UAF on error paths (RZA1, GICv3 ITS) - Fix iMX GPCv2 trigger setting - Add missing of_node_put() on error path in MBIGEN - Add another bunch of /* fall-through */ to silence warnings" * 'irq-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: irqchip/renesas-rza1: Fix an use-after-free in rza1_irqc_probe() irqchip/irq-imx-gpcv2: Forward irq type to parent irqchip/irq-mbigen: Add of_node_put() before return irqchip/gic-v3-its: Free unused vpt_page when alloc vpe table fail irqchip/gic-v3: Mark expected switch fall-through commit e12b243de76dcc24a904a48a2efda94fdc4cdf07 Merge: b7aea68a19f3 afa1d96d1430 Author: Linus Torvalds Date: Sat Aug 3 10:43:44 2019 -0700 Merge tag 'xfs-5.3-fixes-1' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux Pull xfs fixes from Darrick Wong: - Avoid leaking kernel stack contents to userspace - Fix a potential null pointer dereference in the dabtree scrub code * tag 'xfs-5.3-fixes-1' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux: xfs: Fix possible null-pointer dereferences in xchk_da_btree_block_check_sibling() xfs: fix stack contents leakage in the v1 inumber ioctls commit 294fc7a4c8ec42b3053b1d2e87b0dafef80a76b8 Author: Tetsuo Handa Date: Thu Aug 1 13:47:07 2019 -0700 fs: xfs: xfs_log: Don't use KM_MAYFAIL at xfs_log_reserve(). When the system is close-to-OOM, fsync() may fail due to -ENOMEM because xfs_log_reserve() is using KM_MAYFAIL. It is a bad thing to fail writeback operation due to user-triggerable OOM condition. Since we are not using KM_MAYFAIL at xfs_trans_alloc() before calling xfs_log_reserve(), let's use the same flags at xfs_log_reserve(). oom-torture: page allocation failure: order:0, mode:0x46c40(GFP_NOFS|__GFP_NOWARN|__GFP_RETRY_MAYFAIL|__GFP_COMP), nodemask=(null) CPU: 7 PID: 1662 Comm: oom-torture Kdump: loaded Not tainted 5.3.0-rc2+ #925 Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 Call Trace: dump_stack+0x67/0x95 warn_alloc+0xa9/0x140 __alloc_pages_slowpath+0x9a8/0xbce __alloc_pages_nodemask+0x372/0x3b0 alloc_slab_page+0x3a/0x8d0 new_slab+0x330/0x420 ___slab_alloc.constprop.94+0x879/0xb00 __slab_alloc.isra.89.constprop.93+0x43/0x6f kmem_cache_alloc+0x331/0x390 kmem_zone_alloc+0x9f/0x110 [xfs] kmem_zone_alloc+0x9f/0x110 [xfs] xlog_ticket_alloc+0x33/0xd0 [xfs] xfs_log_reserve+0xb4/0x410 [xfs] xfs_trans_reserve+0x1d1/0x2b0 [xfs] xfs_trans_alloc+0xc9/0x250 [xfs] xfs_setfilesize_trans_alloc.isra.27+0x44/0xc0 [xfs] xfs_submit_ioend.isra.28+0xa5/0x180 [xfs] xfs_vm_writepages+0x76/0xa0 [xfs] do_writepages+0x17/0x80 __filemap_fdatawrite_range+0xc1/0xf0 file_write_and_wait_range+0x53/0xa0 xfs_file_fsync+0x87/0x290 [xfs] vfs_fsync_range+0x37/0x80 do_fsync+0x38/0x60 __x64_sys_fsync+0xf/0x20 do_syscall_64+0x4a/0x1c0 entry_SYSCALL_64_after_hwframe+0x49/0xbe Fixes: eb01c9cd87 ("[XFS] Remove the xlog_ticket allocator") Signed-off-by: Tetsuo Handa Reviewed-by: Darrick J. Wong Signed-off-by: Darrick J. Wong commit b7aea68a19f3b13455a889ab58954c5fb2b5e1db Merge: 616725492ec7 7291edca2021 Author: Linus Torvalds Date: Sat Aug 3 09:20:49 2019 -0700 Merge branch 'akpm' (patches from Andrew) Merge misc fixes from Andrew Morton: "17 fixes" * emailed patches from Andrew Morton : drivers/acpi/scan.c: document why we don't need the device_hotplug_lock memremap: move from kernel/ to mm/ lib/test_meminit.c: use GFP_ATOMIC in RCU critical section asm-generic: fix -Wtype-limits compiler warnings cgroup: kselftest: relax fs_spec checks mm/memory_hotplug.c: remove unneeded return for void function mm/migrate.c: initialize pud_entry in migrate_vma() coredump: split pipe command whitespace before expanding template page flags: prioritize kasan bits over last-cpuid ubsan: build ubsan.c more conservatively kasan: remove clang version check for KASAN_STACK mm: compaction: avoid 100% CPU usage during compaction when a task is killed mm: migrate: fix reference check race between __find_get_block() and migration mm: vmscan: check if mem cgroup is disabled or not before calling memcg slab shrinker ocfs2: remove set but not used variable 'last_hash' Revert "kmemleak: allow to coexist with fault injection" kernel/signal.c: fix a kernel-doc markup commit 616725492ec7519643d5638de02a92a28200d03f Merge: 0e31225f99e0 b7edabfe8438 Author: Linus Torvalds Date: Sat Aug 3 08:59:11 2019 -0700 Merge tag 'riscv/for-v5.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux Pull RISC-V fixes from Paul Walmsley: "Three minor RISC-V-related changes for v5.3-rc3: - Add build ID to VDSO builds to avoid a double-free in perf when libelf isn't used - Align the RV64 defconfig to the output of "make savedefconfig" so subsequent defconfig patches don't get out of hand - Drop a superfluous DT property from the FU540 SoC DT data (since it must be already set in board data that includes it)" * tag 'riscv/for-v5.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux: riscv: defconfig: align RV64 defconfig to the output of "make savedefconfig" riscv: dts: fu540-c000: drop "timebase-frequency" riscv: Fix perf record without libelf support commit a5580eb394c8a48afc3e64aaad68db0d44662cc6 Author: Lukasz Majewski Date: Wed Jul 31 16:11:51 2019 +0200 ARM: dts: vf610-bk4: Fix qspi node description Before this change the device tree description of qspi node for second memory on BK4 board was wrong (applicable to old, removed fsl-quadspi.c driver). As a result this memory was not recognized correctly when used with the new spi-fsl-qspi.c driver. From the dt-bindings: "Required SPI slave node properties: - reg: There are two buses (A and B) with two chip selects each. This encodes to which bus and CS the flash is connected: <0>: Bus A, CS 0 <1>: Bus A, CS 1 <2>: Bus B, CS 0 <3>: Bus B, CS 1" According to above with new driver the second SPI-NOR memory shall have reg=<2> as it is connected to Bus B, CS 0. Fixes: a67d2c52a82f ("ARM: dts: Add support for Liebherr's BK4 device (vf610 based)") Suggested-by: Fabio Estevam Signed-off-by: Lukasz Majewski Reviewed-by: Fabio Estevam Signed-off-by: Shawn Guo commit 7291edca20215dfdf0eb841881d63753448ef09c Author: David Hildenbrand Date: Fri Aug 2 21:49:29 2019 -0700 drivers/acpi/scan.c: document why we don't need the device_hotplug_lock Let's document why the lock is not needed in acpi_scan_init(), right now this is not really obvious. [akpm@linux-foundation.org: fix tpyo] Link: http://lkml.kernel.org/r/20190731135306.31524-1-david@redhat.com Signed-off-by: David Hildenbrand Acked-by: Michal Hocko Acked-by: Rafael J. Wysocki Cc: Oscar Salvador Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 14c5cebad510c2875ca525f36605b47058769670 Author: Christoph Hellwig Date: Fri Aug 2 21:49:26 2019 -0700 memremap: move from kernel/ to mm/ memremap.c implements MM functionality for ZONE_DEVICE, so it really should be in the mm/ directory, not the kernel/ one. Link: http://lkml.kernel.org/r/20190722094143.18387-1-hch@lst.de Signed-off-by: Christoph Hellwig Reviewed-by: Anshuman Khandual Acked-by: Dan Williams Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 733d1d1a7745113e2b6a1761300e7e26b6eb6009 Author: Alexander Potapenko Date: Fri Aug 2 21:49:22 2019 -0700 lib/test_meminit.c: use GFP_ATOMIC in RCU critical section kmalloc() shouldn't sleep while in RCU critical section, therefore use GFP_ATOMIC instead of GFP_KERNEL. The bug was spotted by the 0day kernel testing robot. Link: http://lkml.kernel.org/r/20190725121703.210874-1-glider@google.com Fixes: 7e659650cbda ("lib: introduce test_meminit module") Signed-off-by: Alexander Potapenko Reviewed-by: Andrew Morton Reported-by: kernel test robot Cc: Kees Cook Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit cbedfe11347fe418621bd188d58a206beb676218 Author: Qian Cai Date: Fri Aug 2 21:49:19 2019 -0700 asm-generic: fix -Wtype-limits compiler warnings Commit d66acc39c7ce ("bitops: Optimise get_order()") introduced a compilation warning because "rx_frag_size" is an "ushort" while PAGE_SHIFT here is 16. The commit changed the get_order() to be a multi-line macro where compilers insist to check all statements in the macro even when __builtin_constant_p(rx_frag_size) will return false as "rx_frag_size" is a module parameter. In file included from ./arch/powerpc/include/asm/page_64.h:107, from ./arch/powerpc/include/asm/page.h:242, from ./arch/powerpc/include/asm/mmu.h:132, from ./arch/powerpc/include/asm/lppaca.h:47, from ./arch/powerpc/include/asm/paca.h:17, from ./arch/powerpc/include/asm/current.h:13, from ./include/linux/thread_info.h:21, from ./arch/powerpc/include/asm/processor.h:39, from ./include/linux/prefetch.h:15, from drivers/net/ethernet/emulex/benet/be_main.c:14: drivers/net/ethernet/emulex/benet/be_main.c: In function 'be_rx_cqs_create': ./include/asm-generic/getorder.h:54:9: warning: comparison is always true due to limited range of data type [-Wtype-limits] (((n) < (1UL << PAGE_SHIFT)) ? 0 : \ ^ drivers/net/ethernet/emulex/benet/be_main.c:3138:33: note: in expansion of macro 'get_order' adapter->big_page_size = (1 << get_order(rx_frag_size)) * PAGE_SIZE; ^~~~~~~~~ Fix it by moving all of this multi-line macro into a proper function, and killing __get_order() off. [akpm@linux-foundation.org: remove __get_order() altogether] [cai@lca.pw: v2] Link: http://lkml.kernel.org/r/1564000166-31428-1-git-send-email-cai@lca.pw Link: http://lkml.kernel.org/r/1563914986-26502-1-git-send-email-cai@lca.pw Fixes: d66acc39c7ce ("bitops: Optimise get_order()") Signed-off-by: Qian Cai Reviewed-by: Nathan Chancellor Cc: David S. Miller Cc: Arnd Bergmann Cc: David Howells Cc: Jakub Jelinek Cc: Nick Desaulniers Cc: Bill Wendling Cc: James Y Knight Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit b59b1baab789eacdde809135542e3d4f256f6878 Author: Chris Down Date: Fri Aug 2 21:49:15 2019 -0700 cgroup: kselftest: relax fs_spec checks On my laptop most memcg kselftests were being skipped because it claimed cgroup v2 hierarchy wasn't mounted, but this isn't correct. Instead, it seems current systemd HEAD mounts it with the name "cgroup2" instead of "cgroup": % grep cgroup /proc/mounts cgroup2 /sys/fs/cgroup cgroup2 rw,nosuid,nodev,noexec,relatime,nsdelegate 0 0 I can't think of a reason to need to check fs_spec explicitly since it's arbitrary, so we can just rely on fs_vfstype. After these changes, `make TARGETS=cgroup kselftest` actually runs the cgroup v2 tests in more cases. Link: http://lkml.kernel.org/r/20190723210737.GA487@chrisdown.name Signed-off-by: Chris Down Cc: Johannes Weiner Cc: Tejun Heo Cc: Roman Gushchin Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit aa4996b3af19f8535177ba21cb7241348a34fb94 Author: Weitao Hou Date: Fri Aug 2 21:49:12 2019 -0700 mm/memory_hotplug.c: remove unneeded return for void function return is unneeded in void function Link: http://lkml.kernel.org/r/20190723130814.21826-1-houweitaoo@gmail.com Signed-off-by: Weitao Hou Reviewed-by: David Hildenbrand Reviewed-by: Oscar Salvador Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 7b358c6f12dc82364f6d317f8c8f1d794adbc3f5 Author: Ralph Campbell Date: Fri Aug 2 21:49:08 2019 -0700 mm/migrate.c: initialize pud_entry in migrate_vma() When CONFIG_MIGRATE_VMA_HELPER is enabled, migrate_vma() calls migrate_vma_collect() which initializes a struct mm_walk but didn't initialize mm_walk.pud_entry. (Found by code inspection) Use a C structure initialization to make sure it is set to NULL. Link: http://lkml.kernel.org/r/20190719233225.12243-1-rcampbell@nvidia.com Fixes: 8763cb45ab967 ("mm/migrate: new memory migration helper for use with device memory") Signed-off-by: Ralph Campbell Reviewed-by: John Hubbard Reviewed-by: Andrew Morton Cc: "Jérôme Glisse" Cc: Mel Gorman Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 315c69261dd3fa12dbc830d4fa00d1fad98d3b03 Author: Paul Wise Date: Fri Aug 2 21:49:05 2019 -0700 coredump: split pipe command whitespace before expanding template Save the offsets of the start of each argument to avoid having to update pointers to each argument after every corename krealloc and to avoid having to duplicate the memory for the dump command. Executable names containing spaces were previously being expanded from %e or %E and then split in the middle of the filename. This is incorrect behaviour since an argument list can represent arguments with spaces. The splitting could lead to extra arguments being passed to the core dump handler that it might have interpreted as options or ignored completely. Core dump handlers that are not aware of this Linux kernel issue will be using %e or %E without considering that it may be split and so they will be vulnerable to processes with spaces in their names breaking their argument list. If their internals are otherwise well written, such as if they are written in shell but quote arguments, they will work better after this change than before. If they are not well written, then there is a slight chance of breakage depending on the details of the code but they will already be fairly broken by the split filenames. Core dump handlers that are aware of this Linux kernel issue will be placing %e or %E as the last item in their core_pattern and then aggregating all of the remaining arguments into one, separated by spaces. Alternatively they will be obtaining the filename via other methods. Both of these will be compatible with the new arrangement. A side effect from this change is that unknown template types (for example %z) result in an empty argument to the dump handler instead of the argument being dropped. This is a desired change as: It is easier for dump handlers to process empty arguments than dropped ones, especially if they are written in shell or don't pass each template item with a preceding command-line option in order to differentiate between individual template types. Most core_patterns in the wild do not use options so they can confuse different template types (especially numeric ones) if an earlier one gets dropped in old kernels. If the kernel introduces a new template type and a core_pattern uses it, the core dump handler might not expect that the argument can be dropped in old kernels. For example, this can result in security issues when %d is dropped in old kernels. This happened with the corekeeper package in Debian and resulted in the interface between corekeeper and Linux having to be rewritten to use command-line options to differentiate between template types. The core_pattern for most core dump handlers is written by the handler author who would generally not insert unknown template types so this change should be compatible with all the core dump handlers that exist. Link: http://lkml.kernel.org/r/20190528051142.24939-1-pabs3@bonedaddy.net Fixes: 74aadce98605 ("core_pattern: allow passing of arguments to user mode helper when core_pattern is a pipe") Signed-off-by: Paul Wise Reported-by: Jakub Wilk [https://bugs.debian.org/924398] Reported-by: Paul Wise [https://lore.kernel.org/linux-fsdevel/c8b7ecb8508895bf4adb62a748e2ea2c71854597.camel@bonedaddy.net/] Suggested-by: Jakub Wilk Acked-by: Neil Horman Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit ee38d94a0ad89890b770f6c876263cf9fcbfde84 Author: Arnd Bergmann Date: Fri Aug 2 21:49:02 2019 -0700 page flags: prioritize kasan bits over last-cpuid ARM64 randdconfig builds regularly run into a build error, especially when NUMA_BALANCING and SPARSEMEM are enabled but not SPARSEMEM_VMEMMAP: #error "KASAN: not enough bits in page flags for tag" The last-cpuid bits are already contitional on the available space, so the result of the calculation is a bit random on whether they were already left out or not. Adding the kasan tag bits before last-cpuid makes it much more likely to end up with a successful build here, and should be reliable for randconfig at least, as long as that does not randomize NR_CPUS or NODES_SHIFT but uses the defaults. In order for the modified check to not trigger in the x86 vdso32 code where all constants are wrong (building with -m32), enclose all the definitions with an #ifdef. [arnd@arndb.de: build fix] Link: http://lkml.kernel.org/r/CAK8P3a3Mno1SWTcuAOT0Wa9VS15pdU6EfnkxLbDpyS55yO04+g@mail.gmail.com Link: http://lkml.kernel.org/r/20190722115520.3743282-1-arnd@arndb.de Link: https://lore.kernel.org/lkml/20190618095347.3850490-1-arnd@arndb.de/ Fixes: 2813b9c02962 ("kasan, mm, arm64: tag non slab memory allocated via pagealloc") Signed-off-by: Arnd Bergmann Signed-off-by: Arnd Bergmann Reviewed-by: Andrey Konovalov Reviewed-by: Andrey Ryabinin Cc: Andrey Konovalov Cc: Dmitry Vyukov Cc: Will Deacon Cc: Christoph Lameter Cc: Mark Rutland Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit af700eaed0564d5d3963a7a51cb0843629d7fe3d Author: Arnd Bergmann Date: Fri Aug 2 21:48:58 2019 -0700 ubsan: build ubsan.c more conservatively objtool points out several conditions that it does not like, depending on the combination with other configuration options and compiler variants: stack protector: lib/ubsan.o: warning: objtool: __ubsan_handle_type_mismatch()+0xbf: call to __stack_chk_fail() with UACCESS enabled lib/ubsan.o: warning: objtool: __ubsan_handle_type_mismatch_v1()+0xbe: call to __stack_chk_fail() with UACCESS enabled stackleak plugin: lib/ubsan.o: warning: objtool: __ubsan_handle_type_mismatch()+0x4a: call to stackleak_track_stack() with UACCESS enabled lib/ubsan.o: warning: objtool: __ubsan_handle_type_mismatch_v1()+0x4a: call to stackleak_track_stack() with UACCESS enabled kasan: lib/ubsan.o: warning: objtool: __ubsan_handle_type_mismatch()+0x25: call to memcpy() with UACCESS enabled lib/ubsan.o: warning: objtool: __ubsan_handle_type_mismatch_v1()+0x25: call to memcpy() with UACCESS enabled The stackleak and kasan options just need to be disabled for this file as we do for other files already. For the stack protector, we already attempt to disable it, but this fails on clang because the check is mixed with the gcc specific -fno-conserve-stack option. According to Andrey Ryabinin, that option is not even needed, dropping it here fixes the stackprotector issue. Link: http://lkml.kernel.org/r/20190722125139.1335385-1-arnd@arndb.de Link: https://lore.kernel.org/lkml/20190617123109.667090-1-arnd@arndb.de/t/ Link: https://lore.kernel.org/lkml/20190722091050.2188664-1-arnd@arndb.de/t/ Fixes: d08965a27e84 ("x86/uaccess, ubsan: Fix UBSAN vs. SMAP") Signed-off-by: Arnd Bergmann Reviewed-by: Andrey Ryabinin Cc: Josh Poimboeuf Cc: Peter Zijlstra Cc: Arnd Bergmann Cc: Borislav Petkov Cc: Dmitry Vyukov Cc: Thomas Gleixner Cc: Ingo Molnar Cc: Kees Cook Cc: Matthew Wilcox Cc: Ard Biesheuvel Cc: Andy Shevchenko Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit ebb6d35a74ce21ce1673b8f404c1039d5a1e7e2d Author: Arnd Bergmann Date: Fri Aug 2 21:48:54 2019 -0700 kasan: remove clang version check for KASAN_STACK asan-stack mode still uses dangerously large kernel stacks of tens of kilobytes in some drivers, and it does not seem that anyone is working on the clang bug. Turn it off for all clang versions to prevent users from accidentally enabling it once they update to clang-9, and to help automated build testing with clang-9. Link: https://bugs.llvm.org/show_bug.cgi?id=38809 Link: http://lkml.kernel.org/r/20190719200347.2596375-1-arnd@arndb.de Fixes: 6baec880d7a5 ("kasan: turn off asan-stack for clang-8 and earlier") Signed-off-by: Arnd Bergmann Acked-by: Nick Desaulniers Reviewed-by: Mark Brown Reviewed-by: Andrey Ryabinin Cc: Qian Cai Cc: Andrey Konovalov Cc: Vasily Gorbik Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 670105a25608affe01cb0ccdc2a1f4bd2327172b Author: Mel Gorman Date: Fri Aug 2 21:48:51 2019 -0700 mm: compaction: avoid 100% CPU usage during compaction when a task is killed "howaboutsynergy" reported via kernel buzilla number 204165 that compact_zone_order was consuming 100% CPU during a stress test for prolonged periods of time. Specifically the following command, which should exit in 10 seconds, was taking an excessive time to finish while the CPU was pegged at 100%. stress -m 220 --vm-bytes 1000000000 --timeout 10 Tracing indicated a pattern as follows stress-3923 [007] 519.106208: mm_compaction_isolate_migratepages: range=(0x70bb80 ~ 0x70bb80) nr_scanned=0 nr_taken=0 stress-3923 [007] 519.106212: mm_compaction_isolate_migratepages: range=(0x70bb80 ~ 0x70bb80) nr_scanned=0 nr_taken=0 stress-3923 [007] 519.106216: mm_compaction_isolate_migratepages: range=(0x70bb80 ~ 0x70bb80) nr_scanned=0 nr_taken=0 stress-3923 [007] 519.106219: mm_compaction_isolate_migratepages: range=(0x70bb80 ~ 0x70bb80) nr_scanned=0 nr_taken=0 stress-3923 [007] 519.106223: mm_compaction_isolate_migratepages: range=(0x70bb80 ~ 0x70bb80) nr_scanned=0 nr_taken=0 stress-3923 [007] 519.106227: mm_compaction_isolate_migratepages: range=(0x70bb80 ~ 0x70bb80) nr_scanned=0 nr_taken=0 stress-3923 [007] 519.106231: mm_compaction_isolate_migratepages: range=(0x70bb80 ~ 0x70bb80) nr_scanned=0 nr_taken=0 stress-3923 [007] 519.106235: mm_compaction_isolate_migratepages: range=(0x70bb80 ~ 0x70bb80) nr_scanned=0 nr_taken=0 stress-3923 [007] 519.106238: mm_compaction_isolate_migratepages: range=(0x70bb80 ~ 0x70bb80) nr_scanned=0 nr_taken=0 stress-3923 [007] 519.106242: mm_compaction_isolate_migratepages: range=(0x70bb80 ~ 0x70bb80) nr_scanned=0 nr_taken=0 Note that compaction is entered in rapid succession while scanning and isolating nothing. The problem is that when a task that is compacting receives a fatal signal, it retries indefinitely instead of exiting while making no progress as a fatal signal is pending. It's not easy to trigger this condition although enabling zswap helps on the basis that the timing is altered. A very small window has to be hit for the problem to occur (signal delivered while compacting and isolating a PFN for migration that is not aligned to SWAP_CLUSTER_MAX). This was reproduced locally -- 16G single socket system, 8G swap, 30% zswap configured, vm-bytes 22000000000 using Colin Kings stress-ng implementation from github running in a loop until the problem hits). Tracing recorded the problem occurring almost 200K times in a short window. With this patch, the problem hit 4 times but the task existed normally instead of consuming CPU. This problem has existed for some time but it was made worse by commit cf66f0700c8f ("mm, compaction: do not consider a need to reschedule as contention"). Before that commit, if the same condition was hit then locks would be quickly contended and compaction would exit that way. Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=204165 Link: http://lkml.kernel.org/r/20190718085708.GE24383@techsingularity.net Fixes: cf66f0700c8f ("mm, compaction: do not consider a need to reschedule as contention") Signed-off-by: Mel Gorman Reviewed-by: Vlastimil Babka Cc: [5.1+] Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit ebdf4de5642fb6580b0763158b6b4b791c4d6a4d Author: Jan Kara Date: Fri Aug 2 21:48:47 2019 -0700 mm: migrate: fix reference check race between __find_get_block() and migration buffer_migrate_page_norefs() can race with bh users in the following way: CPU1 CPU2 buffer_migrate_page_norefs() buffer_migrate_lock_buffers() checks bh refs spin_unlock(&mapping->private_lock) __find_get_block() spin_lock(&mapping->private_lock) grab bh ref spin_unlock(&mapping->private_lock) move page do bh work This can result in various issues like lost updates to buffers (i.e. metadata corruption) or use after free issues for the old page. This patch closes the race by holding mapping->private_lock while the mapping is being moved to a new page. Ordinarily, a reference can be taken outside of the private_lock using the per-cpu BH LRU but the references are checked and the LRU invalidated if necessary. The private_lock is held once the references are known so the buffer lookup slow path will spin on the private_lock. Between the page lock and private_lock, it should be impossible for other references to be acquired and updates to happen during the migration. A user had reported data corruption issues on a distribution kernel with a similar page migration implementation as mainline. The data corruption could not be reproduced with this patch applied. A small number of migration-intensive tests were run and no performance problems were noted. [mgorman@techsingularity.net: Changelog, removed tracing] Link: http://lkml.kernel.org/r/20190718090238.GF24383@techsingularity.net Fixes: 89cb0888ca14 "mm: migrate: provide buffer_migrate_page_norefs()" Signed-off-by: Jan Kara Signed-off-by: Mel Gorman Cc: [5.0+] Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit fa1e512fac717f34e7c12d7a384c46e90a647392 Author: Yang Shi Date: Fri Aug 2 21:48:44 2019 -0700 mm: vmscan: check if mem cgroup is disabled or not before calling memcg slab shrinker Shakeel Butt reported premature oom on kernel with "cgroup_disable=memory" since mem_cgroup_is_root() returns false even though memcg is actually NULL. The drop_caches is also broken. It is because commit aeed1d325d42 ("mm/vmscan.c: generalize shrink_slab() calls in shrink_node()") removed the !memcg check before !mem_cgroup_is_root(). And, surprisingly root memcg is allocated even though memory cgroup is disabled by kernel boot parameter. Add mem_cgroup_disabled() check to make reclaimer work as expected. Link: http://lkml.kernel.org/r/1563385526-20805-1-git-send-email-yang.shi@linux.alibaba.com Fixes: aeed1d325d42 ("mm/vmscan.c: generalize shrink_slab() calls in shrink_node()") Signed-off-by: Yang Shi Reported-by: Shakeel Butt Reviewed-by: Shakeel Butt Reviewed-by: Kirill Tkhai Acked-by: Michal Hocko Cc: Jan Hadrava Cc: Vladimir Davydov Cc: Johannes Weiner Cc: Roman Gushchin Cc: Hugh Dickins Cc: Qian Cai Cc: Kirill A. Shutemov Cc: [4.19+] Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 7bc36e3ce91471b6377c8eadc0a2f220a2280083 Author: YueHaibing Date: Fri Aug 2 21:48:40 2019 -0700 ocfs2: remove set but not used variable 'last_hash' Fixes gcc '-Wunused-but-set-variable' warning: fs/ocfs2/xattr.c: In function ocfs2_xattr_bucket_find: fs/ocfs2/xattr.c:3828:6: warning: variable last_hash set but not used [-Wunused-but-set-variable] It's never used and can be removed. Link: http://lkml.kernel.org/r/20190716132110.34836-1-yuehaibing@huawei.com Signed-off-by: YueHaibing Acked-by: Joseph Qi Cc: Mark Fasheh Cc: Joel Becker Cc: Junxiao Bi Cc: Changwei Ge Cc: Gang He Cc: Jun Piao Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit df9576def004d2cd5beedc00cb6e8901427634b9 Author: Yang Shi Date: Fri Aug 2 21:48:37 2019 -0700 Revert "kmemleak: allow to coexist with fault injection" When running ltp's oom test with kmemleak enabled, the below warning was triggerred since kernel detects __GFP_NOFAIL & ~__GFP_DIRECT_RECLAIM is passed in: WARNING: CPU: 105 PID: 2138 at mm/page_alloc.c:4608 __alloc_pages_nodemask+0x1c31/0x1d50 Modules linked in: loop dax_pmem dax_pmem_core ip_tables x_tables xfs virtio_net net_failover virtio_blk failover ata_generic virtio_pci virtio_ring virtio libata CPU: 105 PID: 2138 Comm: oom01 Not tainted 5.2.0-next-20190710+ #7 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.10.2-0-g5f4c7b1-prebuilt.qemu-project.org 04/01/2014 RIP: 0010:__alloc_pages_nodemask+0x1c31/0x1d50 ... kmemleak_alloc+0x4e/0xb0 kmem_cache_alloc+0x2a7/0x3e0 mempool_alloc_slab+0x2d/0x40 mempool_alloc+0x118/0x2b0 bio_alloc_bioset+0x19d/0x350 get_swap_bio+0x80/0x230 __swap_writepage+0x5ff/0xb20 The mempool_alloc_slab() clears __GFP_DIRECT_RECLAIM, however kmemleak has __GFP_NOFAIL set all the time due to d9570ee3bd1d4f2 ("kmemleak: allow to coexist with fault injection"). But, it doesn't make any sense to have __GFP_NOFAIL and ~__GFP_DIRECT_RECLAIM specified at the same time. According to the discussion on the mailing list, the commit should be reverted for short term solution. Catalin Marinas would follow up with a better solution for longer term. The failure rate of kmemleak metadata allocation may increase in some circumstances, but this should be expected side effect. Link: http://lkml.kernel.org/r/1563299431-111710-1-git-send-email-yang.shi@linux.alibaba.com Fixes: d9570ee3bd1d4f2 ("kmemleak: allow to coexist with fault injection") Signed-off-by: Yang Shi Suggested-by: Catalin Marinas Acked-by: Michal Hocko Cc: Dmitry Vyukov Cc: David Rientjes Cc: Matthew Wilcox Cc: Qian Cai Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 68d8681e97bd1c90259f341c1695af05002070ef Author: Mauro Carvalho Chehab Date: Fri Aug 2 21:48:33 2019 -0700 kernel/signal.c: fix a kernel-doc markup The kernel-doc parser doesn't handle expressions with %foo*. Instead, when an asterisk should be part of a constant, it uses an alternative notation: `foo*`. Link: http://lkml.kernel.org/r/7f18c2e0b5e39e6b7eb55ddeb043b8b260b49f2d.1563361575.git.mchehab+samsung@kernel.org Signed-off-by: Mauro Carvalho Chehab Cc: Deepa Dinamani Cc: Jonathan Corbet Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 9b562437d388582f5463a4c3f60ee97a2d4d8d58 Author: Chuhong Yuan Date: Wed Jul 31 10:01:40 2019 +0800 drm/modes: Fix unterminated strncpy strncpy(dest, src, strlen(src)) leads to unterminated dest, which is dangerous. Fix it by using strscpy. Fixes: 3aeeb13d8996 ("drm/modes: Support modes names on the command line") Signed-off-by: Chuhong Yuan Signed-off-by: Maxime Ripard Link: https://patchwork.freedesktop.org/patch/msgid/20190731020140.3529-1-hslester96@gmail.com commit b887011803582c8539cd9f963035eef91373a169 Author: Evan Quan Date: Fri Aug 2 16:38:32 2019 +0800 drm/amd/powerplay: correct navi10 vcn powergate vcn dpm on is a prerequisite for vcn power gate control. Signed-off-by: Evan Quan Reviewed-by: Kenneth Feng Signed-off-by: Alex Deucher commit 8ecd998debe1280ef8aab45049e69ac3d2116398 Author: Kevin Wang Date: Fri Aug 2 12:01:00 2019 +0800 drm/amd/powerplay: honor hw limit on fetching metrics data for navi10 too frequently to update mertrics table will cause smu internal error. Signed-off-by: Kevin Wang Reviewed-by: Evan Quan Signed-off-by: Alex Deucher commit 4853fc32306faaef03d409c38921c401379da2ea Author: Matt Coffin Date: Wed Jul 31 14:14:35 2019 -0600 drm/amd/powerplay: Allow changing of fan_control in smu_v11_0 [Why] Before this change, the fan control state on smu_v11 was not able to be changed because the capability check for checking if the fan control capability existed was inverted. [How] The capability check for fan control in smu_v11_0_auto_fan_control was inverted, to correctly check for the absence, instead of presence of fan control capabilities. Reviewed-by: Evan Quan Signed-off-by: Matt Coffin Signed-off-by: Alex Deucher commit 0e31225f99e077d0b8c7f8577aab39e766e2477b Merge: 4f1a6ef1df6f 9c8c9c7cdb4c Author: Linus Torvalds Date: Fri Aug 2 18:53:51 2019 -0700 Merge tag 'drm-fixes-2019-08-02-1' of git://anongit.freedesktop.org/drm/drm Pull more drm fixes from Daniel Vetter: "Dave sends his pull, everyone realizes they've been asleep at the wheel and hits send on their own pulls :-/ Normally I'd just ignore these all because w/e for me and Dave. But this time around the latecomers also included drm-intel-fixes, which failed to send out a -fixes pull thus far for this release (screwed up vacation coverage, despite that 2/3 maintainers were around ... they all look appropriately guilty), and that really is overdue to get landed. And since I had to do a pull request anyway I pulled the other two late ones too. intel fixes (didn't have any ever since the main merge window pull): - gvt fixes (2 cc: stable) - fix gpu reset vs mm-shrinker vs wakeup fun (needed a few patches) - two gem locking fixes (one cc: stable) - pile of misc fixes all over with minor impact, 6 cc: stable, others from this window exynos: - misc minor fixes misc: - some build/Kconfig fixes - regression fix for vm scalability perf test which seems to mostly exercise dmesg/console logging ... - the vgem cache flush fix for arm64 broke the world on x86, so that's reverted again * tag 'drm-fixes-2019-08-02-1' of git://anongit.freedesktop.org/drm/drm: (42 commits) Revert "drm/vgem: fix cache synchronization on arm/arm64" drm/exynos: fix missing decrement of retry counter drm/exynos: add CONFIG_MMU dependency drm/exynos: remove redundant assignment to pointer 'node' drm/exynos: using dev_get_drvdata directly drm/bochs: Use shadow buffer for bochs framebuffer console drm/fb-helper: Instanciate shadow FB if configured in device's mode_config drm/fb-helper: Map DRM client buffer only when required drm/client: Support unmapping of DRM client buffers drm/i915: Only recover active engines drm/i915: Add a wakeref getter for iff the wakeref is already active drm/i915: Lift intel_engines_resume() to callers drm/vgem: fix cache synchronization on arm/arm64 drm/i810: Use CONFIG_PREEMPTION drm/bridge: tc358764: Fix build error drm/bridge: lvds-encoder: Fix build error while CONFIG_DRM_KMS_HELPER=m drm/i915/gvt: Adding ppgtt to GVT GEM context after shadow pdps settled. drm/i915/gvt: grab runtime pm first for forcewake use drm/i915/gvt: fix incorrect cache entry for guest page mapping drm/i915/gvt: Checking workload's gma earlier ... commit 4f1a6ef1df6f952fc9f22f34d51a6c3d3c4fbe23 Merge: dcb8cfbd8fe9 45385237f65a Author: Linus Torvalds Date: Fri Aug 2 18:40:49 2019 -0700 Merge tag 'selinux-pr-20190801' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux Pull selinux fix from Paul Moore: "One more small fix for a potential memory leak in an error path" * tag 'selinux-pr-20190801' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux: selinux: fix memory leak in policydb_init() commit 59c0b47a1e11b5e81ab1dfd13579c9fbdb02f0b4 Author: Kevin Lo Date: Thu Aug 1 11:29:38 2019 +0800 r8152: fix typo in register name It is likely that PAL_BDC_CR should be PLA_BDC_CR. Signed-off-by: Kevin Lo Acked-by: Hayes Wang Signed-off-by: David S. Miller commit aa6b1956158f1afc52761137620d4b3f8a058d24 Author: Heiner Kallweit Date: Wed Jul 31 23:05:10 2019 +0200 net: phy: fix race in genphy_update_link In phy_start_aneg() autoneg is started, and immediately after that link and autoneg status are read. As reported in [0] it can happen that at time of this read the PHY has reset the "aneg complete" bit but not yet the "link up" bit, what can result in a false link-up detection. To fix this don't report link as up if we're in aneg mode and PHY doesn't signal "aneg complete". [0] https://marc.info/?t=156413509900003&r=1&w=2 Fixes: 4950c2ba49cc ("net: phy: fix autoneg mismatch case in genphy_read_status") Reported-by: liuyonglong Tested-by: liuyonglong Signed-off-by: Heiner Kallweit Signed-off-by: David S. Miller commit 2802d2cf24b1ca7ea4c54dde266ded6a16020eb5 Author: YueHaibing Date: Thu Aug 1 09:24:19 2019 +0800 enetc: Select PHYLIB while CONFIG_FSL_ENETC_VF is set Like FSL_ENETC, when CONFIG_FSL_ENETC_VF is set, we should select PHYLIB, otherwise building still fails: drivers/net/ethernet/freescale/enetc/enetc.o: In function `enetc_open': enetc.c:(.text+0x2744): undefined reference to `phy_start' enetc.c:(.text+0x282c): undefined reference to `phy_disconnect' drivers/net/ethernet/freescale/enetc/enetc.o: In function `enetc_close': enetc.c:(.text+0x28f8): undefined reference to `phy_stop' enetc.c:(.text+0x2904): undefined reference to `phy_disconnect' drivers/net/ethernet/freescale/enetc/enetc_ethtool.o:(.rodata+0x3f8): undefined reference to `phy_ethtool_get_link_ksettings' drivers/net/ethernet/freescale/enetc/enetc_ethtool.o:(.rodata+0x400): undefined reference to `phy_ethtool_set_link_ksettings' Reported-by: Hulk Robot Fixes: d4fd0404c1c9 ("enetc: Introduce basic PF and VF ENETC ethernet drivers") Signed-off-by: YueHaibing Signed-off-by: David S. Miller commit 3690c8c9a8edff0db077a38783112d8fe12a7dd2 Author: Wang Xiayang Date: Wed Jul 31 16:15:42 2019 +0800 net/ethernet/qlogic/qed: force the string buffer NULL-terminated strncpy() does not ensure NULL-termination when the input string size equals to the destination buffer size 30. The output string is passed to qed_int_deassertion_aeu_bit() which calls DP_INFO() and relies NULL-termination. Use strlcpy instead. The other conditional branch above strncpy() needs no fix as snprintf() ensures NULL-termination. This issue is identified by a Coccinelle script. Signed-off-by: Wang Xiayang Signed-off-by: David S. Miller commit ea443e5e98b5b74e317ef3d26bcaea54931ccdee Author: Gustavo A. R. Silva Date: Tue Jul 30 22:21:41 2019 -0500 atm: iphase: Fix Spectre v1 vulnerability board is controlled by user-space, hence leading to a potential exploitation of the Spectre variant 1 vulnerability. This issue was detected with the help of Smatch: drivers/atm/iphase.c:2765 ia_ioctl() warn: potential spectre issue 'ia_dev' [r] (local cap) drivers/atm/iphase.c:2774 ia_ioctl() warn: possible spectre second half. 'iadev' drivers/atm/iphase.c:2782 ia_ioctl() warn: possible spectre second half. 'iadev' drivers/atm/iphase.c:2816 ia_ioctl() warn: possible spectre second half. 'iadev' drivers/atm/iphase.c:2823 ia_ioctl() warn: possible spectre second half. 'iadev' drivers/atm/iphase.c:2830 ia_ioctl() warn: potential spectre issue '_ia_dev' [r] (local cap) drivers/atm/iphase.c:2845 ia_ioctl() warn: possible spectre second half. 'iadev' drivers/atm/iphase.c:2856 ia_ioctl() warn: possible spectre second half. 'iadev' Fix this by sanitizing board before using it to index ia_dev and _ia_dev Notice that given that speculation windows are large, the policy is to kill the speculation on the first load and not worry if it can be completed with a dependent load/store [1]. [1] https://lore.kernel.org/lkml/20180423164740.GY17484@dhcp22.suse.cz/ Signed-off-by: Gustavo A. R. Silva Signed-off-by: David S. Miller commit 685703b497bacea8765bb409d6b73455b73c540e Author: Dexuan Cui Date: Wed Jul 31 01:25:45 2019 +0000 hv_sock: Fix hang when a connection is closed There is a race condition for an established connection that is being closed by the guest: the refcnt is 4 at the end of hvs_release() (Note: here the 'remove_sock' is false): 1 for the initial value; 1 for the sk being in the bound list; 1 for the sk being in the connected list; 1 for the delayed close_work. After hvs_release() finishes, __vsock_release() -> sock_put(sk) *may* decrease the refcnt to 3. Concurrently, hvs_close_connection() runs in another thread: calls vsock_remove_sock() to decrease the refcnt by 2; call sock_put() to decrease the refcnt to 0, and free the sk; next, the "release_sock(sk)" may hang due to use-after-free. In the above, after hvs_release() finishes, if hvs_close_connection() runs faster than "__vsock_release() -> sock_put(sk)", then there is not any issue, because at the beginning of hvs_close_connection(), the refcnt is still 4. The issue can be resolved if an extra reference is taken when the connection is established. Fixes: a9eeb998c28d ("hv_sock: Add support for delayed close") Signed-off-by: Dexuan Cui Reviewed-by: Sunil Muthuswamy Signed-off-by: David S. Miller commit 2b372a9685a757a1d3ab30615ef42b2db7c45298 Author: Jean Delvare Date: Wed Jul 31 10:07:06 2019 +0200 mtd: hyperbus: Add hardware dependency to AM654 driver The hbmc-am654 driver is for the TI AM654, which is an ARM64 SoC, so don't propose this driver on other architectures unless build-testing. Fixes: b07079f1642c ("mtd: hyperbus: Add driver for TI's HyperBus memory controller") Signed-off-by: Jean Delvare Cc: Vignesh Raghavendra Cc: Miquel Raynal Signed-off-by: Miquel Raynal commit 2d75989d2d92b71f3f34f2704ac109897a87319f Author: Vignesh Raghavendra Date: Fri Jul 19 13:59:12 2019 +0530 mtd: hyperbus: Kconfig: Fix HBMC_AM654 dependencies On x86_64, when CONFIG_OF is not disabled: WARNING: unmet direct dependencies detected for MUX_MMIO Depends on [n]: MULTIPLEXER [=y] && (OF [=n] || COMPILE_TEST [=n]) Selected by [y]: - HBMC_AM654 [=y] && MTD [=y] && MTD_HYPERBUS [=y] due to config HBMC_AM654 tristate "HyperBus controller driver for AM65x SoC" select MULTIPLEXER select MUX_MMIO Fix this by making HBMC_AM654 imply MUX_MMIO instead of select so that dependencies are taken care of. MUX_MMIO is optional for functioning of driver. Fixes: b07079f1642c ("mtd: hyperbus: Add driver for TI's HyperBus memory controller") Reported-by: Randy Dunlap Signed-off-by: Vignesh Raghavendra Acked-by: Randy Dunlap # build-tested Signed-off-by: Miquel Raynal commit 8493b2a06fc5b77ef5c579dc32b12761f7b7a84c Author: Marco Felsch Date: Tue Jul 30 15:44:07 2019 +0200 mtd: rawnand: micron: handle on-die "ECC-off" devices correctly Some devices are not supposed to support on-die ECC but experience shows that internal ECC machinery can actually be enabled through the "SET FEATURE (EFh)" command, even if a read of the "READ ID Parameter Tables" returns that it is not. Currently, the driver checks the "READ ID Parameter" field directly after having enabled the feature. If the check fails it returns immediately but leaves the ECC on. When using buggy chips like MT29F2G08ABAGA and MT29F2G08ABBGA, all future read/program cycles will go through the on-die ECC, confusing the host controller which is supposed to be the one handling correction. To address this in a common way we need to turn off the on-die ECC directly after reading the "READ ID Parameter" and before checking the "ECC status". Cc: stable@vger.kernel.org Fixes: dbc44edbf833 ("mtd: rawnand: micron: Fix on-die ECC detection logic") Signed-off-by: Marco Felsch Reviewed-by: Boris Brezillon Signed-off-by: Miquel Raynal commit dcb8cfbd8fe9e62c7d64e82288d3ffe2502b7371 Merge: a507f25d1c20 b877ac9815a8 Author: Linus Torvalds Date: Fri Aug 2 15:26:48 2019 -0700 Merge tag 'for-linus-5.3a-rc3-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip Pull xen fixes from Juergen Gross: - a small cleanup - a fix for a build error on ARM with some configs - a fix of a patch for the Xen gntdev driver - three patches for fixing a potential problem in the swiotlb-xen driver which Konrad was fine with me carrying them through the Xen tree * tag 'for-linus-5.3a-rc3-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip: xen/swiotlb: remember having called xen_create_contiguous_region() xen/swiotlb: simplify range_straddles_page_boundary() xen/swiotlb: fix condition for calling xen_destroy_contiguous_region() xen: avoid link error on ARM xen/gntdev.c: Replace vm_map_pages() with vm_map_pages_zero() xen/pciback: remove set but not used variable 'old_state' commit a507f25d1c2048c136f6834f10966510b62af987 Merge: 9100fc5ae83e d8bb6718c4db Author: Linus Torvalds Date: Fri Aug 2 15:23:27 2019 -0700 Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux Pull arm64 fixes from Catalin Marinas: - Update the compat layer to allow single-byte watchpoints on all addresses (similar to the native support) - arm_pmu: fix the restoration of the counters on the CPU_PM_ENTER_FAILED path - Fix build regression with vDSO and Makefile not stripping CROSS_COMPILE_COMPAT - Fix the CTR_EL0 (cache type register) sanitisation on heterogeneous machines (e.g. big.LITTLE) - Fix the interrupt controller priority mask value when pseudo-NMIs are enabled - arm64 kprobes fixes: recovering of the PSTATE.D flag in the single-step exception handler, NOKPROBE annotations for unwind_frame() and walk_stackframe(), remove unneeded rcu_read_lock/unlock from debug handlers - Several gcc fall-through warnings - Unused variable warnings * tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux: arm64: Make debug exception handlers visible from RCU arm64: kprobes: Recover pstate.D in single-step exception handler arm64/mm: fix variable 'tag' set but not used arm64/mm: fix variable 'pud' set but not used arm64: Remove unneeded rcu_read_lock from debug handlers arm64: unwind: Prohibit probing on return_address() arm64: Lower priority mask for GIC_PRIO_IRQON arm64/efi: fix variable 'si' set but not used arm64: cpufeature: Fix feature comparison for CTR_EL0.{CWG,ERG} arm64: vdso: Fix Makefile regression arm64: module: Mark expected switch fall-through arm64: smp: Mark expected switch fall-through arm64: hw_breakpoint: Fix warnings about implicit fallthrough drivers/perf: arm_pmu: Fix failure path in PM notifier arm64: compat: Allow single-byte watchpoints on all addresses commit 9100fc5ae83e64d99fd3300104893ef0e0b0aadb Merge: 4dd68199f3ed f2c5ed0dd500 Author: Linus Torvalds Date: Fri Aug 2 15:18:51 2019 -0700 Merge branch 'parisc-5.3-4' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux Pull parisc fixes from Helge Deller: "A few small fixes for the parisc architecture: - Fix fall-through warnings in parisc math emu code - Fix vmlinuz linking failure with debug-enabled kernels - Fix a race condition in kernel live-patching code - Add missing archclean Makefile target & defconfig adjustments" * 'parisc-5.3-4' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux: parisc: Add archclean Makefile target parisc: Strip debug info from kernel before creating compressed vmlinuz parisc: Fix build of compressed kernel even with debug enabled parisc: fix race condition in patching code parisc: rename default_defconfig to defconfig parisc: Fix fall-through warnings in fpudispatch.c parisc: Mark expected switch fall-throughs in fault.c commit 4dd68199f3ed7ee62f94869a1d7b29749e3696fb Merge: 6e6d05360b80 3cdd98606750 Author: Linus Torvalds Date: Fri Aug 2 15:13:27 2019 -0700 Merge tag 's390-5.3-4' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux Pull s390 updates from Vasily Gorbik: - Default configs updates - Minor qdio cleanup - Sparse warnings fixes - Implicit-fallthrough warnings fixes * tag 's390-5.3-4' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux: s390/zcrypt: adjust switch fall through comments for -Wimplicit-fallthrough vfio-ccw: make vfio_ccw_async_region_ops static s390/3215: add switch fall through comment for -Wimplicit-fallthrough s390/tape: add fallthrough annotations s390/mm: add fallthrough annotations s390/mm: make gmap_test_and_clear_dirty_pmd static s390/kexec: add missing include to machine_kexec_reloc.c s390/perf: make cf_diag_csd static s390/lib: add missing include s390/boot: add missing declarations and includes s390: update configs s390: clean up qdio.h commit 6e6d05360b80f196ed07061327f03346b204abea Merge: 10e5ddd71fb3 e82f04ec6ba9 Author: Linus Torvalds Date: Fri Aug 2 14:46:33 2019 -0700 Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull SCSI fixes from James Bottomley: "Seven fixes to four drivers with no core changes. The mpt3sas one is theoretical until we get a CPU that goes up to 64 bits physical, the qla2xxx one fixes an oops in a driver initialization error leg and the others are mostly cosmetic" [ The fcoe patches may be worth highlighting - they may be "just" cleanups, but they simplify and fix the odd fc_rport_priv structure handling rules so that the new gcc-9 warnings about memset crossing structure boundaries are gone. The old code was hard for humans to understand too, and really confused the compiler sanity checks - Linus ] * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: scsi: qla2xxx: Fix possible fcport null-pointer dereferences scsi: mpt3sas: Use 63-bit DMA addressing on SAS35 HBA scsi: hpsa: remove printing internal cdb on tag collision scsi: hpsa: correct scsi command status issue after reset scsi: fcoe: pass in fcoe_rport structure instead of fc_rport_priv scsi: fcoe: Embed fc_rport_priv in fcoe_rport structure scsi: libfc: Whitespace cleanup in libfc.h commit 10e5ddd71fb35cfa4eb86a980b6951d4fe9f68a9 Merge: b2c742373d19 41995342b40c Author: Linus Torvalds Date: Fri Aug 2 14:31:26 2019 -0700 Merge tag 'for-linus-20190802' of git://git.kernel.dk/linux-block Pull block fixes from Jens Axboe: "Here's a small collection of fixes that should go into this series. This contains: - io_uring potential use-after-free fix (Jackie) - loop regression fix (Jan) - O_DIRECT fragmented bio regression fix (Damien) - Mark Denis as the new floppy maintainer (Denis) - ataflop switch fall-through annotation (Gustavo) - libata zpodd overflow fix (Kees) - libata ahci deferred probe fix (Miquel) - nbd invalidation BUG_ON() fix (Munehisa) - dasd endless loop fix (Stefan)" * tag 'for-linus-20190802' of git://git.kernel.dk/linux-block: s390/dasd: fix endless loop after read unit address configuration block: Fix __blkdev_direct_IO() for bio fragments MAINTAINERS: floppy: take over maintainership nbd: replace kill_bdev() with __invalidate_device() again ata: libahci: do not complain in case of deferred probe io_uring: fix KASAN use after free in io_sq_wq_submit_work loop: Fix mount(2) failure due to race with LOOP_SET_FD libata: zpodd: Fix small read overflow in zpodd_get_mech_type() ataflop: Mark expected switch fall-through commit b2c742373d19b356b112d9f3ca4e9377c6f9708d Merge: b07042ca32ff 9c50a98f55f4 Author: Linus Torvalds Date: Fri Aug 2 14:28:40 2019 -0700 Merge tag 'for-5.3/dm-fixes-1' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm Pull device mapper fixes from Mike Snitzer: "Fix NULL pointer and various whitespace issues with DM's recent DAX code changes from commit in 5.3 merge" * tag 'for-5.3/dm-fixes-1' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm: dm table: fix various whitespace issues with recent DAX code dm table: fix dax_dev NULL dereference in device_synchronous() commit b07042ca32ffca69b4e3c3b938bb89ab8aa18035 Merge: d38c3fa6f959 020fb3bebc22 Author: Linus Torvalds Date: Fri Aug 2 14:23:24 2019 -0700 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma Pull rdma fixes from Doug Ledford: "Here's our second -rc pull request. Nothing particularly special in this one. The client removal deadlock fix is kindy tricky, but we had multiple eyes on it and no one could find a fault in it. A couple Spectre V1 fixes too. Otherwise, all just normal -rc fodder: - A couple Spectre V1 fixes (umad, hfi1) - Fix a tricky deadlock in the rdma core code with refcounting instead of locks (client removal patches) - Build errors (hns) - Fix a scheduling while atomic issue (mlx5) - Use after free fix (mad) - Fix error path return code (hns) - Null deref fix (siw_crypto_hash) - A few other misc. minor fixes" * tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma: RDMA/hns: Fix error return code in hns_roce_v1_rsv_lp_qp() RDMA/mlx5: Release locks during notifier unregister IB/hfi1: Fix Spectre v1 vulnerability IB/mad: Fix use-after-free in ib mad completion handling RDMA/restrack: Track driver QP types in resource tracker IB/mlx5: Fix MR registration flow to use UMR properly RDMA/devices: Remove the lock around remove_client_context RDMA/devices: Do not deadlock during client removal IB/core: Add mitigation for Spectre V1 Do not dereference 'siw_crypto_shash' before checking RDMA/qedr: Fix the hca_type and hca_rev returned in device attributes RDMA/hns: Fix build error commit d38c3fa6f959b8b5b167f120d70d66418714dbe4 Merge: 97b00aff2c45 a6d155d2e363 Author: Linus Torvalds Date: Fri Aug 2 14:19:41 2019 -0700 Merge tag 'for-5.3-rc2-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux Pull btrfs fixes from David Sterba: - tiny race window during 2 transactions aborting at the same time can accidentally lead to a commit - regression fix, possible deadlock during fiemap - fix for an old bug when incremental send can fail on a file that has been deduplicated in a special way * tag 'for-5.3-rc2-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux: Btrfs: fix deadlock between fiemap and transaction commits Btrfs: fix race leading to fs corruption after transaction abort Btrfs: fix incremental send failure after deduplication commit 30c21734d853dae99d05a5295a59b7e26ccd5135 Author: Vijendar Mukunda Date: Fri Aug 2 19:21:24 2019 +0530 ASoC: amd: acp3x: use dma address for acp3x dma driver We shouldn't assume CPU physical address we get from page_to_phys() is same as DMA address we get from dma_alloc_coherent(). On x86_64, we won't run into any problem with the assumption when dma_ops is nommu_dma_ops. However, DMA address is IOVA when IOMMU is enabled. And it's most likely different from CPU physical address when AMD IOMMU is not in passthrough mode. This patch fixes page faults when IOMMU is enabled. Signed-off-by: Vijendar Mukunda Link: https://lore.kernel.org/r/1564753899-17124-2-git-send-email-Vijendar.Mukunda@amd.com Signed-off-by: Mark Brown commit 88639051017fb61a414b636dd0fc490da2b62b64 Author: Vijendar Mukunda Date: Fri Aug 2 19:21:23 2019 +0530 ASoC: amd: acp3x: use dma_ops of parent device for acp3x dma driver AMD platform device acp3x_rv_i2s created by parent PCI device driver. Pass struct device of the parent to snd_pcm_lib_preallocate_pages() so dma_alloc_coherent() can use correct dma_ops. Otherwise, it will use default dma_ops which is nommu_dma_ops on x86_64 even when IOMMU is enabled and set to non passthrough mode. Signed-off-by: Vijendar Mukunda Link: https://lore.kernel.org/r/1564753899-17124-1-git-send-email-Vijendar.Mukunda@amd.com Signed-off-by: Mark Brown commit 88d02c9ba2e83fc22d37ccb1f11c62ea6fc9ae50 Author: Guenter Roeck Date: Fri Aug 2 09:03:42 2019 -0700 usb: typec: tcpm: Ignore unsupported/unknown alternate mode requests TCPM may receive PD messages associated with unknown or unsupported alternate modes. If that happens, calls to typec_match_altmode() will return NULL. The tcpm code does not currently take this into account. This results in crashes. Unable to handle kernel NULL pointer dereference at virtual address 000001f0 pgd = 41dad9a1 [000001f0] *pgd=00000000 Internal error: Oops: 5 [#1] THUMB2 Modules linked in: tcpci tcpm CPU: 0 PID: 2338 Comm: kworker/u2:0 Not tainted 5.1.18-sama5-armv7-r2 #6 Hardware name: Atmel SAMA5 Workqueue: 2-0050 tcpm_pd_rx_handler [tcpm] PC is at typec_altmode_attention+0x0/0x14 LR is at tcpm_pd_rx_handler+0xa3b/0xda0 [tcpm] ... [] (typec_altmode_attention) from [] (tcpm_pd_rx_handler+0xa3b/0xda0 [tcpm]) [] (tcpm_pd_rx_handler [tcpm]) from [] (process_one_work+0x123/0x2a8) [] (process_one_work) from [] (worker_thread+0xbd/0x3b0) [] (worker_thread) from [] (kthread+0xcf/0xf4) [] (kthread) from [] (ret_from_fork+0x11/0x38) Ignore PD messages if the associated alternate mode is not supported. Fixes: e9576fe8e605c ("usb: typec: tcpm: Support for Alternate Modes") Cc: stable Reported-by: Douglas Gilbert Cc: Douglas Gilbert Acked-by: Heikki Krogerus Tested-by: Douglas Gilbert Signed-off-by: Guenter Roeck Link: https://lore.kernel.org/r/1564761822-13984-1-git-send-email-linux@roeck-us.net Signed-off-by: Greg Kroah-Hartman commit cb53c517285f8d2548d11422173ca8ec7b9c8f44 Author: Mathias Nyman Date: Fri Aug 2 18:00:44 2019 +0300 xhci: Fix NULL pointer dereference at endpoint zero reset. Usb core will reset the default control endpoint "ep0" before resetting a device. if the endpoint has a valid pointer back to the usb device then the xhci driver reset callback will try to clear the toggle for the endpoint. ep0 didn't use to have this pointer set as ep0 was always allocated by default together with a xhci slot for the usb device. Other endpoints got their usb device pointer set in xhci_add_endpoint() This changed with commit ef513be0a905 ("usb: xhci: Add Clear_TT_Buffer") which sets the pointer for any endpoint on a FS/LS device behind a HS hub that halts, including ep0. If xHC controller needs to be reset at resume, then all the xhci slots will be lost. Slots will be reenabled and reallocated at device reset, but unlike other endpoints the ep0 is reset before device reset, while the xhci slot may still be invalid, causing NULL pointer dereference. Fix it by checking that the endpoint has both a usb device pointer and valid xhci slot before trying to clear the toggle. This issue was not seen earlier as ep0 didn't use to have a valid usb device pointer, and other endpoints were only reset after device reset when xhci slots were properly reenabled. Reported-by: Bob Gleitsmann Reported-by: Enric Balletbo Serra Fixes: ef513be0a905 ("usb: xhci: Add Clear_TT_Buffer") Signed-off-by: Mathias Nyman Tested-by: Enric Balletbo i Serra Link: https://lore.kernel.org/r/1564758044-24748-1-git-send-email-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit 783bda5e41acc71f98336e1a402c180f9748e5dc Author: Yoshihiro Shimoda Date: Fri Aug 2 17:33:35 2019 +0900 usb: host: xhci-rcar: Fix timeout in xhci_suspend() When a USB device is connected to the host controller and the system enters suspend, the following error happens in xhci_suspend(): xhci-hcd ee000000.usb: WARN: xHC CMD_RUN timeout Since the firmware/internal CPU control the USBSTS.STS_HALT and the process speed is down when the roothub port enters U3, long delay for the handshake of STS_HALT is neeed in xhci_suspend(). So, this patch adds to set the XHCI_SLOW_SUSPEND. Fixes: 435cc1138ec9 ("usb: host: xhci-plat: set resume_quirk() for R-Car controllers") Cc: # v4.12+ Signed-off-by: Yoshihiro Shimoda Link: https://lore.kernel.org/r/1564734815-17964-1-git-send-email-yoshihiro.shimoda.uh@renesas.com Signed-off-by: Greg Kroah-Hartman commit 97b00aff2c45069bb8ea88acac664a17d63f77f9 Merge: 755f1fed27f4 706cb5492c8c Author: Linus Torvalds Date: Fri Aug 2 09:02:58 2019 -0700 Merge tag 'gfs2-v5.3-rc2.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/gfs2/linux-gfs2 Pull gfs2 fix from Andreas Gruenbacher: "Fix gfs2 cluster coherency bug" * tag 'gfs2-v5.3-rc2.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/gfs2/linux-gfs2: gfs2: Inode dirtying fix commit 755f1fed27f4b1d57dd8b2856c06086636cd7284 Merge: 75cdf416b322 42787ed79638 Author: Linus Torvalds Date: Fri Aug 2 08:55:28 2019 -0700 Merge tag 'pm-5.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull power management fix from Rafael Wysocki: "Fix recent regression affecting ACPI device power management" * tag 'pm-5.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: ACPI: PM: Fix regression in acpi_device_set_power() commit 75cdf416b32293dfc348d4c06fcc775ba4dacff6 Merge: f26dbb2302e9 5d78e1c2b7f4 Author: Linus Torvalds Date: Fri Aug 2 08:53:34 2019 -0700 Merge tag 'sound-5.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: - A further fix for syzcaller issues with USB-audio, addressing NULL dereference that was introduced by the recent fix - Avoid a long delay at boot with HD-audio when i915 module was built but not installed, found on some Debian systems - A fix of small race window at PCM draining * tag 'sound-5.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: ALSA: usb-audio: Fix gpf in snd_usb_pipe_sanity_check ALSA: pcm: fix lost wakeup event scenarios in snd_pcm_drain ALSA: hda: Fix 1-minute detection delay when i915 module is not available commit f26dbb2302e94c0964f52b9193166430cc8b922a Merge: 42d21900b39c f8981e0309e9 Author: Linus Torvalds Date: Fri Aug 2 08:50:37 2019 -0700 Merge tag 'drm-fixes-2019-08-02' of git://anongit.freedesktop.org/drm/drm Pull drm fixes from Dave Airlie: "Thanks to Daniel for handling the email the last couple of weeks, flus and break-ins combined to derail me. Surprised nothing materialised today to take me out again. Just more amdgpu navi fixes, msm fixes and a single nouveau regression fix: amdgpu: - navi10 temperature and pstate fixes - vcn dynamic power management fix - CS ioctl error handling fix - debugfs info leak fix - amdkfd VegaM fix msm: - dma sync call fix - mdp5 dsi command mode fix - fall-through fixes - disabled GPU fix nouveau: - regression fix for displayport MST support" * tag 'drm-fixes-2019-08-02' of git://anongit.freedesktop.org/drm/drm: drm/nouveau: Only release VCPI slots on mode changes drm: msm: Fix add_gpu_components drm/msm: Annotate intentional switch statement fall throughs drm/msm: add support for per-CRTC max_vblank_count on mdp5 drm/msm: Use the correct dma_sync calls in msm_gem drm/amd/powerplay: correct UVD/VCE/VCN power status retrieval drm/amd/powerplay: correct Navi10 VCN powergate control (v2) drm/amd/powerplay: support VCN powergate status retrieval for SW SMU drm/amd/powerplay: support VCN powergate status retrieval on Raven drm/amd/powerplay: add new sensor type for VCN powergate status drm/amdgpu: fix a potential information leaking bug drm/amdgpu: fix error handling in amdgpu_cs_process_fence_dep drm/amd/powerplay: enable SW SMU reset functionality drm/amd/powerplay: fix null pointer dereference around dpm state relates drm/amdgpu/powerplay: use proper revision id for navi drm/amd/powerplay: fix temperature granularity error in smu11 drm/amd/powerplay: add callback function of get_thermal_temperature_range drm/amdkfd: Fix byte align on VegaM commit 42d21900b39ceebf7be1512d02d915280ba2bba5 Merge: 234172f6bbf8 e1f1ae8002e4 Author: Linus Torvalds Date: Fri Aug 2 08:47:28 2019 -0700 Merge tag 'clk-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux Pull clk fixes from Stephen Boyd: "A few fixes for code that came in during the merge window or that started getting exercised differently this time around: - Select regmap MMIO kconfig in spreadtrum driver to avoid compile errors - Complete kerneldoc on devm_clk_bulk_get_optional() - Register an essential clk earlier on mediatek mt8183 SoCs so the clocksource driver can use it - Fix divisor math in the at91 driver - Plug a race in Renesas reset control logic" * tag 'clk-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux: clk: renesas: cpg-mssr: Fix reset control race condition clk: sprd: Select REGMAP_MMIO to avoid compile errors clk: mediatek: mt8183: Register 13MHz clock earlier for clocksource clk: Add missing documentation of devm_clk_bulk_get_optional() argument clk: at91: generated: Truncate divisor to GENERATED_MAX_DIV + 1 commit 234172f6bbf8e26fa8407c4bbbf2a36da30d7913 Merge: 35fca9f8a999 ad3c7b18c5b3 Author: Linus Torvalds Date: Fri Aug 2 08:44:33 2019 -0700 Merge tag 'arm-swiotlb-5.3' of git://git.infradead.org/users/hch/dma-mapping Pull arm swiotlb support from Christoph Hellwig: "This fixes a cascade of regressions that originally started with the addition of the ia64 port, but only got fatal once we removed most uses of block layer bounce buffering in Linux 4.18. The reason is that while the original i386/PAE code that was the first architecture that supported > 4GB of memory without an iommu decided to leave bounce buffering to the subsystems, which in those days just mean block and networking as no one else consumed arbitrary userspace memory. Later with ia64, x86_64 and other ports we assumed that either an iommu or something that fakes it up ("software IOTLB" in beautiful Intel speak) is present and that subsystems can rely on that for dealing with addressing limitations in devices. Except that the ARM LPAE scheme that added larger physical address to 32-bit ARM did not follow that scheme and thus only worked by chance and only for block and networking I/O directly to highmem. Long story, short fix - add swiotlb support to arm when build for LPAE platforms, which actuallys turns out to be pretty trivial with the modern dma-direct / swiotlb code to fix the Linux 4.18-ish regression" * tag 'arm-swiotlb-5.3' of git://git.infradead.org/users/hch/dma-mapping: arm: use swiotlb for bounce buffering on LPAE configs dma-mapping: check pfn validity in dma_common_{mmap,get_sgtable} commit 35fca9f8a999627e3291907992b299b1207baee5 Merge: 1e78030e5e5b f46cc0152501 Author: Linus Torvalds Date: Fri Aug 2 08:41:11 2019 -0700 Merge tag 'dma-mapping-5.3-3' of git://git.infradead.org/users/hch/dma-mapping Pull dma-mapping regression fixes from Christoph Hellwig: "Two related regression fixes for changes from this merge window to fix alignment issues introduced in the CMA allocation rework (Nicolin Chen)" * tag 'dma-mapping-5.3-3' of git://git.infradead.org/users/hch/dma-mapping: dma-contiguous: page-align the size in dma_free_contiguous() dma-contiguous: do not overwrite align in dma_alloc_contiguous() commit d1836f3813ee0742a2067d5f4d78e811d2b76d9d Author: Thong Thai Date: Thu Jul 25 11:26:56 2019 -0400 drm/amd/amdgpu/vcn_v2_0: Move VCN 2.0 specific dec ring test to vcn_v2_0 VCN 2.0 firmware now requires a packet start command to be sent before any other decode ring buffer command. Signed-off-by: Thong Thai Reviewed-by: Leo Liu Signed-off-by: Alex Deucher commit af655cc5aae800f30cd71c5d72d36bd3ecb1e7df Author: Thong Thai Date: Thu Jul 25 11:21:58 2019 -0400 drm/amd/amdgpu/vcn_v2_0: Mark RB commands as KMD commands Sets the CMD_SOURCE bit for VCN 2.0 Decoder Ring Buffer commands. This bit was previously set by the RBC HW on older firmware. Newer firmware uses a SW RBC and this bit has to be set by the driver. Signed-off-by: Thong Thai Reviewed-by: Leo Liu Reviewed-by: Christian König Signed-off-by: Alex Deucher commit 9c8c9c7cdb4c8fb48a2bc70f41a07920f761d2cd Merge: 63dc6e63e682 1bbbab097a05 Author: Daniel Vetter Date: Fri Aug 2 17:10:16 2019 +0200 Merge tag 'exynos-drm-fixes-for-v5.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/daeinki/drm-exynos into drm-fixes - Two cleanup patches . use dev_get_drvdata for readability instead of platform_get_drvdata . remove redundant assignment to node. - Two fixup patches . fix undefined reference to 'vmf_insert_mixed' with NOMMU configuration. . fix potential infinite spin issue by decrementing 'retry' variable in scaler_reset function of exynos_drm_scaler.c Signed-off-by: Daniel Vetter From: Inki Dae Link: https://patchwork.freedesktop.org/patch/msgid/1564734791-745-1-git-send-email-inki.dae@samsung.com commit 63dc6e63e682cf756ab8c18aa1b85b0efb358dad Author: Chris Wilson Date: Thu Aug 1 13:44:58 2019 +0100 Revert "drm/vgem: fix cache synchronization on arm/arm64" commit 7e9e5ead55be ("drm/vgem: fix cache synchronization on arm/arm64") broke all of the !llc i915-vgem coherency tests in CI, and left the HW very, very unhappy (which is even more scary). Fixes: 7e9e5ead55be ("drm/vgem: fix cache synchronization on arm/arm64") Signed-off-by: Chris Wilson Cc: Daniel Vetter Cc: Rob Clark Cc: Sean Paul Acked-by: Sean Paul Signed-off-by: Daniel Vetter Link: https://patchwork.freedesktop.org/patch/msgid/20190801124458.24949-1-chris@chris-wilson.co.uk commit 5fd5d2b7c53de5a1290d82f8085876e2afadc97d Merge: ab35c8a5b07e 585405945707 Author: Daniel Vetter Date: Fri Aug 2 17:03:04 2019 +0200 Merge tag 'drm-misc-fixes-2019-08-02' of git://anongit.freedesktop.org/drm/drm-misc into drm-fixes drm-misc-fixes for v5.3-rc3: - Fix some build errors in drm/bridge. - Do not build i810 on CONFIG_PREEMPTION. - Fix cache sync on arm in vgem. - Allow mapping fb in drm_client only when required, and use it to fix bochs fbdev. Signed-off-by: Daniel Vetter From: Maarten Lankhorst Link: https://patchwork.freedesktop.org/patch/msgid/af0dc371-16e0-cee8-0d71-4824d44aa973@linux.intel.com commit 664b16589f882202b8fa8149d0074f3159bade76 Author: Pierre-Louis Bossart Date: Thu Jul 25 18:40:06 2019 -0500 soundwire: cadence_master: fix definitions for INTSTAT0/1 Two off-by-one errors: INTSTAT0 missed BIT(31) and INTSTAT1 is only defined on first 16 bits. Signed-off-by: Pierre-Louis Bossart Link: https://lore.kernel.org/r/20190725234032.21152-15-pierre-louis.bossart@linux.intel.com Signed-off-by: Vinod Koul commit b07dd9b400981f487940a4d84292d3a0e7cd9362 Author: Pierre-Louis Bossart Date: Thu Jul 25 18:40:05 2019 -0500 soundwire: cadence_master: fix register definition for SLAVE_STATE wrong prefix and wrong macro. Signed-off-by: Pierre-Louis Bossart Link: https://lore.kernel.org/r/20190725234032.21152-14-pierre-louis.bossart@linux.intel.com Signed-off-by: Vinod Koul commit 3cdd98606750a5a1d1c8bcda5b481cb86ed67b3b Author: Vasily Gorbik Date: Mon Jul 29 01:23:46 2019 +0200 s390/zcrypt: adjust switch fall through comments for -Wimplicit-fallthrough Silence the following warnings when built with -Wimplicit-fallthrough=3 enabled by default since 5.3-rc2: In file included from ./include/linux/preempt.h:11, from ./include/linux/spinlock.h:51, from ./include/linux/mmzone.h:8, from ./include/linux/gfp.h:6, from ./include/linux/slab.h:15, from drivers/s390/crypto/ap_queue.c:13: drivers/s390/crypto/ap_queue.c: In function 'ap_sm_recv': ./include/linux/list.h:577:2: warning: this statement may fall through [-Wimplicit-fallthrough=] 577 | for (pos = list_first_entry(head, typeof(*pos), member); \ | ^~~ drivers/s390/crypto/ap_queue.c:147:3: note: in expansion of macro 'list_for_each_entry' 147 | list_for_each_entry(ap_msg, &aq->pendingq, list) { | ^~~~~~~~~~~~~~~~~~~ drivers/s390/crypto/ap_queue.c:155:2: note: here 155 | case AP_RESPONSE_NO_PENDING_REPLY: | ^~~~ drivers/s390/crypto/zcrypt_msgtype6.c: In function 'convert_response_ep11_xcrb': drivers/s390/crypto/zcrypt_msgtype6.c:871:6: warning: this statement may fall through [-Wimplicit-fallthrough=] 871 | if (msg->cprbx.cprb_ver_id == 0x04) | ^ drivers/s390/crypto/zcrypt_msgtype6.c:874:2: note: here 874 | default: /* Unknown response type, this should NEVER EVER happen */ | ^~~~~~~ drivers/s390/crypto/zcrypt_msgtype6.c: In function 'convert_response_rng': drivers/s390/crypto/zcrypt_msgtype6.c:901:6: warning: this statement may fall through [-Wimplicit-fallthrough=] 901 | if (msg->cprbx.cprb_ver_id == 0x02) | ^ drivers/s390/crypto/zcrypt_msgtype6.c:907:2: note: here 907 | default: /* Unknown response type, this should NEVER EVER happen */ | ^~~~~~~ drivers/s390/crypto/zcrypt_msgtype6.c: In function 'convert_response_xcrb': drivers/s390/crypto/zcrypt_msgtype6.c:838:6: warning: this statement may fall through [-Wimplicit-fallthrough=] 838 | if (msg->cprbx.cprb_ver_id == 0x02) | ^ drivers/s390/crypto/zcrypt_msgtype6.c:844:2: note: here 844 | default: /* Unknown response type, this should NEVER EVER happen */ | ^~~~~~~ drivers/s390/crypto/zcrypt_msgtype6.c: In function 'convert_response_ica': drivers/s390/crypto/zcrypt_msgtype6.c:801:6: warning: this statement may fall through [-Wimplicit-fallthrough=] 801 | if (msg->cprbx.cprb_ver_id == 0x02) | ^ drivers/s390/crypto/zcrypt_msgtype6.c:808:2: note: here 808 | default: /* Unknown response type, this should NEVER EVER happen */ | ^~~~~~~ Acked-by: Patrick Steuer Signed-off-by: Vasily Gorbik commit ead16e53c2f0ed946d82d4037c630e2f60f4ab69 Author: Tomas Bortoli Date: Wed Jul 31 10:54:47 2019 -0400 can: peak_usb: pcan_usb_pro: Fix info-leaks to USB devices Uninitialized Kernel memory can leak to USB devices. Fix by using kzalloc() instead of kmalloc() on the affected buffers. Signed-off-by: Tomas Bortoli Reported-by: syzbot+d6a5a1a3657b596ef132@syzkaller.appspotmail.com Fixes: f14e22435a27 ("net: can: peak_usb: Do not do dma on the stack") Cc: linux-stable Signed-off-by: Marc Kleine-Budde commit 30a8beeb3042f49d0537b7050fd21b490166a3d9 Author: Tomas Bortoli Date: Wed Jul 31 10:54:47 2019 -0400 can: peak_usb: pcan_usb_fd: Fix info-leaks to USB devices Uninitialized Kernel memory can leak to USB devices. Fix by using kzalloc() instead of kmalloc() on the affected buffers. Signed-off-by: Tomas Bortoli Reported-by: syzbot+513e4d0985298538bf9b@syzkaller.appspotmail.com Fixes: 0a25e1f4f185 ("can: peak_usb: add support for PEAK new CANFD USB adapters") Cc: linux-stable Signed-off-by: Marc Kleine-Budde commit e787f19373b8a5fa24087800ed78314fd17b984a Author: Wang Xiayang Date: Wed Jul 31 15:25:59 2019 +0800 can: peak_usb: force the string buffer NULL-terminated strncpy() does not ensure NULL-termination when the input string size equals to the destination buffer size IFNAMSIZ. The output string is passed to dev_info() which relies on the NULL-termination. Use strlcpy() instead. This issue is identified by a Coccinelle script. Signed-off-by: Wang Xiayang Signed-off-by: Marc Kleine-Budde commit cd28aa2e056cd1ea79fc5f24eed0ce868c6cab5c Author: Wang Xiayang Date: Wed Jul 31 15:31:14 2019 +0800 can: sja1000: force the string buffer NULL-terminated strncpy() does not ensure NULL-termination when the input string size equals to the destination buffer size IFNAMSIZ. The output string 'name' is passed to dev_info which relies on NULL-termination. Use strlcpy() instead. This issue is identified by a Coccinelle script. Signed-off-by: Wang Xiayang Signed-off-by: Marc Kleine-Budde commit a4127952859a869cf3fc5a49547dbe2ffa2eac89 Author: Jarkko Nikula Date: Thu Aug 1 16:49:01 2019 +0300 spi: pxa2xx: Add support for Intel Tiger Lake Intel Tiger Lake -LP LPSS SPI controller is otherwise similar than Cannon Lake but has more controllers and up to two chip selects per controller. Signed-off-by: Jarkko Nikula Link: https://lore.kernel.org/r/20190801134901.12635-1-jarkko.nikula@linux.intel.com Signed-off-by: Mark Brown commit d8bb6718c4db9bcd075dde7ff55d46091ccfae15 Author: Masami Hiramatsu Date: Thu Aug 1 23:36:14 2019 +0900 arm64: Make debug exception handlers visible from RCU Make debug exceptions visible from RCU so that synchronize_rcu() correctly track the debug exception handler. This also introduces sanity checks for user-mode exceptions as same as x86's ist_enter()/ist_exit(). The debug exception can interrupt in idle task. For example, it warns if we put a kprobe on a function called from idle task as below. The warning message showed that the rcu_read_lock() caused this problem. But actually, this means the RCU is lost the context which is already in NMI/IRQ. /sys/kernel/debug/tracing # echo p default_idle_call >> kprobe_events /sys/kernel/debug/tracing # echo 1 > events/kprobes/enable /sys/kernel/debug/tracing # [ 135.122237] [ 135.125035] ============================= [ 135.125310] WARNING: suspicious RCU usage [ 135.125581] 5.2.0-08445-g9187c508bdc7 #20 Not tainted [ 135.125904] ----------------------------- [ 135.126205] include/linux/rcupdate.h:594 rcu_read_lock() used illegally while idle! [ 135.126839] [ 135.126839] other info that might help us debug this: [ 135.126839] [ 135.127410] [ 135.127410] RCU used illegally from idle CPU! [ 135.127410] rcu_scheduler_active = 2, debug_locks = 1 [ 135.128114] RCU used illegally from extended quiescent state! [ 135.128555] 1 lock held by swapper/0/0: [ 135.128944] #0: (____ptrval____) (rcu_read_lock){....}, at: call_break_hook+0x0/0x178 [ 135.130499] [ 135.130499] stack backtrace: [ 135.131192] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.2.0-08445-g9187c508bdc7 #20 [ 135.131841] Hardware name: linux,dummy-virt (DT) [ 135.132224] Call trace: [ 135.132491] dump_backtrace+0x0/0x140 [ 135.132806] show_stack+0x24/0x30 [ 135.133133] dump_stack+0xc4/0x10c [ 135.133726] lockdep_rcu_suspicious+0xf8/0x108 [ 135.134171] call_break_hook+0x170/0x178 [ 135.134486] brk_handler+0x28/0x68 [ 135.134792] do_debug_exception+0x90/0x150 [ 135.135051] el1_dbg+0x18/0x8c [ 135.135260] default_idle_call+0x0/0x44 [ 135.135516] cpu_startup_entry+0x2c/0x30 [ 135.135815] rest_init+0x1b0/0x280 [ 135.136044] arch_call_rest_init+0x14/0x1c [ 135.136305] start_kernel+0x4d4/0x500 [ 135.136597] So make debug exception visible to RCU can fix this warning. Reported-by: Naresh Kamboju Acked-by: Paul E. McKenney Signed-off-by: Masami Hiramatsu Signed-off-by: Will Deacon commit b3980e48528c4d2a9e70b145a5bba328b73a0f93 Author: Masami Hiramatsu Date: Thu Aug 1 23:25:49 2019 +0900 arm64: kprobes: Recover pstate.D in single-step exception handler kprobes manipulates the interrupted PSTATE for single step, and doesn't restore it. Thus, if we put a kprobe where the pstate.D (debug) masked, the mask will be cleared after the kprobe hits. Moreover, in the most complicated case, this can lead a kernel crash with below message when a nested kprobe hits. [ 152.118921] Unexpected kernel single-step exception at EL1 When the 1st kprobe hits, do_debug_exception() will be called. At this point, debug exception (= pstate.D) must be masked (=1). But if another kprobes hits before single-step of the first kprobe (e.g. inside user pre_handler), it unmask the debug exception (pstate.D = 0) and return. Then, when the 1st kprobe setting up single-step, it saves current DAIF, mask DAIF, enable single-step, and restore DAIF. However, since "D" flag in DAIF is cleared by the 2nd kprobe, the single-step exception happens soon after restoring DAIF. This has been introduced by commit 7419333fa15e ("arm64: kprobe: Always clear pstate.D in breakpoint exception handler") To solve this issue, this stores all DAIF bits and restore it after single stepping. Reported-by: Naresh Kamboju Fixes: 7419333fa15e ("arm64: kprobe: Always clear pstate.D in breakpoint exception handler") Reviewed-by: James Morse Tested-by: James Morse Signed-off-by: Masami Hiramatsu Signed-off-by: Will Deacon commit ab35c8a5b07ee70f8544a2f2a131153a6584cb53 Merge: f8981e0309e9 4b9bb9728c91 Author: Daniel Vetter Date: Fri Aug 2 11:31:20 2019 +0200 Merge tag 'drm-intel-fixes-2019-08-02' of git://anongit.freedesktop.org/drm/drm-intel into drm-fixes drm/i915 fixes for v5.3-rc3: - GVT fixes - Fix TBT aux powerwell - Fix PSR2 training pattern duration - Fix memory leak in runtime wakeref tracking - Fix ICL memory bandwidth issue preventing planes from being enabled - Fix OA mux configuration delays for accurate performance data - Fix VLV/CHV DP audio cdclk frequency requirements - Fix register whitelisting to fix a number of GL & Vulkan CTS tests - Fix ICL perf register offsets - Fix Gen11 Sampler Prefetch workaround, impacting dEQP tests - Fix various gen2 tracepoints - A number of GEM locking fixes addressing lockdep issues - Fix idle engine reset, recover only active engines - Fix incorrect MCR programming Signed-off-by: Daniel Vetter From: Jani Nikula Link: https://patchwork.freedesktop.org/patch/msgid/87d0hnncgo.fsf@intel.com commit 1bbbab097a05276e312dd2462791d32b21ceb1ee Author: Colin Ian King Date: Mon Jul 22 23:25:35 2019 +0100 drm/exynos: fix missing decrement of retry counter Currently the retry counter is not being decremented, leading to a potential infinite spin if the scalar_reads don't change state. Addresses-Coverity: ("Infinite loop") Fixes: 280e54c9f614 ("drm/exynos: scaler: Reset hardware before starting the operation") Signed-off-by: Colin Ian King Signed-off-by: Inki Dae commit d6f25bd9d4079165ea90f12d71e06d1dca83cd86 Author: Arnd Bergmann Date: Tue Jul 9 21:08:48 2019 +0900 drm/exynos: add CONFIG_MMU dependency Compile-testing this driver on a NOMMU configuration shows a link failure: drivers/gpu/drm/exynos/exynos_drm_gem.o: In function `exynos_drm_gem_fault': exynos_drm_gem.c:(.text+0x484): undefined reference to `vmf_insert_mixed' Add a CONFIG_MMU dependency to ensure we only enable this in configurations that build correctly. Many other drm drivers have the same dependency. It would be nice to make this work in MMU-less configurations, but evidently nobody has ever needed this so far. Fixes: 156bdac99061 ("drm/exynos: trigger build of all modules") Signed-off-by: Arnd Bergmann Reviewed-by: Vladimir Murzin Signed-off-by: Inki Dae commit 59d431746f1b3c76fd551b71241d7fdce38a58e9 Author: Colin Ian King Date: Tue Jul 9 21:01:14 2019 +0900 drm/exynos: remove redundant assignment to pointer 'node' The pointer 'node' is being assigned with a value that is never read and is re-assigned later. The assignment is redundant and can be removed. Addresses-Coverity: ("Unused value") Signed-off-by: Colin Ian King Signed-off-by: Inki Dae commit 9eae7c3bcb52ec0a9f816d830e232e36a20b46d4 Author: Fuqian Huang Date: Thu Jul 4 10:34:36 2019 +0800 drm/exynos: using dev_get_drvdata directly Several drivers cast a struct device pointer to a struct platform_device pointer only to then call platform_get_drvdata(). To improve readability, these constructs can be simplified by using dev_get_drvdata() directly. Signed-off-by: Fuqian Huang Reviewed-by: Emil Velikov Signed-off-by: Inki Dae commit e2664ecbb2f26225ac6646876f2899558ffb2604 Author: Gary R Hook Date: Tue Jul 30 16:05:26 2019 +0000 crypto: ccp - Ignore tag length when decrypting GCM ciphertext AES GCM input buffers for decryption contain AAD+CTEXT+TAG. Only decrypt the ciphertext, and use the tag for comparison. Fixes: 36cf515b9bbe2 ("crypto: ccp - Enable support for AES GCM on v5 CCPs") Cc: Signed-off-by: Gary R Hook Signed-off-by: Herbert Xu commit 9f00baf74e4b6f79a3a3dfab44fb7bb2e797b551 Author: Gary R Hook Date: Tue Jul 30 16:05:24 2019 +0000 crypto: ccp - Add support for valid authsize values less than 16 AES GCM encryption allows for authsize values of 4, 8, and 12-16 bytes. Validate the requested authsize, and retain it to save in the request context. Fixes: 36cf515b9bbe2 ("crypto: ccp - Enable support for AES GCM on v5 CCPs") Cc: Signed-off-by: Gary R Hook Signed-off-by: Herbert Xu commit 25e44338321af545ab34243a6081c3f0fc6107d0 Author: Gary R Hook Date: Tue Jul 30 16:05:22 2019 +0000 crypto: ccp - Fix oops by properly managing allocated structures A plaintext or ciphertext length of 0 is allowed in AES, in which case no encryption occurs. Ensure that we don't clean up data structures that were never allocated. Fixes: 36cf515b9bbe2 ("crypto: ccp - Enable support for AES GCM on v5 CCPs") Cc: Signed-off-by: Gary R Hook Signed-off-by: Herbert Xu commit 41995342b40c418a47603e1321256d2c4a2ed0fb Author: Stefan Haberland Date: Thu Aug 1 13:06:30 2019 +0200 s390/dasd: fix endless loop after read unit address configuration After getting a storage server event that causes the DASD device driver to update its unit address configuration during a device shutdown there is the possibility of an endless loop in the device driver. In the system log there will be ongoing DASD error messages with RC: -19. The reason is that the loop starting the ruac request only terminates when the retry counter is decreased to 0. But in the sleep_on function there are early exit paths that do not decrease the retry counter. Prevent an endless loop by handling those cases separately. Remove the unnecessary do..while loop since the sleep_on function takes care of retries by itself. Fixes: 8e09f21574ea ("[S390] dasd: add hyper PAV support to DASD device driver, part 1") Cc: stable@vger.kernel.org # 2.6.25+ Signed-off-by: Stefan Haberland Reviewed-by: Jan Hoeppner Signed-off-by: Jens Axboe commit f8981e0309e9004c6e86d218049045700c79d740 Merge: 412e85b60531 9ca7ad6c7706 Author: Dave Airlie Date: Fri Aug 2 10:17:25 2019 +1000 Merge tag 'msm-fixes-2019_08_01' of https://gitlab.freedesktop.org/drm/msm into drm-fixes - Fix the dma_sync calls applied last week (Rob) - Fix mdp5 dsi command mode (Brian) - Squash fall through warnings (Jordan) - Don't add disabled gpu nodes to the of device list (Jeffrey) Cc: Jeffrey Hugo Cc: Jordan Crouse Cc: Brian Masney Cc: Rob Clark Signed-off-by: Dave Airlie # gpg: Signature made Fri 02 Aug 2019 05:54:27 AM AEST # gpg: using RSA key 96F70DFDA84A070A # gpg: Can't check signature: public key not found From: Sean Paul Link: https://patchwork.freedesktop.org/patch/msgid/20190801200439.GV104440@art_vandelay commit 412e85b605315fd129a849599cf4a5a7959573a8 Author: Lyude Paul Date: Thu Aug 1 18:02:15 2019 -0400 drm/nouveau: Only release VCPI slots on mode changes Looks like a regression got introduced into nv50_mstc_atomic_check() that somehow didn't get found until now. If userspace changes crtc_state->active to false but leaves the CRTC enabled, we end up calling drm_dp_atomic_find_vcpi_slots() using the PBN calculated in asyh->dp.pbn. However, if the display is inactive we end up calculating a PBN of 0, which inadvertently causes us to have an allocation of 0. >From there, if userspace then disables the CRTC afterwards we end up accidentally attempting to free the VCPI twice: WARNING: CPU: 0 PID: 1484 at drivers/gpu/drm/drm_dp_mst_topology.c:3336 drm_dp_atomic_release_vcpi_slots+0x87/0xb0 [drm_kms_helper] RIP: 0010:drm_dp_atomic_release_vcpi_slots+0x87/0xb0 [drm_kms_helper] Call Trace: drm_atomic_helper_check_modeset+0x3f3/0xa60 [drm_kms_helper] ? drm_atomic_check_only+0x43/0x780 [drm] drm_atomic_helper_check+0x15/0x90 [drm_kms_helper] nv50_disp_atomic_check+0x83/0x1d0 [nouveau] drm_atomic_check_only+0x54d/0x780 [drm] ? drm_atomic_set_crtc_for_connector+0xec/0x100 [drm] drm_atomic_commit+0x13/0x50 [drm] drm_atomic_helper_set_config+0x81/0x90 [drm_kms_helper] drm_mode_setcrtc+0x194/0x6a0 [drm] ? vprintk_emit+0x16a/0x230 ? drm_ioctl+0x163/0x390 [drm] ? drm_mode_getcrtc+0x180/0x180 [drm] drm_ioctl_kernel+0xaa/0xf0 [drm] drm_ioctl+0x208/0x390 [drm] ? drm_mode_getcrtc+0x180/0x180 [drm] nouveau_drm_ioctl+0x63/0xb0 [nouveau] do_vfs_ioctl+0x405/0x660 ? recalc_sigpending+0x17/0x50 ? _copy_from_user+0x37/0x60 ksys_ioctl+0x5e/0x90 ? exit_to_usermode_loop+0x92/0xe0 __x64_sys_ioctl+0x16/0x20 do_syscall_64+0x59/0x190 entry_SYSCALL_64_after_hwframe+0x44/0xa9 WARNING: CPU: 0 PID: 1484 at drivers/gpu/drm/drm_dp_mst_topology.c:3336 drm_dp_atomic_release_vcpi_slots+0x87/0xb0 [drm_kms_helper] ---[ end trace 4c395c0c51b1f88d ]--- [drm:drm_dp_atomic_release_vcpi_slots [drm_kms_helper]] *ERROR* no VCPI for [MST PORT:00000000e288eb7d] found in mst state 000000008e642070 So, fix this by doing what we probably should have done from the start: only call drm_dp_atomic_find_vcpi_slots() when crtc_state->mode_changed is set, so that VCPI allocations remain for as long as the CRTC is enabled. Signed-off-by: Lyude Paul Fixes: 232c9eec417a ("drm/nouveau: Use atomic VCPI helpers for MST") Cc: Lyude Paul Cc: Ben Skeggs Cc: Daniel Vetter Cc: David Airlie Cc: Jerry Zuo Cc: Harry Wentland Cc: Juston Li Cc: Karol Herbst Cc: Laurent Pinchart Cc: Ilia Mirkin Cc: # v5.1+ Acked-by: Ben Skeggs Signed-off-by: Dave Airlie Link: https://patchwork.freedesktop.org/patch/msgid/20190801220216.15323-1-lyude@redhat.com commit 4b381ee25d9bd02ad9d75a96938472cf1f443013 Merge: 609488bc979f 6dee4829cfde Author: Dave Airlie Date: Fri Aug 2 09:35:39 2019 +1000 Merge tag 'drm-fixes-5.3-2019-07-31' of git://people.freedesktop.org/~agd5f/linux into drm-fixes drm-fixes-5.3-2019-07-31: amdgpu: - Fix temperature granularity for navi - Fix stable pstate setting for navi - Fix VCN DPM enablement on navi - Fix error handling on CS ioctl when processing dependencies - Fix possible information leak in debugfs amdkfd: - fix memory alignment for VegaM Signed-off-by: Dave Airlie From: Alex Deucher Link: https://patchwork.freedesktop.org/patch/msgid/20190731191648.25729-1-alexander.deucher@amd.com commit 224c04973db1125fcebefffd86115f99f50f8277 Author: Denis Kirjanov Date: Tue Jul 30 15:13:57 2019 +0200 net: usb: pegasus: fix improper read if get_registers() fail get_registers() may fail with -ENOMEM and in this case we can read a garbage from the status variable tmp. Reported-by: syzbot+3499a83b2d062ae409d4@syzkaller.appspotmail.com Signed-off-by: Denis Kirjanov Signed-off-by: David S. Miller commit 4da5f0018eef4c0de31675b670c80e82e13e99d1 Author: Taras Kondratiuk Date: Mon Jul 29 22:15:07 2019 +0000 tipc: compat: allow tipc commands without arguments Commit 2753ca5d9009 ("tipc: fix uninit-value in tipc_nl_compat_doit") broke older tipc tools that use compat interface (e.g. tipc-config from tipcutils package): % tipc-config -p operation not supported The commit started to reject TIPC netlink compat messages that do not have attributes. It is too restrictive because some of such messages are valid (they don't need any arguments): % grep 'tx none' include/uapi/linux/tipc_config.h #define TIPC_CMD_NOOP 0x0000 /* tx none, rx none */ #define TIPC_CMD_GET_MEDIA_NAMES 0x0002 /* tx none, rx media_name(s) */ #define TIPC_CMD_GET_BEARER_NAMES 0x0003 /* tx none, rx bearer_name(s) */ #define TIPC_CMD_SHOW_PORTS 0x0006 /* tx none, rx ultra_string */ #define TIPC_CMD_GET_REMOTE_MNG 0x4003 /* tx none, rx unsigned */ #define TIPC_CMD_GET_MAX_PORTS 0x4004 /* tx none, rx unsigned */ #define TIPC_CMD_GET_NETID 0x400B /* tx none, rx unsigned */ #define TIPC_CMD_NOT_NET_ADMIN 0xC001 /* tx none, rx none */ This patch relaxes the original fix and rejects messages without arguments only if such arguments are expected by a command (reg_type is non zero). Fixes: 2753ca5d9009 ("tipc: fix uninit-value in tipc_nl_compat_doit") Cc: stable@vger.kernel.org Signed-off-by: Taras Kondratiuk Acked-by: Ying Xue Signed-off-by: David S. Miller commit 42787ed79638dc7f0f8d5c164caba1e87bfab50f Author: Rafael J. Wysocki Date: Thu Aug 1 01:31:08 2019 +0200 ACPI: PM: Fix regression in acpi_device_set_power() Commit f850a48a0799 ("ACPI: PM: Allow transitions to D0 to occur in special cases") overlooked the fact that acpi_power_transition() may change the power.state value for the target device and if that happens, it may confuse acpi_device_set_power() and cause it to omit the _PS0 evaluation which on some systems is necessary to change power states of devices from low-power to D0. Fix that by saving the current value of power.state for the target device before passing it to acpi_power_transition() and using the saved value in a subsequent check. Fixes: f850a48a0799 ("ACPI: PM: Allow transitions to D0 to occur in special cases") Reported-by: Kai-Heng Feng Reported-by: Mario Limonciello Signed-off-by: Rafael J. Wysocki Tested-by: Kai-Heng Feng Tested-by: Mario Limonciello commit 8eb9a2dff019055e4ff307bb7f8c64a7a20e79c8 Author: Gustavo A. R. Silva Date: Sun Jul 28 18:51:38 2019 -0500 i2c: s3c2410: Mark expected switch fall-through Mark switch cases where we are expecting to fall through. This patch fixes the following warning: drivers/i2c/busses/i2c-s3c2410.c: In function 'i2c_s3c_irq_nextbyte': drivers/i2c/busses/i2c-s3c2410.c:431:6: warning: this statement may fall through [-Wimplicit-fallthrough=] if (i2c->state == STATE_READ) ^ drivers/i2c/busses/i2c-s3c2410.c:439:2: note: here case STATE_WRITE: ^~~~ Notice that, in this particular case, the code comment is modified in accordance with what GCC is expecting to find. Reported-by: Stephen Rothwell Signed-off-by: Gustavo A. R. Silva Reviewed-by: Kees Cook Signed-off-by: Wolfram Sang commit b1ac6704493fa14b5dc19eb6b69a73932361a131 Author: Michał Mirosław Date: Mon Jul 22 21:05:56 2019 +0200 i2c: at91: fix clk_offset for sama5d2 In SAMA5D2 datasheet, TWIHS_CWGR register rescription mentions clock offset of 3 cycles (compared to 4 in eg. SAMA5D3). Cc: stable@vger.kernel.org # 5.2.x [needs applying to i2c-at91.c instead for earlier kernels] Fixes: 0ef6f3213dac ("i2c: at91: add support for new alternative command mode") Signed-off-by: Michał Mirosław Acked-by: Ludovic Desroches Signed-off-by: Wolfram Sang commit d12e3aae160fb26b534c4496b211d6e60a5179ed Author: Michał Mirosław Date: Mon Jul 22 20:55:27 2019 +0200 i2c: at91: disable TXRDY interrupt after sending data Driver was not disabling TXRDY interrupt after last TX byte. This caused interrupt storm until transfer timeouts for slow or broken device on the bus. The patch fixes the interrupt storm on my SAMA5D2-based board. Cc: stable@vger.kernel.org # 5.2.x [v5.2 introduced file split; the patch should apply to i2c-at91.c before the split] Fixes: fac368a04048 ("i2c: at91: add new driver") Signed-off-by: Michał Mirosław Acked-by: Ludovic Desroches Tested-by: Raag Jadav Signed-off-by: Wolfram Sang commit f1fc7249dddc0e52d9e805e2e661caa118649509 Author: Alexei Starovoitov Date: Tue Jul 30 18:38:27 2019 -0700 selftests/bpf: tests for jmp to 1st insn Add 2 tests that check JIT code generation to jumps to 1st insn. 1st test is similar to syzbot reproducer. The backwards branch is never taken at runtime. 2nd test has branch to 1st insn that executes. The test is written as two bpf functions, since it's not possible to construct valid single bpf program that jumps to 1st insn. Signed-off-by: Alexei Starovoitov Acked-by: Song Liu commit 7c2e988f400e83501e0a3568250780609b7c8263 Author: Alexei Starovoitov Date: Tue Jul 30 18:38:26 2019 -0700 bpf: fix x64 JIT code generation for jmp to 1st insn Introduction of bounded loops exposed old bug in x64 JIT. JIT maintains the array of offsets to the end of all instructions to compute jmp offsets. addrs[0] - offset of the end of the 1st insn (that includes prologue). addrs[1] - offset of the end of the 2nd insn. JIT didn't keep the offset of the beginning of the 1st insn, since classic BPF didn't have backward jumps and valid extended BPF couldn't have a branch to 1st insn, because it didn't allow loops. With bounded loops it's possible to construct a valid program that jumps backwards to the 1st insn. Fix JIT by computing: addrs[0] - offset of the end of prologue == start of the 1st insn. addrs[1] - offset of the end of 1st insn. v1->v2: - Yonghong noticed a bug in jit linfo. Fix it by passing 'addrs + 1' to bpf_prog_fill_jited_linfo(), since it expects insn_to_jit_off array to be offsets to last byte. Reported-by: syzbot+35101610ff3e83119b1b@syzkaller.appspotmail.com Fixes: 2589726d12a1 ("bpf: introduce bounded loops") Fixes: 0a14842f5a3c ("net: filter: Just In Time compiler for x86-64") Signed-off-by: Alexei Starovoitov Acked-by: Song Liu commit 3415ec643e7bd644b03026efbe2f2b36cbe9b34b Author: Andrii Nakryiko Date: Thu Aug 1 00:24:05 2019 -0700 libbpf: set BTF FD for prog only when there is supported .BTF.ext data 5d01ab7bac46 ("libbpf: fix erroneous multi-closing of BTF FD") introduced backwards-compatibility issue, manifesting itself as -E2BIG error returned on program load due to unknown non-zero btf_fd attribute value for BPF_PROG_LOAD sys_bpf() sub-command. This patch fixes bug by ensuring that we only ever associate BTF FD with program if there is a BTF.ext data that was successfully loaded into kernel, which automatically means kernel supports func_info/line_info and associated BTF FD for progs (checked and ensured also by BTF sanitization code). Fixes: 5d01ab7bac46 ("libbpf: fix erroneous multi-closing of BTF FD") Reported-by: Andrey Ignatov Signed-off-by: Andrii Nakryiko Signed-off-by: Alexei Starovoitov commit 0eb6ddfb865c7d7ec05cb330050671363515e67f Author: Damien Le Moal Date: Thu Aug 1 19:21:51 2019 +0900 block: Fix __blkdev_direct_IO() for bio fragments The recent fix to properly handle IOCB_NOWAIT for async O_DIRECT IO (patch 6a43074e2f46) introduced two problems with BIO fragment handling for direct IOs: 1) The dio size processed is calculated by incrementing the ret variable by the size of the bio fragment issued for the dio. However, this size is obtained directly from bio->bi_iter.bi_size AFTER the bio submission which may result in referencing the bi_size value after the bio completed, resulting in an incorrect value use. 2) The ret variable is not incremented by the size of the last bio fragment issued for the bio, leading to an invalid IO size being returned to the user. Fix both problem by using dio->size (which is incremented before the bio submission) to update the value of ret after bio submissions, including for the last bio fragment issued. Fixes: 6a43074e2f46 ("block: properly handle IOCB_NOWAIT for async O_DIRECT IO") Reported-by: Masato Suzuki Signed-off-by: Damien Le Moal Signed-off-by: Jens Axboe commit 5511c0c309db4c526a6e9f8b2b8a1483771574bc Author: Suzuki K Poulose Date: Thu Aug 1 11:23:23 2019 -0600 coresight: Fix DEBUG_LOCKS_WARN_ON for uninitialized attribute While running the linux-next with CONFIG_DEBUG_LOCKS_ALLOC enabled, I get the following splat. BUG: key ffffcb5636929298 has not been registered! ------------[ cut here ]------------ DEBUG_LOCKS_WARN_ON(1) WARNING: CPU: 1 PID: 53 at kernel/locking/lockdep.c:3669 lockdep_init_map+0x164/0x1f0 CPU: 1 PID: 53 Comm: kworker/1:1 Tainted: G W 5.2.0-next-20190712-00015-g00ad4634222e-dirty #603 Workqueue: events amba_deferred_retry_func pstate: 60c00005 (nZCv daif +PAN +UAO) pc : lockdep_init_map+0x164/0x1f0 lr : lockdep_init_map+0x164/0x1f0 [ trimmed ] Call trace: lockdep_init_map+0x164/0x1f0 __kernfs_create_file+0x9c/0x158 sysfs_add_file_mode_ns+0xa8/0x1d0 sysfs_add_file_to_group+0x88/0xd8 etm_perf_add_symlink_sink+0xcc/0x138 coresight_register+0x110/0x280 tmc_probe+0x160/0x420 [ trimmed ] ---[ end trace ab4cc669615ba1b0 ]--- Fix this by initialising the dynamically allocated attribute properly. Cc: Mathieu Poirier Fixes: bb8e370bdc14 ("coresight: perf: Add "sinks" group to PMU directory") Cc: stable Signed-off-by: Suzuki K Poulose [Fixed a typograhic error in the changelog] Signed-off-by: Mathieu Poirier Link: https://lore.kernel.org/r/20190801172323.18359-2-mathieu.poirier@linaro.org Signed-off-by: Greg Kroah-Hartman commit a5dbba8f443e2046c63e5dd2907f562c1179169f Merge: 5f9e832c1370 b5fa9fc9e809 Author: Thomas Gleixner Date: Thu Aug 1 20:21:00 2019 +0200 Merge tag 'irqchip-fixes-5.3' of git://git.kernel.org/pub/scm/linux/kernel/git/maz/arm-platforms into irq/urgent Pull irqchip fixes from Marc Zyngier: A small bunch of fixes from the irqchip department: - Fix a couple of UAF on error paths (RZA1, GICv3 ITS) - Fix iMX GPCv2 trigger setting - Add missing of_node_put on error path in MBIGEN - Add another bunch of /* fall-through */ to silence warnings commit c88090dfc84254fa149174eb3e6a8458de1912c4 Author: Oliver Neukum Date: Thu Aug 1 09:44:25 2019 -0700 Input: kbtab - sanity check for endpoint type The driver should check whether the endpoint it uses has the correct type. Reported-by: syzbot+c7df50363aaff50aa363@syzkaller.appspotmail.com Signed-off-by: Oliver Neukum Signed-off-by: Dmitry Torokhov commit b55d996f057bf2e7ba9422a80b5e17e99860cb0b Author: Oliver Neukum Date: Thu Aug 1 09:40:26 2019 -0700 Input: usbtouchscreen - initialize PM mutex before using it Mutexes shall be initialized before they are used. Fixes: 12e510dbc57b2 ("Input: usbtouchscreen - fix deadlock in autosuspend") Reported-by: syzbot+199ea16c7f26418b4365@syzkaller.appspotmail.com Signed-off-by: Oliver Neukum Cc: stable@vger.kernel.org Signed-off-by: Dmitry Torokhov commit 18601078957b8b9e529a2cc99e72617923e21a55 Merge: 944a83a2669a 509b0538bc28 Author: David S. Miller Date: Thu Aug 1 13:45:49 2019 -0400 Merge branch 'net-Manufacturer-names-and-spelling-fixes' Geert Uytterhoeven says: ==================== net: Manufacturer names and spelling fixes This is a set of fixes for (some blatantly) wrong manufacturer names and various spelling issues, mostly in Kconfig help texts. ==================== Signed-off-by: David S. Miller commit 509b0538bc28870164903f5683e4c3f3b1eca965 Author: Geert Uytterhoeven Date: Wed Jul 31 15:22:16 2019 +0200 net: samsung: Spelling s/case/cause/ Signed-off-by: Geert Uytterhoeven Signed-off-by: David S. Miller commit 1583d448ea84a5b8b98c8d250200ce768b6ced38 Author: Geert Uytterhoeven Date: Wed Jul 31 15:22:15 2019 +0200 net: packetengines: Fix manufacturer spelling and capitalization Use "Packet Engines" consistently. Signed-off-by: Geert Uytterhoeven Signed-off-by: David S. Miller commit 85aee0a793ba223c48fd2cfe534edf83729deef6 Author: Geert Uytterhoeven Date: Wed Jul 31 15:22:14 2019 +0200 net: nixge: Spelling s/Instrument/Instruments/ Signed-off-by: Geert Uytterhoeven Signed-off-by: David S. Miller commit cec754cc7813f300d286b1d7e14480f82f7f2ffa Author: Geert Uytterhoeven Date: Wed Jul 31 15:22:13 2019 +0200 net: ixp4xx: Spelling s/XSacle/XScale/ Signed-off-by: Geert Uytterhoeven Signed-off-by: David S. Miller commit aca3432a607b6f9db2a9fe34f4b87d01cd99a68a Author: Geert Uytterhoeven Date: Wed Jul 31 15:22:12 2019 +0200 net: broadcom: Fix manufacturer name in Kconfig help text The help text refers to AMD instead of Broadcom, presumably because it was copied from the former. Fixes: adfc5217e9db68d3 ("broadcom: Move the Broadcom drivers") Signed-off-by: Geert Uytterhoeven Signed-off-by: David S. Miller commit ac0e3f20c7a9fbace30d38e7d306ab15f3e6fd31 Author: Geert Uytterhoeven Date: Wed Jul 31 15:22:11 2019 +0200 net: apple: Fix manufacturer name in Kconfig help text The help text refers to IBM instead of Apple, presumably because it was copied from the former. Fixes: 8fb6b0908176704a ("bmac/mace/macmace/mac89x0/cs89x0: Move the Macintosh (Apple) drivers") Signed-off-by: Geert Uytterhoeven Signed-off-by: David S. Miller commit 93ae6d2d2e0eef6973d634dd6e1a19ba1b031c30 Author: Geert Uytterhoeven Date: Wed Jul 31 15:22:10 2019 +0200 net: amd: Spelling s/case/cause/ Signed-off-by: Geert Uytterhoeven Signed-off-by: David S. Miller commit 14f1c0f2ff156c89b14fa4c52605e7586436ffb8 Author: Geert Uytterhoeven Date: Wed Jul 31 15:22:09 2019 +0200 net: 8390: Fix manufacturer name in Kconfig help text The help text refers to Western Digital instead of National Semiconductor 8390, presumably because it was copied from the former. Fixes: 644570b830266ff3 ("8390: Move the 8390 related drivers") Signed-off-by: Geert Uytterhoeven Signed-off-by: David S. Miller commit fc5b34a35458314df1dd00281f6e41f419581aa9 Author: Micah Morton Date: Thu Aug 1 10:28:27 2019 -0700 Add entry in MAINTAINERS file for SafeSetID LSM This LSM was added in v5.1 and needs an entry in the MAINTAINERS file. Signed-off-by: Micah Morton Acked-by: James Morris commit 944a83a2669ae8aa2c7664e79376ca7468eb0a2b Author: Matteo Croce Date: Thu Aug 1 14:13:30 2019 +0200 mvpp2: fix panic on module removal mvpp2 uses a delayed workqueue to gather traffic statistics. On module removal the workqueue can be destroyed before calling cancel_delayed_work_sync() on its works. Fix it by moving the destroy_workqueue() call after mvpp2_port_remove(). Also remove an unneeded call to flush_workqueue() # rmmod mvpp2 [ 2743.311722] mvpp2 f4000000.ethernet eth1: phy link down 10gbase-kr/10Gbps/Full [ 2743.320063] mvpp2 f4000000.ethernet eth1: Link is Down [ 2743.572263] mvpp2 f4000000.ethernet eth2: phy link down sgmii/1Gbps/Full [ 2743.580076] mvpp2 f4000000.ethernet eth2: Link is Down [ 2744.102169] mvpp2 f2000000.ethernet eth0: phy link down 10gbase-kr/10Gbps/Full [ 2744.110441] mvpp2 f2000000.ethernet eth0: Link is Down [ 2744.115614] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 [ 2744.115615] Mem abort info: [ 2744.115616] ESR = 0x96000005 [ 2744.115617] Exception class = DABT (current EL), IL = 32 bits [ 2744.115618] SET = 0, FnV = 0 [ 2744.115619] EA = 0, S1PTW = 0 [ 2744.115620] Data abort info: [ 2744.115621] ISV = 0, ISS = 0x00000005 [ 2744.115622] CM = 0, WnR = 0 [ 2744.115624] user pgtable: 4k pages, 39-bit VAs, pgdp=0000000422681000 [ 2744.115626] [0000000000000000] pgd=0000000000000000, pud=0000000000000000 [ 2744.115630] Internal error: Oops: 96000005 [#1] SMP [ 2744.115632] Modules linked in: mvpp2(-) algif_hash af_alg nls_iso8859_1 nls_cp437 vfat fat xhci_plat_hcd m25p80 spi_nor xhci_hcd mtd usbcore i2c_mv64xxx sfp usb_common marvell10g phy_generic spi_orion mdio_i2c i2c_core mvmdio phylink sbsa_gwdt ip_tables x_tables autofs4 [last unloaded: mvpp2] [ 2744.115654] CPU: 3 PID: 8357 Comm: kworker/3:2 Not tainted 5.3.0-rc2 #1 [ 2744.115655] Hardware name: Marvell 8040 MACCHIATOBin Double-shot (DT) [ 2744.115665] Workqueue: events_power_efficient phylink_resolve [phylink] [ 2744.115669] pstate: a0000085 (NzCv daIf -PAN -UAO) [ 2744.115675] pc : __queue_work+0x9c/0x4d8 [ 2744.115677] lr : __queue_work+0x170/0x4d8 [ 2744.115678] sp : ffffff801001bd50 [ 2744.115680] x29: ffffff801001bd50 x28: ffffffc422597600 [ 2744.115684] x27: ffffff80109ae6f0 x26: ffffff80108e4018 [ 2744.115688] x25: 0000000000000003 x24: 0000000000000004 [ 2744.115691] x23: ffffff80109ae6e0 x22: 0000000000000017 [ 2744.115694] x21: ffffffc42c030000 x20: ffffffc42209e8f8 [ 2744.115697] x19: 0000000000000000 x18: 0000000000000000 [ 2744.115699] x17: 0000000000000000 x16: 0000000000000000 [ 2744.115701] x15: 0000000000000010 x14: ffffffffffffffff [ 2744.115702] x13: ffffff8090e2b95f x12: ffffff8010e2b967 [ 2744.115704] x11: ffffff8010906000 x10: 0000000000000040 [ 2744.115706] x9 : ffffff80109223b8 x8 : ffffff80109223b0 [ 2744.115707] x7 : ffffffc42bc00068 x6 : 0000000000000000 [ 2744.115709] x5 : ffffffc42bc00000 x4 : 0000000000000000 [ 2744.115710] x3 : 0000000000000000 x2 : 0000000000000000 [ 2744.115712] x1 : 0000000000000008 x0 : ffffffc42c030000 [ 2744.115714] Call trace: [ 2744.115716] __queue_work+0x9c/0x4d8 [ 2744.115718] delayed_work_timer_fn+0x28/0x38 [ 2744.115722] call_timer_fn+0x3c/0x180 [ 2744.115723] expire_timers+0x60/0x168 [ 2744.115724] run_timer_softirq+0xbc/0x1e8 [ 2744.115727] __do_softirq+0x128/0x320 [ 2744.115731] irq_exit+0xa4/0xc0 [ 2744.115734] __handle_domain_irq+0x70/0xc0 [ 2744.115735] gic_handle_irq+0x58/0xa8 [ 2744.115737] el1_irq+0xb8/0x140 [ 2744.115738] console_unlock+0x3a0/0x568 [ 2744.115740] vprintk_emit+0x200/0x2a0 [ 2744.115744] dev_vprintk_emit+0x1c8/0x1e4 [ 2744.115747] dev_printk_emit+0x6c/0x7c [ 2744.115751] __netdev_printk+0x104/0x1d8 [ 2744.115752] netdev_printk+0x60/0x70 [ 2744.115756] phylink_resolve+0x38c/0x3c8 [phylink] [ 2744.115758] process_one_work+0x1f8/0x448 [ 2744.115760] worker_thread+0x54/0x500 [ 2744.115762] kthread+0x12c/0x130 [ 2744.115764] ret_from_fork+0x10/0x1c [ 2744.115768] Code: aa1403e0 97fffbbe aa0003f5 b4000700 (f9400261) Fixes: 118d6298f6f0 ("net: mvpp2: add ethtool GOP statistics") Signed-off-by: Lorenzo Bianconi Signed-off-by: Matteo Croce Acked-by: Antoine Tenart Signed-off-by: David S. Miller commit 020fb3bebc224dfe9353a56ecbe2d5fac499dffc Author: Wei Yongjun Date: Thu Aug 1 01:27:25 2019 +0000 RDMA/hns: Fix error return code in hns_roce_v1_rsv_lp_qp() Fix to return error code -ENOMEM from the rdma_zalloc_drv_obj() error handling case instead of 0, as done elsewhere in this function. Fixes: e8ac9389f0d7 ("RDMA: Fix allocation failure on pointer pd") Fixes: 21a428a019c9 ("RDMA: Handle PD allocations by IB/core") Signed-off-by: Wei Yongjun Reviewed-by: Leon Romanovsky Link: https://lore.kernel.org/r/20190801012725.150493-1-weiyongjun1@huawei.com Signed-off-by: Doug Ledford commit 9ca7ad6c7706edeae331c1632d0c63897418ebad Author: Jeffrey Hugo Date: Wed Jun 26 11:00:15 2019 -0700 drm: msm: Fix add_gpu_components add_gpu_components() adds found GPU nodes from the DT to the match list, regardless of the status of the nodes. This is a problem, because if the nodes are disabled, they should not be on the match list because they will not be matched. This prevents display from initing if a GPU node is defined, but it's status is disabled. Fix this by checking the node's status before adding it to the match list. Fixes: dc3ea265b856 (drm/msm: Drop the gpu binding) Reviewed-by: Rob Clark Signed-off-by: Jeffrey Hugo Signed-off-by: Sean Paul Link: https://patchwork.freedesktop.org/patch/msgid/20190626180015.45242-1-jeffrey.l.hugo@gmail.com commit 1f66072503316134873060b24b7895dbbcccf00e Author: Mauro Rossi Date: Thu Aug 1 09:04:34 2019 +0200 iwlwifi: dbg_ini: fix compile time assert build errors This patch fixes and preserves existing code style, and readability, for IWL_ERR() and IWL_WARN() macros invocations recently added in dbg.c Fixes the following build errors with Android build system: /home/utente/pie-x86_kernel/kernel/drivers/net/wireless/intel/iwlwifi/fw/dbg.c: In function '_iwl_fw_dbg_apply_point': /home/utente/pie-x86_kernel/kernel/drivers/net/wireless/intel/iwlwifi/fw/dbg.c:2445:3: error: call to '__compiletime_assert_2446' declared with attribute error: BUILD_BUG_ON failed: err_str[sizeof(err_str) - 2] != '\n' /home/utente/pie-x86_kernel/kernel/drivers/net/wireless/intel/iwlwifi/fw/dbg.c:2451:3: error: call to '__compiletime_assert_2452' declared with attribute error: BUILD_BUG_ON failed: err_str[sizeof(err_str) - 2] != '\n' ... /home/utente/pie-x86_kernel/kernel/drivers/net/wireless/intel/iwlwifi/fw/dbg.c:2789:5: error: call to '__compiletime_assert_2790' declared with attribute error: BUILD_BUG_ON failed: invalid_ap_str[sizeof(invalid_ap_str) - 2] != '\n' /home/utente/pie-x86_kernel/kernel/drivers/net/wireless/intel/iwlwifi/fw/dbg.c:2800:5: error: call to '__compiletime_assert_2801' declared with attribute error: BUILD_BUG_ON failed: invalid_ap_str[sizeof(invalid_ap_str) - 2] != '\n' Fixes: 427ab6385cf3 ("iwlwifi: dbg_ini: enforce apply point early on buffer allocation tlv") Fixes: 57d88b116175 ("iwlwifi: dbg_ini: support debug info TLV") Signed-off-by: Mauro Rossi Signed-off-by: Johannes Berg Reviewed-by: Nathan Chancellor Tested-by: Nathan Chancellor Signed-off-by: Kalle Valo commit 23eaf3b5c1a755e3193480c76fb29414be648688 Author: Leon Romanovsky Date: Wed Jul 31 11:38:52 2019 +0300 RDMA/mlx5: Release locks during notifier unregister The below kernel panic was observed when created bond mode LACP with GRE tunnel on top. The reason to it was not released spinlock during mlx5 notify unregsiter sequence. [ 234.562007] BUG: scheduling while atomic: sh/10900/0x00000002 [ 234.563005] Preemption disabled at: [ 234.566864] ------------[ cut here ]------------ [ 234.567120] DEBUG_LOCKS_WARN_ON(val > preempt_count()) [ 234.567139] WARNING: CPU: 16 PID: 10900 at kernel/sched/core.c:3203 preempt_count_sub+0xca/0x170 [ 234.569550] CPU: 16 PID: 10900 Comm: sh Tainted: G W 5.2.0-rc1-for-linust-dbg-2019-05-25_04-57-33-60 #1 [ 234.569886] Hardware name: Dell Inc. PowerEdge R720/0X3D66, BIOS 2.6.1 02/12/2018 [ 234.570183] RIP: 0010:preempt_count_sub+0xca/0x170 [ 234.570404] Code: 03 38 d0 7c 08 84 d2 0f 85 b0 00 00 00 8b 15 dd 02 03 04 85 d2 75 ba 48 c7 c6 00 e1 88 83 48 c7 c7 40 e1 88 83 e8 76 11 f7 ff <0f> 0b 5b c3 65 8b 05 d3 1f d8 7e 84 c0 75 82 e8 62 c3 c3 00 85 c0 [ 234.570911] RSP: 0018:ffff888b94477b08 EFLAGS: 00010286 [ 234.571133] RAX: 0000000000000000 RBX: 0000000000000001 RCX: 0000000000000000 [ 234.571391] RDX: 0000000000000000 RSI: 0000000000000004 RDI: 0000000000000246 [ 234.571648] RBP: ffff888ba5560000 R08: fffffbfff08962d5 R09: fffffbfff08962d5 [ 234.571902] R10: 0000000000000001 R11: fffffbfff08962d4 R12: ffff888bac6e9548 [ 234.572157] R13: ffff888babfaf728 R14: ffff888bac6e9568 R15: ffff888babfaf750 [ 234.572412] FS: 00007fcafa59b740(0000) GS:ffff888bed200000(0000) knlGS:0000000000000000 [ 234.572686] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 234.572914] CR2: 00007f984f16b140 CR3: 0000000b2bf0a001 CR4: 00000000001606e0 [ 234.573172] Call Trace: [ 234.573336] _raw_spin_unlock+0x2e/0x50 [ 234.573542] mlx5_ib_unbind_slave_port+0x1bc/0x690 [mlx5_ib] [ 234.573793] mlx5_ib_cleanup_multiport_master+0x1d3/0x660 [mlx5_ib] [ 234.574039] mlx5_ib_stage_init_cleanup+0x4c/0x360 [mlx5_ib] [ 234.574271] ? kfree+0xf5/0x2f0 [ 234.574465] __mlx5_ib_remove+0x61/0xd0 [mlx5_ib] [ 234.574688] ? __mlx5_ib_remove+0xd0/0xd0 [mlx5_ib] [ 234.574951] mlx5_remove_device+0x234/0x300 [mlx5_core] [ 234.575224] mlx5_unregister_device+0x4d/0x1e0 [mlx5_core] [ 234.575493] remove_one+0x4f/0x160 [mlx5_core] [ 234.575704] pci_device_remove+0xef/0x2a0 [ 234.581407] ? pcibios_free_irq+0x10/0x10 [ 234.587143] ? up_read+0xc1/0x260 [ 234.592785] device_release_driver_internal+0x1ab/0x430 [ 234.598442] unbind_store+0x152/0x200 [ 234.604064] ? sysfs_kf_write+0x3b/0x180 [ 234.609441] ? sysfs_file_ops+0x160/0x160 [ 234.615021] kernfs_fop_write+0x277/0x440 [ 234.620288] ? __sb_start_write+0x1ef/0x2c0 [ 234.625512] vfs_write+0x15e/0x460 [ 234.630786] ksys_write+0x156/0x1e0 [ 234.635988] ? __ia32_sys_read+0xb0/0xb0 [ 234.641120] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 234.646163] do_syscall_64+0x95/0x470 [ 234.651106] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 234.656004] RIP: 0033:0x7fcaf9c9cfd0 [ 234.660686] Code: 73 01 c3 48 8b 0d c0 6e 2d 00 f7 d8 64 89 01 48 83 c8 ff c3 66 0f 1f 44 00 00 83 3d cd cf 2d 00 00 75 10 b8 01 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 31 c3 48 83 ec 08 e8 ee cb 01 00 48 89 04 24 [ 234.670128] RSP: 002b:00007ffd3b01ddd8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 234.674811] RAX: ffffffffffffffda RBX: 000000000000000d RCX: 00007fcaf9c9cfd0 [ 234.679387] RDX: 000000000000000d RSI: 00007fcafa5c1000 RDI: 0000000000000001 [ 234.683848] RBP: 00007fcafa5c1000 R08: 000000000000000a R09: 00007fcafa59b740 [ 234.688167] R10: 00007ffd3b01d8e0 R11: 0000000000000246 R12: 00007fcaf9f75400 [ 234.692386] R13: 000000000000000d R14: 0000000000000001 R15: 0000000000000000 [ 234.696495] irq event stamp: 153067 [ 234.700525] hardirqs last enabled at (153067): [] _raw_spin_unlock_irqrestore+0x59/0x70 [ 234.704665] hardirqs last disabled at (153066): [] _raw_spin_lock_irqsave+0x22/0x90 [ 234.708722] softirqs last enabled at (153058): [] __do_softirq+0x6c5/0xb4e [ 234.712673] softirqs last disabled at (153051): [] irq_exit+0x17d/0x1d0 [ 234.716601] ---[ end trace 5dbf096843ee9ce6 ]--- Fixes: df097a278c75 ("IB/mlx5: Use the new mlx5 core notifier API") Signed-off-by: Leon Romanovsky Link: https://lore.kernel.org/r/20190731083852.584-1-leon@kernel.org Signed-off-by: Doug Ledford commit a29d56c2ed24ad33062bfdafdec9e34149715320 Author: Heikki Krogerus Date: Thu Aug 1 10:55:12 2019 +0300 usb: typec: ucsi: ccg: Fix uninitilized symbol error Fix smatch error: drivers/usb/typec/ucsi/ucsi_ccg.c:975 ccg_fw_update() error: uninitialized symbol 'err'. Fixes: 5c9ae5a87573 ("usb: typec: ucsi: ccg: add firmware flashing support") Cc: stable@vger.kernel.org Reported-by: kbuild test robot Signed-off-by: Heikki Krogerus Link: https://lore.kernel.org/r/20190801075512.24354-1-heikki.krogerus@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit 6497d0a9c53df6e98b25e2b79f2295d7caa47b6e Author: Gustavo A. R. Silva Date: Wed Jul 31 12:54:28 2019 -0500 IB/hfi1: Fix Spectre v1 vulnerability sl is controlled by user-space, hence leading to a potential exploitation of the Spectre variant 1 vulnerability. Fix this by sanitizing sl before using it to index ibp->sl_to_sc. Notice that given that speculation windows are large, the policy is to kill the speculation on the first load and not worry if it can be completed with a dependent load/store [1]. [1] https://lore.kernel.org/lkml/20180423164740.GY17484@dhcp22.suse.cz/ Cc: stable@vger.kernel.org Signed-off-by: Gustavo A. R. Silva Link: https://lore.kernel.org/r/20190731175428.GA16736@embeddedor Signed-off-by: Doug Ledford commit 770b7d96cfff6a8bf6c9f261ba6f135dc9edf484 Author: Jack Morgenstein Date: Thu Aug 1 15:14:49 2019 +0300 IB/mad: Fix use-after-free in ib mad completion handling We encountered a use-after-free bug when unloading the driver: [ 3562.116059] BUG: KASAN: use-after-free in ib_mad_post_receive_mads+0xddc/0xed0 [ib_core] [ 3562.117233] Read of size 4 at addr ffff8882ca5aa868 by task kworker/u13:2/23862 [ 3562.118385] [ 3562.119519] CPU: 2 PID: 23862 Comm: kworker/u13:2 Tainted: G OE 5.1.0-for-upstream-dbg-2019-05-19_16-44-30-13 #1 [ 3562.121806] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu2 04/01/2014 [ 3562.123075] Workqueue: ib-comp-unb-wq ib_cq_poll_work [ib_core] [ 3562.124383] Call Trace: [ 3562.125640] dump_stack+0x9a/0xeb [ 3562.126911] print_address_description+0xe3/0x2e0 [ 3562.128223] ? ib_mad_post_receive_mads+0xddc/0xed0 [ib_core] [ 3562.129545] __kasan_report+0x15c/0x1df [ 3562.130866] ? ib_mad_post_receive_mads+0xddc/0xed0 [ib_core] [ 3562.132174] kasan_report+0xe/0x20 [ 3562.133514] ib_mad_post_receive_mads+0xddc/0xed0 [ib_core] [ 3562.134835] ? find_mad_agent+0xa00/0xa00 [ib_core] [ 3562.136158] ? qlist_free_all+0x51/0xb0 [ 3562.137498] ? mlx4_ib_sqp_comp_worker+0x1970/0x1970 [mlx4_ib] [ 3562.138833] ? quarantine_reduce+0x1fa/0x270 [ 3562.140171] ? kasan_unpoison_shadow+0x30/0x40 [ 3562.141522] ib_mad_recv_done+0xdf6/0x3000 [ib_core] [ 3562.142880] ? _raw_spin_unlock_irqrestore+0x46/0x70 [ 3562.144277] ? ib_mad_send_done+0x1810/0x1810 [ib_core] [ 3562.145649] ? mlx4_ib_destroy_cq+0x2a0/0x2a0 [mlx4_ib] [ 3562.147008] ? _raw_spin_unlock_irqrestore+0x46/0x70 [ 3562.148380] ? debug_object_deactivate+0x2b9/0x4a0 [ 3562.149814] __ib_process_cq+0xe2/0x1d0 [ib_core] [ 3562.151195] ib_cq_poll_work+0x45/0xf0 [ib_core] [ 3562.152577] process_one_work+0x90c/0x1860 [ 3562.153959] ? pwq_dec_nr_in_flight+0x320/0x320 [ 3562.155320] worker_thread+0x87/0xbb0 [ 3562.156687] ? __kthread_parkme+0xb6/0x180 [ 3562.158058] ? process_one_work+0x1860/0x1860 [ 3562.159429] kthread+0x320/0x3e0 [ 3562.161391] ? kthread_park+0x120/0x120 [ 3562.162744] ret_from_fork+0x24/0x30 ... [ 3562.187615] Freed by task 31682: [ 3562.188602] save_stack+0x19/0x80 [ 3562.189586] __kasan_slab_free+0x11d/0x160 [ 3562.190571] kfree+0xf5/0x2f0 [ 3562.191552] ib_mad_port_close+0x200/0x380 [ib_core] [ 3562.192538] ib_mad_remove_device+0xf0/0x230 [ib_core] [ 3562.193538] remove_client_context+0xa6/0xe0 [ib_core] [ 3562.194514] disable_device+0x14e/0x260 [ib_core] [ 3562.195488] __ib_unregister_device+0x79/0x150 [ib_core] [ 3562.196462] ib_unregister_device+0x21/0x30 [ib_core] [ 3562.197439] mlx4_ib_remove+0x162/0x690 [mlx4_ib] [ 3562.198408] mlx4_remove_device+0x204/0x2c0 [mlx4_core] [ 3562.199381] mlx4_unregister_interface+0x49/0x1d0 [mlx4_core] [ 3562.200356] mlx4_ib_cleanup+0xc/0x1d [mlx4_ib] [ 3562.201329] __x64_sys_delete_module+0x2d2/0x400 [ 3562.202288] do_syscall_64+0x95/0x470 [ 3562.203277] entry_SYSCALL_64_after_hwframe+0x49/0xbe The problem was that the MAD PD was deallocated before the MAD CQ. There was completion work pending for the CQ when the PD got deallocated. When the mad completion handling reached procedure ib_mad_post_receive_mads(), we got a use-after-free bug in the following line of code in that procedure: sg_list.lkey = qp_info->port_priv->pd->local_dma_lkey; (the pd pointer in the above line is no longer valid, because the pd has been deallocated). We fix this by allocating the PD before the CQ in procedure ib_mad_port_open(), and deallocating the PD after freeing the CQ in procedure ib_mad_port_close(). Since the CQ completion work queue is flushed during ib_free_cq(), no completions will be pending for that CQ when the PD is later deallocated. Note that freeing the CQ before deallocating the PD is the practice in the ULPs. Fixes: 4be90bc60df4 ("IB/mad: Remove ib_get_dma_mr calls") Signed-off-by: Jack Morgenstein Signed-off-by: Leon Romanovsky Link: https://lore.kernel.org/r/20190801121449.24973-1-leon@kernel.org Signed-off-by: Doug Ledford commit 52e0a118a20308dd6aa531e20a5ab5907d2264c8 Author: Gal Pressman Date: Thu Aug 1 13:43:54 2019 +0300 RDMA/restrack: Track driver QP types in resource tracker The check for QP type different than XRC has excluded driver QP types from the resource tracker. As a result, "rdma resource show" user command would not show opened driver QPs which does not reflect the real state of the system. Check QP type explicitly instead of assuming enum values/ordering. Fixes: 40909f664d27 ("RDMA/efa: Add EFA verbs implementation") Signed-off-by: Gal Pressman Reviewed-by: Leon Romanovsky Link: https://lore.kernel.org/r/20190801104354.11417-1-galpress@amazon.com Signed-off-by: Doug Ledford commit e5366d309a772fef264ec85e858f9ea46f939848 Author: Guy Levi Date: Wed Jul 31 11:19:29 2019 +0300 IB/mlx5: Fix MR registration flow to use UMR properly Driver shouldn't allow to use UMR to register a MR when umr_modify_atomic_disabled is set. Otherwise it will always end up with a failure in the post send flow which sets the UMR WQE to modify atomic access right. Fixes: c8d75a980fab ("IB/mlx5: Respect new UMR capabilities") Signed-off-by: Guy Levi Reviewed-by: Moni Shoua Signed-off-by: Leon Romanovsky Link: https://lore.kernel.org/r/20190731081929.32559-1-leon@kernel.org Signed-off-by: Doug Ledford commit 9cd5881719e9555cae300ec8b389eda3c8101339 Author: Jason Gunthorpe Date: Wed Jul 31 11:18:41 2019 +0300 RDMA/devices: Remove the lock around remove_client_context Due to the complexity of client->remove() callbacks it is desirable to not hold any locks while calling them. Remove the last one by tracking only the highest client ID and running backwards from there over the xarray. Since the only purpose of that lock was to protect the linked list, we can drop the lock. Signed-off-by: Jason Gunthorpe Signed-off-by: Leon Romanovsky Link: https://lore.kernel.org/r/20190731081841.32345-3-leon@kernel.org Signed-off-by: Doug Ledford commit 621e55ff5b8e0ab5d1063f0eae0ef3960bef8f6e Author: Jason Gunthorpe Date: Wed Jul 31 11:18:40 2019 +0300 RDMA/devices: Do not deadlock during client removal lockdep reports: WARNING: possible circular locking dependency detected modprobe/302 is trying to acquire lock: 0000000007c8919c ((wq_completion)ib_cm){+.+.}, at: flush_workqueue+0xdf/0x990 but task is already holding lock: 000000002d3d2ca9 (&device->client_data_rwsem){++++}, at: remove_client_context+0x79/0xd0 [ib_core] which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #2 (&device->client_data_rwsem){++++}: down_read+0x3f/0x160 ib_get_net_dev_by_params+0xd5/0x200 [ib_core] cma_ib_req_handler+0x5f6/0x2090 [rdma_cm] cm_process_work+0x29/0x110 [ib_cm] cm_req_handler+0x10f5/0x1c00 [ib_cm] cm_work_handler+0x54c/0x311d [ib_cm] process_one_work+0x4aa/0xa30 worker_thread+0x62/0x5b0 kthread+0x1ca/0x1f0 ret_from_fork+0x24/0x30 -> #1 ((work_completion)(&(&work->work)->work)){+.+.}: process_one_work+0x45f/0xa30 worker_thread+0x62/0x5b0 kthread+0x1ca/0x1f0 ret_from_fork+0x24/0x30 -> #0 ((wq_completion)ib_cm){+.+.}: lock_acquire+0xc8/0x1d0 flush_workqueue+0x102/0x990 cm_remove_one+0x30e/0x3c0 [ib_cm] remove_client_context+0x94/0xd0 [ib_core] disable_device+0x10a/0x1f0 [ib_core] __ib_unregister_device+0x5a/0xe0 [ib_core] ib_unregister_device+0x21/0x30 [ib_core] mlx5_ib_stage_ib_reg_cleanup+0x9/0x10 [mlx5_ib] __mlx5_ib_remove+0x3d/0x70 [mlx5_ib] mlx5_ib_remove+0x12e/0x140 [mlx5_ib] mlx5_remove_device+0x144/0x150 [mlx5_core] mlx5_unregister_interface+0x3f/0xf0 [mlx5_core] mlx5_ib_cleanup+0x10/0x3a [mlx5_ib] __x64_sys_delete_module+0x227/0x350 do_syscall_64+0xc3/0x6a4 entry_SYSCALL_64_after_hwframe+0x49/0xbe Which is due to the read side of the client_data_rwsem being obtained recursively through a work queue flush during cm client removal. The lock is being held across the remove in remove_client_context() so that the function is a fence, once it returns the client is removed. This is required so that the two callers do not proceed with destruction until the client completes removal. Instead of using client_data_rwsem use the existing device unregistration refcount and add a similar client unregistration (client->uses) refcount. This will fence the two unregistration paths without holding any locks. Cc: Fixes: 921eab1143aa ("RDMA/devices: Re-organize device.c locking") Signed-off-by: Jason Gunthorpe Signed-off-by: Leon Romanovsky Link: https://lore.kernel.org/r/20190731081841.32345-2-leon@kernel.org Signed-off-by: Doug Ledford commit 61f259821dd3306e49b7d42a3f90fb5a4ff3351b Author: Luck, Tony Date: Tue Jul 30 21:39:57 2019 -0700 IB/core: Add mitigation for Spectre V1 Some processors may mispredict an array bounds check and speculatively access memory that they should not. With a user supplied array index we like to play things safe by masking the value with the array size before it is used as an index. Signed-off-by: Tony Luck Link: https://lore.kernel.org/r/20190731043957.GA1600@agluck-desk2.amr.corp.intel.com Signed-off-by: Doug Ledford commit 7732d20a160c76006c7fe7bca5178aea6af1d2e8 Author: Qian Cai Date: Thu Aug 1 10:47:05 2019 -0400 arm64/mm: fix variable 'tag' set but not used When CONFIG_KASAN_SW_TAGS=n, set_tag() is compiled away. GCC throws a warning, mm/kasan/common.c: In function '__kasan_kmalloc': mm/kasan/common.c:464:5: warning: variable 'tag' set but not used [-Wunused-but-set-variable] u8 tag = 0xff; ^~~ Fix it by making __tag_set() a static inline function the same as arch_kasan_set_tag() in mm/kasan/kasan.h for consistency because there is a macro in arch/arm64/include/asm/kasan.h, #define arch_kasan_set_tag(addr, tag) __tag_set(addr, tag) However, when CONFIG_DEBUG_VIRTUAL=n and CONFIG_SPARSEMEM_VMEMMAP=y, page_to_virt() will call __tag_set() with incorrect type of a parameter, so fix that as well. Also, still let page_to_virt() return "void *" instead of "const void *", so will not need to add a similar cast in lowmem_page_address(). Signed-off-by: Qian Cai Signed-off-by: Will Deacon commit 6bbfe4e602691b90ac866712bd4c43c51e546a60 Author: Jiri Olsa Date: Thu Aug 1 16:26:42 2019 +0200 perf bench numa: Fix cpu0 binding Michael reported an issue with perf bench numa failing with binding to cpu0 with '-0' option. # perf bench numa mem -p 3 -t 1 -P 512 -s 100 -zZcm0 --thp 1 -M 1 -ddd # Running 'numa/mem' benchmark: # Running main, "perf bench numa numa-mem -p 3 -t 1 -P 512 -s 100 -zZcm0 --thp 1 -M 1 -ddd" binding to node 0, mask: 0000000000000001 => -1 perf: bench/numa.c:356: bind_to_memnode: Assertion `!(ret)' failed. Aborted (core dumped) This happens when the cpu0 is not part of node0, which is the benchmark assumption and we can see that's not the case for some powerpc servers. Using correct node for cpu0 binding. Reported-by: Michael Petlan Signed-off-by: Jiri Olsa Cc: Alexander Shishkin Cc: Andi Kleen Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Satheesh Rajendran Link: http://lkml.kernel.org/r/20190801142642.28004-1-jolsa@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit c14b5dce5ece48035cfd0aa951b39c69ad5056f4 Author: Jordan Crouse Date: Thu Jul 25 10:53:08 2019 -0600 drm/msm: Annotate intentional switch statement fall throughs Explicitly mark intentional fall throughs in switch statements to keep -Wimplicit-fallthrough from complaining. Reviewed-by: Rob Clark Signed-off-by: Jordan Crouse Signed-off-by: Sean Paul Link: https://patchwork.freedesktop.org/patch/msgid/1564073588-27386-1-git-send-email-jcrouse@codeaurora.org commit 2bab52af6fe68c43b327a57e5ce5fc10eefdfadf Author: Brian Masney Date: Fri May 31 05:46:15 2019 -0400 drm/msm: add support for per-CRTC max_vblank_count on mdp5 The mdp5 drm/kms driver currently does not work on command-mode DSI panels due to 'vblank wait timed out' errors. This causes a latency of seconds, or tens of seconds in some cases, before content is shown on the panel. This hardware does not have the something that we can use as a frame counter available when running in command mode, so we need to fall back to using timestamps by setting the max_vblank_count to zero. This can be done on a per-CRTC basis, so the convert mdp5 to use drm_crtc_set_max_vblank_count(). This change was tested on a LG Nexus 5 (hammerhead) phone. Suggested-by: Jeffrey Hugo Reviewed-by: Jeffrey Hugo Signed-off-by: Brian Masney Signed-off-by: Sean Paul Link: https://patchwork.freedesktop.org/patch/msgid/20190531094619.31704-3-masneyb@onstation.org commit 7d4e2dcf311d3b98421d1f119efe5964cafa32fc Author: Qian Cai Date: Wed Jul 31 16:05:45 2019 -0400 arm64/mm: fix variable 'pud' set but not used GCC throws a warning, arch/arm64/mm/mmu.c: In function 'pud_free_pmd_page': arch/arm64/mm/mmu.c:1033:8: warning: variable 'pud' set but not used [-Wunused-but-set-variable] pud_t pud; ^~~ because pud_table() is a macro and compiled away. Fix it by making it a static inline function and for pud_sect() as well. Signed-off-by: Qian Cai Signed-off-by: Will Deacon commit 760d8ed069c4e32a92e2ba251a3b0d9a87a3e771 Author: Masami Hiramatsu Date: Thu Jul 25 17:16:25 2019 +0900 arm64: Remove unneeded rcu_read_lock from debug handlers Remove rcu_read_lock()/rcu_read_unlock() from debug exception handlers since we are sure those are not preemptible and interrupts are off. Acked-by: Paul E. McKenney Signed-off-by: Masami Hiramatsu Signed-off-by: Will Deacon commit ee07b93e7721ccd5d5b9fa6f0c10cb3fe2f1f4f9 Author: Masami Hiramatsu Date: Thu Jul 25 17:16:05 2019 +0900 arm64: unwind: Prohibit probing on return_address() Prohibit probing on return_address() and subroutines which is called from return_address(), since the it is invoked from trace_hardirqs_off() which is also kprobe blacklisted. Reported-by: Naresh Kamboju Signed-off-by: Masami Hiramatsu Signed-off-by: Will Deacon commit 677379bc9139ac24b310a281fcb21a2f04288353 Author: Julien Thierry Date: Mon Jul 29 15:57:46 2019 +0100 arm64: Lower priority mask for GIC_PRIO_IRQON On a system with two security states, if SCR_EL3.FIQ is cleared, non-secure IRQ priorities get shifted to fit the secure view but priority masks aren't. On such system, it turns out that GIC_PRIO_IRQON masks the priority of normal interrupts, which obviously ends up in a hang. Increase GIC_PRIO_IRQON value (i.e. lower priority) to make sure interrupts are not blocked by it. Cc: Oleg Nesterov Fixes: bd82d4bd21880b7c ("arm64: Fix incorrect irqflag restore for priority masking") Acked-by: Marc Zyngier Signed-off-by: Julien Thierry Signed-off-by: Catalin Marinas [will: fixed Fixes: tag] Signed-off-by: Will Deacon commit 1e78030e5e5b2d8b0cad7136caf9cfab986a6bff Merge: 28f5ab1e12ba 3a6ffb3c8c32 Author: Linus Torvalds Date: Thu Aug 1 06:37:42 2019 -0700 Merge tag 'mmc-v5.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc Pull MMC fixes from Ulf Hansson: - sdhci-sprd: Add a missing pm_runtime_put_noidle() to fix deferred probe - dw_mmc: Fix occasional hang after tuning on eMMC - meson-mx-sdio: Fix misuse of GENMASK macro - mmc_spi: Fix CRC problems for writes by using BDI_CAP_STABLE_WRITES * tag 'mmc-v5.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc: mmc: mmc_spi: Enable stable writes mmc: meson-mx-sdio: Fix misuse of GENMASK macro mmc: dw_mmc: Fix occasional hang after tuning on eMMC mmc: host: sdhci-sprd: Fix the missing pm_runtime_put_noidle() commit 28f5ab1e12ba702389c41bc95d02733673020d85 Merge: 5c6207539aea d95da993383c Author: Linus Torvalds Date: Thu Aug 1 06:26:30 2019 -0700 Merge tag 'gpio-v5.3-3' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio Pull GPIO fixes from Linus Walleij: "Three GPIO fixes, all touching the core, so quite important: - Fix the request of active low GPIO line events. - Don't issue WARN() stuff on NULL descriptors if the GPIOLIB is disabled. - Preserve the descriptor flags when setting the initial direction on lines" * tag 'gpio-v5.3-3' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio: gpiolib: Preserve desc->flags when setting state gpio: don't WARN() on NULL descs if gpiolib is disabled gpiolib: fix incorrect IRQ requesting of an active-low lineevent commit 811ba489fa524ec634933cdf83aaf6c007a4c004 Author: Nishka Dasgupta Date: Wed Jul 24 14:02:31 2019 +0530 regulator: of: Add of_node_put() before return in function The local variable search in regulator_of_get_init_node takes the value returned by either of_get_child_by_name or of_node_get, both of which get a node. If this node is not put before returning, it could cause a memory leak. Hence put search before a mid-loop return statement. Issue found with Coccinelle. Signed-off-by: Nishka Dasgupta Link: https://lore.kernel.org/r/20190724083231.10276-1-nishkadg.linux@gmail.com Signed-off-by: Mark Brown commit 58540594570778fd149cd8c9b2bff61f2cefa8c9 Author: Thomas Zimmermann Date: Wed Jul 3 09:58:34 2019 +0200 drm/bochs: Use shadow buffer for bochs framebuffer console The bochs driver (and virtual hardware) requires buffer objects to reside in video ram to display them to the screen. So it can not display the framebuffer console because the respective buffer object is permanently pinned in system memory. Using a shadow buffer for the console solves this problem. The console emulation will pin the buffer object only during updates from the shadow buffer. Otherwise, the bochs driver can freely relocated the buffer between system memory and video ram. v2: * select shadow FB via struct drm_mode_config.prefer_shadow_fbdev Signed-off-by: Thomas Zimmermann Acked-by: Noralf Trønnes Link: https://patchwork.freedesktop.org/patch/315833/ Signed-off-by: Gerd Hoffmann commit 01b947afaa940327e7adf57070a4bf3d0bed9810 Author: Thomas Zimmermann Date: Fri Jul 5 09:31:00 2019 +0200 drm/fb-helper: Instanciate shadow FB if configured in device's mode_config Generic framebuffer emulation uses a shadow buffer for framebuffers with dirty() function. If drivers want to use the shadow FB without such a function, they can now set prefer_shadow or prefer_shadow_fbdev in their mode_config structures. The former flag is exported to userspace, the latter flag is fbdev-only. v3: * only schedule dirty worker if fbdev uses shadow fb * test shadow fb settings with boolean operators * use bool for struct drm_mode_config.prefer_shadow_fbdev * fix documentation comments Signed-off-by: Thomas Zimmermann Reviewed-by: Noralf Trønnes Tested-by: Noralf Trønnes Link: https://patchwork.freedesktop.org/patch/315834/ Signed-off-by: Gerd Hoffmann commit 87e281f88f3aa4ed401554f793685bcb2463580a Author: Thomas Zimmermann Date: Wed Jul 3 09:58:24 2019 +0200 drm/fb-helper: Map DRM client buffer only when required This patch changes DRM clients to not map the buffer by default. The buffer, like any buffer object, should be mapped and unmapped when needed. An unmapped buffer object can be evicted to system memory and does not consume video ram until displayed. This allows to use generic fbdev emulation with drivers for low-memory devices, such as ast and mgag200. This change affects the generic framebuffer console. HW-based consoles map their console buffer once and keep it mapped. Userspace can mmap this buffer into its address space. The shadow-buffered framebuffer console only needs the buffer object to be mapped during updates. While not being updated from the shadow buffer, the buffer object can remain unmapped. Userspace will always mmap the shadow buffer. v2: * change DRM client to not map buffer by default * manually map client buffer for fbdev with HW framebuffer Signed-off-by: Thomas Zimmermann Reviewed-by: Noralf Trønnes Link: https://patchwork.freedesktop.org/patch/315830/ Signed-off-by: Gerd Hoffmann commit d9b42dfab513c9130ee0458f2e6febb75c89d1c8 Author: Thomas Zimmermann Date: Wed Jul 3 09:58:18 2019 +0200 drm/client: Support unmapping of DRM client buffers DRM clients, such as the fbdev emulation, have their buffer objects mapped by default. Mapping a buffer implicitly prevents its relocation. Hence, the buffer may permanently consume video memory while it's allocated. This is a problem for drivers of low-memory devices, such as ast, mgag200 or older framebuffer hardware, which will then not have enough memory to display other content (e.g., X11). This patch introduces drm_client_buffer_vmap() and _vunmap(). Internal DRM clients can use these functions to unmap and remap buffer objects as needed. There's no reference counting for vmap operations. Callers are expected to either keep buffers mapped (as it is now), or call vmap and vunmap in pairs around code that accesses the mapped memory. v2: * remove several duplicated NULL-pointer checks v3: * style and typo fixes Signed-off-by: Thomas Zimmermann Reviewed-by: Noralf Trønnes Link: https://patchwork.freedesktop.org/patch/315831/ Signed-off-by: Gerd Hoffmann commit fd01eecdf9591453177d7b06faaabef8c300114a Author: Rayagonda Kokatanur Date: Wed Jul 24 13:58:27 2019 +0530 i2c: iproc: Fix i2c master read more than 63 bytes Use SMBUS_MASTER_DATA_READ.MASTER_RD_STATUS bit to check for RX FIFO empty condition because SMBUS_MASTER_FIFO_CONTROL.MASTER_RX_PKT_COUNT is not updated for read >= 64 bytes. This fixes the issue when trying to read from the I2C slave more than 63 bytes. Fixes: c24b8d574b7c ("i2c: iproc: Extend I2C read up to 255 bytes") Cc: stable@kernel.org Signed-off-by: Rayagonda Kokatanur Reviewed-by: Ray Jui Signed-off-by: Wolfram Sang commit f2c5ed0dd5004c2cff5c0e3d430a107576fcc17f Author: James Bottomley Date: Thu Aug 1 13:47:03 2019 +0200 parisc: Add archclean Makefile target Apparently we don't have an archclean target in our arch/parisc/Makefile, so files in there never get cleaned out by make mrproper. This, in turn means that the sizes.h file in arch/parisc/boot/compressed never gets removed and worse, when you transition to an O=build/parisc[64] build model it overrides the generated file. The upshot being my bzImage was building with a SZ_end that was too small. I fixed it by making mrproper clean everything. Signed-off-by: James Bottomley Cc: stable@vger.kernel.org # v4.20+ Signed-off-by: Helge Deller commit e50beea8e7738377b4fa664078547be338038ff9 Author: Helge Deller Date: Thu Aug 1 13:42:18 2019 +0200 parisc: Strip debug info from kernel before creating compressed vmlinuz Same as on x86-64, strip the .comment, .note and debug sections from the Linux kernel before creating the compressed image for the boot loader. Reported-by: James Bottomley Reported-by: Sven Schnelle Cc: stable@vger.kernel.org # v4.20+ Signed-off-by: Helge Deller commit 3fe6c873af2f2247544debdbe51ec29f690a2ccf Author: Helge Deller Date: Thu Aug 1 13:33:39 2019 +0200 parisc: Fix build of compressed kernel even with debug enabled With debug info enabled (CONFIG_DEBUG_INFO=y) the resulting vmlinux may get that huge that we need to increase the start addresss for the decompression text section otherwise one will face a linker error. Reported-by: Sven Schnelle Tested-by: Sven Schnelle Cc: stable@vger.kernel.org # v4.14+ Signed-off-by: Helge Deller commit 3a5ff11be8dc1f5ea4e89158623204672fc588de Merge: 609488bc979f 25e5ef302c24 Author: Wolfram Sang Date: Thu Aug 1 14:05:17 2019 +0200 Merge tag 'at24-v5.3-rc3-fixes-for-wolfram' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux into i2c/for-current at24 fixes for v5.3-rc3 - make spd eeproms world-readable again commit 4b9bb9728c915c6079619e71e3340fe4840d9d40 Author: Chris Wilson Date: Wed Jun 26 16:45:48 2019 +0100 drm/i915: Only recover active engines If we issue a reset to a currently idle engine, leave it idle afterwards. This is useful to excise a linkage between reset and the shrinker. When waking the engine, we need to pin the default context image which we use for overwriting a guilty context -- if the engine is idle we do not need this pinned image! However, this pinning means that waking the engine acquires the FS_RECLAIM, and so may trigger the shrinker. The shrinker itself may need to wait upon the GPU to unbind and object and so may require services of reset; ergo we should avoid the engine wake up path. The danger in skipping the recovery for idle engines is that we leave the engine with no context defined, which may interfere with the operation of the power context on some older platforms. In practice, we should only be resetting an active GPU but it something to look out for on Ironlake (if memory serves). Fixes: 79ffac8599c4 ("drm/i915: Invert the GEM wakeref hierarchy") Signed-off-by: Chris Wilson Reviewed-by: Mika Kuoppala Cc: Tvrtko Ursulin Cc: Imre Deak Link: https://patchwork.freedesktop.org/patch/msgid/20190626154549.10066-2-chris@chris-wilson.co.uk (cherry picked from commit 18398904ca9e3ddd180e2ecd45886e146b1d9d5b) Signed-off-by: Jani Nikula commit b1fa6fd94fc6a5d6be85359743b5f3626f3f881c Author: Chris Wilson Date: Wed Jun 26 16:45:47 2019 +0100 drm/i915: Add a wakeref getter for iff the wakeref is already active For use in the next patch, we want to acquire a wakeref without having to wake the device up -- i.e. only acquire the engine wakeref if the engine is already active. Signed-off-by: Chris Wilson Reviewed-by: Mika Kuoppala Link: https://patchwork.freedesktop.org/patch/msgid/20190626154549.10066-1-chris@chris-wilson.co.uk (cherry picked from commit de5147b8ce6d51f634661d7c531385371485cec6) Signed-off-by: Jani Nikula commit 0de50e40fc685fed4d6896a379b123f859ffb17b Author: Chris Wilson Date: Wed Jun 26 16:45:49 2019 +0100 drm/i915: Lift intel_engines_resume() to callers Since the reset path wants to recover the engines itself, it only wants to reinitialise the hardware using i915_gem_init_hw(). Pull the call to intel_engines_resume() to the module init/resume path so we can avoid it during reset. Fixes: 79ffac8599c4 ("drm/i915: Invert the GEM wakeref hierarchy") Signed-off-by: Chris Wilson Reviewed-by: Mika Kuoppala Cc: Tvrtko Ursulin Cc: Imre Deak Link: https://patchwork.freedesktop.org/patch/msgid/20190626154549.10066-3-chris@chris-wilson.co.uk (cherry picked from commit 092be382a2602067766f190a113514d469162456) Signed-off-by: Jani Nikula commit b877ac9815a8fe7e5f6d7fdde3dc34652408840a Author: Juergen Gross Date: Fri Jun 14 07:46:04 2019 +0200 xen/swiotlb: remember having called xen_create_contiguous_region() Instead of always calling xen_destroy_contiguous_region() in case the memory is DMA-able for the used device, do so only in case it has been made DMA-able via xen_create_contiguous_region() before. This will avoid a lot of xen_destroy_contiguous_region() calls for 64-bit capable devices. As the memory in question is owned by swiotlb-xen the PG_owner_priv_1 flag of the first allocated page can be used for remembering. Signed-off-by: Juergen Gross Acked-by: Konrad Rzeszutek Wilk Signed-off-by: Juergen Gross commit bf70726668c6116aa4976e0cc87f470be6268a2f Author: Juergen Gross Date: Fri Jun 14 07:46:03 2019 +0200 xen/swiotlb: simplify range_straddles_page_boundary() range_straddles_page_boundary() is open coding several macros from include/xen/page.h. Use those instead. Additionally there is no need to have check_pages_physically_contiguous() as a separate function as it is used only once, so merge it into range_straddles_page_boundary(). Signed-off-by: Juergen Gross Reviewed-by: Boris Ostrovsky Acked-by: Konrad Rzeszutek Wilk Signed-off-by: Juergen Gross commit 50f6393f9654c561df4cdcf8e6cfba7260143601 Author: Juergen Gross Date: Fri Jun 14 07:46:02 2019 +0200 xen/swiotlb: fix condition for calling xen_destroy_contiguous_region() The condition in xen_swiotlb_free_coherent() for deciding whether to call xen_destroy_contiguous_region() is wrong: in case the region to be freed is not contiguous calling xen_destroy_contiguous_region() is the wrong thing to do: it would result in inconsistent mappings of multiple PFNs to the same MFN. This will lead to various strange crashes or data corruption. Instead of calling xen_destroy_contiguous_region() in that case a warning should be issued as that situation should never occur. Cc: stable@vger.kernel.org Signed-off-by: Juergen Gross Reviewed-by: Boris Ostrovsky Reviewed-by: Jan Beulich Acked-by: Konrad Rzeszutek Wilk Signed-off-by: Juergen Gross commit 56fbc24116f458a0ea48f9f37fe770fd791042d9 Author: Takshak Chahande Date: Wed Jul 31 15:10:55 2019 -0700 libbpf : make libbpf_num_possible_cpus function thread safe Having static variable `cpus` in libbpf_num_possible_cpus function without guarding it with mutex makes this function thread-unsafe. If multiple threads accessing this function, in the current form; it leads to incrementing the static variable value `cpus` in the multiple of total available CPUs. Used local stack variable to calculate the number of possible CPUs and then updated the static variable using WRITE_ONCE(). Changes since v1: * added stack variable to calculate cpus * serialized static variable update using WRITE_ONCE() * fixed Fixes tag Fixes: 6446b3155521 ("bpf: add a new API libbpf_num_possible_cpus()") Signed-off-by: Takshak Chahande Acked-by: Andrey Ignatov Reviewed-by: Jakub Kicinski Signed-off-by: Alexei Starovoitov commit bd46a90634302bfe791e93ad5496f98f165f7ae0 Author: Keith Busch Date: Mon Jul 29 16:34:52 2019 -0600 nvme-pci: Fix async probe remove race Ensure the controller is not in the NEW state when nvme_probe() exits. This will always allow a subsequent nvme_remove() to set the state to DELETING, fixing a potential race between the initial asynchronous probe and device removal. Reported-by: Li Zhong Reviewed-by: Sagi Grimberg Signed-off-by: Keith Busch Signed-off-by: Sagi Grimberg commit 0157ec8dad3c8fc9bc9790f76e0831ffdaf2e7f0 Author: Sagi Grimberg Date: Thu Jul 25 11:56:57 2019 -0700 nvme: fix controller removal race with scan work With multipath enabled, nvme_scan_work() can read from the device (through nvme_mpath_add_disk()) and hang [1]. However, with fabrics, once ctrl->state is set to NVME_CTRL_DELETING, the reads will hang (see nvmf_check_ready()) and the mpath stack device make_request will block if head->list is not empty. However, when the head->list consistst of only DELETING/DEAD controllers, we should actually not block, but rather fail immediately. In addition, before we go ahead and remove the namespaces, make sure to clear the current path and kick the requeue list so that the request will fast fail upon requeuing. [1]: -- INFO: task kworker/u4:3:166 blocked for more than 120 seconds. Not tainted 5.2.0-rc6-vmlocalyes-00005-g808c8c2dc0cf #316 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. kworker/u4:3 D 0 166 2 0x80004000 Workqueue: nvme-wq nvme_scan_work Call Trace: __schedule+0x851/0x1400 schedule+0x99/0x210 io_schedule+0x21/0x70 do_read_cache_page+0xa57/0x1330 read_cache_page+0x4a/0x70 read_dev_sector+0xbf/0x380 amiga_partition+0xc4/0x1230 check_partition+0x30f/0x630 rescan_partitions+0x19a/0x980 __blkdev_get+0x85a/0x12f0 blkdev_get+0x2a5/0x790 __device_add_disk+0xe25/0x1250 device_add_disk+0x13/0x20 nvme_mpath_set_live+0x172/0x2b0 nvme_update_ns_ana_state+0x130/0x180 nvme_set_ns_ana_state+0x9a/0xb0 nvme_parse_ana_log+0x1c3/0x4a0 nvme_mpath_add_disk+0x157/0x290 nvme_validate_ns+0x1017/0x1bd0 nvme_scan_work+0x44d/0x6a0 process_one_work+0x7d7/0x1240 worker_thread+0x8e/0xff0 kthread+0x2c3/0x3b0 ret_from_fork+0x35/0x40 INFO: task kworker/u4:1:1034 blocked for more than 120 seconds. Not tainted 5.2.0-rc6-vmlocalyes-00005-g808c8c2dc0cf #316 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. kworker/u4:1 D 0 1034 2 0x80004000 Workqueue: nvme-delete-wq nvme_delete_ctrl_work Call Trace: __schedule+0x851/0x1400 schedule+0x99/0x210 schedule_timeout+0x390/0x830 wait_for_completion+0x1a7/0x310 __flush_work+0x241/0x5d0 flush_work+0x10/0x20 nvme_remove_namespaces+0x85/0x3d0 nvme_do_delete_ctrl+0xb4/0x1e0 nvme_delete_ctrl_work+0x15/0x20 process_one_work+0x7d7/0x1240 worker_thread+0x8e/0xff0 kthread+0x2c3/0x3b0 ret_from_fork+0x35/0x40 -- Reported-by: Logan Gunthorpe Tested-by: Logan Gunthorpe Reviewed-by: Logan Gunthorpe Reviewed-by: Ming Lei Signed-off-by: Sagi Grimberg commit d94211b8bad3787e0655a67284105f57db728cb1 Author: Sagi Grimberg Date: Fri Jul 26 10:29:49 2019 -0700 nvme-rdma: fix possible use-after-free in connect error flow When start_queue fails, we need to make sure to drain the queue cq before freeing the rdma resources because we might still race with the completion path. Have start_queue() error path safely stop the queue. -- [30371.808111] nvme nvme1: Failed reconnect attempt 11 [30371.808113] nvme nvme1: Reconnecting in 10 seconds... [...] [30382.069315] nvme nvme1: creating 4 I/O queues. [30382.257058] nvme nvme1: Connect Invalid SQE Parameter, qid 4 [30382.257061] nvme nvme1: failed to connect queue: 4 ret=386 [30382.305001] BUG: unable to handle kernel NULL pointer dereference at 0000000000000018 [30382.305022] IP: qedr_poll_cq+0x8a3/0x1170 [qedr] [30382.305028] PGD 0 P4D 0 [30382.305037] Oops: 0000 [#1] SMP PTI [...] [30382.305153] Call Trace: [30382.305166] ? __switch_to_asm+0x34/0x70 [30382.305187] __ib_process_cq+0x56/0xd0 [ib_core] [30382.305201] ib_poll_handler+0x26/0x70 [ib_core] [30382.305213] irq_poll_softirq+0x88/0x110 [30382.305223] ? sort_range+0x20/0x20 [30382.305232] __do_softirq+0xde/0x2c6 [30382.305241] ? sort_range+0x20/0x20 [30382.305249] run_ksoftirqd+0x1c/0x60 [30382.305258] smpboot_thread_fn+0xef/0x160 [30382.305265] kthread+0x113/0x130 [30382.305273] ? kthread_create_worker_on_cpu+0x50/0x50 [30382.305281] ret_from_fork+0x35/0x40 -- Reported-by: Nicolas Morey-Chaisemartin Reviewed-by: Max Gurtovoy Reviewed-by: Hannes Reinecke Signed-off-by: Sagi Grimberg commit b9156daeb1601d69007b7e50efcf89d69d72ec1d Author: Sagi Grimberg Date: Wed Jul 31 11:00:26 2019 -0700 nvme: fix a possible deadlock when passthru commands sent to a multipath device When the user issues a command with side effects, we will end up freezing the namespace request queue when updating disk info (and the same for the corresponding mpath disk node). However, we are not freezing the mpath node request queue, which means that mpath I/O can still come in and block on blk_queue_enter (called from nvme_ns_head_make_request -> direct_make_request). This is a deadlock, because blk_queue_enter will block until the inner namespace request queue is unfroze, but that process is blocked because the namespace revalidation is trying to update the mpath disk info and freeze its request queue (which will never complete because of the I/O that is blocked on blk_queue_enter). Fix this by freezing all the subsystem nsheads request queues before executing the passthru command. Given that these commands are infrequent we should not worry about this temporary I/O freeze to keep things sane. Here is the matching hang traces: -- [ 374.465002] INFO: task systemd-udevd:17994 blocked for more than 122 seconds. [ 374.472975] Not tainted 5.2.0-rc3-mpdebug+ #42 [ 374.478522] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 374.487274] systemd-udevd D 0 17994 1 0x00000000 [ 374.493407] Call Trace: [ 374.496145] __schedule+0x2ef/0x620 [ 374.500047] schedule+0x38/0xa0 [ 374.503569] blk_queue_enter+0x139/0x220 [ 374.507959] ? remove_wait_queue+0x60/0x60 [ 374.512540] direct_make_request+0x60/0x130 [ 374.517219] nvme_ns_head_make_request+0x11d/0x420 [nvme_core] [ 374.523740] ? generic_make_request_checks+0x307/0x6f0 [ 374.529484] generic_make_request+0x10d/0x2e0 [ 374.534356] submit_bio+0x75/0x140 [ 374.538163] ? guard_bio_eod+0x32/0xe0 [ 374.542361] submit_bh_wbc+0x171/0x1b0 [ 374.546553] block_read_full_page+0x1ed/0x330 [ 374.551426] ? check_disk_change+0x70/0x70 [ 374.556008] ? scan_shadow_nodes+0x30/0x30 [ 374.560588] blkdev_readpage+0x18/0x20 [ 374.564783] do_read_cache_page+0x301/0x860 [ 374.569463] ? blkdev_writepages+0x10/0x10 [ 374.574037] ? prep_new_page+0x88/0x130 [ 374.578329] ? get_page_from_freelist+0xa2f/0x1280 [ 374.583688] ? __alloc_pages_nodemask+0x179/0x320 [ 374.588947] read_cache_page+0x12/0x20 [ 374.593142] read_dev_sector+0x2d/0xd0 [ 374.597337] read_lba+0x104/0x1f0 [ 374.601046] find_valid_gpt+0xfa/0x720 [ 374.605243] ? string_nocheck+0x58/0x70 [ 374.609534] ? find_valid_gpt+0x720/0x720 [ 374.614016] efi_partition+0x89/0x430 [ 374.618113] ? string+0x48/0x60 [ 374.621632] ? snprintf+0x49/0x70 [ 374.625339] ? find_valid_gpt+0x720/0x720 [ 374.629828] check_partition+0x116/0x210 [ 374.634214] rescan_partitions+0xb6/0x360 [ 374.638699] __blkdev_reread_part+0x64/0x70 [ 374.643377] blkdev_reread_part+0x23/0x40 [ 374.647860] blkdev_ioctl+0x48c/0x990 [ 374.651956] block_ioctl+0x41/0x50 [ 374.655766] do_vfs_ioctl+0xa7/0x600 [ 374.659766] ? locks_lock_inode_wait+0xb1/0x150 [ 374.664832] ksys_ioctl+0x67/0x90 [ 374.668539] __x64_sys_ioctl+0x1a/0x20 [ 374.672732] do_syscall_64+0x5a/0x1c0 [ 374.676828] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 374.738474] INFO: task nvmeadm:49141 blocked for more than 123 seconds. [ 374.745871] Not tainted 5.2.0-rc3-mpdebug+ #42 [ 374.751419] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 374.760170] nvmeadm D 0 49141 36333 0x00004080 [ 374.766301] Call Trace: [ 374.769038] __schedule+0x2ef/0x620 [ 374.772939] schedule+0x38/0xa0 [ 374.776452] blk_mq_freeze_queue_wait+0x59/0x100 [ 374.781614] ? remove_wait_queue+0x60/0x60 [ 374.786192] blk_mq_freeze_queue+0x1a/0x20 [ 374.790773] nvme_update_disk_info.isra.57+0x5f/0x350 [nvme_core] [ 374.797582] ? nvme_identify_ns.isra.50+0x71/0xc0 [nvme_core] [ 374.804006] __nvme_revalidate_disk+0xe5/0x110 [nvme_core] [ 374.810139] nvme_revalidate_disk+0xa6/0x120 [nvme_core] [ 374.816078] ? nvme_submit_user_cmd+0x11e/0x320 [nvme_core] [ 374.822299] nvme_user_cmd+0x264/0x370 [nvme_core] [ 374.827661] nvme_dev_ioctl+0x112/0x1d0 [nvme_core] [ 374.833114] do_vfs_ioctl+0xa7/0x600 [ 374.837117] ? __audit_syscall_entry+0xdd/0x130 [ 374.842184] ksys_ioctl+0x67/0x90 [ 374.845891] __x64_sys_ioctl+0x1a/0x20 [ 374.850082] do_syscall_64+0x5a/0x1c0 [ 374.854178] entry_SYSCALL_64_after_hwframe+0x44/0xa9 -- Reported-by: James Puthukattukaran Tested-by: James Puthukattukaran Reviewed-by: Keith Busch Signed-off-by: Sagi Grimberg commit 8c36e66fb407ce076535a7db98ab9f6d720b866a Author: Logan Gunthorpe Date: Wed Jul 31 17:35:34 2019 -0600 nvme-core: Fix extra device_put() call on error path In the error path for nvme_init_subsystem(), nvme_put_subsystem() will call device_put(), but it will get called again after the mutex_unlock(). The device_put() only needs to be called if device_add() fails. This bug caused a KASAN use-after-free error when adding and removing subsytems in a loop: BUG: KASAN: use-after-free in device_del+0x8d9/0x9a0 Read of size 8 at addr ffff8883cdaf7120 by task multipathd/329 CPU: 0 PID: 329 Comm: multipathd Not tainted 5.2.0-rc6-vmlocalyes-00019-g70a2b39005fd-dirty #314 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1 04/01/2014 Call Trace: dump_stack+0x7b/0xb5 print_address_description+0x6f/0x280 ? device_del+0x8d9/0x9a0 __kasan_report+0x148/0x199 ? device_del+0x8d9/0x9a0 ? class_release+0x100/0x130 ? device_del+0x8d9/0x9a0 kasan_report+0x12/0x20 __asan_report_load8_noabort+0x14/0x20 device_del+0x8d9/0x9a0 ? device_platform_notify+0x70/0x70 nvme_destroy_subsystem+0xf9/0x150 nvme_free_ctrl+0x280/0x3a0 device_release+0x72/0x1d0 kobject_put+0x144/0x410 put_device+0x13/0x20 nvme_free_ns+0xc4/0x100 nvme_release+0xb3/0xe0 __blkdev_put+0x549/0x6e0 ? kasan_check_write+0x14/0x20 ? bd_set_size+0xb0/0xb0 ? kasan_check_write+0x14/0x20 ? mutex_lock+0x8f/0xe0 ? __mutex_lock_slowpath+0x20/0x20 ? locks_remove_file+0x239/0x370 blkdev_put+0x72/0x2c0 blkdev_close+0x8d/0xd0 __fput+0x256/0x770 ? _raw_read_lock_irq+0x40/0x40 ____fput+0xe/0x10 task_work_run+0x10c/0x180 ? filp_close+0xf7/0x140 exit_to_usermode_loop+0x151/0x170 do_syscall_64+0x240/0x2e0 ? prepare_exit_to_usermode+0xd5/0x190 entry_SYSCALL_64_after_hwframe+0x44/0xa9 RIP: 0033:0x7f5a79af05d7 Code: 00 00 0f 05 48 3d 00 f0 ff ff 77 3f c3 66 0f 1f 44 00 00 53 89 fb 48 83 ec 10 e8 c4 fb ff ff 89 df 89 c2 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 2b 89 d7 89 44 24 0c e8 06 fc ff ff 8b 44 24 RSP: 002b:00007f5a7799c810 EFLAGS: 00000293 ORIG_RAX: 0000000000000003 RAX: 0000000000000000 RBX: 0000000000000008 RCX: 00007f5a79af05d7 RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000008 RBP: 00007f5a58000f98 R08: 0000000000000002 R09: 00007f5a7935ee80 R10: 0000000000000000 R11: 0000000000000293 R12: 000055e432447240 R13: 0000000000000000 R14: 0000000000000001 R15: 000055e4324a9cf0 Allocated by task 1236: save_stack+0x21/0x80 __kasan_kmalloc.constprop.6+0xab/0xe0 kasan_kmalloc+0x9/0x10 kmem_cache_alloc_trace+0x102/0x210 nvme_init_identify+0x13c3/0x3820 nvme_loop_configure_admin_queue+0x4fa/0x5e0 nvme_loop_create_ctrl+0x469/0xf40 nvmf_dev_write+0x19a3/0x21ab __vfs_write+0x66/0x120 vfs_write+0x154/0x490 ksys_write+0x104/0x240 __x64_sys_write+0x73/0xb0 do_syscall_64+0xa5/0x2e0 entry_SYSCALL_64_after_hwframe+0x44/0xa9 Freed by task 329: save_stack+0x21/0x80 __kasan_slab_free+0x129/0x190 kasan_slab_free+0xe/0x10 kfree+0xa7/0x200 nvme_release_subsystem+0x49/0x60 device_release+0x72/0x1d0 kobject_put+0x144/0x410 put_device+0x13/0x20 klist_class_dev_put+0x31/0x40 klist_put+0x8f/0xf0 klist_del+0xe/0x10 device_del+0x3a7/0x9a0 nvme_destroy_subsystem+0xf9/0x150 nvme_free_ctrl+0x280/0x3a0 device_release+0x72/0x1d0 kobject_put+0x144/0x410 put_device+0x13/0x20 nvme_free_ns+0xc4/0x100 nvme_release+0xb3/0xe0 __blkdev_put+0x549/0x6e0 blkdev_put+0x72/0x2c0 blkdev_close+0x8d/0xd0 __fput+0x256/0x770 ____fput+0xe/0x10 task_work_run+0x10c/0x180 exit_to_usermode_loop+0x151/0x170 do_syscall_64+0x240/0x2e0 entry_SYSCALL_64_after_hwframe+0x44/0xa9 Fixes: 32fd90c40768 ("nvme: change locking for the per-subsystem controller list") Signed-off-by: Logan Gunthorpe Reviewed-by: Sagi Grimberg Reviewed-by : Chaitanya Kulkarni Signed-off-by: Sagi Grimberg commit cfc1a1af56200362d1508b82b9a3cc3acb2eae0c Author: Logan Gunthorpe Date: Wed Jul 31 17:35:33 2019 -0600 nvmet-file: fix nvmet_file_flush() always returning an error Presently, nvmet_file_flush() always returns a call to errno_to_nvme_status() but that helper doesn't take into account the case when errno=0. So nvmet_file_flush() always returns an error code. All other callers of errno_to_nvme_status() check for success before calling it. To fix this, ensure errno_to_nvme_status() returns success if the errno is zero. This should prevent future mistakes like this from happening. Fixes: c6aa3542e010 ("nvmet: add error log support for file backend") Signed-off-by: Logan Gunthorpe Reviewed-by: Sagi Grimberg Reviewed-by: Chaitanya Kulkarni Signed-off-by: Sagi Grimberg commit 86b9a63e595ff03f9d0a7b92b6acc231fecefc29 Author: Logan Gunthorpe Date: Wed Jul 31 17:35:32 2019 -0600 nvmet-loop: Flush nvme_delete_wq when removing the port After calling nvme_loop_delete_ctrl(), the controllers will not yet be deleted because nvme_delete_ctrl() only schedules work to do the delete. This means a race can occur if a port is removed but there are still active controllers trying to access that memory. To fix this, flush the nvme_delete_wq before returning from nvme_loop_remove_port() so that any controllers that might be in the process of being deleted won't access a freed port. Signed-off-by: Logan Gunthorpe Reviewed-by: Sagi Grimberg Reviewed-by: Max Gurtovoy Reviewed-by : Chaitanya Kulkarni Signed-off-by: Sagi Grimberg commit 3aed86731ee2b23e4dc4d2c6d943d33992cd551b Author: Logan Gunthorpe Date: Wed Jul 31 17:35:31 2019 -0600 nvmet: Fix use-after-free bug when a port is removed When a port is removed through configfs, any connected controllers are still active and can still send commands. This causes a use-after-free bug which is detected by KASAN for any admin command that dereferences req->port (like in nvmet_execute_identify_ctrl). To fix this, disconnect all active controllers when a subsystem is removed from a port. This ensures there are no active controllers when the port is eventually removed. Signed-off-by: Logan Gunthorpe Reviewed-by: Sagi Grimberg Reviewed-by: Max Gurtovoy Reviewed-by : Chaitanya Kulkarni Signed-off-by: Sagi Grimberg commit 4d97972b45f080db4c6d27cc0b54321d9cd7be17 Author: Frode Isaksen Date: Tue Jul 30 13:38:14 2019 +0200 net: stmmac: Use netif_tx_napi_add() for TX polling function This variant of netif_napi_add() should be used from drivers using NAPI to exclusively poll a TX queue. Signed-off-by: Frode Isaksen Tested-by: Bartosz Golaszewski Signed-off-by: Bartosz Golaszewski Signed-off-by: David S. Miller commit 5c725b6b65067909548ac9ca9bc777098ec9883d Author: Nikolay Aleksandrov Date: Tue Jul 30 14:21:00 2019 +0300 net: bridge: mcast: don't delete permanent entries when fast leave is enabled When permanent entries were introduced by the commit below, they were exempt from timing out and thus igmp leave wouldn't affect them unless fast leave was enabled on the port which was added before permanent entries existed. It shouldn't matter if fast leave is enabled or not if the user added a permanent entry it shouldn't be deleted on igmp leave. Before: $ echo 1 > /sys/class/net/eth4/brport/multicast_fast_leave $ bridge mdb add dev br0 port eth4 grp 229.1.1.1 permanent $ bridge mdb show dev br0 port eth4 grp 229.1.1.1 permanent < join and leave 229.1.1.1 on eth4 > $ bridge mdb show $ After: $ echo 1 > /sys/class/net/eth4/brport/multicast_fast_leave $ bridge mdb add dev br0 port eth4 grp 229.1.1.1 permanent $ bridge mdb show dev br0 port eth4 grp 229.1.1.1 permanent < join and leave 229.1.1.1 on eth4 > $ bridge mdb show dev br0 port eth4 grp 229.1.1.1 permanent Fixes: ccb1c31a7a87 ("bridge: add flags to distinguish permanent mdb entires") Signed-off-by: Nikolay Aleksandrov Signed-off-by: David S. Miller commit 271da132e29b5341c31eca6ba6a72ea1302ebac8 Author: Jia-Ju Bai Date: Tue Jul 30 16:08:13 2019 +0800 net: phy: phy_led_triggers: Fix a possible null-pointer dereference in phy_led_trigger_change_speed() In phy_led_trigger_change_speed(), there is an if statement on line 48 to check whether phy->last_triggered is NULL: if (!phy->last_triggered) When phy->last_triggered is NULL, it is used on line 52: led_trigger_event(&phy->last_triggered->trigger, LED_OFF); Thus, a possible null-pointer dereference may occur. To fix this bug, led_trigger_event(&phy->last_triggered->trigger, LED_OFF) is called when phy->last_triggered is not NULL. This bug is found by a static analysis tool STCheck written by the OSLAB group in Tsinghua University. Signed-off-by: Jia-Ju Bai Signed-off-by: David S. Miller commit e29903c49990376e5e928b20f658cdf7c29bf1eb Author: Jakub Kicinski Date: Mon Jul 29 16:08:03 2019 -0700 selftests/tls: fix TLS tests with CONFIG_TLS=n Build bot reports some recent TLS tests are failing with CONFIG_TLS=n. Correct the expected return code and skip TLS installation if not supported. Tested with CONFIG_TLS=n and CONFIG_TLS=m. Reported-by: kernel test robot Fixes: cf32526c8842 ("selftests/tls: add a test for ULP but no keys") Fixes: 65d41fb317c6 ("selftests/tls: add a bidirectional test") Signed-off-by: Jakub Kicinski Signed-off-by: David S. Miller commit 45385237f65aeee73641f1ef737d7273905a233f Author: Ondrej Mosnacek Date: Thu Jul 25 12:52:43 2019 +0200 selinux: fix memory leak in policydb_init() Since roles_init() adds some entries to the role hash table, we need to destroy also its keys/values on error, otherwise we get a memory leak in the error path. Cc: Reported-by: syzbot+fee3a14d4cdf92646287@syzkaller.appspotmail.com Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Ondrej Mosnacek Signed-off-by: Paul Moore commit 3de433c5b38af49a5fc7602721e2ab5d39f1e69c Author: Rob Clark Date: Tue Jul 30 14:46:28 2019 -0700 drm/msm: Use the correct dma_sync calls in msm_gem [subject was: drm/msm: shake fist angrily at dma-mapping] So, using dma_sync_* for our cache needs works out w/ dma iommu ops, but it falls appart with dma direct ops. The problem is that, depending on display generation, we can have either set of dma ops (mdp4 and dpu have iommu wired to mdss node, which maps to toplevel drm device, but mdp5 has iommu wired up to the mdp sub-node within mdss). Fixes this splat on mdp5 devices: Unable to handle kernel paging request at virtual address ffffffff80000000 Mem abort info: ESR = 0x96000144 Exception class = DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 Data abort info: ISV = 0, ISS = 0x00000144 CM = 1, WnR = 1 swapper pgtable: 4k pages, 48-bit VAs, pgdp=00000000810e4000 [ffffffff80000000] pgd=0000000000000000 Internal error: Oops: 96000144 [#1] SMP Modules linked in: btqcomsmd btqca bluetooth cfg80211 ecdh_generic ecc rfkill libarc4 panel_simple msm wcnss_ctrl qrtr_smd drm_kms_helper venus_enc venus_dec videobuf2_dma_sg videobuf2_memops drm venus_core ipv6 qrtr qcom_wcnss_pil v4l2_mem2mem qcom_sysmon videobuf2_v4l2 qmi_helpers videobuf2_common crct10dif_ce mdt_loader qcom_common videodev qcom_glink_smem remoteproc bmc150_accel_i2c bmc150_magn_i2c bmc150_accel_core bmc150_magn snd_soc_lpass_apq8016 snd_soc_msm8916_analog mms114 mc nf_defrag_ipv6 snd_soc_lpass_cpu snd_soc_apq8016_sbc industrialio_triggered_buffer kfifo_buf snd_soc_lpass_platform snd_soc_msm8916_digital drm_panel_orientation_quirks CPU: 2 PID: 33 Comm: kworker/2:1 Not tainted 5.3.0-rc2 #1 Hardware name: Samsung Galaxy A5U (EUR) (DT) Workqueue: events deferred_probe_work_func pstate: 80000005 (Nzcv daif -PAN -UAO) pc : __clean_dcache_area_poc+0x20/0x38 lr : arch_sync_dma_for_device+0x28/0x30 sp : ffff0000115736a0 x29: ffff0000115736a0 x28: 0000000000000001 x27: ffff800074830800 x26: ffff000011478000 x25: 0000000000000000 x24: 0000000000000001 x23: ffff000011478a98 x22: ffff800009fd1c10 x21: 0000000000000001 x20: ffff800075ad0a00 x19: 0000000000000000 x18: ffff0000112b2000 x17: 0000000000000000 x16: 0000000000000000 x15: 00000000fffffff0 x14: ffff000011455d70 x13: 0000000000000000 x12: 0000000000000028 x11: 0000000000000001 x10: ffff00001106c000 x9 : ffff7e0001d6b380 x8 : 0000000000001000 x7 : ffff7e0001d6b380 x6 : ffff7e0001d6b382 x5 : 0000000000000000 x4 : 0000000000001000 x3 : 000000000000003f x2 : 0000000000000040 x1 : ffffffff80001000 x0 : ffffffff80000000 Call trace: __clean_dcache_area_poc+0x20/0x38 dma_direct_sync_sg_for_device+0xb8/0xe8 get_pages+0x22c/0x250 [msm] msm_gem_get_and_pin_iova+0xdc/0x168 [msm] ... Fixes the combination of two patches: Fixes: 0036bc73ccbe (drm/msm: stop abusing dma_map/unmap for cache) Fixes: 449fa54d6815 (dma-direct: correct the physical addr in dma_direct_sync_sg_for_cpu/device) Tested-by: Stephan Gerhold Signed-off-by: Rob Clark [seanpaul changed subject to something more desriptive] Signed-off-by: Sean Paul Link: https://patchwork.freedesktop.org/patch/msgid/20190730214633.17820-1-robdclark@gmail.com commit 5c6207539aea8b22490f9569db5aa72ddfd0d486 Merge: b36a1552d731 c2c44ec20a84 Author: Linus Torvalds Date: Wed Jul 31 13:26:54 2019 -0700 Merge branch 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs Pull mount_capable() fix from Al Viro. * 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: Unbreak mount_capable() commit b36a1552d7319bbfd5cf7f08726c23c5c66d4f73 Author: Vladis Dronov Date: Tue Jul 30 11:33:45 2019 +0200 Bluetooth: hci_uart: check for missing tty operations Certain ttys operations (pty_unix98_ops) lack tiocmget() and tiocmset() functions which are called by the certain HCI UART protocols (hci_ath, hci_bcm, hci_intel, hci_mrvl, hci_qca) via hci_uart_set_flow_control() or directly. This leads to an execution at NULL and can be triggered by an unprivileged user. Fix this by adding a helper function and a check for the missing tty operations in the protocols code. This fixes CVE-2019-10207. The Fixes: lines list commits where calls to tiocm[gs]et() or hci_uart_set_flow_control() were added to the HCI UART protocols. Link: https://syzkaller.appspot.com/bug?id=1b42faa2848963564a5b1b7f8c837ea7b55ffa50 Reported-by: syzbot+79337b501d6aa974d0f6@syzkaller.appspotmail.com Cc: stable@vger.kernel.org # v2.6.36+ Fixes: b3190df62861 ("Bluetooth: Support for Atheros AR300x serial chip") Fixes: 118612fb9165 ("Bluetooth: hci_bcm: Add suspend/resume PM functions") Fixes: ff2895592f0f ("Bluetooth: hci_intel: Add Intel baudrate configuration support") Fixes: 162f812f23ba ("Bluetooth: hci_uart: Add Marvell support") Fixes: fa9ad876b8e0 ("Bluetooth: hci_qca: Add support for Qualcomm Bluetooth chip wcn3990") Signed-off-by: Vladis Dronov Signed-off-by: Marcel Holtmann Reviewed-by: Yu-Chen, Cho Tested-by: Yu-Chen, Cho Signed-off-by: Linus Torvalds commit 1b7e816fc80e668f0ccc8542cec20b9259abace1 Author: Laura Abbott Date: Wed Jul 31 15:32:40 2019 -0400 mm: slub: Fix slab walking for init_on_free To properly clear the slab on free with slab_want_init_on_free, we walk the list of free objects using get_freepointer/set_freepointer. The value we get from get_freepointer may not be valid. This isn't an issue since an actual value will get written later but this means there's a chance of triggering a bug if we use this value with set_freepointer: kernel BUG at mm/slub.c:306! invalid opcode: 0000 [#1] PREEMPT PTI CPU: 0 PID: 0 Comm: swapper Not tainted 5.2.0-05754-g6471384a #4 RIP: 0010:kfree+0x58a/0x5c0 Code: 48 83 05 78 37 51 02 01 0f 0b 48 83 05 7e 37 51 02 01 48 83 05 7e 37 51 02 01 48 83 05 7e 37 51 02 01 48 83 05 d6 37 51 02 01 <0f> 0b 48 83 05 d4 37 51 02 01 48 83 05 d4 37 51 02 01 48 83 05 d4 RSP: 0000:ffffffff82603d90 EFLAGS: 00010002 RAX: ffff8c3976c04320 RBX: ffff8c3976c04300 RCX: 0000000000000000 RDX: ffff8c3976c04300 RSI: 0000000000000000 RDI: ffff8c3976c04320 RBP: ffffffff82603db8 R08: 0000000000000000 R09: 0000000000000000 R10: ffff8c3976c04320 R11: ffffffff8289e1e0 R12: ffffd52cc8db0100 R13: ffff8c3976c01a00 R14: ffffffff810f10d4 R15: ffff8c3976c04300 FS: 0000000000000000(0000) GS:ffffffff8266b000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffff8c397ffff000 CR3: 0000000125020000 CR4: 00000000000406b0 Call Trace: apply_wqattrs_prepare+0x154/0x280 apply_workqueue_attrs_locked+0x4e/0xe0 apply_workqueue_attrs+0x36/0x60 alloc_workqueue+0x25a/0x6d0 workqueue_init_early+0x246/0x348 start_kernel+0x3c7/0x7ec x86_64_start_reservations+0x40/0x49 x86_64_start_kernel+0xda/0xe4 secondary_startup_64+0xb6/0xc0 Modules linked in: ---[ end trace f67eb9af4d8d492b ]--- Fix this by ensuring the value we set with set_freepointer is either NULL or another value in the chain. Reported-by: kernel test robot Signed-off-by: Laura Abbott Fixes: 6471384af2a6 ("mm: security: introduce init_on_alloc=1 and init_on_free=1 boot options") Reviewed-by: Kees Cook Signed-off-by: Linus Torvalds commit b7edabfe843805b7ab8a91396b0782042a289308 Author: Paul Walmsley Date: Thu Jul 25 15:05:59 2019 -0700 riscv: defconfig: align RV64 defconfig to the output of "make savedefconfig" Align the RV64 defconfig to the output of "make savedefconfig" to avoid unnecessary deltas for future defconfig patches. This patch should have no runtime functional impact. Signed-off-by: Paul Walmsley Reviewed-by: Bin Meng commit 11ae2d892139a1086f257188d457ddcb71ab5257 Author: Paul Walmsley Date: Thu Jul 25 13:41:31 2019 -0700 riscv: dts: fu540-c000: drop "timebase-frequency" On FU540-based systems, the "timebase-frequency" (RTCCLK) is sourced from an external crystal located on the PCB. Thus the timebase-frequency DT property should be defined by the board that uses the SoC, not the SoC itself. Drop the superfluous timebase-frequency property from the SoC DT data. (It's already present in the board DT data.) Signed-off-by: Paul Walmsley Reviewed-by: Bin Meng commit b399abe7c21e248dc6224cadc9a378a2beb10cfd Author: Mao Han Date: Thu Jul 11 10:38:40 2019 +0800 riscv: Fix perf record without libelf support This patch fix following perf record error by linking vdso.so with build id. perf.data perf.data.old [ perf record: Woken up 1 times to write data ] free(): double free detected in tcache 2 Aborted perf record use filename__read_build_id(util/symbol-minimal.c) to get build id when libelf is not supported. When vdso.so is linked without build id, the section size of PT_NOTE will be zero, buf size will realloc to zero and cause memory corruption. Signed-off-by: Mao Han Cc: Paul Walmsley Cc: Palmer Dabbelt Cc: Albert Ou Signed-off-by: Paul Walmsley commit 7e9e5ead55beacc11116b3fb90b0de6e7cf55a69 Author: Rob Clark Date: Wed Jul 17 14:15:37 2019 -0700 drm/vgem: fix cache synchronization on arm/arm64 drm_cflush_pages() is no-op on arm/arm64. But instead we can use dma_sync API. Fixes failures w/ vgem_test. Acked-by: Daniel Vetter Signed-off-by: Rob Clark Signed-off-by: Sean Paul Link: https://patchwork.freedesktop.org/patch/msgid/20190717211542.30482-1-robdclark@gmail.com commit d2eee9fca172d0d010ef3060cdc971e0b079b87f Merge: 52fde4348ccc 6c77221df961 Author: Linus Torvalds Date: Wed Jul 31 10:26:59 2019 -0700 Merge tag 'trace-v5.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace Pull tracing fixes from Steven Rostedt: "Two minor fixes: - Fix trace event header include guards, as several did not match the #define to the #ifdef - Remove a redundant test to ftrace_graph_notrace_addr() that was accidentally added" * tag 'trace-v5.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace: fgraph: Remove redundant ftrace_graph_notrace_addr() test tracing: Fix header include guards in trace event headers commit f1d4836201543e88ebe70237e67938168d5fab19 Author: Qian Cai Date: Tue Jul 30 17:23:48 2019 -0400 arm64/efi: fix variable 'si' set but not used GCC throws out this warning on arm64. drivers/firmware/efi/libstub/arm-stub.c: In function 'efi_entry': drivers/firmware/efi/libstub/arm-stub.c:132:22: warning: variable 'si' set but not used [-Wunused-but-set-variable] Fix it by making free_screen_info() a static inline function. Acked-by: Will Deacon Signed-off-by: Qian Cai Signed-off-by: Catalin Marinas commit 52fde4348ccc317e7ad091a3280f5d4ae19f91ef Merge: 4010b622f1d2 71be7b0e7d40 Author: Linus Torvalds Date: Wed Jul 31 10:13:00 2019 -0700 Merge tag 'for-linus-5.3-2' of git://github.com/cminyard/linux-ipmi Pull IPMI fix from Corey Minyard: "One necessary fix for an uninitialized variable in the new IPMB driver. Nothing else has come in besides things that need to wait until later" * tag 'for-linus-5.3-2' of git://github.com/cminyard/linux-ipmi: Fix uninitialized variable in ipmb_dev_int.c commit 147b9635e6347104b91f48ca9dca61eb0fbf2a54 Author: Will Deacon Date: Tue Jul 30 15:40:20 2019 +0100 arm64: cpufeature: Fix feature comparison for CTR_EL0.{CWG,ERG} If CTR_EL0.{CWG,ERG} are 0b0000 then they must be interpreted to have their architecturally maximum values, which defeats the use of FTR_HIGHER_SAFE when sanitising CPU ID registers on heterogeneous machines. Introduce FTR_HIGHER_OR_ZERO_SAFE so that these fields effectively saturate at zero. Fixes: 3c739b571084 ("arm64: Keep track of CPU feature registers") Cc: # 4.4.x- Reviewed-by: Suzuki K Poulose Acked-by: Mark Rutland Signed-off-by: Will Deacon Signed-off-by: Catalin Marinas commit a22c5cf5d37ddcd4d2dd98ee9cf04fa5dd1e1c01 Author: Vincenzo Frascino Date: Mon Jul 29 13:54:21 2019 +0100 arm64: vdso: Fix Makefile regression Using an old .config in combination with "make oldconfig" can cause an incorrect detection of the compat compiler: $ grep CROSS_COMPILE_COMPAT .config CONFIG_CROSS_COMPILE_COMPAT_VDSO="" $ make oldconfig && make arch/arm64/Makefile:58: gcc not found, check CROSS_COMPILE_COMPAT. Stop. Accordingly to the section 7.2 of the GNU Make manual "Syntax of Conditionals", "When the value results from complex expansions of variables and functions, expansions you would consider empty may actually contain whitespace characters and thus are not seen as empty. However, you can use the strip function to avoid interpreting whitespace as a non-empty value." Fix the issue adding strip to the CROSS_COMPILE_COMPAT string evaluation. Reported-by: Matteo Croce Tested-by: Matteo Croce Acked-by: Will Deacon Signed-off-by: Vincenzo Frascino Signed-off-by: Catalin Marinas commit 706cb5492c8c459199fa0ab3b5fd2ba54ee53b0c Author: Andreas Gruenbacher Date: Sat Jul 27 17:12:54 2019 +0200 gfs2: Inode dirtying fix With the recent iomap write page reclaim deadlock fix, it turns out that the GLF_DIRTY flag isn't always set when it needs to be anymore: previously, this happened as a side effect of always adding the inode buffer head to the current transaction with gfs2_trans_add_meta, but this isn't happening consistently anymore. Fix by removing an additional unnecessary gfs2_trans_add_meta call and by setting the GLF_DIRTY flag in gfs2_iomap_end. (The GLF_DIRTY flag causes inode_go_sync to flush the transaction log when syncing out the glock of that inode. When the flag isn't set, inode_go_sync will skip inodes, including ones with an i_state of I_DIRTY_PAGES, which will lead to cluster incoherency.) In addition, in gfs2_iomap_page_done, if the metadata has changed, mark the inode as I_DIRTY_DATASYNC to have the inode added to the current transaction: we don't expect metadata to change here, but let's err on the safe side. Fixes: d0a22a4b03b8 ("gfs2: Fix iomap write page reclaim deadlock"); Signed-off-by: Andreas Gruenbacher commit c2c44ec20a8496f7a3b3401c092afe96908eced1 Author: Al Viro Date: Sat Jul 27 08:29:57 2019 -0400 Unbreak mount_capable() In "consolidate the capability checks in sget_{fc,userns}())" the wrong argument had been passed to mount_capable() by sget_fc(). That mistake had been further obscured later, when switching mount_capable() to fs_context has moved the calculation of bogus argument from sget_fc() to mount_capable() itself. It should've been fc->user_ns all along. Screwed-up-by: Al Viro Reported-by: Christian Brauner Tested-by: Christian Brauner Reviewed-by: David Howells Signed-off-by: Al Viro commit d8a1de3d5bb881507602bc02e004904828f88711 Author: Juliana Rodrigueiro Date: Wed Jul 31 15:17:23 2019 +0200 isdn: hfcsusb: Fix mISDN driver crash caused by transfer buffer on the stack Since linux 4.9 it is not possible to use buffers on the stack for DMA transfers. During usb probe the driver crashes with "transfer buffer is on stack" message. This fix k-allocates a buffer to be used on "read_reg_atomic", which is a macro that calls "usb_control_msg" under the hood. Kernel 4.19 backtrace: usb_hcd_submit_urb+0x3e5/0x900 ? sched_clock+0x9/0x10 ? log_store+0x203/0x270 ? get_random_u32+0x6f/0x90 ? cache_alloc_refill+0x784/0x8a0 usb_submit_urb+0x3b4/0x550 usb_start_wait_urb+0x4e/0xd0 usb_control_msg+0xb8/0x120 hfcsusb_probe+0x6bc/0xb40 [hfcsusb] usb_probe_interface+0xc2/0x260 really_probe+0x176/0x280 driver_probe_device+0x49/0x130 __driver_attach+0xa9/0xb0 ? driver_probe_device+0x130/0x130 bus_for_each_dev+0x5a/0x90 driver_attach+0x14/0x20 ? driver_probe_device+0x130/0x130 bus_add_driver+0x157/0x1e0 driver_register+0x51/0xe0 usb_register_driver+0x5d/0x120 ? 0xf81ed000 hfcsusb_drv_init+0x17/0x1000 [hfcsusb] do_one_initcall+0x44/0x190 ? free_unref_page_commit+0x6a/0xd0 do_init_module+0x46/0x1c0 load_module+0x1dc1/0x2400 sys_init_module+0xed/0x120 do_fast_syscall_32+0x7a/0x200 entry_SYSENTER_32+0x6b/0xbe Signed-off-by: Juliana Rodrigueiro Signed-off-by: David S. Miller commit c6349f8807324e270c5214920a1309481dd89ba4 Author: Geert Uytterhoeven Date: Wed Jul 31 15:12:02 2019 +0200 net: mediatek: Drop unneeded dependency on NET_VENDOR_MEDIATEK The whole block is protected by "if NET_VENDOR_MEDIATEK", so there is no need for individual driver config symbols to duplicate this dependency. Signed-off-by: Geert Uytterhoeven Signed-off-by: David S. Miller commit f86a677e5752a0250fef0415c40bbe4af37e8653 Merge: fa9586aff919 eef347f846ee Author: David S. Miller Date: Wed Jul 31 08:51:34 2019 -0700 Merge tag 'mac80211-for-davem-2019-07-31' of git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211 Johannes Berg says: ==================== Just a few fixes: * revert NETIF_F_LLTX usage as it caused problems * avoid warning on WMM parameters from AP that are too short * fix possible null-ptr dereference in hwsim * fix interface combinations with 4-addr and crypto control ==================== Signed-off-by: David S. Miller commit fa9586aff919a93761a76feb69718b54d49fdd8e Merge: 246902bdf562 7cdc44122847 Author: David S. Miller Date: Wed Jul 31 08:49:09 2019 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf Pablo Neira Ayuso says: ==================== netfilter fixes for net The following patchset contains Netfilter fixes for your net tree: 1) memleak in ebtables from the error path for the 32/64 compat layer, from Florian Westphal. 2) Fix inverted meta ifname/ifidx matching when no interface is set on either from the input/output path, from Phil Sutter. 3) Remove goto label in nft_meta_bridge, also from Phil. 4) Missing include guard in xt_connlabel, from Masahiro Yamada. 5) Two patch to fix ipset destination MAC matching coming from Stephano Brivio, via Jozsef Kadlecsik. 6) Fix set rename and listing concurrency problem, from Shijie Luo. Patch also coming via Jozsef Kadlecsik. 7) ebtables 32/64 compat missing base chain policy in rule count, from Florian Westphal. ==================== Signed-off-by: David S. Miller commit 246902bdf562d45ea3475fac64c93048a7a39f01 Author: Christophe JAILLET Date: Wed Jul 31 10:06:48 2019 +0200 net: ag71xx: Use GFP_KERNEL instead of GFP_ATOMIC in 'ag71xx_rings_init()' There is no need to use GFP_ATOMIC here, GFP_KERNEL should be enough. The 'kcalloc()' just a few lines above, already uses GFP_KERNEL. Signed-off-by: Christophe JAILLET Signed-off-by: David S. Miller commit 47b69bf74f16b20a3bb95b1fe27e5347dd34b683 Author: Christophe JAILLET Date: Wed Jul 31 09:38:42 2019 +0200 net: ethernet: et131x: Use GFP_KERNEL instead of GFP_ATOMIC when allocating tx_ring->tcb_ring There is no good reason to use GFP_ATOMIC here. Other memory allocations are performed with GFP_KERNEL (see other 'dma_alloc_coherent()' below and 'kzalloc()' in 'et131x_rx_dma_memory_alloc()') Use GFP_KERNEL which should be enough. Signed-off-by: Christophe JAILLET Signed-off-by: David S. Miller commit 3d0b63c5dfa8a912ac2d5026a24826b99b20ecc9 Author: Denis Efremov Date: Wed Jul 31 08:53:42 2019 -0600 MAINTAINERS: floppy: take over maintainership I would like to maintain the floppy driver. After the recent fixes, I think I know the code pretty well. Nowadays I've got 2 physical 3.5" readers to test all the changes. Signed-off-by: Denis Efremov Acked-by: Will Deacon Signed-off-by: Jens Axboe commit 5b31f3e39a6c4be55ede49da0dd352017f09e8cf Author: Ido Schimmel Date: Wed Jul 31 09:38:19 2019 +0300 drop_monitor: Add missing uAPI file to MAINTAINERS file Fixes: 6e43650cee64 ("add maintainer for network drop monitor kernel service") Signed-off-by: Ido Schimmel Acked-by: Neil Horman Signed-off-by: David S. Miller commit 23201ea57f6957ff9e02fcafafe6e0844a0087b5 Merge: abb48f801396 744ad9a35728 Author: David S. Miller Date: Wed Jul 31 08:22:12 2019 -0700 Merge branch 'mlxsw-Two-small-fixes' Ido Schimmel says: ==================== mlxsw: Two small fixes Patch #1 from Jiri fixes the error path of the module initialization function. Found during manual code inspection. Patch #2 from Petr further reduces the default shared buffer pool sizes in order to work around a problem that was originally described in commit e891ce1dd2a5 ("mlxsw: spectrum_buffers: Reduce pool size on Spectrum-2"). ==================== Signed-off-by: David S. Miller commit 744ad9a357280d03d567538cee7e1e457dedd481 Author: Petr Machata Date: Wed Jul 31 09:33:15 2019 +0300 mlxsw: spectrum_buffers: Further reduce pool size on Spectrum-2 In commit e891ce1dd2a5 ("mlxsw: spectrum_buffers: Reduce pool size on Spectrum-2"), pool size was reduced to mitigate a problem in port buffer usage of ports split four ways. It turns out that this work around does not solve the issue, and a further reduction is required. Thus reduce the size of pool 0 by another 2.7 MiB, and round down to the whole number of cells. Fixes: e891ce1dd2a5 ("mlxsw: spectrum_buffers: Reduce pool size on Spectrum-2") Signed-off-by: Petr Machata Signed-off-by: Ido Schimmel Signed-off-by: David S. Miller commit 28fe79000e9b0a6f99959869947f1ca305f14599 Author: Jiri Pirko Date: Wed Jul 31 09:33:14 2019 +0300 mlxsw: spectrum: Fix error path in mlxsw_sp_module_init() In case of sp2 pci driver registration fail, fix the error path to start with sp1 pci driver unregister. Fixes: c3ab435466d5 ("mlxsw: spectrum: Extend to support Spectrum-2 ASIC") Signed-off-by: Jiri Pirko Signed-off-by: Ido Schimmel Signed-off-by: David S. Miller commit e8de12fb7cde2c85bc31097cd098da79a4818305 Author: Stephen Boyd Date: Tue Jul 30 09:48:03 2019 -0700 kbuild: Check for unknown options with cc-option usage in Kconfig and clang If the particular version of clang a user has doesn't enable -Werror=unknown-warning-option by default, even though it is the default[1], then make sure to pass the option to the Kconfig cc-option command so that testing options from Kconfig files works properly. Otherwise, depending on the default values setup in the clang toolchain we will silently assume options such as -Wmaybe-uninitialized are supported by clang, when they really aren't. A compilation issue only started happening for me once commit 589834b3a009 ("kbuild: Add -Werror=unknown-warning-option to CLANG_FLAGS") was applied on top of commit b303c6df80c9 ("kbuild: compute false-positive -Wmaybe-uninitialized cases in Kconfig"). This leads kbuild to try and test for the existence of the -Wmaybe-uninitialized flag with the cc-option command in scripts/Kconfig.include, and it doesn't see an error returned from the option test so it sets the config value to Y. Then the Makefile tries to pass the unknown option on the command line and -Werror=unknown-warning-option catches the invalid option and breaks the build. Before commit 589834b3a009 ("kbuild: Add -Werror=unknown-warning-option to CLANG_FLAGS") the build works fine, but any cc-option test of a warning option in Kconfig files silently evaluates to true, even if the warning option flag isn't supported on clang. Note: This doesn't change cc-option usages in Makefiles because those use a different rule that includes KBUILD_CFLAGS by default (see the __cc-option command in scripts/Kbuild.incluide). The KBUILD_CFLAGS variable already has the -Werror=unknown-warning-option flag set. Thanks to Doug for pointing out the different rule. [1] https://clang.llvm.org/docs/DiagnosticsReference.html#wunknown-warning-option Cc: Peter Smith Cc: Nick Desaulniers Cc: Douglas Anderson Signed-off-by: Stephen Boyd Reviewed-by: Nathan Chancellor Signed-off-by: Masahiro Yamada commit e2a280d28d32d2cf7eaa2b1cecefd079b24c0245 Author: Masahiro Yamada Date: Wed Jul 31 01:40:42 2019 +0900 lib/raid6: fix unnecessary rebuild of vpermxor*.c The following four files are every time rebuilt: UNROLL lib/raid6/vpermxor1.c UNROLL lib/raid6/vpermxor2.c UNROLL lib/raid6/vpermxor4.c UNROLL lib/raid6/vpermxor8.c Fix the suffixes in the targets. Fixes: 72ad21075df8 ("lib/raid6: refactor unroll rules with pattern rules") Signed-off-by: Masahiro Yamada commit a721588d9475cbbf9e8b3ae1a69b1dea88d01653 Author: Masahiro Yamada Date: Wed Jul 31 00:59:02 2019 +0900 kbuild: modpost: do not parse unnecessary rules for vmlinux modpost Since commit ff9b45c55b26 ("kbuild: modpost: read modules.order instead of $(MODVERDIR)/*.mod"), 'make vmlinux' emits a warning, like this: $ make defconfig vmlinux [ snip ] LD vmlinux.o cat: modules.order: No such file or directory MODPOST vmlinux.o MODINFO modules.builtin.modinfo KSYM .tmp_kallsyms1.o KSYM .tmp_kallsyms2.o LD vmlinux SORTEX vmlinux SYSMAP System.map When building only vmlinux, KBUILD_MODULES is not set. Hence, the modules.order is not generated. For the vmlinux modpost, it is not necessary at all. Separate scripts/Makefile.modpost for the vmlinux/modules stages. This works more efficiently because the vmlinux modpost does not need to include .*.cmd files. Fixes: ff9b45c55b26 ("kbuild: modpost: read modules.order instead of $(MODVERDIR)/*.mod") Signed-off-by: Masahiro Yamada commit acf2a1397a686365775385ed4657941119172263 Author: Masahiro Yamada Date: Wed Jul 31 00:59:01 2019 +0900 kbuild: modpost: remove unnecessary dependency for __modpost __modpost is a phony target. The dependency on FORCE is pointless. All the objects have been built in the previous stage, so the dependency on the objects are not necessary either. Count the number of modules in a more straightforward way. Signed-off-by: Masahiro Yamada commit cb4819934a7f9b87876f11ed05b8624c0114551b Author: Masahiro Yamada Date: Wed Jul 31 00:59:00 2019 +0900 kbuild: modpost: handle KBUILD_EXTRA_SYMBOLS only for external modules KBUILD_EXTRA_SYMBOLS makes sense only when building external modules. Moreover, the modpost sets 'external_module' if the -e option is given. I replaced $(patsubst %, -e %,...) with simpler $(addprefix -e,...) while I was here. Signed-off-by: Masahiro Yamada commit 944cfe9be1fbbec73bab2f7e77fe2e8f9c72970f Author: Masahiro Yamada Date: Wed Jul 31 00:58:59 2019 +0900 kbuild: modpost: include .*.cmd files only when targets exist If a build rule fails, the .DELETE_ON_ERROR special target removes the target, but does nothing for the .*.cmd file, which might be corrupted. So, .*.cmd files should be included only when the corresponding targets exist. Commit 392885ee82d3 ("kbuild: let fixdep directly write to .*.cmd files") missed to fix up this file. Fixes: 392885ee82d3 ("kbuild: let fixdep directly write to .*.cmd") Cc: # v5.0+ Signed-off-by: Masahiro Yamada commit dc25ace66c74ca148c393952bd2ce0856029c692 Author: Thomas Gleixner Date: Fri Jul 26 22:25:20 2019 +0200 drm/i810: Use CONFIG_PREEMPTION CONFIG_PREEMPTION is selected by CONFIG_PREEMPT and by CONFIG_PREEMPT_RT. Both PREEMPT and PREEMPT_RT require the same functionality which today depends on CONFIG_PREEMPT. Change the Kconfig dependency of i810 to !CONFIG_PREEMPTION so the driver is not accidentally built on a RT kernel. Signed-off-by: Thomas Gleixner Cc: dri-devel@lists.freedesktop.org Cc: Maarten Lankhorst Cc: David Airlie Cc: Daniel Vetter Signed-off-by: Daniel Vetter Link: https://patchwork.freedesktop.org/patch/msgid/alpine.DEB.2.21.1907262223280.1791@nanos.tec.linutronix.de commit 1956ecf4c6ed4f7e4f728c360f378937d249bcd4 Merge: e1ae72a21e5f 609488bc979f Author: Maarten Lankhorst Date: Wed Jul 31 17:02:40 2019 +0200 Merge tag 'v5.3-rc2' into drm-misc-fixes Linux 5.3-rc2 Required for a CONFIG_PREEMPTION fix to i810. :) Signed-off-by: Maarten Lankhorst commit 2b5c8f0063e4b263cf2de82029798183cf85c320 Author: Munehisa Kamata Date: Wed Jul 31 20:13:10 2019 +0800 nbd: replace kill_bdev() with __invalidate_device() again Commit abbbdf12497d ("replace kill_bdev() with __invalidate_device()") once did this, but 29eaadc03649 ("nbd: stop using the bdev everywhere") resurrected kill_bdev() and it has been there since then. So buffer_head mappings still get killed on a server disconnection, and we can still hit the BUG_ON on a filesystem on the top of the nbd device. EXT4-fs (nbd0): mounted filesystem with ordered data mode. Opts: (null) block nbd0: Receive control failed (result -32) block nbd0: shutting down sockets print_req_error: I/O error, dev nbd0, sector 66264 flags 3000 EXT4-fs warning (device nbd0): htree_dirblock_to_tree:979: inode #2: lblock 0: comm ls: error -5 reading directory block print_req_error: I/O error, dev nbd0, sector 2264 flags 3000 EXT4-fs error (device nbd0): __ext4_get_inode_loc:4690: inode #2: block 283: comm ls: unable to read itable block EXT4-fs error (device nbd0) in ext4_reserve_inode_write:5894: IO failure ------------[ cut here ]------------ kernel BUG at fs/buffer.c:3057! invalid opcode: 0000 [#1] SMP PTI CPU: 7 PID: 40045 Comm: jbd2/nbd0-8 Not tainted 5.1.0-rc3+ #4 Hardware name: Amazon EC2 m5.12xlarge/, BIOS 1.0 10/16/2017 RIP: 0010:submit_bh_wbc+0x18b/0x190 ... Call Trace: jbd2_write_superblock+0xf1/0x230 [jbd2] ? account_entity_enqueue+0xc5/0xf0 jbd2_journal_update_sb_log_tail+0x94/0xe0 [jbd2] jbd2_journal_commit_transaction+0x12f/0x1d20 [jbd2] ? __switch_to_asm+0x40/0x70 ... ? lock_timer_base+0x67/0x80 kjournald2+0x121/0x360 [jbd2] ? remove_wait_queue+0x60/0x60 kthread+0xf8/0x130 ? commit_timeout+0x10/0x10 [jbd2] ? kthread_bind+0x10/0x10 ret_from_fork+0x35/0x40 With __invalidate_device(), I no longer hit the BUG_ON with sync or unmount on the disconnected device. Fixes: 29eaadc03649 ("nbd: stop using the bdev everywhere") Cc: linux-block@vger.kernel.org Cc: Ratna Manoj Bolla Cc: nbd@other.debian.org Cc: stable@vger.kernel.org Cc: David Woodhouse Reviewed-by: Josef Bacik Signed-off-by: Munehisa Kamata Signed-off-by: Jens Axboe commit 090bb803708198e5ab6b0046398c7ed9f4d12d6b Author: Miquel Raynal Date: Wed Jul 31 14:26:51 2019 +0200 ata: libahci: do not complain in case of deferred probe Retrieving PHYs can defer the probe, do not spawn an error when -EPROBE_DEFER is returned, it is normal behavior. Fixes: b1a9edbda040 ("ata: libahci: allow to use multiple PHYs") Reviewed-by: Hans de Goede Signed-off-by: Miquel Raynal Signed-off-by: Jens Axboe commit d0ee879187df966ef638031b5f5183078d672141 Author: Jackie Liu Date: Wed Jul 31 14:39:33 2019 +0800 io_uring: fix KASAN use after free in io_sq_wq_submit_work [root@localhost ~]# ./liburing/test/link QEMU Standard PC report that: [ 29.379892] CPU: 0 PID: 84 Comm: kworker/u2:2 Not tainted 5.3.0-rc2-00051-g4010b622f1d2-dirty #86 [ 29.379902] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 29.379913] Workqueue: io_ring-wq io_sq_wq_submit_work [ 29.379929] Call Trace: [ 29.379953] dump_stack+0xa9/0x10e [ 29.379970] ? io_sq_wq_submit_work+0xbf4/0xe90 [ 29.379986] print_address_description.cold.6+0x9/0x317 [ 29.379999] ? io_sq_wq_submit_work+0xbf4/0xe90 [ 29.380010] ? io_sq_wq_submit_work+0xbf4/0xe90 [ 29.380026] __kasan_report.cold.7+0x1a/0x34 [ 29.380044] ? io_sq_wq_submit_work+0xbf4/0xe90 [ 29.380061] kasan_report+0xe/0x12 [ 29.380076] io_sq_wq_submit_work+0xbf4/0xe90 [ 29.380104] ? io_sq_thread+0xaf0/0xaf0 [ 29.380152] process_one_work+0xb59/0x19e0 [ 29.380184] ? pwq_dec_nr_in_flight+0x2c0/0x2c0 [ 29.380221] worker_thread+0x8c/0xf40 [ 29.380248] ? __kthread_parkme+0xab/0x110 [ 29.380265] ? process_one_work+0x19e0/0x19e0 [ 29.380278] kthread+0x30b/0x3d0 [ 29.380292] ? kthread_create_on_node+0xe0/0xe0 [ 29.380311] ret_from_fork+0x3a/0x50 [ 29.380635] Allocated by task 209: [ 29.381255] save_stack+0x19/0x80 [ 29.381268] __kasan_kmalloc.constprop.6+0xc1/0xd0 [ 29.381279] kmem_cache_alloc+0xc0/0x240 [ 29.381289] io_submit_sqe+0x11bc/0x1c70 [ 29.381300] io_ring_submit+0x174/0x3c0 [ 29.381311] __x64_sys_io_uring_enter+0x601/0x780 [ 29.381322] do_syscall_64+0x9f/0x4d0 [ 29.381336] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 29.381633] Freed by task 84: [ 29.382186] save_stack+0x19/0x80 [ 29.382198] __kasan_slab_free+0x11d/0x160 [ 29.382210] kmem_cache_free+0x8c/0x2f0 [ 29.382220] io_put_req+0x22/0x30 [ 29.382230] io_sq_wq_submit_work+0x28b/0xe90 [ 29.382241] process_one_work+0xb59/0x19e0 [ 29.382251] worker_thread+0x8c/0xf40 [ 29.382262] kthread+0x30b/0x3d0 [ 29.382272] ret_from_fork+0x3a/0x50 [ 29.382569] The buggy address belongs to the object at ffff888067172140 which belongs to the cache io_kiocb of size 224 [ 29.384692] The buggy address is located 120 bytes inside of 224-byte region [ffff888067172140, ffff888067172220) [ 29.386723] The buggy address belongs to the page: [ 29.387575] page:ffffea00019c5c80 refcount:1 mapcount:0 mapping:ffff88806ace5180 index:0x0 [ 29.387587] flags: 0x100000000000200(slab) [ 29.387603] raw: 0100000000000200 dead000000000100 dead000000000122 ffff88806ace5180 [ 29.387617] raw: 0000000000000000 00000000800c000c 00000001ffffffff 0000000000000000 [ 29.387624] page dumped because: kasan: bad access detected [ 29.387920] Memory state around the buggy address: [ 29.388771] ffff888067172080: fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc [ 29.390062] ffff888067172100: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb [ 29.391325] >ffff888067172180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 29.392578] ^ [ 29.393480] ffff888067172200: fb fb fb fb fc fc fc fc fc fc fc fc fc fc fc fc [ 29.394744] ffff888067172280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 29.396003] ================================================================== [ 29.397260] Disabling lock debugging due to kernel taint io_sq_wq_submit_work free and read req again. Cc: Zhengyuan Liu Cc: linux-block@vger.kernel.org Cc: stable@vger.kernel.org Fixes: f7b76ac9d17e ("io_uring: fix counter inc/dec mismatch in async_list") Signed-off-by: Jackie Liu Signed-off-by: Jens Axboe commit 740f05f30a8c49ec63668055d28feedd906d3c50 Author: Sven Schnelle Date: Tue Jul 23 22:37:54 2019 +0200 parisc: fix race condition in patching code Assume the following ftrace code sequence that was patched in earlier by ftrace_make_call(): PAGE A: ffc: addr of ftrace_caller() PAGE B: 000: 0x6fc10080 /* stw,ma r1,40(sp) */ 004: 0x48213fd1 /* ldw -18(r1),r1 */ 008: 0xe820c002 /* bv,n r0(r1) */ 00c: 0xe83f1fdf /* b,l,n .-c,r1 */ When a Code sequences that is to be patched spans a page break, we might have already cleared the part on the PAGE A. If an interrupt is coming in during the remap of the fixed mapping to PAGE B, it might execute the patched function with only parts of the FTRACE code cleared. To prevent this, clear the jump to our mini trampoline first, and clear the remaining parts after this. This might also happen when patch_text() patches a function that it calls during remap. Signed-off-by: Sven Schnelle Cc: # 5.2+ Signed-off-by: Helge Deller commit c5df04521b521f14c30de327aa1e880f1190a355 Author: Masahiro Yamada Date: Tue Jul 23 18:47:51 2019 +0900 parisc: rename default_defconfig to defconfig 'default_defconfig' is an awkward name since 'defconfig' is the default. Let's simply say 'defconfig' like other architectures. You can drop the KBUILD_DEFCONFIG define by following the standard naming. Signed-off-by: Masahiro Yamada Signed-off-by: Helge Deller commit 73b886724747ea5fa599ada988fe0a30edcc2e00 Author: Helge Deller Date: Wed Jul 31 16:16:43 2019 +0200 parisc: Fix fall-through warnings in fpudispatch.c In fpudispatch.c we see a lot of fall-through warnings, but for this file we prefer to not mark the switches and instead keep it in it's original state as it's copied from HP-UX. Fixes: a035d552a93b ("Makefile: Globally enable fall-through warning") Signed-off-by: Helge Deller commit 12d1402ce35a900b4273893b885ddf35dbea0571 Author: Helge Deller Date: Wed Jul 31 16:16:00 2019 +0200 parisc: Mark expected switch fall-throughs in fault.c Fix a fall-through warning in fault.c. Fixes: a035d552a93b ("Makefile: Globally enable fall-through warning") Signed-off-by: Helge Deller commit e77ff779a0c6666b697c56a6e41972bbf30b977f Author: YueHaibing Date: Wed Jul 31 06:48:09 2019 -0700 Input: applespi - add dependency on LEDS_CLASS If applespi is enabled, but LEDs class support is not, the build fails: drivers/input/keyboard/applespi.o: In function `applespi_probe': applespi.c:(.text+0x1fcd): undefined reference to `devm_led_classdev_register_ext' Add "depends on LEDS_CLASS" to the Konfig Reported-by: Hulk Robot Fixes: 038b1a05eae6 ("Input: add Apple SPI keyboard and trackpad driver") Signed-off-by: YueHaibing Signed-off-by: Dmitry Torokhov commit ed4289e8b48845888ee46377bd2b55884a55e60b Author: Michael Ellerman Date: Mon Jul 29 22:28:54 2019 +1000 Revert "powerpc: slightly improve cache helpers" This reverts commit 6c5875843b87c3adea2beade9d1b8b3d4523900a. It triggers a probable compiler bug on clang which leads to crashes. With GCC it allows the compiler to use a more efficient register allocation but current GCC versions never do that at any of the current call sites, so there's no benefit. Signed-off-by: Michael Ellerman commit d7e23b887f67178c4f840781be7a6aa6aeb52ab1 Author: Christophe Leroy Date: Wed Jul 31 06:01:42 2019 +0000 powerpc/kasan: fix early boot failure on PPC32 Due to commit 4a6d8cf90017 ("powerpc/mm: don't use pte_alloc_kernel() until slab is available on PPC32"), pte_alloc_kernel() cannot be used during early KASAN init. Fix it by using memblock_alloc() instead. Fixes: 2edb16efc899 ("powerpc/32: Add KASAN support") Cc: stable@vger.kernel.org # v5.2+ Reported-by: Erhard F. Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/da89670093651437f27d2975224712e0a130b055.1564552796.git.christophe.leroy@c-s.fr commit 66f5772ee29db1062d5677a26e4e0ec9c6308c16 Merge: df612421fe25 71b256f8f7a5 Author: Kalle Valo Date: Wed Jul 31 14:51:55 2019 +0300 Merge tag 'iwlwifi-fixes-for-kvalo-2019-07-30' of git://git.kernel.org/pub/scm/linux/kernel/git/iwlwifi/iwlwifi-fixes We have a lot of fixes, most of them are also applicable to stable. Notably: * fix use-after-free issues * fix DMA mapping API usage errors * fix frame drop occurring due to reorder buffer handling in RSS in certain conditions * fix rate scale locking issues * disable TX A-MSDU on older NICs as it causes problems and was never supposed to be supported * new PCI IDs * GEO_TX_POWER_LIMIT API issue that many people were hitting commit 7440ea8b2a4430eef5120d0a7faac6c39304ae6d Author: Stephen Rothwell Date: Tue Jul 30 14:37:04 2019 +1000 drivers/macintosh/smu.c: Mark expected switch fall-through Mark switch cases where we are expecting to fall through. This patch fixes the following warning (Building: powerpc): drivers/macintosh/smu.c: In function 'smu_queue_i2c': drivers/macintosh/smu.c:854:21: warning: this statement may fall through [-Wimplicit-fallthrough=] cmd->info.devaddr &= 0xfe; ~~~~~~~~~~~~~~~~~~^~~~~~~ drivers/macintosh/smu.c:855:2: note: here case SMU_I2C_TRANSFER_STDSUB: ^~~~ Fixes: 0365ba7fb1fa ("[PATCH] ppc64: SMU driver update & i2c support") Signed-off-by: Stephen Rothwell Reviewed-by: Kees Cook Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20190730143704.060a2606@canb.auug.org.au commit b9da500bde81ad820b5d95c6bf52fc33e1f490ee Author: fengchunguo Date: Wed Jul 31 15:41:56 2019 +0800 ASoC: max98373: add 88200 and 96000 sampling rate support 88200 and 96000 sampling rate was not enabled on driver, so can't be played. The error information: max98373 3-0031：rate 96000 not supported max98373 3-0031：ASoC: can't set max98373-aif1 hw params: -22 Signed-off-by: fengchunguo Link: https://lore.kernel.org/r/20190731074156.5620-1-chunguo.feng@amlogic.com Signed-off-by: Mark Brown commit 52f87f3ca251f5e43b42e78ab9816b2b07718bfe Author: Marcus Cooper Date: Mon Jul 29 17:21:30 2019 +0200 ASoC: sun4i-i2s: Incorrect SR and WSS computation The A64 audio codec uses the original I2S block but the SR and WSS computation currently assigned is for the newer block. Fixes: 619c15f7fac9 (ASoC: sun4i-i2s: Change SR and WSS computation) Signed-off-by: Marcus Cooper Link: https://lore.kernel.org/r/20190729152130.27955-1-codekipper@gmail.com Signed-off-by: Mark Brown commit 6963d00bb6e42e91882d2eb36639701aca9fe032 Author: Cezary Rojewski Date: Fri Jul 26 20:15:17 2019 +0200 MAINTAINERS: Update Intel ASoC drivers maintainers Adding myself to Intel ASoC drivers maintainers list. Signed-off-by: Cezary Rojewski Acked-by: Pierre-Louis Bossart Link: https://lore.kernel.org/r/20190726181517.27655-1-cezary.rojewski@intel.com Signed-off-by: Mark Brown commit 6dee4829cfde106a8af7d0d3ba23022f8f054761 Author: Evan Quan Date: Mon Jul 22 10:42:29 2019 +0800 drm/amd/powerplay: correct UVD/VCE/VCN power status retrieval VCN should be used for Vega20 later ASICs while UVD and VCE are for previous ASICs. Signed-off-by: Evan Quan Reviewed-by: Kenneth Feng Signed-off-by: Alex Deucher commit a3ebbdb95f8c343a547ee2abec4d8abbf71f8a94 Author: Evan Quan Date: Mon Jul 22 10:27:21 2019 +0800 drm/amd/powerplay: correct Navi10 VCN powergate control (v2) No VCN DPM bit check as that's different from VCN PG. Also no extra check for possible double enablement/disablement as that's already done by VCN. v2: check return value of smu_feature_set_enabled Signed-off-by: Evan Quan Reviewed-by: Kenneth Feng Signed-off-by: Alex Deucher commit e21e3581e2a1df75abb96b545be15e526bd8c1c6 Author: Evan Quan Date: Mon Jul 22 09:57:27 2019 +0800 drm/amd/powerplay: support VCN powergate status retrieval for SW SMU Commonly used for VCN powergate status retrieval for SW SMU. Signed-off-by: Evan Quan Reviewed-by: Kenneth Feng Signed-off-by: Alex Deucher commit 201cd702b7012ecee2a613e09b6a227ca0e12504 Author: Evan Quan Date: Mon Jul 22 09:55:36 2019 +0800 drm/amd/powerplay: support VCN powergate status retrieval on Raven Enable VCN powergate status report on Raven. Signed-off-by: Evan Quan Reviewed-by: Kenneth Feng Signed-off-by: Alex Deucher commit a02709818f397e7ed7a0943d65a49d54b2752626 Author: Evan Quan Date: Mon Jul 22 09:51:59 2019 +0800 drm/amd/powerplay: add new sensor type for VCN powergate status VCN is widely used in new ASICs and different from tranditional UVD and VCE. Signed-off-by: Evan Quan Reviewed-by: Kenneth Feng Signed-off-by: Alex Deucher commit 929e571c04c285861e0bb049a396a2bdaea63282 Author: Wang Xiayang Date: Sat Jul 27 17:30:30 2019 +0800 drm/amdgpu: fix a potential information leaking bug Coccinelle reports a path that the array "data" is never initialized. The path skips the checks in the conditional branches when either of callback functions, read_wave_vgprs and read_wave_sgprs, is not registered. Later, the uninitialized "data" array is read in the while-loop below and passed to put_user(). Fix the path by allocating the array with kcalloc(). The patch is simplier than adding a fall-back branch that explicitly calls memset(data, 0, ...). Also it does not need the multiplication 1024*sizeof(*data) as the size parameter for memset() though there is no risk of integer overflow. Signed-off-by: Wang Xiayang Reviewed-by: Chunming Zhou Reviewed-by: Christian König Signed-off-by: Alex Deucher commit 67d0859e2758ef992fd32499747ce4b1038a63c0 Author: Christian König Date: Tue Jul 30 11:17:03 2019 +0200 drm/amdgpu: fix error handling in amdgpu_cs_process_fence_dep We always need to drop the ctx reference and should check for errors first and then dereference the fence pointer. Signed-off-by: Christian König Reviewed-by: Chunming Zhou Signed-off-by: Alex Deucher commit a78d14a31666c636a9e00a589032119fb59e3b94 Author: Arnd Bergmann Date: Mon Jul 22 09:46:29 2019 +0200 xen: avoid link error on ARM Building the privcmd code as a loadable module on ARM, we get a link error due to the private cache management functions: ERROR: "__sync_icache_dcache" [drivers/xen/xen-privcmd.ko] undefined! Move the code into a new that is always built in when Xen is enabled, as suggested by Juergen Gross and Boris Ostrovsky. Signed-off-by: Arnd Bergmann Reviewed-by: Stefano Stabellini Signed-off-by: Juergen Gross commit 8d1502f629c9966743de45744f4c1ba93a57d105 Author: Souptick Joarder Date: Wed Jul 31 00:04:56 2019 +0530 xen/gntdev.c: Replace vm_map_pages() with vm_map_pages_zero() 'commit df9bde015a72 ("xen/gntdev.c: convert to use vm_map_pages()")' breaks gntdev driver. If vma->vm_pgoff > 0, vm_map_pages() will: - use map->pages starting at vma->vm_pgoff instead of 0 - verify map->count against vma_pages()+vma->vm_pgoff instead of just vma_pages(). In practice, this breaks using a single gntdev FD for mapping multiple grants. relevant strace output: [pid 857] ioctl(7, IOCTL_GNTDEV_MAP_GRANT_REF, 0x7ffd3407b6d0) = 0 [pid 857] mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_SHARED, 7, 0) = 0x777f1211b000 [pid 857] ioctl(7, IOCTL_GNTDEV_SET_UNMAP_NOTIFY, 0x7ffd3407b710) = 0 [pid 857] ioctl(7, IOCTL_GNTDEV_MAP_GRANT_REF, 0x7ffd3407b6d0) = 0 [pid 857] mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_SHARED, 7, 0x1000) = -1 ENXIO (No such device or address) details here: https://github.com/QubesOS/qubes-issues/issues/5199 The reason is -> ( copying Marek's word from discussion) vma->vm_pgoff is used as index passed to gntdev_find_map_index. It's basically using this parameter for "which grant reference to map". map struct returned by gntdev_find_map_index() describes just the pages to be mapped. Specifically map->pages[0] should be mapped at vma->vm_start, not vma->vm_start+vma->vm_pgoff*PAGE_SIZE. When trying to map grant with index (aka vma->vm_pgoff) > 1, __vm_map_pages() will refuse to map it because it will expect map->count to be at least vma_pages(vma)+vma->vm_pgoff, while it is exactly vma_pages(vma). Converting vm_map_pages() to use vm_map_pages_zero() will fix the problem. Marek has tested and confirmed the same. Cc: stable@vger.kernel.org # v5.2+ Fixes: df9bde015a72 ("xen/gntdev.c: convert to use vm_map_pages()") Reported-by: Marek Marczykowski-Górecki Signed-off-by: Souptick Joarder Tested-by: Marek Marczykowski-Górecki Reviewed-by: Boris Ostrovsky Signed-off-by: Juergen Gross commit f0bc1ee473fefd4d9f2ace9fad1cefdc0b7f6fdd Author: Evan Quan Date: Thu Jul 25 10:12:42 2019 +0800 drm/amd/powerplay: enable SW SMU reset functionality Move SMU irq handler register to sw_init as that's totally software related. Otherwise, it will prevent SMU reset working. Signed-off-by: Evan Quan Reviewed-by: Kenneth Feng Signed-off-by: Alex Deucher commit 479156f2e5540077377a823eaf5a4263bd329063 Author: Evan Quan Date: Thu Jul 25 12:10:34 2019 +0800 drm/amd/powerplay: fix null pointer dereference around dpm state relates DPM state relates are not supported on the new SW SMU ASICs. But still it's not OK to trigger null pointer dereference on accessing them. Signed-off-by: Evan Quan Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher commit 090efd946d00cd23ce4ac25bce125f408b704d7d Author: Alex Deucher Date: Thu Jul 25 22:28:58 2019 -0500 drm/amdgpu/powerplay: use proper revision id for navi The PCI revision id determines the sku. Reviewed-by: Feifei Xu Reviewed-by: Kevin Wang Reviewed-by: Evan Quan Signed-off-by: Alex Deucher commit 45a660143bf90a35ab64df663b88d82c02a17091 Author: Kevin Wang Date: Tue Jul 23 19:56:52 2019 +0800 drm/amd/powerplay: fix temperature granularity error in smu11 in this patch, drm/amd/powerplay: add callback function of get_thermal_temperature_range the driver missed temperature granularity change on other temperature. Signed-off-by: Kevin Wang Reviewed-by: Evan Quan Reviewed-by: Kenneth Feng Signed-off-by: Alex Deucher commit 2c0f07fe3ca57c8fb4ee179c9fb50d6eba75349e Author: Kevin Wang Date: Mon Jun 3 15:58:31 2019 +0800 drm/amd/powerplay: add callback function of get_thermal_temperature_range 1. the thermal temperature is asic related data, move the code logic to xxx_ppt.c. 2. replace data structure PP_TemperatureRange with smu_temperature_range. 3. change temperature uint from temp*1000 to temp (temperature uint). Signed-off-by: Kevin Wang Signed-off-by: Kenneth Feng Acked-by: Huang Rui Signed-off-by: Alex Deucher commit d65848657c3da5c0d4b685f823d0230f151ab34e Author: Kent Russell Date: Tue Jul 23 10:18:01 2019 -0400 drm/amdkfd: Fix byte align on VegaM This was missed during the addition of VegaM support Reviewed-by: Alex Deucher Signed-off-by: Kent Russell Signed-off-by: Alex Deucher commit 6c77221df96177da0520847ce91e33f539fb8b2d Author: Changbin Du Date: Tue Jul 30 22:08:50 2019 +0800 fgraph: Remove redundant ftrace_graph_notrace_addr() test We already have tested it before. The second one should be removed. With this change, the performance should have little improvement. Link: http://lkml.kernel.org/r/20190730140850.7927-1-changbin.du@gmail.com Cc: stable@vger.kernel.org Fixes: 9cd2992f2d6c ("fgraph: Have set_graph_notrace only affect function_graph tracer") Signed-off-by: Changbin Du Signed-off-by: Steven Rostedt (VMware) commit b1d45c23284e55a379f85554a27a548b7988d47a Author: Masahiro Yamada Date: Sat Jul 20 19:39:43 2019 +0900 tracing: Fix header include guards in trace event headers These include guards are broken. Match the #if !define() and #define lines so that they work correctly. Link: http://lkml.kernel.org/r/20190720103943.16982-1-yamada.masahiro@socionext.com Fixes: f54d1867005c3 ("dma-buf: Rename struct fence to dma_fence") Fixes: 2e26ca7150a4f ("tracing: Fix tracepoint.h DECLARE_TRACE() to allow more than one header") Fixes: e543002f77f46 ("qdisc: add tracepoint qdisc:qdisc_dequeue for dequeued SKBs") Fixes: 95f295f9fe081 ("dmaengine: tegra: add tracepoints to driver") Signed-off-by: Masahiro Yamada Signed-off-by: Steven Rostedt (VMware) commit 4010b622f1d2a6112244101f38225eaee20c07f2 Merge: 629f8205a6cc 61c30c98ef17 Author: Linus Torvalds Date: Tue Jul 30 17:32:46 2019 -0700 Merge branch 'dax-fix-5.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm Pull dax fix from Dan Williams: "Fix a botched manual patch update that got dropped between testing and application" * 'dax-fix-5.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm: dax: Fix missed wakeup in put_unlocked_entry() commit 9c50a98f55f4b123227eebb25009524d20bc4c2a Author: Mike Snitzer Date: Tue Jul 30 14:39:43 2019 -0400 dm table: fix various whitespace issues with recent DAX code Also, rename device_synchronous to device_dax_synchronous. Signed-off-by: Mike Snitzer commit 5348deb138abb90ca8f728356772e38abc791cf9 Author: Pankaj Gupta Date: Tue Jul 30 17:07:08 2019 +0530 dm table: fix dax_dev NULL dereference in device_synchronous() If a device doesn't support DAX its 'dax_dev' is NULL. Fix device_synchronous() to first check if dax_dev is NULL before dereferencing it. Fixes: 2e9ee0955d3c ("dm: enable synchronous dax") Reported-by: jencce.kernel@gmail.com Signed-off-by: Pankaj Gupta Acked-by: Dan Williams Signed-off-by: Mike Snitzer commit 33a58980ff3cc5dbf0bb1b325746ac69223eda0b Author: Thomas Gleixner Date: Sun Jul 28 15:12:56 2019 +0200 arm64: compat: vdso: Use legacy syscalls as fallback The generic VDSO implementation uses the Y2038 safe clock_gettime64() and clock_getres_time64() syscalls as fallback for 32bit VDSO. This breaks seccomp setups because these syscalls might be not (yet) allowed. Implement the 32bit variants which use the legacy syscalls and select the variant in the core library. The 64bit time variants are not removed because they are required for the time64 based vdso accessors. Fixes: 00b26474c2f1 ("lib/vdso: Provide generic VDSO implementation") Reported-by: Sean Christopherson Reported-by: Paul Bolle Suggested-by: Andy Lutomirski Signed-off-by: Thomas Gleixner Tested-by: Vincenzo Frascino Reviewed-by: Vincenzo Frascino Link: https://lkml.kernel.org/r/20190728131648.971361611@linutronix.de commit d2f5d3fa26196183adb44a413c44caa9872275b4 Author: Thomas Gleixner Date: Sun Jul 28 15:12:55 2019 +0200 x86/vdso/32: Use 32bit syscall fallback The generic VDSO implementation uses the Y2038 safe clock_gettime64() and clock_getres_time64() syscalls as fallback for 32bit VDSO. This breaks seccomp setups because these syscalls might be not (yet) allowed. Implement the 32bit variants which use the legacy syscalls and select the variant in the core library. The 64bit time variants are not removed because they are required for the time64 based vdso accessors. Fixes: 7ac870747988 ("x86/vdso: Switch to generic vDSO implementation") Reported-by: Sean Christopherson Reported-by: Paul Bolle Suggested-by: Andy Lutomirski Signed-off-by: Thomas Gleixner Reviewed-by: Vincenzo Frascino Reviewed-by: Andy Lutomirski Link: https://lkml.kernel.org/r/20190728131648.879156507@linutronix.de commit c60a32ea4f459f99b98d383cad3b1ac7cfb3f4be Author: Thomas Gleixner Date: Tue Jul 30 11:38:50 2019 +0200 lib/vdso/32: Provide legacy syscall fallbacks To address the regression which causes seccomp to deny applications the access to clock_gettime64() and clock_getres64() syscalls because they are not enabled in the existing filters. That trips over the fact that 32bit VDSOs use the new clock_gettime64() and clock_getres64() syscalls in the fallback path. Add a conditional to invoke the 32bit legacy fallback syscalls instead of the new 64bit variants. The conditional can go away once all architectures are converted. Fixes: 00b26474c2f1 ("lib/vdso: Provide generic VDSO implementation") Signed-off-by: Thomas Gleixner Tested-by: Sean Christopherson Reviewed-by: Sean Christopherson Link: https://lkml.kernel.org/r/alpine.DEB.2.21.1907301134470.1738@nanos.tec.linutronix.de commit 502a590a170b3b3d0ad998ee0b639ac0b3db1dfa Author: Thomas Gleixner Date: Sun Jul 28 15:12:53 2019 +0200 lib/vdso: Move fallback invocation to the callers To allow syscall fallbacks using the legacy 32bit syscall for 32bit VDSO builds, move the fallback invocation out into the callers. Split the common code out of __cvdso_clock_gettime/getres() and invoke the syscall fallback in the 64bit and 32bit variants. Preparatory work for using legacy syscalls in 32bit VDSO. No functional change. Fixes: 00b26474c2f1 ("lib/vdso: Provide generic VDSO implementation") Signed-off-by: Thomas Gleixner Tested-by: Vincenzo Frascino Reviewed-by: Andy Lutomirski Reviewed-by: Vincenzo Frascino Link: https://lkml.kernel.org/r/20190728131648.695579736@linutronix.de commit a9446a906f52292c52ecbd5be78eaa4d8395756c Author: Thomas Gleixner Date: Sun Jul 28 15:12:52 2019 +0200 lib/vdso/32: Remove inconsistent NULL pointer checks The 32bit variants of vdso_clock_gettime()/getres() have a NULL pointer check for the timespec pointer. That's inconsistent vs. 64bit. But the vdso implementation will never be consistent versus the syscall because the only case which it can handle is NULL. Any other invalid pointer will cause a segfault. So special casing NULL is not really useful. Remove it along with the superflouos syscall fallback invocation as that will return -EFAULT anyway. That also gets rid of the dubious typecast which only works because the pointer is NULL. Fixes: 00b26474c2f1 ("lib/vdso: Provide generic VDSO implementation") Signed-off-by: Thomas Gleixner Tested-by: Vincenzo Frascino Reviewed-by: Vincenzo Frascino Reviewed-by: Andy Lutomirski Link: https://lkml.kernel.org/r/20190728131648.587523358@linutronix.de commit abb48f801396ba312e95f3c11072425221ce7401 Author: xiaofeis Date: Sun Jul 28 08:57:50 2019 +0800 net: dsa: qca8k: enable port flow control Set phy device advertising to enable MAC flow control. Signed-off-by: Xiaofei Shen Signed-off-by: David S. Miller commit fbb01c52471c8fb4ec2422c0ab26c134bd90bbff Author: Joe Lawrence Date: Thu Jul 18 16:29:48 2019 -0400 selftests/livepatch: push and pop dynamic debug config The livepatching self-tests tweak the dynamic debug config to verify the kernel log during the tests. Enhance set_dynamic_debug() so that the config changes are restored when the script exits. Note this functionality needs to keep in sync with: - dynamic_debug input/output formatting - functions affected by set_dynamic_debug() For example, push_dynamic_debug() transforms: kernel/livepatch/transition.c:530 [livepatch]klp_init_transition =_ "'%s': initializing %s transition\012" to the following: file kernel/livepatch/transition.c line 530 =_ Signed-off-by: Joe Lawrence Tested-by: Petr Mladek Signed-off-by: Shuah Khan commit fc2e634e997d84f2610a482b500865ef2c04fcde Author: Aleksa Sarai Date: Sat Jul 20 10:03:32 2019 +1000 kselftest: save-and-restore errno to allow for %m formatting Previously, using "%m" in a ksft_* format string can result in strange output because the errno value wasn't saved before calling other libc functions. The solution is to simply save and restore the errno before we format the user-supplied format string. Signed-off-by: Aleksa Sarai Signed-off-by: Shuah Khan commit 055d88242a6046a1ceac3167290f054c72571cd9 Author: Arnd Bergmann Date: Tue Jul 30 21:25:20 2019 +0200 compat_ioctl: pppoe: fix PPPOEIOCSFWD handling Support for handling the PPPOEIOCSFWD ioctl in compat mode was added in linux-2.5.69 along with hundreds of other commands, but was always broken sincen only the structure is compatible, but the command number is not, due to the size being sizeof(size_t), or at first sizeof(sizeof((struct sockaddr_pppox)), which is different on 64-bit architectures. Guillaume Nault adds: And the implementation was broken until 2016 (see 29e73269aa4d ("pppoe: fix reference counting in PPPoE proxy")), and nobody ever noticed. I should probably have removed this ioctl entirely instead of fixing it. Clearly, it has never been used. Fix it by adding a compat_ioctl handler for all pppoe variants that translates the command number and then calls the regular ioctl function. All other ioctl commands handled by pppoe are compatible between 32-bit and 64-bit, and require compat_ptr() conversion. This should apply to all stable kernels. Acked-by: Guillaume Nault Signed-off-by: Arnd Bergmann Signed-off-by: David S. Miller commit 2948a1fcd77a8bb11604387e3fc52f0ebf5729e9 Author: Jon Maloy Date: Tue Jul 30 20:19:10 2019 +0200 tipc: fix unitilized skb list crash Our test suite somtimes provokes the following crash: Description of problem: [ 1092.597234] BUG: unable to handle kernel NULL pointer dereference at 00000000000000e8 [ 1092.605072] PGD 0 P4D 0 [ 1092.607620] Oops: 0000 [#1] SMP PTI [ 1092.611118] CPU: 37 PID: 0 Comm: swapper/37 Kdump: loaded Not tainted 4.18.0-122.el8.x86_64 #1 [ 1092.619724] Hardware name: Dell Inc. PowerEdge R740/08D89F, BIOS 1.3.7 02/08/2018 [ 1092.627215] RIP: 0010:tipc_mcast_filter_msg+0x93/0x2d0 [tipc] [ 1092.632955] Code: 0f 84 aa 01 00 00 89 cf 4d 01 ca 4c 8b 26 c1 ef 19 83 e7 0f 83 ff 0c 4d 0f 45 d1 41 8b 6a 10 0f cd 4c 39 e6 0f 84 81 01 00 00 <4d> 8b 9c 24 e8 00 00 00 45 8b 13 41 0f ca 44 89 d7 c1 ef 13 83 e7 [ 1092.651703] RSP: 0018:ffff929e5fa83a18 EFLAGS: 00010282 [ 1092.656927] RAX: ffff929e3fb38100 RBX: 00000000069f29ee RCX: 00000000416c0045 [ 1092.664058] RDX: ffff929e5fa83a88 RSI: ffff929e31a28420 RDI: 0000000000000000 [ 1092.671209] RBP: 0000000029b11821 R08: 0000000000000000 R09: ffff929e39b4407a [ 1092.678343] R10: ffff929e39b4407a R11: 0000000000000007 R12: 0000000000000000 [ 1092.685475] R13: 0000000000000001 R14: ffff929e3fb38100 R15: ffff929e39b4407a [ 1092.692614] FS: 0000000000000000(0000) GS:ffff929e5fa80000(0000) knlGS:0000000000000000 [ 1092.700702] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1092.706447] CR2: 00000000000000e8 CR3: 000000031300a004 CR4: 00000000007606e0 [ 1092.713579] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 1092.720712] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 1092.727843] PKRU: 55555554 [ 1092.730556] Call Trace: [ 1092.733010] [ 1092.735034] tipc_sk_filter_rcv+0x7ca/0xb80 [tipc] [ 1092.739828] ? __kmalloc_node_track_caller+0x1cb/0x290 [ 1092.744974] ? dev_hard_start_xmit+0xa5/0x210 [ 1092.749332] tipc_sk_rcv+0x389/0x640 [tipc] [ 1092.753519] tipc_sk_mcast_rcv+0x23c/0x3a0 [tipc] [ 1092.758224] tipc_rcv+0x57a/0xf20 [tipc] [ 1092.762154] ? ktime_get_real_ts64+0x40/0xe0 [ 1092.766432] ? tpacket_rcv+0x50/0x9f0 [ 1092.770098] tipc_l2_rcv_msg+0x4a/0x70 [tipc] [ 1092.774452] __netif_receive_skb_core+0xb62/0xbd0 [ 1092.779164] ? enqueue_entity+0xf6/0x630 [ 1092.783084] ? kmem_cache_alloc+0x158/0x1c0 [ 1092.787272] ? __build_skb+0x25/0xd0 [ 1092.790849] netif_receive_skb_internal+0x42/0xf0 [ 1092.795557] napi_gro_receive+0xba/0xe0 [ 1092.799417] mlx5e_handle_rx_cqe+0x83/0xd0 [mlx5_core] [ 1092.804564] mlx5e_poll_rx_cq+0xd5/0x920 [mlx5_core] [ 1092.809536] mlx5e_napi_poll+0xb2/0xce0 [mlx5_core] [ 1092.814415] ? __wake_up_common_lock+0x89/0xc0 [ 1092.818861] net_rx_action+0x149/0x3b0 [ 1092.822616] __do_softirq+0xe3/0x30a [ 1092.826193] irq_exit+0x100/0x110 [ 1092.829512] do_IRQ+0x85/0xd0 [ 1092.832483] common_interrupt+0xf/0xf [ 1092.836147] [ 1092.838255] RIP: 0010:cpuidle_enter_state+0xb7/0x2a0 [ 1092.843221] Code: e8 3e 79 a5 ff 80 7c 24 03 00 74 17 9c 58 0f 1f 44 00 00 f6 c4 02 0f 85 d7 01 00 00 31 ff e8 a0 6b ab ff fb 66 0f 1f 44 00 00 <48> b8 ff ff ff ff f3 01 00 00 4c 29 f3 ba ff ff ff 7f 48 39 c3 7f [ 1092.861967] RSP: 0018:ffffaa5ec6533e98 EFLAGS: 00000246 ORIG_RAX: ffffffffffffffdd [ 1092.869530] RAX: ffff929e5faa3100 RBX: 000000fe63dd2092 RCX: 000000000000001f [ 1092.876665] RDX: 000000fe63dd2092 RSI: 000000003a518aaa RDI: 0000000000000000 [ 1092.883795] RBP: 0000000000000003 R08: 0000000000000004 R09: 0000000000022940 [ 1092.890929] R10: 0000040cb0666b56 R11: ffff929e5faa20a8 R12: ffff929e5faade78 [ 1092.898060] R13: ffffffffb59258f8 R14: 000000fe60f3228d R15: 0000000000000000 [ 1092.905196] ? cpuidle_enter_state+0x92/0x2a0 [ 1092.909555] do_idle+0x236/0x280 [ 1092.912785] cpu_startup_entry+0x6f/0x80 [ 1092.916715] start_secondary+0x1a7/0x200 [ 1092.920642] secondary_startup_64+0xb7/0xc0 [...] The reason is that the skb list tipc_socket::mc_method.deferredq only is initialized for connectionless sockets, while nothing stops arriving multicast messages from being filtered by connection oriented sockets, with subsequent access to the said list. We fix this by initializing the list unconditionally at socket creation. This eliminates the crash, while the message still is dropped further down in tipc_sk_filter_rcv() as it should be. Reported-by: Li Shuang Signed-off-by: Jon Maloy Reviewed-by: Xin Long Signed-off-by: David S. Miller commit 629f8205a6cc63d2e8e30956bad958a3507d018f Merge: 0572d7668a58 30b692d3b390 Author: Linus Torvalds Date: Tue Jul 30 13:25:14 2019 -0700 Merge tag 'for-linus-20190730' of git://git.kernel.org/pub/scm/linux/kernel/git/brauner/linux Pull pidfd fixes from Christian Brauner: "This makes setting the exit_state in exit_notify() consistent after fixing the pidfd polling race pre-rc1. Related to the race fix, this adds a WARN_ON() to do_notify_pidfd() to catch any future exit_state races. Last, this removes an obsolete comment from the pidfd tests" * tag 'for-linus-20190730' of git://git.kernel.org/pub/scm/linux/kernel/git/brauner/linux: exit: make setting exit_state consistent pidfd: Add warning if exit_state is 0 during notification pidfd: remove obsolete comments from test commit 0572d7668a58794059030b88945f78dfb94e3325 Merge: 2f6f0a996218 38fb6d0ea342 Author: Linus Torvalds Date: Tue Jul 30 13:15:39 2019 -0700 Merge tag 'f2fs-for-5.4-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/jaegeuk/f2fs Pull f2fs fixes from Jaegeuk Kim: "This set of patches adjust to follow recent setflags changes and fix two regressions" * tag 'f2fs-for-5.4-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/jaegeuk/f2fs: f2fs: use EINVAL for superblock with invalid magic f2fs: fix to read source block before invalidating it f2fs: remove redundant check from f2fs_setflags_common() f2fs: use generic checking function for FS_IOC_FSSETXATTR f2fs: use generic checking and prep function for FS_IOC_SETFLAGS commit 2f6f0a996218cdd9d275aac41828f54367e6fa28 Merge: 32a024b9a9f3 527d37e9e575 Author: Linus Torvalds Date: Tue Jul 30 13:10:07 2019 -0700 Merge tag 'linux-kselftest-5.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest Pull kselftest fixes from Shuah Khan: "Minor fixes to tests and one major fix to livepatch test to add skip handling to avoid false fail reports when livepatch is disabled" * tag 'linux-kselftest-5.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest: selftests/livepatch: add test skip handling selftests: mlxsw: Fix typo in qos_mc_aware.sh selftests/x86: fix spelling mistake "FAILT" -> "FAIL" selftests: kmod: Fix typo in kmod.sh commit 32a024b9a9f3b40f84bc55a6dd35eaa770ea26a4 Merge: 515f12b9eeed b7165bd0d6cb Author: Linus Torvalds Date: Tue Jul 30 13:01:04 2019 -0700 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma Pull rdma fixes from Jason Gunthorpe: "A few regression and bug fixes for the patches merged in the last cycle: - hns fixes a subtle crash from the ib core SGL rework - hfi1 fixes various error handling, oops and protocol errors - bnxt_re fixes a regression where nvmeof doesn't work on some configurations - mlx5 fixes a serious 'use after free' bug in how MR caching is handled - some edge case crashers in the new statistic core code - more siw static checker fixups" * tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma: IB/mlx5: Fix RSS Toeplitz setup to be aligned with the HW specification IB/counters: Always initialize the port counter object IB/core: Fix querying total rdma stats IB/mlx5: Prevent concurrent MR updates during invalidation IB/mlx5: Fix clean_mr() to work in the expected order IB/mlx5: Move MRs to a kernel PD when freeing them to the MR cache IB/mlx5: Use direct mkey destroy command upon UMR unreg failure IB/mlx5: Fix unreg_umr to ignore the mkey state RDMA/siw: Remove set but not used variables 'rv' IB/mlx5: Replace kfree with kvfree RDMA/bnxt_re: Honor vlan_id in GID entry comparison IB/hfi1: Drop all TID RDMA READ RESP packets after r_next_psn IB/hfi1: Field not zero-ed when allocating TID flow memory IB/hfi1: Unreserve a flushed OPFN request IB/hfi1: Check for error on call to alloc_rsm_map_table RDMA/hns: Fix sg offset non-zero issue RDMA/siw: Fix error return code in siw_init_module() commit 515f12b9eeed35250d793b7c874707c33f7f6e05 Merge: 2a11c76e5301 de4ee728465f Author: Linus Torvalds Date: Tue Jul 30 12:54:44 2019 -0700 Merge tag 'for-linus-hmm' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma Pull HMM fixes from Jason Gunthorpe: "Fix the locking around nouveau's use of the hmm_range_* APIs. It works correctly in the success case, but many of the the edge cases have missing unlocks or double unlocks. The diffstat is a bit big as Christoph did a comprehensive job to move the obsolete API from the core header and into the driver before fixing its flow, but the risk of regression from this code motion is low" * tag 'for-linus-hmm' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma: nouveau: unlock mmap_sem on all errors from nouveau_range_fault nouveau: remove the block parameter to nouveau_range_fault mm/hmm: move hmm_vma_range_done and hmm_vma_fault to nouveau mm/hmm: always return EBUSY for invalid ranges in hmm_range_{fault,snapshot} commit 89e524c04fa966330e2e80ab2bc50b9944c5847a Author: Jan Kara Date: Tue Jul 30 13:10:14 2019 +0200 loop: Fix mount(2) failure due to race with LOOP_SET_FD Commit 33ec3e53e7b1 ("loop: Don't change loop device under exclusive opener") made LOOP_SET_FD ioctl acquire exclusive block device reference while it updates loop device binding. However this can make perfectly valid mount(2) fail with EBUSY due to racing LOOP_SET_FD holding temporarily the exclusive bdev reference in cases like this: for i in {a..z}{a..z}; do dd if=/dev/zero of=$i.image bs=1k count=0 seek=1024 mkfs.ext2 $i.image mkdir mnt$i done echo "Run" for i in {a..z}{a..z}; do mount -o loop -t ext2 $i.image mnt$i & done Fix the problem by not getting full exclusive bdev reference in LOOP_SET_FD but instead just mark the bdev as being claimed while we update the binding information. This just blocks new exclusive openers instead of failing them with EBUSY thus fixing the problem. Fixes: 33ec3e53e7b1 ("loop: Don't change loop device under exclusive opener") Cc: stable@vger.kernel.org Tested-by: Kai-Heng Feng Signed-off-by: Jan Kara Signed-off-by: Jens Axboe commit 740ce365a4dccc1df4d05219cd5bf68f01359196 Author: Rob Herring Date: Tue Jul 30 08:49:34 2019 -0600 dt-bindings: Fix generated example files getting added to schemas Commit 837158b847a4 ("dt-bindings: Check the examples against the schemas") started generating YAML encoded DT files to validate the examples against the schema. When running 'make dt_binding_check' in tree after the 1st time, the generated example .dt.yaml files are mistakenly added to the list of schema files. Exclude *.example.dt.yaml files from the search for schema files. Fixes: 837158b847a4 ("dt-bindings: Check the examples against the schemas") Reported-by: Guido Günther Tested-by: Guido Günther Signed-off-by: Rob Herring commit afa1d96d1430c2138c545fb76e6dcb21222098d4 Author: Jia-Ju Bai Date: Tue Jul 30 11:28:20 2019 -0700 xfs: Fix possible null-pointer dereferences in xchk_da_btree_block_check_sibling() In xchk_da_btree_block_check_sibling(), there is an if statement on line 274 to check whether ds->state->altpath.blk[level].bp is NULL: if (ds->state->altpath.blk[level].bp) When ds->state->altpath.blk[level].bp is NULL, it is used on line 281: xfs_trans_brelse(..., ds->state->altpath.blk[level].bp); struct xfs_buf_log_item *bip = bp->b_log_item; ASSERT(bp->b_transp == tp); Thus, possible null-pointer dereferences may occur. To fix these bugs, ds->state->altpath.blk[level].bp is checked before being used. These bugs are found by a static analysis tool STCheck written by us. Signed-off-by: Jia-Ju Bai Reviewed-by: Darrick J. Wong Signed-off-by: Darrick J. Wong commit 30b692d3b390c6fe78a5064be0c4bbd44a41be59 Author: Christian Brauner Date: Mon Jul 29 17:48:24 2019 +0200 exit: make setting exit_state consistent Since commit b191d6491be6 ("pidfd: fix a poll race when setting exit_state") we unconditionally set exit_state to EXIT_ZOMBIE before calling into do_notify_parent(). This was done to eliminate a race when querying exit_state in do_notify_pidfd(). Back then we decided to do the absolute minimal thing to fix this and not touch the rest of the exit_notify() function where exit_state is set. Since this fix has not caused any issues change the setting of exit_state to EXIT_DEAD in the autoreap case to account for the fact hat exit_state is set to EXIT_ZOMBIE unconditionally. This fix was planned but also explicitly requested in [1] and makes the whole code more consistent. /* References */ [1]: https://lore.kernel.org/lkml/CAHk-=wigcxGFR2szue4wavJtH5cYTTeNES=toUBVGsmX0rzX+g@mail.gmail.com Signed-off-by: Christian Brauner Acked-by: Oleg Nesterov Cc: Linus Torvalds commit fac7b714c514fcc555541e1d6450c694b0a5f8d3 Author: Nishad Kamdar Date: Fri Jul 26 19:58:45 2019 +0530 intel_th: Use the correct style for SPDX License Identifier This patch corrects the SPDX License Identifier style in header files related to Drivers for Intel(R) Trace Hub controller. For C header files Documentation/process/license-rules.rst mandates C-like comments (opposed to C source files where C++ style should be used) Changes made by using a script provided by Joe Perches here: https://lkml.org/lkml/2019/2/7/46 Suggested-by: Joe Perches Signed-off-by: Nishad Kamdar Signed-off-by: Greg Kroah-Hartman commit a17c42f968969fbd5c34befef933bbdb81205c33 Merge: 5f4e4203add2 c69565ee6681 Author: David S. Miller Date: Tue Jul 30 10:31:25 2019 -0700 Merge tag 'rxrpc-fixes-20190730' of git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs David Howells says: ==================== Here are a couple of fixes for rxrpc: (1) Fix a potential deadlock in the peer keepalive dispatcher. (2) Fix a missing notification when a UDP sendmsg error occurs in rxrpc. ==================== Signed-off-by: David S. Miller commit 5f4e4203add2b860d2345312509a160f8292063b Author: YueHaibing Date: Tue Jul 30 22:29:59 2019 +0800 enetc: Fix build error without PHYLIB If PHYLIB is not set, build enetc will fails: drivers/net/ethernet/freescale/enetc/enetc.o: In function `enetc_open': enetc.c: undefined reference to `phy_disconnect' enetc.c: undefined reference to `phy_start' drivers/net/ethernet/freescale/enetc/enetc.o: In function `enetc_close': enetc.c: undefined reference to `phy_stop' enetc.c: undefined reference to `phy_disconnect' drivers/net/ethernet/freescale/enetc/enetc_ethtool.o: undefined reference to `phy_ethtool_get_link_ksettings' drivers/net/ethernet/freescale/enetc/enetc_ethtool.o: undefined reference to `phy_ethtool_set_link_ksettings' drivers/net/ethernet/freescale/enetc/enetc_mdio.o: In function `enetc_mdio_probe': enetc_mdio.c: undefined reference to `mdiobus_alloc_size' enetc_mdio.c: undefined reference to `mdiobus_free' Reported-by: Hulk Robot Fixes: d4fd0404c1c9 ("enetc: Introduce basic PF and VF ENETC ethernet drivers") Signed-off-by: YueHaibing Acked-by: Claudiu Manoil Signed-off-by: David S. Miller commit 3caa61c208753492fe59efb20e06f7c608eb8db2 Author: Jose Abreu Date: Tue Jul 30 15:57:16 2019 +0200 net: stmmac: Sync RX Buffer upon allocation With recent changes that introduced support for Page Pool in stmmac, Jon reported that NFS boot was no longer working on an ARM64 based platform that had the IP behind an IOMMU. As Page Pool API does not guarantee DMA syncing because of the use of DMA_ATTR_SKIP_CPU_SYNC flag, we have to explicit sync the whole buffer upon re-allocation because we are always re-using same pages. In fact, ARM64 code invalidates the DMA area upon two situations [1]: - sync_single_for_cpu(): Invalidates if direction != DMA_TO_DEVICE - sync_single_for_device(): Invalidates if direction == DMA_FROM_DEVICE So, as we must invalidate both the current RX buffer and the newly allocated buffer we propose this fix. [1] arch/arm64/mm/cache.S Reported-by: Jon Hunter Tested-by: Jon Hunter Fixes: 2af6106ae949 ("net: stmmac: Introducing support for Page Pool") Signed-off-by: Jose Abreu Tested-by: Ezequiel Garcia Signed-off-by: David S. Miller commit 2ad07086a557efdd80dd036f7b843bd3c51b81c2 Author: Colin Ian King Date: Tue Jul 30 12:47:52 2019 +0100 mlxsw: spectrum_ptp: fix duplicated check on orig_egr_types Currently are duplicated checks on orig_egr_types which are redundant, I believe this is a typo and should actually be orig_ing_types || orig_egr_types instead of the expression orig_egr_types || orig_egr_types. Fix these. Addresses-Coverity: ("Same on both sides") Fixes: c6b36bdd04b5 ("mlxsw: spectrum_ptp: Increase parsing depth when PTP is enabled") Signed-off-by: Colin Ian King Signed-off-by: David S. Miller commit 43c8e0ae76bdcb5c00b381c294c176b373316c8d Author: Hubert Feurstein Date: Tue Jul 30 12:11:42 2019 +0200 net: dsa: mv88e6xxx: use link-down-define instead of plain value Using the define here makes the code more expressive. Signed-off-by: Hubert Feurstein Reviewed-by: Andrew Lunn Signed-off-by: David S. Miller commit ab98c008ac761752cdc27f9eb053419feadeb2f7 Author: Hubert Feurstein Date: Tue Jul 30 11:46:23 2019 +0200 net: phy: fixed_phy: print gpio error only if gpio node is present It is perfectly ok to not have an gpio attached to the fixed-link node. So the driver should not throw an error message when the gpio is missing. Fixes: 5468e82f7034 ("net: phy: fixed-phy: Drop GPIO from fixed_phy_add()") Signed-off-by: Hubert Feurstein Reviewed-by: Andrew Lunn Signed-off-by: David S. Miller commit e82f04ec6ba91065fd33a6201ffd7cab840e1475 Author: Jia-Ju Bai Date: Mon Jul 29 16:44:51 2019 +0800 scsi: qla2xxx: Fix possible fcport null-pointer dereferences In qla2x00_alloc_fcport(), fcport is assigned to NULL in the error handling code on line 4880: fcport = NULL; Then fcport is used on lines 4883-4886: INIT_WORK(&fcport->del_work, qla24xx_delete_sess_fn); INIT_WORK(&fcport->reg_work, qla_register_fcport_fn); INIT_LIST_HEAD(&fcport->gnl_entry); INIT_LIST_HEAD(&fcport->list); Thus, possible null-pointer dereferences may occur. To fix these bugs, qla2x00_alloc_fcport() directly returns NULL in the error handling code. These bugs are found by a static analysis tool STCheck written by us. Signed-off-by: Jia-Ju Bai Acked-by: Himanshu Madhani Signed-off-by: Martin K. Petersen commit df9a606184bfdb5ae3ca9d226184e9489f5c24f7 Author: Suganath Prabu Date: Tue Jul 30 03:43:57 2019 -0400 scsi: mpt3sas: Use 63-bit DMA addressing on SAS35 HBA Although SAS3 & SAS3.5 IT HBA controllers support 64-bit DMA addressing, as per hardware design, if DMA-able range contains all 64-bits set (0xFFFFFFFF-FFFFFFFF) then it results in a firmware fault. E.g. SGE's start address is 0xFFFFFFFF-FFFF000 and data length is 0x1000 bytes. when HBA tries to DMA the data at 0xFFFFFFFF-FFFFFFFF location then HBA will fault the firmware. Driver will set 63-bit DMA mask to ensure the above address will not be used. Cc: # 5.1.20+ Signed-off-by: Suganath Prabu Reviewed-by: Christoph Hellwig Signed-off-by: Martin K. Petersen commit ac43432cb1f5c2950408534987e57c2071e24d8f Author: Muchun Song Date: Sat Jul 27 11:21:22 2019 +0800 driver core: Fix use-after-free and double free on glue directory There is a race condition between removing glue directory and adding a new device under the glue dir. It can be reproduced in following test: CPU1: CPU2: device_add() get_device_parent() class_dir_create_and_add() kobject_add_internal() create_dir() // create glue_dir device_add() get_device_parent() kobject_get() // get glue_dir device_del() cleanup_glue_dir() kobject_del(glue_dir) kobject_add() kobject_add_internal() create_dir() // in glue_dir sysfs_create_dir_ns() kernfs_create_dir_ns(sd) sysfs_remove_dir() // glue_dir->sd=NULL sysfs_put() // free glue_dir->sd // sd is freed kernfs_new_node(sd) kernfs_get(glue_dir) kernfs_add_one() kernfs_put() Before CPU1 remove last child device under glue dir, if CPU2 add a new device under glue dir, the glue_dir kobject reference count will be increase to 2 via kobject_get() in get_device_parent(). And CPU2 has been called kernfs_create_dir_ns(), but not call kernfs_new_node(). Meanwhile, CPU1 call sysfs_remove_dir() and sysfs_put(). This result in glue_dir->sd is freed and it's reference count will be 0. Then CPU2 call kernfs_get(glue_dir) will trigger a warning in kernfs_get() and increase it's reference count to 1. Because glue_dir->sd is freed by CPU1, the next call kernfs_add_one() by CPU2 will fail(This is also use-after-free) and call kernfs_put() to decrease reference count. Because the reference count is decremented to 0, it will also call kmem_cache_free() to free the glue_dir->sd again. This will result in double free. In order to avoid this happening, we also should make sure that kernfs_node for glue_dir is released in CPU1 only when refcount for glue_dir kobj is 1 to fix this race. The following calltrace is captured in kernel 4.14 with the following patch applied: commit 726e41097920 ("drivers: core: Remove glue dirs from sysfs earlier") -------------------------------------------------------------------------- [ 3.633703] WARNING: CPU: 4 PID: 513 at .../fs/kernfs/dir.c:494 Here is WARN_ON(!atomic_read(&kn->count) in kernfs_get(). .... [ 3.633986] Call trace: [ 3.633991] kernfs_create_dir_ns+0xa8/0xb0 [ 3.633994] sysfs_create_dir_ns+0x54/0xe8 [ 3.634001] kobject_add_internal+0x22c/0x3f0 [ 3.634005] kobject_add+0xe4/0x118 [ 3.634011] device_add+0x200/0x870 [ 3.634017] _request_firmware+0x958/0xc38 [ 3.634020] request_firmware_into_buf+0x4c/0x70 .... [ 3.634064] kernel BUG at .../mm/slub.c:294! Here is BUG_ON(object == fp) in set_freepointer(). .... [ 3.634346] Call trace: [ 3.634351] kmem_cache_free+0x504/0x6b8 [ 3.634355] kernfs_put+0x14c/0x1d8 [ 3.634359] kernfs_create_dir_ns+0x88/0xb0 [ 3.634362] sysfs_create_dir_ns+0x54/0xe8 [ 3.634366] kobject_add_internal+0x22c/0x3f0 [ 3.634370] kobject_add+0xe4/0x118 [ 3.634374] device_add+0x200/0x870 [ 3.634378] _request_firmware+0x958/0xc38 [ 3.634381] request_firmware_into_buf+0x4c/0x70 -------------------------------------------------------------------------- Fixes: 726e41097920 ("drivers: core: Remove glue dirs from sysfs earlier") Signed-off-by: Muchun Song Reviewed-by: Mukesh Ojha Signed-off-by: Prateek Sood Link: https://lore.kernel.org/r/20190727032122.24639-1-smuchun@gmail.com Signed-off-by: Greg Kroah-Hartman commit 18a56d699d174f3ac41f2ea86e1ca21f98b01d8f Author: Don Brace Date: Wed Jul 24 17:08:12 2019 -0500 scsi: hpsa: remove printing internal cdb on tag collision Remove racy printing of internal commands. Completion thread can be cleaning up the command in parallel. Reviewed-by: Bader Ali - Saleh Reviewed-by: Scott Teel Reviewed-by: Scott Benesh Reviewed-by: Kevin Barnett Signed-off-by: Don Brace Signed-off-by: Martin K. Petersen commit 2d291e6cc183608e1f6eb8580268df7c68bdf7c3 Author: Gustavo A. R. Silva Date: Mon Jul 29 18:32:10 2019 -0500 MIPS: OProfile: Mark expected switch fall-throughs Mark switch cases where we are expecting to fall through. This patch fixes the following warning (Building: mips): arch/mips/oprofile/op_model_mipsxx.c: In function ‘mipsxx_cpu_stop’: arch/mips/oprofile/op_model_mipsxx.c:217:3: warning: this statement may fall through [-Wimplicit-fallthrough=] w_c0_perfctrl3(0); ^~~~~~~~~~~~~~~~~ arch/mips/oprofile/op_model_mipsxx.c:218:2: note: here case 3: ^~~~ arch/mips/oprofile/op_model_mipsxx.c:219:3: warning: this statement may fall through [-Wimplicit-fallthrough=] w_c0_perfctrl2(0); ^~~~~~~~~~~~~~~~~ arch/mips/oprofile/op_model_mipsxx.c:220:2: note: here case 2: ^~~~ arch/mips/oprofile/op_model_mipsxx.c:221:3: warning: this statement may fall through [-Wimplicit-fallthrough=] w_c0_perfctrl1(0); ^~~~~~~~~~~~~~~~~ arch/mips/oprofile/op_model_mipsxx.c:222:2: note: here case 1: ^~~~ arch/mips/oprofile/op_model_mipsxx.c: In function ‘mipsxx_cpu_start’: arch/mips/oprofile/op_model_mipsxx.c:197:3: warning: this statement may fall through [-Wimplicit-fallthrough=] w_c0_perfctrl3(WHAT | reg.control[3]); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ arch/mips/oprofile/op_model_mipsxx.c:198:2: note: here case 3: ^~~~ arch/mips/oprofile/op_model_mipsxx.c:199:3: warning: this statement may fall through [-Wimplicit-fallthrough=] w_c0_perfctrl2(WHAT | reg.control[2]); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ arch/mips/oprofile/op_model_mipsxx.c:200:2: note: here case 2: ^~~~ arch/mips/oprofile/op_model_mipsxx.c:201:3: warning: this statement may fall through [-Wimplicit-fallthrough=] w_c0_perfctrl1(WHAT | reg.control[1]); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ arch/mips/oprofile/op_model_mipsxx.c:202:2: note: here case 1: ^~~~ arch/mips/oprofile/op_model_mipsxx.c: In function ‘reset_counters’: arch/mips/oprofile/op_model_mipsxx.c:299:3: warning: this statement may fall through [-Wimplicit-fallthrough=] w_c0_perfcntr3(0); ^~~~~~~~~~~~~~~~~ arch/mips/oprofile/op_model_mipsxx.c:300:2: note: here case 3: ^~~~ arch/mips/oprofile/op_model_mipsxx.c:302:3: warning: this statement may fall through [-Wimplicit-fallthrough=] w_c0_perfcntr2(0); ^~~~~~~~~~~~~~~~~ arch/mips/oprofile/op_model_mipsxx.c:303:2: note: here case 2: ^~~~ arch/mips/oprofile/op_model_mipsxx.c:305:3: warning: this statement may fall through [-Wimplicit-fallthrough=] w_c0_perfcntr1(0); ^~~~~~~~~~~~~~~~~ arch/mips/oprofile/op_model_mipsxx.c:306:2: note: here case 1: ^~~~ arch/mips/oprofile/op_model_mipsxx.c: In function ‘mipsxx_perfcount_handler’: arch/mips/oprofile/op_model_mipsxx.c:242:6: warning: this statement may fall through [-Wimplicit-fallthrough=] if ((control & MIPS_PERFCTRL_IE) && \ ^ arch/mips/oprofile/op_model_mipsxx.c:248:2: note: in expansion of macro ‘HANDLE_COUNTER’ HANDLE_COUNTER(3) ^~~~~~~~~~~~~~ arch/mips/oprofile/op_model_mipsxx.c:239:2: note: here case n + 1: \ ^ arch/mips/oprofile/op_model_mipsxx.c:249:2: note: in expansion of macro ‘HANDLE_COUNTER’ HANDLE_COUNTER(2) ^~~~~~~~~~~~~~ arch/mips/oprofile/op_model_mipsxx.c:242:6: warning: this statement may fall through [-Wimplicit-fallthrough=] if ((control & MIPS_PERFCTRL_IE) && \ ^ arch/mips/oprofile/op_model_mipsxx.c:249:2: note: in expansion of macro ‘HANDLE_COUNTER’ HANDLE_COUNTER(2) ^~~~~~~~~~~~~~ arch/mips/oprofile/op_model_mipsxx.c:239:2: note: here case n + 1: \ ^ arch/mips/oprofile/op_model_mipsxx.c:250:2: note: in expansion of macro ‘HANDLE_COUNTER’ HANDLE_COUNTER(1) ^~~~~~~~~~~~~~ arch/mips/oprofile/op_model_mipsxx.c:242:6: warning: this statement may fall through [-Wimplicit-fallthrough=] if ((control & MIPS_PERFCTRL_IE) && \ ^ arch/mips/oprofile/op_model_mipsxx.c:250:2: note: in expansion of macro ‘HANDLE_COUNTER’ HANDLE_COUNTER(1) ^~~~~~~~~~~~~~ arch/mips/oprofile/op_model_mipsxx.c:239:2: note: here case n + 1: \ ^ arch/mips/oprofile/op_model_mipsxx.c:251:2: note: in expansion of macro ‘HANDLE_COUNTER’ HANDLE_COUNTER(0) ^~~~~~~~~~~~~~ CC usr/include/linux/pmu.h.s arch/mips/oprofile/op_model_mipsxx.c: In function ‘mipsxx_cpu_setup’: arch/mips/oprofile/op_model_mipsxx.c:174:3: warning: this statement may fall through [-Wimplicit-fallthrough=] w_c0_perfcntr3(reg.counter[3]); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ arch/mips/oprofile/op_model_mipsxx.c:175:2: note: here case 3: ^~~~ arch/mips/oprofile/op_model_mipsxx.c:177:3: warning: this statement may fall through [-Wimplicit-fallthrough=] w_c0_perfcntr2(reg.counter[2]); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ arch/mips/oprofile/op_model_mipsxx.c:178:2: note: here case 2: ^~~~ arch/mips/oprofile/op_model_mipsxx.c:180:3: warning: this statement may fall through [-Wimplicit-fallthrough=] w_c0_perfcntr1(reg.counter[1]); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ arch/mips/oprofile/op_model_mipsxx.c:181:2: note: here case 1: ^~~~ Signed-off-by: Gustavo A. R. Silva Signed-off-by: Paul Burton Cc: Robert Richter Cc: Ralf Baechle Cc: James Hogan Cc: oprofile-list@lists.sf.net Cc: linux-mips@vger.kernel.org Cc: linux-kernel@vger.kernel.org Cc: Kees Cook commit eeebce1862970653cdf5c01e98bc669edd8f529a Author: Don Brace Date: Wed Jul 24 17:08:06 2019 -0500 scsi: hpsa: correct scsi command status issue after reset Reviewed-by: Bader Ali - Saleh Reviewed-by: Scott Teel Reviewed-by: Scott Benesh Reviewed-by: Kevin Barnett Signed-off-by: Don Brace Signed-off-by: Martin K. Petersen commit 71b256f8f7a5c09810d2c3ed6165629c2cc0a652 Author: Emmanuel Grumbach Date: Mon Jul 22 13:02:25 2019 +0300 iwlwifi: mvm: fix a use-after-free bug in iwl_mvm_tx_tso_segment Accessing the hdr of an skb that was consumed already isn't a good idea. First ask if the skb is a QoS packet, then keep that data on stack, and then consume the skb. This was spotted by KASAN. Cc: stable@vger.kernel.org Fixes: 08f7d8b69aaf ("iwlwifi: mvm: bring back mvm GSO code") Signed-off-by: Emmanuel Grumbach Signed-off-by: Johannes Berg commit ba3224db78034435e9ff0247277cce7c7bb1756c Author: Emmanuel Grumbach Date: Mon Jul 22 12:47:27 2019 +0300 iwlwifi: mvm: fix an out-of-bound access The index for the elements of the ACPI object we dereference was static. This means that if we called the function twice we wouldn't start from 3 again, but rather from the latest index we reached in the previous call. This was dutifully reported by KASAN. Fix this. Cc: stable@vger.kernel.org Fixes: 6996490501ed ("iwlwifi: mvm: add support for EWRD (Dynamic SAR) ACPI table") Signed-off-by: Emmanuel Grumbach Signed-off-by: Johannes Berg commit 87e7e25aee6b59fef740856f4e86d4b60496c9e1 Author: Emmanuel Grumbach Date: Sun Jul 21 14:02:27 2019 +0300 iwlwifi: don't unmap as page memory that was mapped as single In order to remember how to unmap a memory (as single or as page), we maintain a bit per Transmit Buffer (TBs) in the meta data (structure iwl_cmd_meta). We maintain a bitmap: 1 bit per TB. If the TB is set, we will free the memory as a page. This bitmap was never cleared. Fix this. Cc: stable@vger.kernel.org Fixes: 3cd1980b0cdf ("iwlwifi: pcie: introduce new tfd and tb formats") Signed-off-by: Emmanuel Grumbach Signed-off-by: Johannes Berg commit f5a47fae6aa3eb06f100e701d2342ee56b857bee Author: Luca Coelho Date: Fri Jul 19 12:21:59 2019 +0300 iwlwifi: mvm: fix version check for GEO_TX_POWER_LIMIT support We erroneously added a check for FW API version 41 before sending GEO_TX_POWER_LIMIT, but this was already implemented in version 38. Additionally, it was cherry-picked to older versions, namely 17, 26 and 29, so check for those as well. Cc: stable@vger.kernel.org Fixes: eca1e56ceedd ("iwlwifi: mvm: don't send GEO_TX_POWER_LIMIT to old firmwares") Signed-off-by: Luca Coelho Signed-off-by: Johannes Berg commit 03a0995ccc0717ca0c0c7454a033c260872d45ae Author: Ihab Zhaika Date: Mon Jul 15 15:30:48 2019 +0300 iwlwifi: add 3 new IDs for the 9000 series (iwl9260_2ac_160_cfg) Add a few PCI ID'S for 9000 series. Signed-off-by: Ihab Zhaika Signed-off-by: Luca Coelho Signed-off-by: Johannes Berg commit 514ea05b0743435bf181c41f48d83aac050cc6fa Author: Gregory Greenman Date: Mon Jul 8 09:07:42 2019 +0300 iwlwifi: mvm: fix possible out-of-bounds read when accessing lq_info lq_info is an arary of size 2, active_tbl index is u8. When accessing lq_info[1 - active_tbl], theoretically it's possible that the access will be made to a negative index value. Signed-off-by: Gregory Greenman Signed-off-by: Luca Coelho Signed-off-by: Johannes Berg commit ecd09ddc1d14cca4f874151aed51a7feee3f765b Author: Emmanuel Grumbach Date: Thu Jun 27 21:50:24 2019 +0300 iwlwifi: mvm: fix frame drop from the reordering buffer An earlier patch made sure that the queues are not lagging too far behind. This means that iwl_mvm_release_frames should not be called with a head_sn too far behind NSSN. Don't take the risk to change completely the entry condition to iwl_mvm_release_frames, but don't update the head_sn is the NSSN is more than 2048 packets ahead of us. Since this just cannot be right. This means that the scenario described here happened. We are queue 0. Q:0 Q:1 head_sn: 0 -> 2047 head_sn: 2048 Lots of packets arrive: head_sn: 2047 -> 2150 send NSSN_SYNC notification Handle notification from the firmware and do NOT move the head_sn back to 2048 Signed-off-by: Emmanuel Grumbach Signed-off-by: Luca Coelho Signed-off-by: Johannes Berg commit f5d88fa334e6c8e2d840512ffbb30e3cb58d065b Author: Gregory Greenman Date: Sun Jun 30 09:42:57 2019 +0300 iwlwifi: mvm: replace RS mutex with a spin_lock The solution with the worker still had a bug, as in order to get sta, rcu_read_lock should be used and thus no mutex can be used inside iwl_mvm_rs_rate_init. Also, spin_lock is a simpler solution, no need to spawn a dedicated worker. Signed-off-by: Gregory Greenman Signed-off-by: Luca Coelho Signed-off-by: Johannes Berg commit cd4d6b0bcd51580efda9ae54ab7b2d630b4147dc Author: Gregory Greenman Date: Sun Jun 30 09:18:15 2019 +0300 iwlwifi: mvm: send LQ command always ASYNC The only place where the command was sent as SYNC is during init and this is not really critical. This change is required for replacing RS mutex with a spinlock (in the subsequent patch), since SYNC comamnd requres sleeping and thus the flow cannot be done when holding a spinlock. Signed-off-by: Gregory Greenman Signed-off-by: Luca Coelho Signed-off-by: Johannes Berg commit b6cf28796756246f9e317eed6f63f1e2981e9817 Author: Colin Ian King Date: Mon Jul 1 17:26:57 2019 +0100 iwlwifi: mvm: fix comparison of u32 variable with less than zero The comparison of the u32 variable wgds_tbl_idx with less than zero is always going to be false because it is unsigned. Fix this by making wgds_tbl_idx a plain signed int. Addresses-Coverity: ("Unsigned compared against 0") Fixes: 4fd445a2c855 ("iwlwifi: mvm: Add log information about SAR status") Signed-off-by: Colin Ian King Signed-off-by: Luca Coelho Signed-off-by: Johannes Berg commit 6569e7d36773956298ec1d5f4e6a2487913d2752 Author: Johannes Berg Date: Thu Jun 27 09:44:50 2019 +0200 iwlwifi: fix locking in delayed GTK setting This code clearly never could have worked, since it locks while already locked. Add an unlocked __iwl_mvm_mac_set_key() variant that doesn't do locking to fix that. Signed-off-by: Johannes Berg Signed-off-by: Luca Coelho Signed-off-by: Johannes Berg commit abcbef5977df1fb61026ba429964cd6b9a085699 Author: Shahar S Matityahu Date: Thu Jun 13 15:11:24 2019 +0300 iwlwifi: dbg_ini: move iwl_dbg_tlv_free outside of debugfs ifdef The driver should call iwl_dbg_tlv_free even if debugfs is not defined since ini mode does not depend on debugfs ifdef. Signed-off-by: Shahar S Matityahu Fixes: 68f6f492c4fa ("iwlwifi: trans: support loading ini TLVs from external file") Signed-off-by: Luca Coelho Signed-off-by: Johannes Berg commit 072b30642f90b01d139131ec7bf763778a3a3f41 Author: Shahar S Matityahu Date: Thu Jun 13 15:08:24 2019 +0300 iwlwifi: dbg_ini: move iwl_dbg_tlv_load_bin out of debug override ifdef ini debug mode should work even if debug override is not defined. Signed-off-by: Shahar S Matityahu Fixes: 68f6f492c4fa ("iwlwifi: trans: support loading ini TLVs from external file") Signed-off-by: Luca Coelho Signed-off-by: Johannes Berg commit ef349abd91c1b37f87639170bcd9d11fe3ac58ff Author: Matthias Maennich Date: Thu Jul 25 11:17:04 2019 +0100 coccinelle: api/atomic_as_refcounter: add SPDX License Identifier Add the missing GPLv2 SPDX license identifier. It appears this single file was missing from 7f904d7e1f3e ("treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 505"), which addressed all other files in scripts/coccinelle. Hence I added GPL-2.0-only consitently with the mentioned patch. Cc: linux-spdx@vger.kernel.org Cc: Elena Reshetova Signed-off-by: Matthias Maennich Acked-by: Julia Lawall Signed-off-by: Greg Kroah-Hartman commit 23babdf06779482a65c5072a145d826a62979534 Author: Gregory Greenman Date: Tue Jun 25 11:42:49 2019 +0300 iwlwifi: mvm: add a wrapper around rs_tx_status to handle locks iwl_mvm_rs_tx_status can be called from two places in the code, but the mutex is taken only on one of the calls. Split it into a wrapper taking locks and an internal __iwl_mvm_rs_tx_status function. Signed-off-by: Gregory Greenman Signed-off-by: Luca Coelho Signed-off-by: Johannes Berg commit 2b089bf8d19c66f70ae3b2d2d101be1ae49bfe24 Author: Thomas Huth Date: Mon Jul 22 11:20:08 2019 +0200 kernel/configs: Replace GPL boilerplate code with SPDX identifier The FSF does not reside in "675 Mass Ave, Cambridge" anymore... let's replace the old GPL boilerplate code with a proper SPDX identifier instead. Signed-off-by: Thomas Huth Signed-off-by: Greg Kroah-Hartman commit 3c514bf831ac12356b695ff054bef641b9e99593 Author: Emmanuel Grumbach Date: Mon Jun 24 16:26:24 2019 +0300 iwlwifi: mvm: add a loose synchronization of the NSSN across Rx queues In order to support MSI-X efficiently, we want to avoid communication across Rx queues. Each Rx queue should have all the data it needs to process a packet. The reordering buffer is a challenge in the MSI-X world since we can have a single BA session whose packets are directed to different queues. This is why each queue has its own reordering buffer. The hardware is able to hint the driver whether we have a hole or not, which allows the driver to know whether it can release a packet or not. This indication is called NSSN. Roughly, if the packet's SN is lower than the NSSN, we can release the packet to the stack. The NSSN is the SN of the newest packet received without any holes + 1. This is working as long as we don't have packets that we release because of a timeout. When that happens, we could have taken the decision to release a packet after we have been waiting for its predecessor for too long. If this predecessor comes later, we have to drop it because we can't release packets out of order. In that case, the hardware will give us an indication that we can we release the packet (SN < NSSN), but the packet still needs to be dropped. This is why we sometimes need to ignore the NSSN and we track the head_sn in software. Here is a specific example of this: 1) Rx queue 1 got packets: 480, 482, 483 2) We release 480 to to the stack and wait for 481 3) NSSN is now 481 4) The timeout expires 5) We release 482 and 483, NSSN is still 480 6) 481 arrives its NSSN is 484. We need to drop 481 even if 481 < 484. This is why we'll update the head_sn to 484 at step 2. The flow now is: 1) Rx queue 1 got packets: 480, 482, 483 2) We release 480 to to the stack and wait for 481 3) NSSN is now 481 / head_sn is 481 4) The timeout expires 5) We release 482 and 483, NSSN is still 480 but head_sn is 484. 6) 481 arrives its NSSN is 484, but head_sn is 484 and we drop it. This code introduces another problem in case all the traffic goes well (no hole, no timeout): Rx queue 1: 0 -> 483 (head_sn = 484) Rx queue 2: 501 -> 4095 (head_sn = 0) Rx queue 2: 0 -> 480 (head_sn = 481) Rx queue 1: 481 but head_sn = 484 and we drop it. At this point, the SN of queue 1 is far behind: more than 4040 packets behind. Queue 1 will consider 481 "old" because 481 is in [501-64:501] whereas it is a very new packet. In order to fix that, send an Rx notification from time to time (twice across the full set of 4096 packets) to make sure no Rx queue is lagging too far behind. What will happen then is: Rx queue 1: 0 -> 483 (head_sn = 484) Rx queue 2: 501 -> 2047 (head_sn = 2048) Rx queue 1: Sync nofication (head_sn = 2048) Rx queue 2: 2048 -> 4095 (head_sn = 0) Rx queue 1: Sync notification (head_sn = 0) Rx queue 2: 1 -> 481 (head_sn = 482) Rx queue 1: 481 and head_sn = 0. In queue 1's data, head_sn is now 0, the packet coming in is 481, it'll understand that the new packet is new and it won't be dropped. Signed-off-by: Emmanuel Grumbach Signed-off-by: Luca Coelho Signed-off-by: Johannes Berg commit 521dc6c7c74e88fbd02947e4e50a5cb0d49b4395 Author: Emmanuel Grumbach Date: Tue Jun 25 09:14:14 2019 +0300 iwlwiif: mvm: refactor iwl_mvm_notify_rx_queue Instead of allocating memory for which we have an upper limit, use a small buffer on stack. Signed-off-by: Emmanuel Grumbach Signed-off-by: Luca Coelho Signed-off-by: Johannes Berg commit c61b655a88a54d8690c1e134c47bc3f6d40d2dc3 Author: Emmanuel Grumbach Date: Mon Jun 24 13:57:34 2019 +0300 iwlwifi: mvm: add a new RSS sync notification for NSSN sync We will soon be using a new notification that will be initiated by the driver, sent to the firmware and sent back to all the RSS queues by the firmware. This new notification will be useful to synchronize the NSSN across all the queues. For now, don't send the notification, just add the code to handle it. Later patch will add the code to actually send it. While at it, validate the baid coming from the firmware to avoid accessing an array with a bad index in the driver. Signed-off-by: Emmanuel Grumbach Signed-off-by: Luca Coelho Signed-off-by: Johannes Berg commit 6b2dbce549bb513316823af34e92f0bb2e0dbd55 Author: Emmanuel Grumbach Date: Mon Jun 24 13:41:13 2019 +0300 iwlwifi: mvm: prepare the ground for more RSS notifications We will need a new type of synchronization message going through all the RSS queues. Prepare the ground for this. Signed-off-by: Emmanuel Grumbach Signed-off-by: Luca Coelho Signed-off-by: Johannes Berg commit 39bd984c203e86f3109b49c2a2e20677c4d3ab65 Author: Luca Coelho Date: Mon Jun 24 22:29:33 2019 +0300 iwlwifi: mvm: don't send GEO_TX_POWER_LIMIT on version < 41 Firmware versions before 41 don't support the GEO_TX_POWER_LIMIT command, and sending it to the firmware will cause a firmware crash. We allow this via debugfs, so we need to return an error value in case it's not supported. This had already been fixed during init, when we send the command if the ACPI WGDS table is present. Fix it also for the other, userspace-triggered case. Cc: stable@vger.kernel.org Fixes: 7fe90e0e3d60 ("iwlwifi: mvm: refactor geo init") Signed-off-by: Luca Coelho Signed-off-by: Johannes Berg commit 0f8084cdc1f9d4a6693ef4168167febb0918c6f6 Author: Mordechay Goodstein Date: Thu Jun 13 16:34:07 2019 +0300 iwlwifi: mvm: avoid races in rate init and rate perform Rate perform uses the lq_sta table to calculate the next rate to scale while rate init resets the same table, Rate perform is done in soft irq context in parallel to rate init that can be called in case we are doing changes like AP changes BW or moving state for auth to assoc. Signed-off-by: Mordechay Goodstein Signed-off-by: Luca Coelho Signed-off-by: Johannes Berg commit cfb21b11b891b08b79be07be57c40a85bb926668 Author: Johannes Berg Date: Wed Jun 12 11:09:58 2019 +0200 iwlwifi: mvm: disable TX-AMSDU on older NICs On older NICs, we occasionally see issues with A-MSDU support, where the commands in the FIFO get confused and then we see an assert EDC because the next command in the FIFO isn't TX. We've tried to isolate this issue and understand where it comes from, but haven't found any errors in building the A-MSDU in software. At least for now, disable A-MSDU support on older hardware so that users can use it again without fearing the assert. This fixes https://bugzilla.kernel.org/show_bug.cgi?id=203315. Signed-off-by: Johannes Berg Signed-off-by: Luca Coelho Signed-off-by: Johannes Berg commit 1dd38ae96973006c45a8010a7fc3c313f1c229a9 Author: Moritz Fischer Date: Thu Jul 25 10:45:17 2019 -0700 MAINTAINERS: Move linux-fpga tree to new location Move the linux-fpga tree to new location at: git://git.kernel.org/pub/scm/linux/kernel/git/mdf/linux-fpga.git Signed-off-by: Moritz Fischer Link: https://lore.kernel.org/r/20190725174517.10516-1-mdf@kernel.org Signed-off-by: Greg Kroah-Hartman commit a6d155d2e363f26290ffd50591169cb96c2a609e Author: Filipe Manana Date: Mon Jul 29 09:37:10 2019 +0100 Btrfs: fix deadlock between fiemap and transaction commits The fiemap handler locks a file range that can have unflushed delalloc, and after locking the range, it tries to attach to a running transaction. If the running transaction started its commit, that is, it is in state TRANS_STATE_COMMIT_START, and either the filesystem was mounted with the flushoncommit option or the transaction is creating a snapshot for the subvolume that contains the file that fiemap is operating on, we end up deadlocking. This happens because fiemap is blocked on the transaction, waiting for it to complete, and the transaction is waiting for the flushed dealloc to complete, which requires locking the file range that the fiemap task already locked. The following stack traces serve as an example of when this deadlock happens: (...) [404571.515510] Workqueue: btrfs-endio-write btrfs_endio_write_helper [btrfs] [404571.515956] Call Trace: [404571.516360] ? __schedule+0x3ae/0x7b0 [404571.516730] schedule+0x3a/0xb0 [404571.517104] lock_extent_bits+0x1ec/0x2a0 [btrfs] [404571.517465] ? remove_wait_queue+0x60/0x60 [404571.517832] btrfs_finish_ordered_io+0x292/0x800 [btrfs] [404571.518202] normal_work_helper+0xea/0x530 [btrfs] [404571.518566] process_one_work+0x21e/0x5c0 [404571.518990] worker_thread+0x4f/0x3b0 [404571.519413] ? process_one_work+0x5c0/0x5c0 [404571.519829] kthread+0x103/0x140 [404571.520191] ? kthread_create_worker_on_cpu+0x70/0x70 [404571.520565] ret_from_fork+0x3a/0x50 [404571.520915] kworker/u8:6 D 0 31651 2 0x80004000 [404571.521290] Workqueue: btrfs-flush_delalloc btrfs_flush_delalloc_helper [btrfs] (...) [404571.537000] fsstress D 0 13117 13115 0x00004000 [404571.537263] Call Trace: [404571.537524] ? __schedule+0x3ae/0x7b0 [404571.537788] schedule+0x3a/0xb0 [404571.538066] wait_current_trans+0xc8/0x100 [btrfs] [404571.538349] ? remove_wait_queue+0x60/0x60 [404571.538680] start_transaction+0x33c/0x500 [btrfs] [404571.539076] btrfs_check_shared+0xa3/0x1f0 [btrfs] [404571.539513] ? extent_fiemap+0x2ce/0x650 [btrfs] [404571.539866] extent_fiemap+0x2ce/0x650 [btrfs] [404571.540170] do_vfs_ioctl+0x526/0x6f0 [404571.540436] ksys_ioctl+0x70/0x80 [404571.540734] __x64_sys_ioctl+0x16/0x20 [404571.540997] do_syscall_64+0x60/0x1d0 [404571.541279] entry_SYSCALL_64_after_hwframe+0x49/0xbe (...) [404571.543729] btrfs D 0 14210 14208 0x00004000 [404571.544023] Call Trace: [404571.544275] ? __schedule+0x3ae/0x7b0 [404571.544526] ? wait_for_completion+0x112/0x1a0 [404571.544795] schedule+0x3a/0xb0 [404571.545064] schedule_timeout+0x1ff/0x390 [404571.545351] ? lock_acquire+0xa6/0x190 [404571.545638] ? wait_for_completion+0x49/0x1a0 [404571.545890] ? wait_for_completion+0x112/0x1a0 [404571.546228] wait_for_completion+0x131/0x1a0 [404571.546503] ? wake_up_q+0x70/0x70 [404571.546775] btrfs_wait_ordered_extents+0x27c/0x400 [btrfs] [404571.547159] btrfs_commit_transaction+0x3b0/0xae0 [btrfs] [404571.547449] ? btrfs_mksubvol+0x4a4/0x640 [btrfs] [404571.547703] ? remove_wait_queue+0x60/0x60 [404571.547969] btrfs_mksubvol+0x605/0x640 [btrfs] [404571.548226] ? __sb_start_write+0xd4/0x1c0 [404571.548512] ? mnt_want_write_file+0x24/0x50 [404571.548789] btrfs_ioctl_snap_create_transid+0x169/0x1a0 [btrfs] [404571.549048] btrfs_ioctl_snap_create_v2+0x11d/0x170 [btrfs] [404571.549307] btrfs_ioctl+0x133f/0x3150 [btrfs] [404571.549549] ? mem_cgroup_charge_statistics+0x4c/0xd0 [404571.549792] ? mem_cgroup_commit_charge+0x84/0x4b0 [404571.550064] ? __handle_mm_fault+0xe3e/0x11f0 [404571.550306] ? do_raw_spin_unlock+0x49/0xc0 [404571.550608] ? _raw_spin_unlock+0x24/0x30 [404571.550976] ? __handle_mm_fault+0xedf/0x11f0 [404571.551319] ? do_vfs_ioctl+0xa2/0x6f0 [404571.551659] ? btrfs_ioctl_get_supported_features+0x30/0x30 [btrfs] [404571.552087] do_vfs_ioctl+0xa2/0x6f0 [404571.552355] ksys_ioctl+0x70/0x80 [404571.552621] __x64_sys_ioctl+0x16/0x20 [404571.552864] do_syscall_64+0x60/0x1d0 [404571.553104] entry_SYSCALL_64_after_hwframe+0x49/0xbe (...) If we were joining the transaction instead of attaching to it, we would not risk a deadlock because a join only blocks if the transaction is in a state greater then or equals to TRANS_STATE_COMMIT_DOING, and the delalloc flush performed by a transaction is done before it reaches that state, when it is in the state TRANS_STATE_COMMIT_START. However a transaction join is intended for use cases where we do modify the filesystem, and fiemap only needs to peek at delayed references from the current transaction in order to determine if extents are shared, and, besides that, when there is no current transaction or when it blocks to wait for a current committing transaction to complete, it creates a new transaction without reserving any space. Such unnecessary transactions, besides doing unnecessary IO, can cause transaction aborts (-ENOSPC) and unnecessary rotation of the precious backup roots. So fix this by adding a new transaction join variant, named join_nostart, which behaves like the regular join, but it does not create a transaction when none currently exists or after waiting for a committing transaction to complete. Fixes: 03628cdbc64db6 ("Btrfs: do not start a transaction during fiemap") Signed-off-by: Filipe Manana Signed-off-by: David Sterba commit cb2d3daddbfb6318d170e79aac1f7d5e4d49f0d7 Author: Filipe Manana Date: Thu Jul 25 11:27:04 2019 +0100 Btrfs: fix race leading to fs corruption after transaction abort When one transaction is finishing its commit, it is possible for another transaction to start and enter its initial commit phase as well. If the first ends up getting aborted, we have a small time window where the second transaction commit does not notice that the previous transaction aborted and ends up committing, writing a superblock that points to btrees that reference extent buffers (nodes and leafs) that were not persisted to disk. The consequence is that after mounting the filesystem again, we will be unable to load some btree nodes/leafs, either because the content on disk is either garbage (or just zeroes) or corresponds to the old content of a previouly COWed or deleted node/leaf, resulting in the well known error messages "parent transid verify failed on ...". The following sequence diagram illustrates how this can happen. CPU 1 CPU 2 btrfs_commit_transaction() (...) --> sets transaction state to TRANS_STATE_UNBLOCKED --> sets fs_info->running_transaction to NULL (...) btrfs_start_transaction() start_transaction() wait_current_trans() --> returns immediately because fs_info->running_transaction is NULL join_transaction() --> creates transaction N + 1 --> sets fs_info->running_transaction to transaction N + 1 --> adds transaction N + 1 to the fs_info->trans_list list --> returns transaction handle pointing to the new transaction N + 1 (...) btrfs_sync_file() btrfs_start_transaction() --> returns handle to transaction N + 1 (...) btrfs_write_and_wait_transaction() --> writeback of some extent buffer fails, returns an error btrfs_handle_fs_error() --> sets BTRFS_FS_STATE_ERROR in fs_info->fs_state --> jumps to label "scrub_continue" cleanup_transaction() btrfs_abort_transaction(N) --> sets BTRFS_FS_STATE_TRANS_ABORTED flag in fs_info->fs_state --> sets aborted field in the transaction and transaction handle structures, for transaction N only --> removes transaction from the list fs_info->trans_list btrfs_commit_transaction(N + 1) --> transaction N + 1 was not aborted, so it proceeds (...) --> sets the transaction's state to TRANS_STATE_COMMIT_START --> does not find the previous transaction (N) in the fs_info->trans_list, so it doesn't know that transaction was aborted, and the commit of transaction N + 1 proceeds (...) --> sets transaction N + 1 state to TRANS_STATE_UNBLOCKED btrfs_write_and_wait_transaction() --> succeeds writing all extent buffers created in the transaction N + 1 write_all_supers() --> succeeds --> we now have a superblock on disk that points to trees that refer to at least one extent buffer that was never persisted So fix this by updating the transaction commit path to check if the flag BTRFS_FS_STATE_TRANS_ABORTED is set on fs_info->fs_state if after setting the transaction to the TRANS_STATE_COMMIT_START we do not find any previous transaction in the fs_info->trans_list. If the flag is set, just fail the transaction commit with -EROFS, as we do in other places. The exact error code for the previous transaction abort was already logged and reported. Fixes: 49b25e0540904b ("btrfs: enhance transaction abort infrastructure") CC: stable@vger.kernel.org # 4.4+ Reviewed-by: Josef Bacik Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit b4f9a1a87a48c255bb90d8a6c3d555a1abb88130 Author: Filipe Manana Date: Wed Jul 17 13:23:39 2019 +0100 Btrfs: fix incremental send failure after deduplication When doing an incremental send operation we can fail if we previously did deduplication operations against a file that exists in both snapshots. In that case we will fail the send operation with -EIO and print a message to dmesg/syslog like the following: BTRFS error (device sdc): Send: inconsistent snapshot, found updated \ extent for inode 257 without updated inode item, send root is 258, \ parent root is 257 This requires that we deduplicate to the same file in both snapshots for the same amount of times on each snapshot. The issue happens because a deduplication only updates the iversion of an inode and does not update any other field of the inode, therefore if we deduplicate the file on each snapshot for the same amount of time, the inode will have the same iversion value (stored as the "sequence" field on the inode item) on both snapshots, therefore it will be seen as unchanged between in the send snapshot while there are new/updated/deleted extent items when comparing to the parent snapshot. This makes the send operation return -EIO and print an error message. Example reproducer: $ mkfs.btrfs -f /dev/sdb $ mount /dev/sdb /mnt # Create our first file. The first half of the file has several 64Kb # extents while the second half as a single 512Kb extent. $ xfs_io -f -s -c "pwrite -S 0xb8 -b 64K 0 512K" /mnt/foo $ xfs_io -c "pwrite -S 0xb8 512K 512K" /mnt/foo # Create the base snapshot and the parent send stream from it. $ btrfs subvolume snapshot -r /mnt /mnt/mysnap1 $ btrfs send -f /tmp/1.snap /mnt/mysnap1 # Create our second file, that has exactly the same data as the first # file. $ xfs_io -f -c "pwrite -S 0xb8 0 1M" /mnt/bar # Create the second snapshot, used for the incremental send, before # doing the file deduplication. $ btrfs subvolume snapshot -r /mnt /mnt/mysnap2 # Now before creating the incremental send stream: # # 1) Deduplicate into a subrange of file foo in snapshot mysnap1. This # will drop several extent items and add a new one, also updating # the inode's iversion (sequence field in inode item) by 1, but not # any other field of the inode; # # 2) Deduplicate into a different subrange of file foo in snapshot # mysnap2. This will replace an extent item with a new one, also # updating the inode's iversion by 1 but not any other field of the # inode. # # After these two deduplication operations, the inode items, for file # foo, are identical in both snapshots, but we have different extent # items for this inode in both snapshots. We want to check this doesn't # cause send to fail with an error or produce an incorrect stream. $ xfs_io -r -c "dedupe /mnt/bar 0 0 512K" /mnt/mysnap1/foo $ xfs_io -r -c "dedupe /mnt/bar 512K 512K 512K" /mnt/mysnap2/foo # Create the incremental send stream. $ btrfs send -p /mnt/mysnap1 -f /tmp/2.snap /mnt/mysnap2 ERROR: send ioctl failed with -5: Input/output error This issue started happening back in 2015 when deduplication was updated to not update the inode's ctime and mtime and update only the iversion. Back then we would hit a BUG_ON() in send, but later in 2016 send was updated to return -EIO and print the error message instead of doing the BUG_ON(). A test case for fstests follows soon. Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=203933 Fixes: 1c919a5e13702c ("btrfs: don't update mtime/ctime on deduped inodes") CC: stable@vger.kernel.org # 4.4+ Signed-off-by: Filipe Manana Signed-off-by: David Sterba commit e70d8b287301eb6d7c7761c6171c56af62110ea3 Author: Jean Delvare Date: Sun Jul 28 18:42:55 2019 +0200 nvmem: Use the same permissions for eeprom as for nvmem The compatibility "eeprom" attribute is currently root-only no matter what the configuration says. The "nvmem" attribute does respect the setting of the root_only configuration bit, so do the same for "eeprom". Signed-off-by: Jean Delvare Fixes: b6c217ab9be6 ("nvmem: Add backwards compatibility support for older EEPROM drivers.") Reviewed-by: Bartosz Golaszewski Cc: Andrew Lunn Cc: Srinivas Kandagatla Cc: Arnd Bergmann Link: https://lore.kernel.org/r/20190728184255.563332e6@endymion Signed-off-by: Greg Kroah-Hartman commit 5241ab4cf42d3a93b933b55d3d53f43049081fa1 Author: Masahiro Yamada Date: Mon Jul 29 18:15:17 2019 +0900 kbuild: initialize CLANG_FLAGS correctly in the top Makefile CLANG_FLAGS is initialized by the following line: CLANG_FLAGS := --target=$(notdir $(CROSS_COMPILE:%-=%)) ..., which is run only when CROSS_COMPILE is set. Some build targets (bindeb-pkg etc.) recurse to the top Makefile. When you build the kernel with Clang but without CROSS_COMPILE, the same compiler flags such as -no-integrated-as are accumulated into CLANG_FLAGS. If you run 'make CC=clang' and then 'make CC=clang bindeb-pkg', Kbuild will recompile everything needlessly due to the build command change. Fix this by correctly initializing CLANG_FLAGS. Fixes: 238bcbc4e07f ("kbuild: consolidate Clang compiler flags") Cc: # v5.0+ Signed-off-by: Masahiro Yamada Reviewed-by: Nathan Chancellor Acked-by: Nick Desaulniers commit 92f5b0313e37e2b37aaf8f0bb75b6c50eafb5808 Author: Hans Verkuil Date: Fri Jul 26 10:01:07 2019 -0400 media: vivid: fix missing cec adapter name Commit "vivid: reorder CEC allocation and control set-up" missed that the CEC adapter needs a valid vfd->name, and that was now filled in after the CEC adapter was created, leading to an empty adapter name. Fill in the name earlier. Signed-off-by: Hans Verkuil Fixes: 4ee895e71abb ("media: vivid: reorder CEC allocation and control set-up") Signed-off-by: Mauro Carvalho Chehab commit 81eaadcae81b4c1bf01649a3053d1f54e2d81cf1 Author: Douglas Anderson Date: Thu Jul 25 11:35:51 2019 -0700 kgdboc: disable the console lock when in kgdb After commit ddde3c18b700 ("vt: More locking checks") kdb / kgdb has become useless because my console is filled with spews of: WARNING: CPU: 0 PID: 0 at .../drivers/tty/vt/vt.c:3846 con_is_visible+0x50/0x74 CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.3.0-rc1+ #48 Hardware name: Rockchip (Device Tree) Backtrace: [] (dump_backtrace) from [] (show_stack+0x20/0x24) [] (show_stack) from [] (dump_stack+0xb0/0xd0) [] (dump_stack) from [] (__warn+0xec/0x11c) [] (__warn) from [] (warn_slowpath_null+0x4c/0x58) [] (warn_slowpath_null) from [] (con_is_visible+0x50/0x74) [] (con_is_visible) from [] (con_scroll+0x108/0x1ac) [] (con_scroll) from [] (lf+0x44/0x88) [] (lf) from [] (vt_console_print+0x1a4/0x2bc) [] (vt_console_print) from [] (vkdb_printf+0x420/0x8a4) [] (vkdb_printf) from [] (kdb_printf+0x44/0x60) [] (kdb_printf) from [] (kdb_main_loop+0xf4/0x6e0) [] (kdb_main_loop) from [] (kdb_stub+0x268/0x398) [] (kdb_stub) from [] (kgdb_cpu_enter+0x1f8/0x674) [] (kgdb_cpu_enter) from [] (kgdb_handle_exception+0x1c4/0x1fc) [] (kgdb_handle_exception) from [] (kgdb_compiled_brk_fn+0x30/0x3c) [] (kgdb_compiled_brk_fn) from [] (do_undefinstr+0x180/0x1a0) [] (do_undefinstr) from [] (__und_svc_finish+0x0/0x3c) ... [] (kgdb_breakpoint) from [] (sysrq_handle_dbg+0x58/0x6c) [] (sysrq_handle_dbg) from [] (__handle_sysrq+0xac/0x154) Let's disable this warning when we're in kgdb to avoid the spew. The whole system is stopped when we're in kgdb so we can't exactly wait for someone else to drop the lock. Presumably the best we can do is to disable the warning and hope for the best. Fixes: ddde3c18b700 ("vt: More locking checks") Cc: Daniel Vetter Signed-off-by: Douglas Anderson Link: https://lore.kernel.org/r/20190725183551.169208-1-dianders@chromium.org Signed-off-by: Greg Kroah-Hartman commit df612421fe2566654047769c6852ffae1a31df16 Author: Brian Norris Date: Wed Jul 24 12:46:34 2019 -0700 mwifiex: fix 802.11n/WPA detection Commit 63d7ef36103d ("mwifiex: Don't abort on small, spec-compliant vendor IEs") adjusted the ieee_types_vendor_header struct, which inadvertently messed up the offsets used in mwifiex_is_wpa_oui_present(). Add that offset back in, mirroring mwifiex_is_rsn_oui_present(). As it stands, commit 63d7ef36103d breaks compatibility with WPA (not WPA2) 802.11n networks, since we hit the "info: Disable 11n if AES is not supported by AP" case in mwifiex_is_network_compatible(). Fixes: 63d7ef36103d ("mwifiex: Don't abort on small, spec-compliant vendor IEs") Cc: Signed-off-by: Brian Norris Signed-off-by: Kalle Valo commit c69565ee6681e151e2bb80502930a16e04b553d1 Author: David Howells Date: Tue Jul 30 14:42:50 2019 +0100 rxrpc: Fix the lack of notification when sendmsg() fails on a DATA packet Fix the fact that a notification isn't sent to the recvmsg side to indicate a call failed when sendmsg() fails to transmit a DATA packet with the error ENETUNREACH, EHOSTUNREACH or ECONNREFUSED. Without this notification, the afs client just sits there waiting for the call to complete in some manner (which it's not now going to do), which also pins the rxrpc call in place. This can be seen if the client has a scope-level IPv6 address, but not a global-level IPv6 address, and we try and transmit an operation to a server's IPv6 address. Looking in /proc/net/rxrpc/calls shows completed calls just sat there with an abort code of RX_USER_ABORT and an error code of -ENETUNREACH. Fixes: c54e43d752c7 ("rxrpc: Fix missing start of call timeout") Signed-off-by: David Howells Reviewed-by: Marc Dionne Reviewed-by: Jeffrey Altman commit 7db57e77586744af46c8bbf8f831bb2b941b7afc Author: Michael Ellerman Date: Wed Jul 31 00:00:15 2019 +1000 powerpc/spe: Mark expected switch fall-throughs Mark switch cases where we are expecting to fall through. Fixes errors such as below, seen with mpc85xx_defconfig: arch/powerpc/kernel/align.c: In function 'emulate_spe': arch/powerpc/kernel/align.c:178:8: error: this statement may fall through ret |= __get_user_inatomic(temp.v[3], p++); ^~ Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20190730141917.21817-1-mpe@ellerman.id.au commit 60034d3d146b11922ab1db613bce062dddc0327a Author: David Howells Date: Tue Jul 30 14:42:50 2019 +0100 rxrpc: Fix potential deadlock There is a potential deadlock in rxrpc_peer_keepalive_dispatch() whereby rxrpc_put_peer() is called with the peer_hash_lock held, but if it reduces the peer's refcount to 0, rxrpc_put_peer() calls __rxrpc_put_peer() - which the tries to take the already held lock. Fix this by providing a version of rxrpc_put_peer() that can be called in situations where the lock is already held. The bug may produce the following lockdep report: ============================================ WARNING: possible recursive locking detected 5.2.0-next-20190718 #41 Not tainted -------------------------------------------- kworker/0:3/21678 is trying to acquire lock: 00000000aa5eecdf (&(&rxnet->peer_hash_lock)->rlock){+.-.}, at: spin_lock_bh /./include/linux/spinlock.h:343 [inline] 00000000aa5eecdf (&(&rxnet->peer_hash_lock)->rlock){+.-.}, at: __rxrpc_put_peer /net/rxrpc/peer_object.c:415 [inline] 00000000aa5eecdf (&(&rxnet->peer_hash_lock)->rlock){+.-.}, at: rxrpc_put_peer+0x2d3/0x6a0 /net/rxrpc/peer_object.c:435 but task is already holding lock: 00000000aa5eecdf (&(&rxnet->peer_hash_lock)->rlock){+.-.}, at: spin_lock_bh /./include/linux/spinlock.h:343 [inline] 00000000aa5eecdf (&(&rxnet->peer_hash_lock)->rlock){+.-.}, at: rxrpc_peer_keepalive_dispatch /net/rxrpc/peer_event.c:378 [inline] 00000000aa5eecdf (&(&rxnet->peer_hash_lock)->rlock){+.-.}, at: rxrpc_peer_keepalive_worker+0x6b3/0xd02 /net/rxrpc/peer_event.c:430 Fixes: 330bdcfadcee ("rxrpc: Fix the keepalive generator [ver #2]") Reported-by: syzbot+72af434e4b3417318f84@syzkaller.appspotmail.com Signed-off-by: David Howells Reviewed-by: Marc Dionne Reviewed-by: Jeffrey Altman commit 9dd0b82ef530cdfe805c9f7079c99e104be59a14 Author: David Howells Date: Tue Jul 30 14:38:52 2019 +0100 afs: Fix missing dentry data version updating In the in-kernel afs filesystem, the d_fsdata dentry field is used to hold the data version of the parent directory when it was created or when d_revalidate() last caused it to be updated. This is compared to the ->invalid_before field in the directory inode, rather than the actual data version number, thereby allowing changes due to local edits to be ignored. Only if the server data version gets bumped unexpectedly (eg. by a competing client), do we need to revalidate stuff. However, the d_fsdata field should also be updated if an rpc op is performed that modifies that particular dentry. Such ops return the revised data version of the directory(ies) involved, so we should use that. This is particularly problematic for rename, since a dentry from one directory may be moved directly into another directory (ie. mv a/x b/x). It would then be sporting the wrong data version - and if this is in the future, for the destination directory, revalidations would be missed, leading to foreign renames and hard-link deletion being missed. Fix this by the following means: (1) Return the data version number from operations that read the directory contents - if they issue the read. This starts in afs_dir_iterate() and is used, ignored or passed back by its callers. (2) In afs_lookup*(), set the dentry version to the version returned by (1) before d_splice_alias() is called and the dentry published. (3) In afs_d_revalidate(), set the dentry version to that returned from (1) if an rpc call was issued. This means that if a parallel procedure, such as mkdir(), modifies the directory, we won't accidentally use the data version from that. (4) In afs_{mkdir,create,link,symlink}(), set the new dentry's version to the directory data version before d_instantiate() is called. (5) In afs_{rmdir,unlink}, update the target dentry's version to the directory data version as soon as we've updated the directory inode. (6) In afs_rename(), we need to unhash the old dentry before we start so that we don't get afs_d_revalidate() reverting the version change in cross-directory renames. We then need to set both the old and the new dentry versions the data version of the new directory before we call d_move() as d_move() will rehash them. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: David Howells commit 5dc84855b0fc7e1db182b55c5564fd539d6eff92 Author: David Howells Date: Tue Jul 30 14:38:51 2019 +0100 afs: Only update d_fsdata if different in afs_d_revalidate() In the in-kernel afs filesystem, d_fsdata is set with the data version of the parent directory. afs_d_revalidate() will update this to the current directory version, but it shouldn't do this if it the value it read from d_fsdata is the same as no lock is held and cmpxchg() is not used. Fix the code to only change the value if it is different from the current directory version. Fixes: 260a980317da ("[AFS]: Add "directory write" support.") Signed-off-by: David Howells commit 37c0bbb3326674940e657118306ac52364314523 Author: David Howells Date: Tue Jul 30 14:38:51 2019 +0100 afs: Fix off-by-one in afs_rename() expected data version calculation When afs_rename() calculates the expected data version of the target directory in a cross-directory rename, it doesn't increment it as it should, so it always thinks that the target inode is unexpectedly modified on the server. Fixes: a58823ac4589 ("afs: Fix application of status and callback to be under same lock") Signed-off-by: David Howells commit a6eed4ab5dd4bfb696c1a3f49742b8d1846a66a0 Author: Jia-Ju Bai Date: Tue Jul 30 14:38:51 2019 +0100 fs: afs: Fix a possible null-pointer dereference in afs_put_read() In afs_read_dir(), there is an if statement on line 255 to check whether req->pages is NULL: if (!req->pages) goto error; If req->pages is NULL, afs_put_read() on line 337 is executed. In afs_put_read(), req->pages[i] is used on line 195. Thus, a possible null-pointer dereference may occur in this case. To fix this possible bug, an if statement is added in afs_put_read() to check req->pages. This bug is found by a static analysis tool STCheck written by us. Fixes: f3ddee8dc4e2 ("afs: Fix directory handling") Signed-off-by: Jia-Ju Bai Signed-off-by: David Howells commit 4a46fdba449a5cd890271df5a9e23927d519ed00 Author: Marc Dionne Date: Tue Jul 30 14:38:51 2019 +0100 afs: Fix loop index mixup in afs_deliver_vl_get_entry_by_name_u() afs_deliver_vl_get_entry_by_name_u() scans through the vl entry received from the volume location server and builds a return list containing the sites that are currently valid. When assigning values for the return list, the index into the vl entry (i) is used rather than the one for the new list (entry->nr_server). If all sites are usable, this works out fine as the indices will match. If some sites are not valid, for example if AFS_VLSF_DONTUSE is set, fs_mask and the uuid will be set for the wrong return site. Fix this by using entry->nr_server as the index into the arrays being filled in rather than i. This can lead to EDESTADDRREQ errors if none of the returned sites have a valid fs_mask. Fixes: d2ddc776a458 ("afs: Overhaul volume and server record caching and fileserver rotation") Signed-off-by: Marc Dionne Signed-off-by: David Howells Reviewed-by: Jeffrey Altman commit 2067b2b3f4846402a040286135f98f46f8919939 Author: David Howells Date: Tue Jul 30 14:38:51 2019 +0100 afs: Fix the CB.ProbeUuid service handler to reply correctly Fix the service handler function for the CB.ProbeUuid RPC call so that it replies in the correct manner - that is an empty reply for success and an abort of 1 for failure. Putting 0 or 1 in an integer in the body of the reply should result in the fileserver throwing an RX_PROTOCOL_ERROR abort and discarding its record of the client; older servers, however, don't necessarily check that all the data got consumed, and so might incorrectly think that they got a positive response and associate the client with the wrong host record. If the client is incorrectly associated, this will result in callbacks intended for a different client being delivered to this one and then, when the other client connects and responds positively, all of the callback promises meant for the client that issued the improper response will be lost and it won't receive any further change notifications. Fixes: 9396d496d745 ("afs: support the CB.ProbeUuid RPC op") Signed-off-by: David Howells Reviewed-by: Jeffrey Altman commit e1ae72a21e5f0d1846e26e3f5963930664702071 Author: YueHaibing Date: Mon Jul 29 17:05:20 2019 +0800 drm/bridge: tc358764: Fix build error If CONFIG_DRM_TOSHIBA_TC358764=y but CONFIG_DRM_KMS_HELPER=m, building fails: drivers/gpu/drm/bridge/tc358764.o:(.rodata+0x228): undefined reference to `drm_atomic_helper_connector_reset' drivers/gpu/drm/bridge/tc358764.o:(.rodata+0x240): undefined reference to `drm_helper_probe_single_connector_modes' drivers/gpu/drm/bridge/tc358764.o:(.rodata+0x268): undefined reference to `drm_atomic_helper_connector_duplicate_state' drivers/gpu/drm/bridge/tc358764.o:(.rodata+0x270): undefined reference to `drm_atomic_helper_connector_destroy_state' Like TC358767, select DRM_KMS_HELPER to fix this, and change to select DRM_PANEL to avoid recursive dependency. Reported-by: Hulk Robot Fixes: f38b7cca6d0e ("drm/bridge: tc358764: Add DSI to LVDS bridge driver") Signed-off-by: YueHaibing Reviewed-by: Laurent Pinchart Reviewed-by: Neil Armstrong Signed-off-by: Neil Armstrong Link: https://patchwork.freedesktop.org/patch/msgid/20190729090520.25968-1-yuehaibing@huawei.com commit eef347f846ee8f7296a6f84e3866c057ca6bcce0 Author: Johannes Berg Date: Tue Jul 30 14:52:07 2019 +0200 Revert "mac80211: set NETIF_F_LLTX when using intermediate tx queues" Revert this for now, it has been reported multiple times that it completely breaks connectivity on various devices. Cc: stable@vger.kernel.org Fixes: 8dbb000ee73b ("mac80211: set NETIF_F_LLTX when using intermediate tx queues") Reported-by: Jean Delvare Reported-by: Peter Lebbing Signed-off-by: Johannes Berg commit f4cc743a98136df3c3763050a0e8223b52d9a960 Author: YueHaibing Date: Mon Jul 29 15:12:16 2019 +0800 drm/bridge: lvds-encoder: Fix build error while CONFIG_DRM_KMS_HELPER=m If DRM_LVDS_ENCODER=y but CONFIG_DRM_KMS_HELPER=m, build fails: drivers/gpu/drm/bridge/lvds-encoder.o: In function `lvds_encoder_probe': lvds-encoder.c:(.text+0x155): undefined reference to `devm_drm_panel_bridge_add' Reported-by: Hulk Robot Fixes: dbb58bfd9ae6 ("drm/bridge: Fix lvds-encoder since the panel_bridge rework.") Signed-off-by: YueHaibing Reviewed-by: Neil Armstrong Signed-off-by: Neil Armstrong Link: https://patchwork.freedesktop.org/patch/msgid/20190729071216.27488-1-yuehaibing@huawei.com commit 46c42d844211ef5902e32aa507beac0817c585e9 Author: Brian Norris Date: Mon Jul 29 13:49:54 2019 -0700 driver core: platform: return -ENXIO for missing GpioInt Commit daaef255dc96 ("driver: platform: Support parsing GpioInt 0 in platform_get_irq()") broke the Embedded Controller driver on most LPC Chromebooks (i.e., most x86 Chromebooks), because cros_ec_lpc expects platform_get_irq() to return -ENXIO for non-existent IRQs. Unfortunately, acpi_dev_gpio_irq_get() doesn't follow this convention and returns -ENOENT instead. So we get this error from cros_ec_lpc: couldn't retrieve IRQ number (-2) I see a variety of drivers that treat -ENXIO specially, so rather than fix all of them, let's fix up the API to restore its previous behavior. I reported this on v2 of this patch: https://lore.kernel.org/lkml/20190220180538.GA42642@google.com/ but apparently the patch had already been merged before v3 got sent out: https://lore.kernel.org/lkml/20190221193429.161300-1-egranata@chromium.org/ and the result is that the bug landed and remains unfixed. I differ from the v3 patch by: * allowing for ret==0, even though acpi_dev_gpio_irq_get() specifically documents (and enforces) that 0 is not a valid return value (noted on the v3 review) * adding a small comment Reported-by: Brian Norris Reported-by: Salvatore Bellizzi Cc: Enrico Granata Cc: Fixes: daaef255dc96 ("driver: platform: Support parsing GpioInt 0 in platform_get_irq()") Signed-off-by: Brian Norris Reviewed-by: Andy Shevchenko Acked-by: Enrico Granata Link: https://lore.kernel.org/r/20190729204954.25510-1-briannorris@chromium.org Signed-off-by: Greg Kroah-Hartman commit 7cdc4412284777c76c919e2ab33b3b8dbed18559 Merge: 3b48300d5cc7 6c1f7e2c1b96 Author: Pablo Neira Ayuso Date: Tue Jul 30 13:39:20 2019 +0200 Merge branch 'master' of git://blackhole.kfki.hu/nf Jozsef Kadlecsik says: ==================== ipset patches for the nf tree - When the support of destination MAC addresses for hash:mac sets was introduced, it was forgotten to add the same functionality to hash:ip,mac types of sets. The patch from Stefano Brivio adds the missing part. - When the support of destination MAC addresses for hash:mac sets was introduced, a copy&paste error was made in the code of the hash:ip,mac and bitmap:ip,mac types: the MAC address in these set types is in the second position and not in the first one. Stefano Brivio's patch fixes the issue. - There was still a not properly handled concurrency handling issue between renaming and listing sets at the same time, reported by Shijie Luo. ==================== Signed-off-by: Pablo Neira Ayuso commit 3b48300d5cc7c7bed63fddb006c4046549ed4aec Author: Florian Westphal Date: Mon Jul 29 17:58:10 2019 +0200 netfilter: ebtables: also count base chain policies ebtables doesn't include the base chain policies in the rule count, so we need to add them manually when we call into the x_tables core to allocate space for the comapt offset table. This lead syzbot to trigger: WARNING: CPU: 1 PID: 9012 at net/netfilter/x_tables.c:649 xt_compat_add_offset.cold+0x11/0x36 net/netfilter/x_tables.c:649 Reported-by: syzbot+276ddebab3382bbf72db@syzkaller.appspotmail.com Fixes: 2035f3ff8eaa ("netfilter: ebtables: compat: un-break 32bit setsockopt when no rules are present") Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit da1115fdbd6e86c62185cdd2b4bf7add39f2f82b Author: Aneesh Kumar K.V Date: Mon Jul 29 15:21:28 2019 +0530 powerpc/nvdimm: Pick nearby online node if the device node is not online Currently, nvdimm subsystem expects the device numa node for SCM device to be an online node. It also doesn't try to bring the device numa node online. Hence if we use a non-online numa node as device node we hit crashes like below. This is because we try to access uninitialized NODE_DATA in different code paths. cpu 0x0: Vector: 300 (Data Access) at [c0000000fac53170] pc: c0000000004bbc50: ___slab_alloc+0x120/0xca0 lr: c0000000004bc834: __slab_alloc+0x64/0xc0 sp: c0000000fac53400 msr: 8000000002009033 dar: 73e8 dsisr: 80000 current = 0xc0000000fabb6d80 paca = 0xc000000003870000 irqmask: 0x03 irq_happened: 0x01 pid = 7, comm = kworker/u16:0 Linux version 5.2.0-06234-g76bd729b2644 (kvaneesh@ltc-boston123) (gcc version 7.4.0 (Ubuntu 7.4.0-1ubuntu1~18.04.1)) #135 SMP Thu Jul 11 05:36:30 CDT 2019 enter ? for help [link register ] c0000000004bc834 __slab_alloc+0x64/0xc0 [c0000000fac53400] c0000000fac53480 (unreliable) [c0000000fac53500] c0000000004bc818 __slab_alloc+0x48/0xc0 [c0000000fac53560] c0000000004c30a0 __kmalloc_node_track_caller+0x3c0/0x6b0 [c0000000fac535d0] c000000000cfafe4 devm_kmalloc+0x74/0xc0 [c0000000fac53600] c000000000d69434 nd_region_activate+0x144/0x560 [c0000000fac536d0] c000000000d6b19c nd_region_probe+0x17c/0x370 [c0000000fac537b0] c000000000d6349c nvdimm_bus_probe+0x10c/0x230 [c0000000fac53840] c000000000cf3cc4 really_probe+0x254/0x4e0 [c0000000fac538d0] c000000000cf429c driver_probe_device+0x16c/0x1e0 [c0000000fac53950] c000000000cf0b44 bus_for_each_drv+0x94/0x130 [c0000000fac539b0] c000000000cf392c __device_attach+0xdc/0x200 [c0000000fac53a50] c000000000cf231c bus_probe_device+0x4c/0xf0 [c0000000fac53a90] c000000000ced268 device_add+0x528/0x810 [c0000000fac53b60] c000000000d62a58 nd_async_device_register+0x28/0xa0 [c0000000fac53bd0] c0000000001ccb8c async_run_entry_fn+0xcc/0x1f0 [c0000000fac53c50] c0000000001bcd9c process_one_work+0x46c/0x860 [c0000000fac53d20] c0000000001bd4f4 worker_thread+0x364/0x5f0 [c0000000fac53db0] c0000000001c7260 kthread+0x1b0/0x1c0 [c0000000fac53e20] c00000000000b954 ret_from_kernel_thread+0x5c/0x68 The patch tries to fix this by picking the nearest online node as the SCM node. This does have a problem of us losing the information that SCM node is equidistant from two other online nodes. If applications need to understand these fine-grained details we should express then like x86 does via /sys/devices/system/node/nodeX/accessY/initiators/ With the patch we get # numactl -H available: 2 nodes (0-1) node 0 cpus: node 0 size: 0 MB node 0 free: 0 MB node 1 cpus: 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 node 1 size: 130865 MB node 1 free: 129130 MB node distances: node 0 1 0: 10 20 1: 20 10 # cat /sys/bus/nd/devices/region0/numa_node 0 # dmesg | grep papr_scm [ 91.332305] papr_scm ibm,persistent-memory:ibm,pmemory@44104001: Region registered with target node 2 and online node 0 Signed-off-by: Aneesh Kumar K.V Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20190729095128.23707-1-aneesh.kumar@linux.ibm.com commit 5d78e1c2b7f4be00bbe62141603a631dc7812f35 Author: Hillf Danton Date: Tue Jul 30 17:24:36 2019 +0800 ALSA: usb-audio: Fix gpf in snd_usb_pipe_sanity_check syzbot found the following crash on: general protection fault: 0000 [#1] SMP KASAN RIP: 0010:snd_usb_pipe_sanity_check+0x80/0x130 sound/usb/helper.c:75 Call Trace: snd_usb_motu_microbookii_communicate.constprop.0+0xa0/0x2fb sound/usb/quirks.c:1007 snd_usb_motu_microbookii_boot_quirk sound/usb/quirks.c:1051 [inline] snd_usb_apply_boot_quirk.cold+0x163/0x370 sound/usb/quirks.c:1280 usb_audio_probe+0x2ec/0x2010 sound/usb/card.c:576 usb_probe_interface+0x305/0x7a0 drivers/usb/core/driver.c:361 really_probe+0x281/0x650 drivers/base/dd.c:548 .... It was introduced in commit 801ebf1043ae for checking pipe and endpoint types. It is fixed by adding a check of the ep pointer in question. BugLink: https://syzkaller.appspot.com/bug?extid=d59c4387bfb6eced94e2 Reported-by: syzbot Fixes: 801ebf1043ae ("ALSA: usb-audio: Sanity checks for each pipe and EP types") Cc: Andrey Konovalov Signed-off-by: Hillf Danton Signed-off-by: Takashi Iwai commit fab7772bfbcfe8fb8e3e352a6a8fcaf044cded17 Author: Anthony Iliopoulos Date: Mon Jul 29 14:40:40 2019 +0200 nvme-multipath: revalidate nvme_ns_head gendisk in nvme_validate_ns When CONFIG_NVME_MULTIPATH is set, only the hidden gendisk associated with the per-controller ns is run through revalidate_disk when a rescan is triggered, while the visible blockdev never gets its size (bdev->bd_inode->i_size) updated to reflect any capacity changes that may have occurred. This prevents online resizing of nvme block devices and in extension of any filesystems atop that will are unable to expand while mounted, as userspace relies on the blockdev size for obtaining the disk capacity (via BLKGETSIZE/64 ioctls). Fix this by explicitly revalidating the actual namespace gendisk in addition to the per-controller gendisk, when multipath is enabled. Signed-off-by: Anthony Iliopoulos Reviewed-by: Sagi Grimberg Reviewed-by: Johannes Thumshirn Signed-off-by: Christoph Hellwig commit 12ca7297b8855c0af1848503d37196159b24e6b9 Author: Li Jun Date: Wed Jul 17 16:06:46 2019 +0800 usb: typec: tcpm: remove tcpm dir if no children If config tcpm as module, module unload will not remove tcpm dir, then the next module load will have problem: the rootdir is NULL but tcpm dir is still there, so tcpm_debugfs_init() will create tcpm dir again with failure, fix it by remove the tcpm dir if no children. Cc: stable@vger.kernel.org # v4.15+ Fixes: 4b4e02c83167 ("typec: tcpm: Move out of staging") Signed-off-by: Li Jun Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20190717080646.30421-2-jun.li@nxp.com Signed-off-by: Greg Kroah-Hartman commit fd5da3e2cc61b4a7c877172fdc9348c82cf6ccfc Author: Li Jun Date: Wed Jul 17 16:06:45 2019 +0800 usb: typec: tcpm: free log buf memory when remove debug file The logbuffer memory should be freed when remove debug file. Cc: stable@vger.kernel.org # v4.15+ Fixes: 4b4e02c83167 ("typec: tcpm: Move out of staging") Signed-off-by: Li Jun Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20190717080646.30421-1-jun.li@nxp.com Signed-off-by: Greg Kroah-Hartman commit 1957de95d425d1c06560069dc7277a73a8b28683 Author: Guenter Roeck Date: Wed Jul 24 07:38:32 2019 -0700 usb: typec: tcpm: Add NULL check before dereferencing config When instantiating tcpm on an NXP OM 13588 board with NXP PTN5110, the following crash is seen when writing into the 'preferred_role' sysfs attribute. Unable to handle kernel NULL pointer dereference at virtual address 00000028 pgd = f69149ad [00000028] *pgd=00000000 Internal error: Oops: 5 [#1] THUMB2 Modules linked in: tcpci tcpm CPU: 0 PID: 1882 Comm: bash Not tainted 5.1.18-sama5-armv7-r2 #4 Hardware name: Atmel SAMA5 PC is at tcpm_try_role+0x3a/0x4c [tcpm] LR is at tcpm_try_role+0x15/0x4c [tcpm] pc : [] lr : [] psr: 60030033 sp : dc1a1e88 ip : c03fb47d fp : 00000000 r10: dc216190 r9 : dc1a1f78 r8 : 00000001 r7 : df4ae044 r6 : dd032e90 r5 : dd1ce340 r4 : df4ae054 r3 : 00000000 r2 : 00000000 r1 : 00000000 r0 : df4ae044 Flags: nZCv IRQs on FIQs on Mode SVC_32 ISA Thumb Segment none Control: 50c53c7d Table: 3efec059 DAC: 00000051 Process bash (pid: 1882, stack limit = 0x6a6d4aa5) Stack: (0xdc1a1e88 to 0xdc1a2000) 1e80: dd05d808 dd1ce340 00000001 00000007 dd1ce340 c03fb4a7 1ea0: 00000007 00000007 dc216180 00000000 00000000 c01e1e03 00000000 00000000 1ec0: c0907008 dee98b40 c01e1d5d c06106c4 00000000 00000000 00000007 c0194e8b 1ee0: 0000000a 00000400 00000000 c01a97db dc22bf00 ffffe000 df4b6a00 df745900 1f00: 00000001 00000001 000000dd c01a9c2f 7aeab3be c0907008 00000000 dc22bf00 1f20: c0907008 00000000 00000000 00000000 00000000 7aeab3be 00000007 dee98b40 1f40: 005dc318 dc1a1f78 00000000 00000000 00000007 c01969f7 0000000a c01a20cb 1f60: dee98b40 c0907008 dee98b40 005dc318 00000000 c0196b9b 00000000 00000000 1f80: dee98b40 7aeab3be 00000074 005dc318 b6f3bdb0 00000004 c0101224 dc1a0000 1fa0: 00000004 c0101001 00000074 005dc318 00000001 005dc318 00000007 00000000 1fc0: 00000074 005dc318 b6f3bdb0 00000004 00000007 00000007 00000000 00000000 1fe0: 00000004 be800880 b6ed35b3 b6e5c746 60030030 00000001 00000000 00000000 [] (tcpm_try_role [tcpm]) from [] (preferred_role_store+0x2b/0x5c) [] (preferred_role_store) from [] (kernfs_fop_write+0xa7/0x150) [] (kernfs_fop_write) from [] (__vfs_write+0x1f/0x104) [] (__vfs_write) from [] (vfs_write+0x6b/0x104) [] (vfs_write) from [] (ksys_write+0x43/0x94) [] (ksys_write) from [] (ret_fast_syscall+0x1/0x62) Since commit 96232cbc6c994 ("usb: typec: tcpm: support get typec and pd config from device properties"), the 'config' pointer in struct tcpc_dev is optional when registering a Type-C port. Since it is optional, we have to check if it is NULL before dereferencing it. Reported-by: Douglas Gilbert Cc: Douglas Gilbert Fixes: 96232cbc6c994 ("usb: typec: tcpm: support get typec and pd config from device properties") Signed-off-by: Guenter Roeck Cc: stable Reviewed-by: Jun Li Reviewed-by: Heikki Krogerus Link: https://lore.kernel.org/r/1563979112-22483-1-git-send-email-linux@roeck-us.net Signed-off-by: Greg Kroah-Hartman commit 38f054d549a869f22a02224cd276a27bf14b6171 Author: Jessica Yu Date: Tue Jul 23 15:26:28 2019 +0200 modules: always page-align module section allocations Some arches (e.g., arm64, x86) have moved towards non-executable module_alloc() allocations for security hardening reasons. That means that the module loader will need to set the text section of a module to executable, regardless of whether or not CONFIG_STRICT_MODULE_RWX is set. When CONFIG_STRICT_MODULE_RWX=y, module section allocations are always page-aligned to handle memory rwx permissions. On some arches with CONFIG_STRICT_MODULE_RWX=n however, when setting the module text to executable, the BUG_ON() in frob_text() gets triggered since module section allocations are not page-aligned when CONFIG_STRICT_MODULE_RWX=n. Since the set_memory_* API works with pages, and since we need to call set_memory_x() regardless of whether CONFIG_STRICT_MODULE_RWX is set, we might as well page-align all module section allocations for ease of managing rwx permissions of module sections (text, rodata, etc). Fixes: 2eef1399a866 ("modules: fix BUG when load module with rodata=n") Reported-by: Martin Kaiser Reported-by: Bartosz Golaszewski Tested-by: David Lechner Tested-by: Martin Kaiser Tested-by: Bartosz Golaszewski Signed-off-by: Jessica Yu commit cf4a459031f23ebb0c3d0b9edd55cb3a1a71a5b7 Merge: 89f5752307cf 418741480809 Author: Jani Nikula Date: Tue Jul 30 11:26:05 2019 +0300 Merge tag 'gvt-fixes-2019-07-30' of https://github.com/intel/gvt-linux into drm-intel-fixes gvt-fixes-2019-07-30 - Guard against potential ggtt access error (Xiong) - Fix includecheck (Zhenyu) - Fix cache entry for guest page mapping found by 2M ppgtt guest (Xiaolin) - Fix runtime pm warning (Xiaolin) - Fix shadow mm settlement for Windows guest reset failure (Colin) Signed-off-by: Jani Nikula From: Zhenyu Wang Link: https://patchwork.freedesktop.org/patch/msgid/20190730070020.GX8319@zhen-hp.sh.intel.com commit d21a95e0ef3e06e403f296c3a409b307c47bdd08 Merge: 609488bc979f 2aa4e410795c Author: Greg Kroah-Hartman Date: Tue Jul 30 09:06:46 2019 +0200 Merge tag 'misc-habanalabs-fixes-2019-07-29' of git://people.freedesktop.org/~gabbayo/linux into char-misc-next Oded writes: This tag contains two fixes when running in BE architecture: - Fix for F/W download. The F/W is in LE so use a function that doesn't do bytw-swapping. - Fix for polling on host memory locations that are written by the device. The device always works in LE, so we need to do byte-swap when polling on those locations. * tag 'misc-habanalabs-fixes-2019-07-29' of git://people.freedesktop.org/~gabbayo/linux: habanalabs: fix host memory polling in BE architecture habanalabs: fix F/W download in BE architecture commit 4187414808095f645ca0661f8dde77617e2e7cb3 Author: Colin Xu Date: Thu Jul 4 16:45:06 2019 +0800 drm/i915/gvt: Adding ppgtt to GVT GEM context after shadow pdps settled. Windows guest can't run after force-TDR with host log: ... gvt: vgpu 1: workload shadow ppgtt isn't ready gvt: vgpu 1: fail to dispatch workload, skip ... The error is raised by set_context_ppgtt_from_shadow(), when it checks and found the shadow_mm isn't marked as shadowed. In work thread before each submission, a shadow_mm is set to shadowed in: shadow_ppgtt_mm() <-intel_vgpu_pin_mm() <-prepare_workload() <-dispatch_workload() <-workload_thread() However checking whether or not shadow_mm is shadowed is prior to it: set_context_ppgtt_from_shadow() <-dispatch_workload() <-workload_thread() In normal case, create workload will check the existence of shadow_mm, if not it will create a new one and marked as shadowed. If already exist it will reuse the old one. Since shadow_mm is reused, checking of shadowed in set_context_ppgtt_from_shadow() actually always see the state set in creation, but not the state set in intel_vgpu_pin_mm(). When force-TDR, all engines are reset, since it's not dmlr level, all ppgtt_mm are invalidated but not destroyed. Invalidation will mark all reused shadow_mm as not shadowed but still keeps in ppgtt_mm_list_head. If workload submission phase those shadow_mm are reused with shadowed not set, then set_context_ppgtt_from_shadow() will report error. Pin for context after shadow_mm pinned and shadow pdps settled. v2: Move set_context_ppgtt_from_shadow() after prepare_workload(). (zhenyu) v3: Move set_context_ppgtt_from_shadow() after shadow pdps updated.(zhenyu) Fixes: 4f15665ccbba ("drm/i915: Add ppgtt to GVT GEM context") Cc: stable@vger.kernel.org Signed-off-by: Colin Xu Signed-off-by: Zhenyu Wang commit ef5b0b444e6297d03ac0bdc0c82f65396ef4dccd Author: Xiaolin Zhang Date: Thu Jun 20 10:29:24 2019 -0400 drm/i915/gvt: grab runtime pm first for forcewake use in workload_thread, it should grab runtime pm wakelock and later uncore forcewake get will check rpm wakelock held successfully. otherwise, sometimes, rpm wakelock not hold and print call trace below: Call Trace: intel_uncore_forcewake_get+0x15/0x20 [i915] workload_thread+0x5f9/0x16f0 [i915] ? __switch_to_asm+0x34/0x70 ? __switch_to_asm+0x40/0x70 ? __switch_to_asm+0x34/0x70 ? __switch_to_asm+0x40/0x70 ? __switch_to_asm+0x34/0x70 ? __switch_to+0x85/0x3f0 ? __switch_to_asm+0x40/0x70 ? do_wait_intr_irq+0x90/0x90 kthread+0x121/0x140 ? intel_vgpu_clean_workloads+0x100/0x100 [i915] ? kthread_park+0x90/0x90 ret_from_fork+0x35/0x40 --[ end trace 86525f742a02e12c ]-- v2: adapted to use rpm structure. Fixes: 251d46b0875c ("drm/i915/gvt: Pin the per-engine GVT shadow contexts") Reviewed-by: Zhenyu Wang Signed-off-by: Xiaolin Zhang Signed-off-by: Zhenyu Wang commit 7366aeb77cd840f3edea02c65065d40affaa7f45 Author: Xiaolin Zhang Date: Thu Jul 18 01:10:24 2019 +0800 drm/i915/gvt: fix incorrect cache entry for guest page mapping GPU hang observed during the guest OCL conformance test which is caused by THP GTT feature used durning the test. It was observed the same GFN with different size (4K and 2M) requested from the guest in GVT. So during the guest page dma map stage, it is required to unmap first with orginal size and then remap again with requested size. Fixes: b901b252b6cf ("drm/i915/gvt: Add 2M huge gtt support") Cc: stable@vger.kernel.org Reviewed-by: Zhenyu Wang Signed-off-by: Xiaolin Zhang Signed-off-by: Zhenyu Wang commit 2089a76ade9005a06c5e08e8454f45f3625fdc1c Author: Xiong Zhang Date: Mon May 27 13:45:53 2019 +0800 drm/i915/gvt: Checking workload's gma earlier Workload contains RB and WA_CTX which are in ggtt space, if they aren't in valid ggtt space, the workload shouldn't be shadowed and scanned. So checking them earlier to avoid shadow them. Reviewed-by: Zhenyu Wang Signed-off-by: Xiong Zhang Signed-off-by: Zhenyu Wang commit c25144098bee19b089c8a37c54517bf467f06403 Author: Xiong Zhang Date: Mon May 27 13:45:52 2019 +0800 drm/i915/gvt: Don't use ggtt_validdate_range() with size=0 Use vgpu_gmadr_is_valid() directly instead. Reviewed-by: Zhenyu Wang Signed-off-by: Xiong Zhang Signed-off-by: Zhenyu Wang commit d18fd0576e05a4b03b588e131093b0437fccb75f Author: Xiong Zhang Date: Mon May 27 13:45:51 2019 +0800 drm/i915/gvt: Warning for invalid ggtt access Instead of silently return virtual ggtt entries that guest is allowed to access, this patch add extra range check. If guest read out of range, it will print a warning and return 0. If guest write out of range, the write will be dropped without any message. Reviewed-by: Zhenyu Wang Signed-off-by: Xiong Zhang Signed-off-by: Zhenyu Wang commit c00f9c6b79f7e1c5caf774c38e9fd5dad2d2ef1c Author: Zhenyu Wang Date: Wed Jun 12 11:17:46 2019 +0800 drm/i915/gvt: remove duplicate include of trace.h This removes duplicate include of trace.h. Found by Hariprasad Kelam with includecheck. Reported-by: Hariprasad Kelam Reviewed-by: Yan Zhao Signed-off-by: Zhenyu Wang commit d478418703d6bcdd163d5d8127683c6c471539f0 Author: Hannes Reinecke Date: Wed Jul 24 11:00:56 2019 +0200 scsi: fcoe: pass in fcoe_rport structure instead of fc_rport_priv Instead of using the generic 'fc_rport_priv' structure as argument and then having to painstakingly outcast this to fcoe_rport we should be passing the fcoe_rport structure itself and reduce complexity. Signed-off-by: Hannes Reinecke Reviewed-by: Christoph Hellwig Signed-off-by: Martin K. Petersen commit 023358b136d490ca91735ac6490db3741af5a8bd Author: Hannes Reinecke Date: Wed Jul 24 11:00:55 2019 +0200 scsi: fcoe: Embed fc_rport_priv in fcoe_rport structure Gcc-9 complains for a memset across pointer boundaries, which happens as the code tries to allocate a flexible array on the stack. Turns out we cannot do this without relying on gcc-isms, so with this patch we'll embed the fc_rport_priv structure into fcoe_rport, can use the normal 'container_of' outcast, and will only have to do a memset over one structure. Signed-off-by: Hannes Reinecke Signed-off-by: Martin K. Petersen commit f3e4ff28b8685d856f381ee6bcf88b6149a6db5b Author: Hannes Reinecke Date: Wed Jul 24 11:00:54 2019 +0200 scsi: libfc: Whitespace cleanup in libfc.h No functional change. [mkp: typo] Signed-off-by: Hannes Reinecke Reviewed-by: Christoph Hellwig Signed-off-by: Martin K. Petersen commit a20961cc9493be46b5c4f565b925284a90c7864c Author: Gustavo A. R. Silva Date: Mon Jul 29 17:10:16 2019 -0500 net: smc911x: Mark expected switch fall-through Mark switch cases where we are expecting to fall through. This patch fixes the following warning (Building: arm): drivers/net/ethernet/smsc/smc911x.c: In function ‘smc911x_phy_detect’: drivers/net/ethernet/smsc/smc911x.c:677:7: warning: this statement may fall through [-Wimplicit-fallthrough=] if (cfg & HW_CFG_EXT_PHY_DET_) { ^ drivers/net/ethernet/smsc/smc911x.c:715:3: note: here default: ^~~~~~~ Signed-off-by: Gustavo A. R. Silva Signed-off-by: David S. Miller commit 71d6c505b4d9e6f76586350450e785e3d452b346 Author: Kees Cook Date: Mon Jul 29 14:47:22 2019 -0700 libata: zpodd: Fix small read overflow in zpodd_get_mech_type() Jeffrin reported a KASAN issue: BUG: KASAN: global-out-of-bounds in ata_exec_internal_sg+0x50f/0xc70 Read of size 16 at addr ffffffff91f41f80 by task scsi_eh_1/149 ... The buggy address belongs to the variable: cdb.48319+0x0/0x40 Much like commit 18c9a99bce2a ("libata: zpodd: small read overflow in eject_tray()"), this fixes a cdb[] buffer length, this time in zpodd_get_mech_type(): We read from the cdb[] buffer in ata_exec_internal_sg(). It has to be ATAPI_CDB_LEN (16) bytes long, but this buffer is only 12 bytes. Reported-by: Jeffrin Jose T Fixes: afe759511808c ("libata: identify and init ZPODD devices") Link: https://lore.kernel.org/lkml/201907181423.E808958@keescook/ Tested-by: Jeffrin Jose T Reviewed-by: Nick Desaulniers Signed-off-by: Kees Cook Signed-off-by: Jens Axboe commit 8c4407de3be44c2a0ec3e316cd3e4a711bc2aaba Author: YueHaibing Date: Thu Jul 11 22:24:57 2019 +0800 pinctrl: aspeed: Make aspeed_pinmux_ips static Fix sparse warning: drivers/pinctrl/aspeed/pinmux-aspeed.c:8:12: warning: symbol 'aspeed_pinmux_ips' was not declared. Should it be static? Reported-by: Hulk Robot Signed-off-by: YueHaibing Link: https://lore.kernel.org/r/20190711142457.37028-1-yuehaibing@huawei.com Reviewed-by: Andrew Jeffery Signed-off-by: Linus Walleij commit 7be21763f703d0f7e878283ec31e52b225097449 Author: Gustavo A. R. Silva Date: Mon Jul 29 16:10:53 2019 -0500 ataflop: Mark expected switch fall-through Mark switch cases where we are expecting to fall through. This patch fixes the following warning (Building: m68k): drivers/block/ataflop.c: In function ‘fd_locked_ioctl’: drivers/block/ataflop.c:1728:3: warning: this statement may fall through [-Wimplicit-fallthrough=] set_capacity(floppy->disk, MAX_DISK_SIZE * 2); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/block/ataflop.c:1729:2: note: here case FDFMTEND: ^~~~ Signed-off-by: Gustavo A. R. Silva Signed-off-by: Jens Axboe commit b3c303be4c35856945cb17ec639b94637447dae2 Merge: 2a11c76e5301 8aa259b10a6a Author: Ingo Molnar Date: Mon Jul 29 23:24:07 2019 +0200 Merge tag 'perf-urgent-for-mingo-5.3-20190729' of git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux into perf/urgent Pull perf/urgent fixes from Arnaldo Carvalho de Melo: perf header: Vince Weaver: - Fix divide by zero error if f_header.attr_size==0, found using a perf tool fuzzer. Numfor Mbiziwo-Tiapo: - Silence use of uninitialized value warning pointed out by clang's MSAN tool. libbpf: Andrii Nakryiko: - Fix missing __WORDSIZE definition in some systems, such as musl libc (Alpine Linux). tools header UAPI: Arnaldo Carvalho de Melo: - Sync headers to address perf build warnings: - syscalls_64.tbl and generic unistd.h to pick up clone3 and pidfd_open. - With new ioctls: kvm.h, drm.h and usbdevice_fs.h. - No tooling change: mman.h, sched.h and if_link.h. Documentation: Vince Weaver: - Fix perf.data documentation units for memory size, its kB, not bytes. Signed-off-by: Arnaldo Carvalho de Melo Signed-off-by: Ingo Molnar commit 7bd6ba4ef4b29db7464da496963081f5fdc88300 Author: Gustavo A. R. Silva Date: Mon Jul 29 15:12:31 2019 -0500 net: hamradio: baycom_epp: Mark expected switch fall-through Mark switch cases where we are expecting to fall through. This patch fixes the following warning (Building: i386): drivers/net/hamradio/baycom_epp.c: In function ‘transmit’: drivers/net/hamradio/baycom_epp.c:491:7: warning: this statement may fall through [-Wimplicit-fallthrough=] if (i) { ^ drivers/net/hamradio/baycom_epp.c:504:3: note: here default: /* fall through */ ^~~~~~~ Notice that, in this particular case, the code comment is modified in accordance with what GCC is expecting to find. Signed-off-by: Gustavo A. R. Silva Signed-off-by: David S. Miller commit 0bc10ad3a42a1c8ef2cef6e158cc40b87c46352d Author: Gustavo A. R. Silva Date: Mon Jul 29 15:01:39 2019 -0500 net: wan: sdla: Mark expected switch fall-through Mark switch cases where we are expecting to fall through. This patch fixes the following warning (Building: i386): drivers/net/wan/sdla.c: In function ‘sdla_errors’: drivers/net/wan/sdla.c:414:7: warning: this statement may fall through [-Wimplicit-fallthrough=] if (cmd == SDLA_INFORMATION_WRITE) ^ drivers/net/wan/sdla.c:417:3: note: here default: ^~~~~~~ Signed-off-by: Gustavo A. R. Silva Signed-off-by: David S. Miller commit d4e575ba9fcc04d10c0a2e555a5b32fa3a8a19d3 Author: Enrico Weigelt Date: Mon Jul 29 20:55:21 2019 +0200 net: sctp: drop unneeded likely() call around IS_ERR() IS_ERR() already calls unlikely(), so this extra unlikely() call around IS_ERR() is not needed. Signed-off-by: Enrico Weigelt Acked-by: Marcelo Ricardo Leitner Signed-off-by: David S. Miller commit c6b36bdd04b5c22b2705f7ae561d4f3b4d8a0ac3 Author: Petr Machata Date: Mon Jul 29 18:26:14 2019 +0000 mlxsw: spectrum_ptp: Increase parsing depth when PTP is enabled Spectrum systems have a configurable limit on how far into the packet they parse. By default, the limit is 96 bytes. An IPv6 PTP packet is layered as Ethernet/IPv6/UDP (14+40+8 bytes), and sequence ID of a PTP event is only available 32 bytes into payload, for a total of 94 bytes. When an additional 802.1q header is present as well (such as when ptp4l is running on a VLAN port), the parsing limit is exceeded. Such packets are not recognized as PTP, and are not timestamped. Therefore generalize the current VXLAN-specific parsing depth setting to allow reference-counted requests from other modules as well. Keep it in the VXLAN module, because the MPRS register also configures UDP destination port number used for VXLAN, and is thus closely tied to the VXLAN code anyway. Then invoke the new interfaces from both VXLAN (in obvious places), as well as from PTP code, when the (global) timestamping configuration changes from disabled to enabled or vice versa. Fixes: 8748642751ed ("mlxsw: spectrum: PTP: Support SIOCGHWTSTAMP, SIOCSHWTSTAMP ioctls") Signed-off-by: Petr Machata Reviewed-by: Ido Schimmel Signed-off-by: David S. Miller commit 6c1f7e2c1b96ab9b09ac97c4df2bd9dc327206f6 Author: Jozsef Kadlecsik Date: Tue Jul 23 10:25:55 2019 +0200 netfilter: ipset: Fix rename concurrency with listing Shijie Luo reported that when stress-testing ipset with multiple concurrent create, rename, flush, list, destroy commands, it can result ipset : Broken LIST kernel message: missing DATA part! error messages and broken list results. The problem was the rename operation was not properly handled with respect of listing. The patch fixes the issue. Reported-by: Shijie Luo Signed-off-by: Jozsef Kadlecsik commit 1b4a75108d5bc153daf965d334e77e8e94534f96 Author: Stefano Brivio Date: Mon Jun 24 15:20:12 2019 +0200 netfilter: ipset: Copy the right MAC address in bitmap:ip,mac and hash:ip,mac sets In commit 8cc4ccf58379 ("ipset: Allow matching on destination MAC address for mac and ipmac sets"), ipset.git commit 1543514c46a7, I added to the KADT functions for sets matching on MAC addreses the copy of source or destination MAC address depending on the configured match. This was done correctly for hash:mac, but for hash:ip,mac and bitmap:ip,mac, copying and pasting the same code block presents an obvious problem: in these two set types, the MAC address is the second dimension, not the first one, and we are actually selecting the MAC address depending on whether the first dimension (IP address) specifies source or destination. Fix this by checking for the IPSET_DIM_TWO_SRC flag in option flags. This way, mixing source and destination matches for the two dimensions of ip,mac set types works as expected. With this setup: ip netns add A ip link add veth1 type veth peer name veth2 netns A ip addr add 192.0.2.1/24 dev veth1 ip -net A addr add 192.0.2.2/24 dev veth2 ip link set veth1 up ip -net A link set veth2 up dst=$(ip netns exec A cat /sys/class/net/veth2/address) ip netns exec A ipset create test_bitmap bitmap:ip,mac range 192.0.0.0/16 ip netns exec A ipset add test_bitmap 192.0.2.1,${dst} ip netns exec A iptables -A INPUT -m set ! --match-set test_bitmap src,dst -j DROP ip netns exec A ipset create test_hash hash:ip,mac ip netns exec A ipset add test_hash 192.0.2.1,${dst} ip netns exec A iptables -A INPUT -m set ! --match-set test_hash src,dst -j DROP ipset correctly matches a test packet: # ping -c1 192.0.2.2 >/dev/null # echo $? 0 Reported-by: Chen Yi Fixes: 8cc4ccf58379 ("ipset: Allow matching on destination MAC address for mac and ipmac sets") Signed-off-by: Stefano Brivio Signed-off-by: Jozsef Kadlecsik commit b89d15480d0cacacae1a0fe0b3da01b529f2914f Author: Stefano Brivio Date: Mon Jun 24 15:20:11 2019 +0200 netfilter: ipset: Actually allow destination MAC address for hash:ip,mac sets too In commit 8cc4ccf58379 ("ipset: Allow matching on destination MAC address for mac and ipmac sets"), ipset.git commit 1543514c46a7, I removed the KADT check that prevents matching on destination MAC addresses for hash:mac sets, but forgot to remove the same check for hash:ip,mac set. Drop this check: functionality is now commented in man pages and there's no reason to restrict to source MAC address matching anymore. Reported-by: Chen Yi Fixes: 8cc4ccf58379 ("ipset: Allow matching on destination MAC address for mac and ipmac sets") Signed-off-by: Stefano Brivio Signed-off-by: Jozsef Kadlecsik commit 2a11c76e5301dddefcb618dac04f74e6314df6bc Merge: 45aee68e19a5 73f628ec9e6b Author: Linus Torvalds Date: Mon Jul 29 11:34:12 2019 -0700 Merge tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost Pull virtio/vhost fixes from Michael Tsirkin: - Fixes in the iommu and balloon devices. - Disable the meta-data optimization for now - I hope we can get it fixed shortly, but there's no point in making users suffer crashes while we are working on that. * tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost: vhost: disable metadata prefetch optimization iommu/virtio: Update to most recent specification balloon: fix up comments mm/balloon_compaction: avoid duplicate page removal commit 52023a53993061b524f6ba1de68858c472f52aad Author: Gustavo A. R. Silva Date: Sun Jul 28 19:32:51 2019 -0500 net: spider_net: Mark expected switch fall-through Mark switch cases where we are expecting to fall through. This patch fixes the following warning: drivers/net/ethernet/toshiba/spider_net.c: In function 'spider_net_release_tx_chain': drivers/net/ethernet/toshiba/spider_net.c:783:7: warning: this statement may fall through [-Wimplicit-fallthrough=] if (!brutal) { ^ drivers/net/ethernet/toshiba/spider_net.c:792:3: note: here case SPIDER_NET_DESCR_RESPONSE_ERROR: ^~~~ Notice that, in this particular case, the code comment is modified in accordance with what GCC is expecting to find. Reported-by: Stephen Rothwell Signed-off-by: Gustavo A. R. Silva Reviewed-by: Kees Cook Signed-off-by: David S. Miller commit 6f315c42d4120303d4cd6520f67889ff7f42736e Author: Gustavo A. R. Silva Date: Sun Jul 28 19:30:09 2019 -0500 net: ehea: Mark expected switch fall-through Mark switch cases where we are expecting to fall through. This patch fixes the following warning: drivers/net/ethernet/ibm/ehea/ehea_main.c: In function 'ehea_mem_notifier': include/linux/printk.h:311:2: warning: this statement may fall through [-Wimplicit-fallthrough=] printk(KERN_INFO pr_fmt(fmt), ##__VA_ARGS__) ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/ibm/ehea/ehea_main.c:3253:3: note: in expansion of macro 'pr_info' pr_info("memory offlining canceled"); ^~~~~~~ drivers/net/ethernet/ibm/ehea/ehea_main.c:3256:2: note: here case MEM_ONLINE: ^~~~ Notice that, in this particular case, the code comment is modified in accordance with what GCC is expecting to find. Reported-by: Stephen Rothwell Signed-off-by: Gustavo A. R. Silva Reviewed-by: Kees Cook Signed-off-by: David S. Miller commit 45aee68e19a52d434624bdd322a0c1d6c0b9be4f Merge: 609488bc979f f14312a93b34 Author: Linus Torvalds Date: Mon Jul 29 11:11:05 2019 -0700 Merge tag 'platform-drivers-x86-v5.3-3' of git://git.infradead.org/linux-platform-drivers-x86 Pull x86 platform driver fixes from Andy Shevchenko: "Business as usual, a few fixes and new IDs: - PC Engines APU got one fix for software dependencies to automatically load them and another fix for mapping of key button in the front to issue restart event. - OLPC driver is now probed automatically based on module device table. - Intel PMC core driver supports Intel Ice Lake NNPI processor. - WMI driver missed description of a new field in the structure that has been added" * tag 'platform-drivers-x86-v5.3-3' of git://git.infradead.org/linux-platform-drivers-x86: platform/x86: pcengines-apuv2: use KEY_RESTART for front button platform/x86: intel_pmc_core: Add ICL-NNPI support to PMC Core Platform: OLPC: add SPI MODULE_DEVICE_TABLE platform/x86: wmi: add missing struct parameter description platform/x86: pcengines-apuv2: Fix softdep statement commit d66503c43c0036d8db526d6c47c149bb971ac0b9 Author: Matteo Croce Date: Sun Jul 28 19:35:49 2019 +0200 mvpp2: refactor the HW checksum setup The hardware can only offload checksum calculation on first port due to the Tx FIFO size limitation, and has a maximum L3 offset of 128 bytes. Document this in a comment and move duplicated code in a function. Fixes: 576193f2d579 ("net: mvpp2: jumbo frames support") Signed-off-by: Matteo Croce Signed-off-by: David S. Miller commit 55b40dbf0e76b4bfb9d8b3a16a0208640a9a45df Author: Jiri Pirko Date: Sun Jul 28 14:56:36 2019 +0200 net: fix ifindex collision during namespace removal Commit aca51397d014 ("netns: Fix arbitrary net_device-s corruptions on net_ns stop.") introduced a possibility to hit a BUG in case device is returning back to init_net and two following conditions are met: 1) dev->ifindex value is used in a name of another "dev%d" device in init_net. 2) dev->name is used by another device in init_net. Under real life circumstances this is hard to get. Therefore this has been present happily for over 10 years. To reproduce: $ ip a 1: lo: mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo valid_lft forever preferred_lft forever inet6 ::1/128 scope host valid_lft forever preferred_lft forever 2: dummy0: mtu 1500 qdisc noop state DOWN group default qlen 1000 link/ether 86:89:3f:86:61:29 brd ff:ff:ff:ff:ff:ff 3: enp0s2: mtu 1500 qdisc noop state DOWN group default qlen 1000 link/ether 52:54:00:12:34:56 brd ff:ff:ff:ff:ff:ff $ ip netns add ns1 $ ip -n ns1 link add dummy1ns1 type dummy $ ip -n ns1 link add dummy2ns1 type dummy $ ip link set enp0s2 netns ns1 $ ip -n ns1 link set enp0s2 name dummy0 [ 100.858894] virtio_net virtio0 dummy0: renamed from enp0s2 $ ip link add dev4 type dummy $ ip -n ns1 a 1: lo: mtu 65536 qdisc noop state DOWN group default qlen 1000 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 2: dummy1ns1: mtu 1500 qdisc noop state DOWN group default qlen 1000 link/ether 16:63:4c:38:3e:ff brd ff:ff:ff:ff:ff:ff 3: dummy2ns1: mtu 1500 qdisc noop state DOWN group default qlen 1000 link/ether aa:9e:86:dd:6b:5d brd ff:ff:ff:ff:ff:ff 4: dummy0: mtu 1500 qdisc noop state DOWN group default qlen 1000 link/ether 52:54:00:12:34:56 brd ff:ff:ff:ff:ff:ff $ ip a 1: lo: mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo valid_lft forever preferred_lft forever inet6 ::1/128 scope host valid_lft forever preferred_lft forever 2: dummy0: mtu 1500 qdisc noop state DOWN group default qlen 1000 link/ether 86:89:3f:86:61:29 brd ff:ff:ff:ff:ff:ff 4: dev4: mtu 1500 qdisc noop state DOWN group default qlen 1000 link/ether 5a:e1:4a:b6:ec:f8 brd ff:ff:ff:ff:ff:ff $ ip netns del ns1 [ 158.717795] default_device_exit: failed to move dummy0 to init_net: -17 [ 158.719316] ------------[ cut here ]------------ [ 158.720591] kernel BUG at net/core/dev.c:9824! [ 158.722260] invalid opcode: 0000 [#1] SMP KASAN PTI [ 158.723728] CPU: 0 PID: 56 Comm: kworker/u2:1 Not tainted 5.3.0-rc1+ #18 [ 158.725422] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-2.fc30 04/01/2014 [ 158.727508] Workqueue: netns cleanup_net [ 158.728915] RIP: 0010:default_device_exit.cold+0x1d/0x1f [ 158.730683] Code: 84 e8 18 c9 3e fe 0f 0b e9 70 90 ff ff e8 36 e4 52 fe 89 d9 4c 89 e2 48 c7 c6 80 d6 25 84 48 c7 c7 20 c0 25 84 e8 f4 c8 3e [ 158.736854] RSP: 0018:ffff8880347e7b90 EFLAGS: 00010282 [ 158.738752] RAX: 000000000000003b RBX: 00000000ffffffef RCX: 0000000000000000 [ 158.741369] RDX: 0000000000000000 RSI: ffffffff8128013d RDI: ffffed10068fcf64 [ 158.743418] RBP: ffff888033550170 R08: 000000000000003b R09: fffffbfff0b94b9c [ 158.745626] R10: fffffbfff0b94b9b R11: ffffffff85ca5cdf R12: ffff888032f28000 [ 158.748405] R13: dffffc0000000000 R14: ffff8880335501b8 R15: 1ffff110068fcf72 [ 158.750638] FS: 0000000000000000(0000) GS:ffff888036000000(0000) knlGS:0000000000000000 [ 158.752944] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 158.755245] CR2: 00007fe8b45d21d0 CR3: 00000000340b4005 CR4: 0000000000360ef0 [ 158.757654] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 158.760012] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 158.762758] Call Trace: [ 158.763882] ? dev_change_net_namespace+0xbb0/0xbb0 [ 158.766148] ? devlink_nl_cmd_set_doit+0x520/0x520 [ 158.768034] ? dev_change_net_namespace+0xbb0/0xbb0 [ 158.769870] ops_exit_list.isra.0+0xa8/0x150 [ 158.771544] cleanup_net+0x446/0x8f0 [ 158.772945] ? unregister_pernet_operations+0x4a0/0x4a0 [ 158.775294] process_one_work+0xa1a/0x1740 [ 158.776896] ? pwq_dec_nr_in_flight+0x310/0x310 [ 158.779143] ? do_raw_spin_lock+0x11b/0x280 [ 158.780848] worker_thread+0x9e/0x1060 [ 158.782500] ? process_one_work+0x1740/0x1740 [ 158.784454] kthread+0x31b/0x420 [ 158.786082] ? __kthread_create_on_node+0x3f0/0x3f0 [ 158.788286] ret_from_fork+0x3a/0x50 [ 158.789871] ---[ end trace defd6c657c71f936 ]--- [ 158.792273] RIP: 0010:default_device_exit.cold+0x1d/0x1f [ 158.795478] Code: 84 e8 18 c9 3e fe 0f 0b e9 70 90 ff ff e8 36 e4 52 fe 89 d9 4c 89 e2 48 c7 c6 80 d6 25 84 48 c7 c7 20 c0 25 84 e8 f4 c8 3e [ 158.804854] RSP: 0018:ffff8880347e7b90 EFLAGS: 00010282 [ 158.807865] RAX: 000000000000003b RBX: 00000000ffffffef RCX: 0000000000000000 [ 158.811794] RDX: 0000000000000000 RSI: ffffffff8128013d RDI: ffffed10068fcf64 [ 158.816652] RBP: ffff888033550170 R08: 000000000000003b R09: fffffbfff0b94b9c [ 158.820930] R10: fffffbfff0b94b9b R11: ffffffff85ca5cdf R12: ffff888032f28000 [ 158.825113] R13: dffffc0000000000 R14: ffff8880335501b8 R15: 1ffff110068fcf72 [ 158.829899] FS: 0000000000000000(0000) GS:ffff888036000000(0000) knlGS:0000000000000000 [ 158.834923] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 158.838164] CR2: 00007fe8b45d21d0 CR3: 00000000340b4005 CR4: 0000000000360ef0 [ 158.841917] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 158.845149] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Fix this by checking if a device with the same name exists in init_net and fallback to original code - dev%d to allocate name - in case it does. This was found using syzkaller. Fixes: aca51397d014 ("netns: Fix arbitrary net_device-s corruptions on net_ns stop.") Signed-off-by: Jiri Pirko Signed-off-by: David S. Miller commit 230bd958c2c846ee292aa38bc6b006296c24ca01 Author: Matteo Croce Date: Sun Jul 28 02:46:45 2019 +0200 mvpp2: refactor MTU change code The MTU change code can call napi_disable() with the device already down, leading to a deadlock. Also, lot of code is duplicated unnecessarily. Rework mvpp2_change_mtu() to avoid the deadlock and remove duplicated code. Fixes: 3f518509dedc ("ethernet: Add new driver for Marvell Armada 375 network unit") Signed-off-by: Matteo Croce Signed-off-by: David S. Miller commit 011f175428d46461f94a65dacb9a416529d08dda Author: Colin Ian King Date: Sun Jul 28 00:37:26 2019 +0100 rocker: fix memory leaks of fib_work on two error return paths Currently there are two error return paths that leak memory allocated to fib_work. Fix this by kfree'ing fib_work before returning. Addresses-Coverity: ("Resource leak") Fixes: 19a9d136f198 ("ipv4: Flag fib_info with a fib_nh using IPv6 gateway") Fixes: dbcc4fa718ee ("rocker: Fail attempts to use routes with nexthop objects") Signed-off-by: Colin Ian King Reviewed-by: David Ahern Acked-by: Jiri Pirko Signed-off-by: David S. Miller commit 195b2919ccd7ffcaf6b6bbcb39444a53ab8308c7 Author: Martin Blumenstingl Date: Sat Jul 27 21:21:37 2019 +0200 net: stmmac: manage errors returned by of_get_mac_address() Commit d01f449c008a ("of_net: add NVMEM support to of_get_mac_address") added support for reading the MAC address from an nvmem-cell. This required changing the logic to return an error pointer upon failure. If stmmac is loaded before the nvmem provider driver then of_get_mac_address() return an error pointer with -EPROBE_DEFER. Propagate this error so the stmmac driver will be probed again after the nvmem provider driver is loaded. Default to a random generated MAC address in case of any other error, instead of using the error pointer as MAC address. Fixes: d01f449c008a ("of_net: add NVMEM support to of_get_mac_address") Signed-off-by: Martin Blumenstingl Reviewed-by: Neil Armstrong Signed-off-by: David S. Miller commit 708637e65abd487ebb75fb55401c36a466c3135b Author: Bernard Metzler Date: Sat Jul 27 12:38:32 2019 +0200 Do not dereference 'siw_crypto_shash' before checking Reported-by: "Dan Carpenter" Fixes: f29dd55b0236 ("rdma/siw: queue pair methods") Link: https://lore.kernel.org/r/OF61E386ED.49A73798-ON00258444.003BD6A6-00258444.003CC8D9@notes.na.collabserv.com Signed-off-by: Bernard Metzler Signed-off-by: Doug Ledford commit 05bba1edaf9c11023901800bc4d2ce5b96e0836a Author: Gustavo A. R. Silva Date: Mon Jul 29 09:59:47 2019 -0500 net/af_iucv: mark expected switch fall-throughs Mark switch cases where we are expecting to fall through. This patch fixes the following warnings: net/iucv/af_iucv.c: warning: this statement may fall through [-Wimplicit-fallthrough=]: => 537:3, 519:6, 2246:6, 510:6 Notice that, in this particular case, the code comment is modified in accordance with what GCC is expecting to find. Reported-by: Geert Uytterhoeven Signed-off-by: Gustavo A. R. Silva Reviewed-by: Kees Cook Signed-off-by: David S. Miller commit e1ab2431ebee2634b9868013d3fefd03c800e510 Author: Gustavo A. R. Silva Date: Mon Jul 29 09:25:03 2019 -0500 arcnet: com20020-isa: Mark expected switch fall-throughs Mark switch cases where we are expecting to fall through. This patch fixes the following warnings: drivers/net/arcnet/com20020-isa.c: warning: this statement may fall through [-Wimplicit-fallthrough=]: => 205:13, 203:10, 209:7, 201:11, 207:8 Reported-by: Geert Uytterhoeven Signed-off-by: Gustavo A. R. Silva Reviewed-by: Kees Cook Signed-off-by: David S. Miller commit 37151a41df800493cfcbbef4f7208ffe04feb959 Author: Yuki Tsunashima Date: Mon Jul 29 17:10:36 2019 +0200 ALSA: pcm: fix lost wakeup event scenarios in snd_pcm_drain lost wakeup can occur after enabling irq, therefore put task into interruptible before enabling interrupts, without this change, task can be put to sleep and snd_pcm_drain will delay Fixes: f2b3614cefb6 ("ALSA: PCM - Don't check DMA time-out too shortly") Signed-off-by: Yuki Tsunashima Signed-off-by: Suresh Udipi [ported from 4.9] Signed-off-by: Adam Miartus Signed-off-by: Takashi Iwai commit 15fe6a8dcc3b48358c28e17b485fc837f9605ec4 Author: Michal Kalderon Date: Sun Jul 28 14:13:38 2019 +0300 RDMA/qedr: Fix the hca_type and hca_rev returned in device attributes There was a place holder for hca_type and vendor was returned in hca_rev. Fix the hca_rev to return the hw revision and fix the hca_type to return an informative string representing the hca. Signed-off-by: Michal Kalderon Link: https://lore.kernel.org/r/20190728111338.21930-1-michal.kalderon@marvell.com Signed-off-by: Doug Ledford commit d7bae09fa008c6c9a489580db0a5a12063b97f97 Author: Nikolay Aleksandrov Date: Mon Jul 29 12:28:41 2019 +0300 net: bridge: delete local fdb on device init failure On initialization failure we have to delete the local fdb which was inserted due to the default pvid creation. This problem has been present since the inception of default_pvid. Note that currently there are 2 cases: 1) in br_dev_init() when br_multicast_init() fails 2) if register_netdevice() fails after calling ndo_init() This patch takes care of both since br_vlan_flush() is called on both occasions. Also the new fdb delete would be a no-op on normal bridge device destruction since the local fdb would've been already flushed by br_dev_delete(). This is not an issue for ports since nbp_vlan_init() is called last when adding a port thus nothing can fail after it. Reported-by: syzbot+88533dc8b582309bf3ee@syzkaller.appspotmail.com Fixes: 5be5a2df40f0 ("bridge: Add filtering support for default_pvid") Signed-off-by: Nikolay Aleksandrov Signed-off-by: David S. Miller commit 051c7b39be4a91f6b7d8c4548444e4b850f1f56c Author: Jia-Ju Bai Date: Mon Jul 29 16:24:33 2019 +0800 net: sched: Fix a possible null-pointer dereference in dequeue_func() In dequeue_func(), there is an if statement on line 74 to check whether skb is NULL: if (skb) When skb is NULL, it is used on line 77: prefetch(&skb->end); Thus, a possible null-pointer dereference may occur. To fix this bug, skb->end is used when skb is not NULL. This bug is found by a static analysis tool STCheck written by us. Fixes: 76e3cc126bb2 ("codel: Controlled Delay AQM") Signed-off-by: Jia-Ju Bai Reviewed-by: Jiri Pirko Signed-off-by: David S. Miller commit a7f9cbf0ed2f67380b547971145e823b9225d39d Author: Jesper Dangaard Brouer Date: Mon Jul 29 14:16:37 2019 +0200 MAINTAINERS: Remove mailing-list entry for XDP (eXpress Data Path) This removes the mailing list xdp-newbies@vger.kernel.org from the XDP kernel maintainers entry. Being in the kernel MAINTAINERS file successfully caused the list to receive kbuild bot warnings, syzbot reports and sometimes developer patches. The level of details in these messages, doesn't match the target audience of the XDP-newbies list. This is based on a survey on the mailing list, where 73% voted for removal from MAINTAINERS file. Signed-off-by: Jesper Dangaard Brouer Acked-by: Jakub Kicinski Signed-off-by: David S. Miller commit 26027f4243c1a23399b85a3cff9b0b89e405be59 Author: Gustavo A. R. Silva Date: Mon Jul 29 06:15:50 2019 -0500 arcnet: arc-rimi: Mark expected switch fall-throughs Mark switch cases where we are expecting to fall through. This patch fixes the following warnings (Building: powerpc allyesconfig): drivers/net/arcnet/arc-rimi.c: In function 'arcrimi_setup': include/linux/printk.h:304:2: warning: this statement may fall through [-Wimplicit-fallthrough=] printk(KERN_ERR pr_fmt(fmt), ##__VA_ARGS__) ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/arcnet/arc-rimi.c:365:3: note: in expansion of macro 'pr_err' pr_err("Too many arguments\n"); ^~~~~~ drivers/net/arcnet/arc-rimi.c:366:2: note: here case 3: /* Node ID */ ^~~~ drivers/net/arcnet/arc-rimi.c:367:8: warning: this statement may fall through [-Wimplicit-fallthrough=] node = ints[3]; ~~~~~^~~~~~~~~ drivers/net/arcnet/arc-rimi.c:368:2: note: here case 2: /* IRQ */ ^~~~ drivers/net/arcnet/arc-rimi.c:369:7: warning: this statement may fall through [-Wimplicit-fallthrough=] irq = ints[2]; ~~~~^~~~~~~~~ drivers/net/arcnet/arc-rimi.c:370:2: note: here case 1: /* IO address */ ^~~~ Reported-by: Stephen Rothwell Signed-off-by: Gustavo A. R. Silva Reviewed-by: Kees Cook Signed-off-by: David S. Miller commit 56f37a3fa2190732957882e10ec20adf83c6cb93 Author: Gustavo A. R. Silva Date: Mon Jul 29 06:13:20 2019 -0500 arcnet: com90io: Mark expected switch fall-throughs Mark switch cases where we are expecting to fall through. This patch fixes the following warnings (Building: powerpc allyesconfig): drivers/net/arcnet/com90io.c: In function 'com90io_setup': include/linux/printk.h:304:2: warning: this statement may fall through [-Wimplicit-fallthrough=] printk(KERN_ERR pr_fmt(fmt), ##__VA_ARGS__) ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/arcnet/com90io.c:365:3: note: in expansion of macro 'pr_err' pr_err("Too many arguments\n"); ^~~~~~ drivers/net/arcnet/com90io.c:366:2: note: here case 2: /* IRQ */ ^~~~ drivers/net/arcnet/com90io.c:367:7: warning: this statement may fall through [-Wimplicit-fallthrough=] irq = ints[2]; ~~~~^~~~~~~~~ drivers/net/arcnet/com90io.c:368:2: note: here case 1: /* IO address */ ^~~~ Reported-by: Stephen Rothwell Signed-off-by: Gustavo A. R. Silva Reviewed-by: Kees Cook Signed-off-by: David S. Miller commit f3eb2c334a6d3f5e704ecd0b150d5cfe6e3aca40 Author: Gustavo A. R. Silva Date: Mon Jul 29 06:09:53 2019 -0500 arcnet: com90xx: Mark expected switch fall-throughs Mark switch cases where we are expecting to fall through. This patch fixes the following warnings (Building: powerpc allyesconfig): drivers/net/arcnet/com90xx.c: In function 'com90xx_setup': include/linux/printk.h:304:2: warning: this statement may fall through [-Wimplicit-fallthrough=] printk(KERN_ERR pr_fmt(fmt), ##__VA_ARGS__) ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/arcnet/com90xx.c:695:3: note: in expansion of macro 'pr_err' pr_err("Too many arguments\n"); ^~~~~~ drivers/net/arcnet/com90xx.c:696:2: note: here case 3: /* Mem address */ ^~~~ drivers/net/arcnet/com90xx.c:697:9: warning: this statement may fall through [-Wimplicit-fallthrough=] shmem = ints[3]; ~~~~~~^~~~~~~~~ drivers/net/arcnet/com90xx.c:698:2: note: here case 2: /* IRQ */ ^~~~ drivers/net/arcnet/com90xx.c:699:7: warning: this statement may fall through [-Wimplicit-fallthrough=] irq = ints[2]; ~~~~^~~~~~~~~ drivers/net/arcnet/com90xx.c:700:2: note: here case 1: /* IO address */ ^~~~ Reported-by: Stephen Rothwell Signed-off-by: Gustavo A. R. Silva Reviewed-by: Kees Cook Signed-off-by: David S. Miller commit 61c30c98ef17e5a330d7bb8494b78b3d6dffe9b8 Author: Jan Kara Date: Mon Jul 29 13:57:49 2019 +0200 dax: Fix missed wakeup in put_unlocked_entry() The condition checking whether put_unlocked_entry() needs to wake up following waiter got broken by commit 23c84eb78375 ("dax: Fix missed wakeup with PMD faults"). We need to wake the waiter whenever the passed entry is valid (i.e., non-NULL and not special conflict entry). This could lead to processes never being woken up when waiting for entry lock. Fix the condition. Cc: Link: http://lore.kernel.org/r/20190729120228.GC17833@quack2.suse.cz Fixes: 23c84eb78375 ("dax: Fix missed wakeup with PMD faults") Signed-off-by: Jan Kara Signed-off-by: Dan Williams commit a07fc0bb483eb24444cebd59a8112ce6e6964c48 Author: YueHaibing Date: Wed Jul 24 14:54:43 2019 +0800 RDMA/hns: Fix build error If INFINIBAND_HNS_HIP08 is selected and HNS3 is m, but INFINIBAND_HNS is y, building fails: drivers/infiniband/hw/hns/hns_roce_hw_v2.o: In function `hns_roce_hw_v2_exit': hns_roce_hw_v2.c:(.exit.text+0xd): undefined reference to `hnae3_unregister_client' drivers/infiniband/hw/hns/hns_roce_hw_v2.o: In function `hns_roce_hw_v2_init': hns_roce_hw_v2.c:(.init.text+0xd): undefined reference to `hnae3_register_client' Also if INFINIBAND_HNS_HIP06 is selected and HNS_DSAF is m, but INFINIBAND_HNS is y, building fails: drivers/infiniband/hw/hns/hns_roce_hw_v1.o: In function `hns_roce_v1_reset': hns_roce_hw_v1.c:(.text+0x39fa): undefined reference to `hns_dsaf_roce_reset' hns_roce_hw_v1.c:(.text+0x3a25): undefined reference to `hns_dsaf_roce_reset' Reported-by: Hulk Robot Fixes: dd74282df573 ("RDMA/hns: Initialize the PCI device for hip08 RoCE") Fixes: 08805fdbeb2d ("RDMA/hns: Split hw v1 driver from hns roce driver") Signed-off-by: YueHaibing Link: https://lore.kernel.org/r/20190724065443.53068-1-yuehaibing@huawei.com Signed-off-by: Doug Ledford commit 8480657280ee769ad23101297e1e6be0f8d205ec Author: Vasily Gorbik Date: Wed Jul 17 20:09:28 2019 +0200 vfio-ccw: make vfio_ccw_async_region_ops static Since vfio_ccw_async_region_ops is not exported and has no reason to be globally visible make it static to avoid the following sparse warning: drivers/s390/cio/vfio_ccw_async.c:73:30: warning: symbol 'vfio_ccw_async_region_ops' was not declared. Should it be static? Fixes: d5afd5d135c8 ("vfio-ccw: add handling for async channel instructions") Reviewed-by: Cornelia Huck Signed-off-by: Vasily Gorbik commit 943dd5fa70ada0266c3a572c641be537b69ae2a8 Author: Vasily Gorbik Date: Mon Jul 29 01:01:21 2019 +0200 s390/3215: add switch fall through comment for -Wimplicit-fallthrough Silence the following warning when built with -Wimplicit-fallthrough=3 enabled by default since 5.3-rc2: drivers/s390/char/con3215.c: In function 'raw3215_irq': drivers/s390/char/con3215.c:399:6: warning: this statement may fall through [-Wimplicit-fallthrough=] 399 | if (dstat == 0x08) | ^ drivers/s390/char/con3215.c:401:2: note: here 401 | case 0x04: | ^~~~ Signed-off-by: Vasily Gorbik commit 90a93ff4051ede8320c5576d99f34e0f75e99c1a Author: Heiko Carstens Date: Mon Jul 29 07:47:02 2019 +0200 s390/tape: add fallthrough annotations Commit a035d552a93b ("Makefile: Globally enable fall-through warning") enables fall-through warnings globally. Add missing annotations. Signed-off-by: Heiko Carstens Signed-off-by: Vasily Gorbik commit 7f5aa1154b1a30653a12e0f7f473494de77ad670 Author: Heiko Carstens Date: Mon Jul 29 07:39:44 2019 +0200 s390/mm: add fallthrough annotations Commit a035d552a93b ("Makefile: Globally enable fall-through warning") enables fall-through warnings globally. Add missing annotations. Signed-off-by: Heiko Carstens Signed-off-by: Vasily Gorbik commit ffbd268506ca70c2cd18238762a29b9a47d8d9fa Author: Vasily Gorbik Date: Wed Jul 17 19:41:09 2019 +0200 s390/mm: make gmap_test_and_clear_dirty_pmd static Since gmap_test_and_clear_dirty_pmd is not exported and has no reason to be globally visible make it static to avoid the following sparse warning: arch/s390/mm/gmap.c:2427:6: warning: symbol 'gmap_test_and_clear_dirty_pmd' was not declared. Should it be static? Signed-off-by: Vasily Gorbik commit 1877011a3568fcadf2ee28f4d02fe5c31b1bb060 Author: Vasily Gorbik Date: Wed Jul 17 19:42:22 2019 +0200 s390/kexec: add missing include to machine_kexec_reloc.c Include into machine_kexec_reloc.c to expose arch_kexec_do_relocs declaration and avoid the following sparse warnings: arch/s390/kernel/machine_kexec_reloc.c:4:5: warning: symbol 'arch_kexec_do_relocs' was not declared. Should it be static? arch/s390/boot/../kernel/machine_kexec_reloc.c:4:5: warning: symbol 'arch_kexec_do_relocs' was not declared. Should it be static? Signed-off-by: Vasily Gorbik commit 06f9895fda39422fb9250a78454e69aadace13c7 Author: Vasily Gorbik Date: Wed Jul 17 20:05:11 2019 +0200 s390/perf: make cf_diag_csd static Since there is really no reason for cf_diag_csd per cpu variable to be globally visible make it static to avoid the following sparse warning: arch/s390/kernel/perf_cpum_cf_diag.c:37:1: warning: symbol 'cf_diag_csd' was not declared. Should it be static? Signed-off-by: Vasily Gorbik commit d25220d2f2ece9e516588ed5df2ed373069b3a02 Author: Vasily Gorbik Date: Wed Jul 17 20:07:42 2019 +0200 s390/lib: add missing include Include into arch/s390/lib/xor.c to expose xor_block_xc declaration and avoid the following sparse warning: arch/s390/lib/xor.c:128:27: warning: symbol 'xor_block_xc' was not declared. Should it be static? Signed-off-by: Vasily Gorbik commit 868202ce15a7b52534257426a94f40b6d9f6150f Author: Vasily Gorbik Date: Wed Jul 17 19:38:42 2019 +0200 s390/boot: add missing declarations and includes Add __swsusp_reset_dma declaration to avoid the following sparse warnings: arch/s390/kernel/setup.c:107:15: warning: symbol '__swsusp_reset_dma' was not declared. Should it be static? arch/s390/boot/startup.c:52:15: warning: symbol '__swsusp_reset_dma' was not declared. Should it be static? Add verify_facilities declaration to avoid the following sparse warning: arch/s390/boot/als.c:105:6: warning: symbol 'verify_facilities' was not declared. Should it be static? Include "boot.h" into arch/s390/boot/kaslr.c to expose get_random_base function declaration and avoid the following sparse warning: arch/s390/boot/kaslr.c:90:15: warning: symbol 'get_random_base' was not declared. Should it be static? Signed-off-by: Vasily Gorbik commit 3361f3193c747e8b32b9edf60f2567187ed4faef Author: Heiko Carstens Date: Thu Jul 25 13:52:08 2019 +0200 s390: update configs Signed-off-by: Heiko Carstens Signed-off-by: Vasily Gorbik commit d655e5b4e1c8ce207f0a1868aa334c4ecdcbddfb Author: Julian Wiedmann Date: Tue Jul 23 10:24:51 2019 +0200 s390: clean up qdio.h Fix two typos, document missing fields in the driver initialization data and remove the copy&pasted 'pfmt' field from the qdr struct. Signed-off-by: Julian Wiedmann Reviewed-by: Jens Remus Signed-off-by: Vasily Gorbik commit f14312a93b34b9350dc33ff0b4215c24f4c82617 Author: Enrico Weigelt Date: Thu Jul 25 21:06:03 2019 +0200 platform/x86: pcengines-apuv2: use KEY_RESTART for front button The keycode KEY_RESTART is more appropriate for the front button, as most people use it for things like restart or factory reset. Signed-off-by: Enrico Weigelt Fixes: f8eb0235f659 ("x86: pcengines apuv2 gpio/leds/keys platform driver") Signed-off-by: Andy Shevchenko commit 1caf7d50f46bd0388e38e653b146aa81700e8eb8 Author: Joel Fernandes (Google) Date: Wed Jul 24 12:48:16 2019 -0400 pidfd: Add warning if exit_state is 0 during notification Previously a condition got missed where the pidfd waiters are awakened before the exit_state gets set. This can result in a missed notification [1] and the polling thread waiting forever. It is fixed now, however it would be nice to avoid this kind of issue going unnoticed in the future. So just add a warning to catch it in the future. /* References */ [1]: https://lore.kernel.org/lkml/20190717172100.261204-1-joel@joelfernandes.org/ Signed-off-by: Joel Fernandes (Google) Link: https://lore.kernel.org/r/20190724164816.201099-1-joel@joelfernandes.org Signed-off-by: Christian Brauner commit 3884ae44f41247e0ae41952d4fad46db86d2e0a8 Author: Christian Brauner Date: Tue Jul 23 10:08:28 2019 +0200 pidfd: remove obsolete comments from test Since the introduction of CLONE_PIDFD pidfd_send_signal() is independent of CONFIG_PROC_FS. Signed-off-by: Christian Brauner commit b55f3b841099e641bdb2701d361a4c304e2dbd6f Author: Jia-Ju Bai Date: Mon Jul 29 16:23:32 2019 +0800 mac80211_hwsim: Fix possible null-pointer dereferences in hwsim_dump_radio_nl() In hwsim_dump_radio_nl(), when genlmsg_put() on line 3617 fails, hdr is assigned to NULL. Then hdr is used on lines 3622 and 3623: genl_dump_check_consistent(cb, hdr); genlmsg_end(skb, hdr); Thus, possible null-pointer dereferences may occur. To fix these bugs, hdr is used here when it is not NULL. This bug is found by a static analysis tool STCheck written by us. Signed-off-by: Jia-Ju Bai Link: https://lore.kernel.org/r/20190729082332.28895-1-baijiaju1990@gmail.com [put braces on all branches] Signed-off-by: Johannes Berg commit 05aaa5c97dce4c10a9e7eae2f1569a684e0c5ced Author: Brian Norris Date: Fri Jul 26 15:47:58 2019 -0700 mac80211: don't WARN on short WMM parameters from AP In a very similar spirit to commit c470bdc1aaf3 ("mac80211: don't WARN on bad WMM parameters from buggy APs"), an AP may not transmit a fully-formed WMM IE. For example, it may miss or repeat an Access Category. The above loop won't catch that and will instead leave one of the four ACs zeroed out. This triggers the following warning in drv_conf_tx() wlan0: invalid CW_min/CW_max: 0/0 and it may leave one of the hardware queues unconfigured. If we detect such a case, let's just print a warning and fall back to the defaults. Tested with a hacked version of hostapd, intentionally corrupting the IEs in hostapd_eid_wmm(). Cc: stable@vger.kernel.org Signed-off-by: Brian Norris Link: https://lore.kernel.org/r/20190726224758.210953-1-briannorris@chromium.org Signed-off-by: Johannes Berg commit 8aa259b10a6a759c50137bbbf225df0c17ca5d27 Author: Andrii Nakryiko Date: Thu Jul 18 10:30:21 2019 -0700 libbpf: fix missing __WORDSIZE definition hashmap.h depends on __WORDSIZE being defined. It is defined by glibc/musl in different headers. It's an explicit goal for musl to be "non-detectable" at compilation time, so instead include glibc header if glibc is explicitly detected and fall back to musl header otherwise. Reported-by: Arnaldo Carvalho de Melo Signed-off-by: Andrii Nakryiko Tested-by: Arnaldo Carvalho de Melo Cc: Alexei Starovoitov Cc: Andrii Nakryiko Cc: Daniel Borkmann Fixes: e3b924224028 ("libbpf: add resizable non-thread safe internal hashmap") Link: https://lkml.kernel.org/r/20190718173021.2418606-1-andriin@fb.com Signed-off-by: Arnaldo Carvalho de Melo commit 91826ba13855f73e252fef68369b3b0e1ed25253 Author: Masahiro Yamada Date: Mon Jul 29 00:51:38 2019 +0900 netfilter: add include guard to xt_connlabel.h Add a header include guard just in case. Signed-off-by: Masahiro Yamada Acked-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit 89f5752307cf53010d97503ac501b2ca1b089922 Author: Imre Deak Date: Fri Jun 28 17:36:18 2019 +0300 drm/i915: Fix the TBT AUX power well enabling Fix the mapping from a TBT AUX power well index to the DP_AUX_CH_CTL register. Fixes: c7375d9542f1 ("drm/i915: Configure AUX_CH_CTL when enabling the AUX power domain") Cc: José Roberto de Souza Cc: Rodrigo Vivi Signed-off-by: Imre Deak Reviewed-by: José Roberto de Souza Link: https://patchwork.freedesktop.org/patch/msgid/20190628143635.22066-7-imre.deak@intel.com (cherry picked from commit 29ae36abf08f943b76a2959f5000c44efa335be7) Signed-off-by: Jani Nikula commit 0bbfdce345c8cf01a3a985fa99fefd2146dcc748 Author: Tvrtko Ursulin Date: Wed Jul 17 19:06:19 2019 +0100 drm/i915: Fix GEN8_MCR_SELECTOR programming fls returns bit positions starting from one for the lsb and the MCR register expects zero based (sub)slice addressing. Incorrent MCR programming can have the effect of directing MMIO reads of registers in the 0xb100-0xb3ff range to invalid subslice returning zeroes instead of actual content. Signed-off-by: Tvrtko Ursulin Fixes: 1e40d4aea57b ("drm/i915/cnl: Implement WaProgramMgsrForCorrectSliceSpecificMmioReads") Reviewed-by: Chris Wilson Link: https://patchwork.freedesktop.org/patch/msgid/20190717180624.20354-2-tvrtko.ursulin@linux.intel.com (cherry picked from commit 15160879d47213c32f357bc67b6014d9aaf14ed7) Signed-off-by: Jani Nikula commit 6d61f716a01ec0e134de38ae97e71d6fec5a6ff6 Author: Dhinakaran Pandiyan Date: Wed Jul 17 15:34:51 2019 -0700 drm/i915/vbt: Fix VBT parsing for the PSR section A single 32-bit PSR2 training pattern field follows the sixteen element array of PSR table entries in the VBT spec. But, we incorrectly define this PSR2 field for each of the PSR table entries. As a result, the PSR1 training pattern duration for any panel_type != 0 will be parsed incorrectly. Secondly, PSR2 training pattern durations for VBTs with bdb version >= 226 will also be wrong. Cc: Rodrigo Vivi Cc: José Roberto de Souza Cc: stable@vger.kernel.org Cc: stable@vger.kernel.org #v5.2 Fixes: 88a0d9606aff ("drm/i915/vbt: Parse and use the new field with PSR2 TP2/3 wakeup time") Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=111088 Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=204183 Signed-off-by: Dhinakaran Pandiyan Reviewed-by: Ville Syrjälä Reviewed-by: José Roberto de Souza Acked-by: Rodrigo Vivi Tested-by: François Guerraz Signed-off-by: Rodrigo Vivi Link: https://patchwork.freedesktop.org/patch/msgid/20190717223451.2595-1-dhinakaran.pandiyan@intel.com (cherry picked from commit b5ea9c9337007d6e700280c8a60b4e10d070fb53) Signed-off-by: Jani Nikula commit a8f196a0fa6391a436f63f360a1fb57031fdf26c Author: Ville Syrjälä Date: Wed Jul 17 14:45:36 2019 +0300 drm/i915: Make sure cdclk is high enough for DP audio on VLV/CHV On VLV/CHV there is some kind of linkage between the cdclk frequency and the DP link frequency. The spec says: "For DP audio configuration, cdclk frequency shall be set to meet the following requirements: DP Link Frequency(MHz) | Cdclk frequency(MHz) 270 | 320 or higher 162 | 200 or higher" I suspect that would more accurately be expressed as "cdclk >= DP link clock", and in any case we can express it like that in the code because of the limited set of cdclk (200, 266, 320, 400 MHz) and link frequencies (162 and 270 MHz) we support. Without this we can end up in a situation where the cdclk is too low and enabling DP audio will kill the pipe. Happens eg. with 2560x1440 modes where the 266MHz cdclk is sufficient to pump the pixels (241.5 MHz dotclock) but is too low for the DP audio due to the link frequency being 270 MHz. v2: Spell out the cdclk and link frequencies we actually support Cc: stable@vger.kernel.org Tested-by: Stefan Gottwald Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=111149 Signed-off-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20190717114536.22937-1-ville.syrjala@linux.intel.com Acked-by: Chris Wilson (cherry picked from commit bffb31f73b29a60ef693842d8744950c2819851d) Signed-off-by: Jani Nikula commit 982b1d002f16c2695871e005c4132060c836db56 Author: Chris Wilson Date: Mon Jul 15 09:09:28 2019 +0100 drm/i915: Lock the engine while dumping the active request We cannot let the request be retired and freed while we are trying to dump it during error capture. It is not sufficient just to grab a reference to the request, as during retirement we may free the ring which we are also dumping. So take the engine lock to prevent retiring and freeing of the request. Reported-by: Alex Shumsky Fixes: 83c317832eb1 ("drm/i915: Dump the ringbuffer of the active request for debugging") Signed-off-by: Chris Wilson Cc: Tvrtko Ursulin Cc: Joonas Lahtinen Cc: Alex Shumsky Reviewed-by: Tvrtko Ursulin Link: https://patchwork.freedesktop.org/patch/msgid/20190715080946.15593-6-chris@chris-wilson.co.uk (cherry picked from commit cfe7288c276e359eebf057699fe86c2f8af14224) Signed-off-by: Jani Nikula commit 8f48de49795ca52f70c96558ccc6a0c174504779 Author: Lionel Landwerlin Date: Wed Jul 10 11:55:24 2019 +0100 drm/i915/perf: add missing delay for OA muxes configuration This was dropped from the original patch series, we weren't sure whether it was needed at the time. More recent tests show it's definitely needed to have acurate performance data. Signed-off-by: Lionel Landwerlin Fixes: 19f81df2859eb1 ("drm/i915/perf: Add OA unit support for Gen 8+") Acked-by: Chris Wilson [ickle: combine duplicate code and comments] Signed-off-by: Chris Wilson Link: https://patchwork.freedesktop.org/patch/msgid/20190710105524.23017-1-chris@chris-wilson.co.uk (cherry picked from commit 14bfcd3e0daeb0f757a02aac85fd03e0933ab37e) Signed-off-by: Jani Nikula commit 06c12ae3b401238477e65e8c4e04e065699a6115 Author: Lionel Landwerlin Date: Tue Jul 9 15:33:39 2019 +0300 drm/i915/perf: ensure we keep a reference on the driver The i915 perf stream has its own file descriptor and is tied to reference of the driver. We haven't taken care of keep the driver alive. Signed-off-by: Lionel Landwerlin Suggested-by: Chris Wilson Fixes: eec688e1420da5 ("drm/i915: Add i915 perf infrastructure") Reviewed-by: Chris Wilson Signed-off-by: Chris Wilson Link: https://patchwork.freedesktop.org/patch/msgid/20190709123351.5645-2-lionel.g.landwerlin@intel.com (cherry picked from commit a5af1df716c123a09341351008fc497bea137b77) Signed-off-by: Jani Nikula commit aa56a292ce623734ddd30f52d73f527d1f3529b5 Author: Chris Wilson Date: Mon Jul 8 15:03:27 2019 +0100 drm/i915/userptr: Acquire the page lock around set_page_dirty() set_page_dirty says: For pages with a mapping this should be done under the page lock for the benefit of asynchronous memory errors who prefer a consistent dirty state. This rule can be broken in some special cases, but should be better not to. Under those rules, it is only safe for us to use the plain set_page_dirty calls for shmemfs/anonymous memory. Userptr may be used with real mappings and so needs to use the locked version (set_page_dirty_lock). Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=203317 Fixes: 5cc9ed4b9a7a ("drm/i915: Introduce mapping of user pages into video memory (userptr) ioctl") References: 6dcc693bc57f ("ext4: warn when page is dirtied without buffers") Signed-off-by: Chris Wilson Cc: Tvrtko Ursulin Cc: stable@vger.kernel.org Reviewed-by: Tvrtko Ursulin Link: https://patchwork.freedesktop.org/patch/msgid/20190708140327.26825-1-chris@chris-wilson.co.uk (cherry picked from commit cb6d7c7dc7ff8cace666ddec66334117a6068ce2) Signed-off-by: Jani Nikula commit 5f4c82c89ff0e11b31561aa7e547acb10bf650c2 Author: Chris Wilson Date: Thu Jul 4 21:16:56 2019 +0100 drm/i915/gtt: Mark the freed page table entries with scratch On unwinding the allocation error path and having freed the page table entry, it is imperative that we mark it as scratch. <4> [416.075569] general protection fault: 0000 [#1] PREEMPT SMP PTI <4> [416.075801] CPU: 0 PID: 2385 Comm: kworker/u2:11 Tainted: G U 5.2.0-rc7-CI-Patchwork_13534+ #1 <4> [416.076162] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.10.1-0-g8891697-prebuilt.qemu-project.org 04/01/2014 <4> [416.076522] Workqueue: i915 __i915_vm_release [i915] <4> [416.076754] RIP: 0010:gen8_ppgtt_cleanup_3lvl+0x58/0xb0 [i915] <4> [416.077023] Code: 81 e2 04 fe ff ff 81 c2 ff 01 00 00 4c 8d 74 d6 58 4d 8b 65 00 4d 3b a7 28 02 00 00 74 40 49 8d 5c 24 50 49 81 c4 50 10 00 00 <48> 8b 2b 49 3b af 20 02 00 00 74 13 4c 89 ff 48 89 ee e8 01 fb ff <4> [416.077445] RSP: 0018:ffffc9000046bd98 EFLAGS: 00010206 <4> [416.077625] RAX: 0001000000000000 RBX: 6b6b6b6b6b6b6bbb RCX: 8b4b56d500000000 <4> [416.077838] RDX: 00000000000001ff RSI: ffff88805a578008 RDI: ffff88805bd0efc8 <4> [416.078167] RBP: ffff88805bd0efc8 R08: 0000000004e42b93 R09: 0000000000000001 <4> [416.078381] R10: 0000000000000000 R11: ffff888077a1b0b8 R12: 6b6b6b6b6b6b7bbb <4> [416.078594] R13: ffff88805a578058 R14: ffff88805a579058 R15: ffff88805bd0efc8 <4> [416.078815] FS: 0000000000000000(0000) GS:ffff88807da00000(0000) knlGS:0000000000000000 <4> [416.079395] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 <4> [416.079851] CR2: 000056160fec2b14 CR3: 0000000071bbc003 CR4: 00000000003606f0 <4> [416.080388] Call Trace: <4> [416.080828] gen8_ppgtt_cleanup+0x64/0x100 [i915] <4> [416.081399] __i915_vm_release+0xfc/0x1d0 [i915] Fixes: 1d1b5490b91c ("drm/i915/gtt: Replace struct_mutex serialisation for allocation") Signed-off-by: Chris Wilson Cc: Matthew Auld Cc: Mika Kuoppala Reviewed-by: Matthew Auld Link: https://patchwork.freedesktop.org/patch/msgid/20190704201656.15775-1-chris@chris-wilson.co.uk (cherry picked from commit e7539b79f703a6b533385088fc15cb5c9ab3f56f) Signed-off-by: Jani Nikula commit f691eaa4801484fffc8a2bcb24caa27fb2edcce3 Author: Chris Wilson Date: Wed Jul 3 18:19:12 2019 +0100 drm/i915/gtt: Defer the free for alloc error paths If we hit an error while allocating the page tables, we have to unwind the incomplete updates, and wish to free the unused pd. However, we are not allowed to be hoding the spinlock at that point, and so must use the later free to defer it until after we drop the lock. <3> [414.363795] BUG: sleeping function called from invalid context at drivers/gpu/drm/i915/i915_gem_gtt.c:472 <3> [414.364167] in_atomic(): 1, irqs_disabled(): 0, pid: 3905, name: i915_selftest <4> [414.364406] 3 locks held by i915_selftest/3905: <4> [414.364408] #0: 0000000034fe8aa8 (&dev->mutex){....}, at: device_driver_attach+0x18/0x50 <4> [414.364415] #1: 000000006bd8a560 (&dev->struct_mutex){+.+.}, at: igt_ctx_exec+0xb7/0x410 [i915] <4> [414.364476] #2: 000000003dfdc766 (&(&pd->lock)->rlock){+.+.}, at: gen8_ppgtt_alloc_pdp+0x448/0x540 [i915] <3> [414.364529] Preemption disabled at: <4> [414.364530] [<0000000000000000>] 0x0 <4> [414.364696] CPU: 0 PID: 3905 Comm: i915_selftest Tainted: G U 5.2.0-rc7-CI-CI_DRM_6403+ #1 <4> [414.364698] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.10.1-0-g8891697-prebuilt.qemu-project.org 04/01/2014 <4> [414.364699] Call Trace: <4> [414.364704] dump_stack+0x67/0x9b <4> [414.364708] ___might_sleep+0x167/0x250 <4> [414.364777] vm_free_page+0x24/0xc0 [i915] <4> [414.364852] free_pd+0xf/0x20 [i915] <4> [414.364897] gen8_ppgtt_alloc_pdp+0x489/0x540 [i915] <4> [414.364946] gen8_ppgtt_alloc_4lvl+0x8e/0x2e0 [i915] <4> [414.364992] ppgtt_bind_vma+0x2e/0x60 [i915] <4> [414.365039] i915_vma_bind+0xe8/0x2c0 [i915] <4> [414.365088] __i915_vma_do_pin+0xa1/0xd20 [i915] Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=111050 Fixes: 1d1b5490b91c ("drm/i915/gtt: Replace struct_mutex serialisation for allocation") Signed-off-by: Chris Wilson Cc: Matthew Auld Cc: Mika Kuoppala Reviewed-by: Mika Kuoppala Link: https://patchwork.freedesktop.org/patch/msgid/20190703171913.16585-3-chris@chris-wilson.co.uk (cherry picked from commit 068610895ebd4bd86f496f01eb7b97e56d7269b2) Signed-off-by: Jani Nikula commit d1b739f326b960631827f0ea350002c5bc8df443 Author: Ville Syrjälä Date: Thu Jun 6 15:42:10 2019 +0300 drm/i915: Deal with machines that expose less than three QGV points When SAGV is forced to disabled/min/med/max in the BIOS pcode will only hand us a single QGV point instead of the normal three. Fix the code to deal with that instead declaring the bandwidth limit to be 0 MB/s (and thus preventing any planes from being enabled). Also shrink the max_bw sturct a bit while at it, and change the deratedbw type to unsigned since the code returns the bw as an unsigned int. Since we now keep track of how many qgv points we got from pcode we can drop the earlier check added for the "pcode doesn't support the memory subsystem query" case. Cc: felix.j.degrood@intel.com Cc: Mark Janes Cc: Matt Roper Cc: Clint Taylor Fixes: c457d9cf256e ("drm/i915: Make sure we have enough memory bandwidth on ICL") Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=110838 Signed-off-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20190606124210.3482-1-ville.syrjala@linux.intel.com Reviewed-by: Matt Roper (cherry picked from commit 56e9371bc3f3e7d6c1a197a45d550b2ce6af25f6) Signed-off-by: Jani Nikula commit fdcc789a4a0bb2ef01857095752be12b03cbb341 Author: Mika Kuoppala Date: Mon Jul 1 13:44:42 2019 +0300 drm/i915: Fix memleak in runtime wakeref tracking If we untrack wakerefs, the actual count may reach zero. However the krealloced owners array is still there and needs to be taken care of. Free the owners unconditionally to fix the leak. Fixes: bd780f37a361 ("drm/i915: Track all held rpm wakerefs") Reported-by: Juha-Pekka Heikkila Cc: Juha-Pekka Heikkila Cc: Chris Wilson Signed-off-by: Mika Kuoppala Reviewed-by: Chris Wilson Signed-off-by: Chris Wilson Link: https://patchwork.freedesktop.org/patch/msgid/20190701104442.9319-1-mika.kuoppala@linux.intel.com (cherry picked from commit c5f846eed2a1856b78e988eeef08215c70598ecd) Signed-off-by: Jani Nikula commit cf8f9aa1eda7d916bd23f6b8c226404deb11690c Author: Lionel Landwerlin Date: Fri Jun 28 15:07:20 2019 +0300 drm/i915/icl: whitelist PS_(DEPTH|INVOCATION)_COUNT The same tests failing on CFL+ platforms are also failing on ICL. Documentation doesn't list the WaAllowPMDepthAndInvocationCountAccessFromUMD workaround for ICL but applying it fixes the same tests as CFL. v2: Use only one whitelist entry (Lionel) Signed-off-by: Lionel Landwerlin Tested-by: Anuj Phogat Cc: stable@vger.kernel.org # 6883eab27481: drm/i915: Support flags in whitlist WAs Cc: stable@vger.kernel.org Acked-by: Chris Wilson Signed-off-by: Chris Wilson Link: https://patchwork.freedesktop.org/patch/msgid/20190628120720.21682-4-lionel.g.landwerlin@intel.com (cherry picked from commit 3fe0107e45ab396342497e06b8924cdd485cde3b) Signed-off-by: Jani Nikula commit 6ce5bfe936ac31d5c52c4b1328d0bfda5f97e7ca Author: Lionel Landwerlin Date: Fri Jun 28 15:07:19 2019 +0300 drm/i915: whitelist PS_(DEPTH|INVOCATION)_COUNT CFL:C0+ changed the status of those registers which are now blacklisted by default. This is breaking a number of CTS tests on GL & Vulkan : KHR-GL45.pipeline_statistics_query_tests_ARB.functional_fragment_shader_invocations (GL) dEQP-VK.query_pool.statistics_query.fragment_shader_invocations.* (Vulkan) v2: Only use one whitelist entry (Lionel) Bspec: 14091 Signed-off-by: Lionel Landwerlin Cc: stable@vger.kernel.org # 6883eab27481: drm/i915: Support flags in whitlist WAs Cc: stable@vger.kernel.org Acked-by: Chris Wilson Signed-off-by: Chris Wilson Link: https://patchwork.freedesktop.org/patch/msgid/20190628120720.21682-3-lionel.g.landwerlin@intel.com (cherry picked from commit 2c903da50f5a9522b134e488bd0f92646c46f3c0) Signed-off-by: Jani Nikula commit c270cac40828eca4fb8d7c27cab1d0ac7765ff3d Author: Lionel Landwerlin Date: Sat Jun 29 14:13:50 2019 +0100 drm/i915: fix whitelist selftests with readonly registers When a register is readonly there is not much we can tell about its value (apart from its default value?). This can be covered by tests exercising the value of the register from userspace. For PS_INVOCATION_COUNT we've got the following piglit tests : KHR-GL45.pipeline_statistics_query_tests_ARB.functional_fragment_shader_invocations Vulkan CTS tests : dEQP-VK.query_pool.statistics_query.fragment_shader_invocations.* v2: Use a local to shrink under 80cols. Signed-off-by: Lionel Landwerlin Fixes: 86554f48e511 ("drm/i915/selftests: Verify whitelist of context registers") Tested-by: Anuj Phogat Signed-off-by: Chris Wilson Reviewed-by: Chris Wilson Link: https://patchwork.freedesktop.org/patch/msgid/20190629131350.31185-1-chris@chris-wilson.co.uk (cherry picked from commit 361b69051326ed0e07553315227678d00d651a9e) Signed-off-by: Jani Nikula commit 705d0abbcc7adf04743d04ea8754acbcdf21c326 Author: Santosh Sivaraj Date: Mon Jul 29 11:25:36 2019 +0530 powerpc/kvm: Fall through switch case explicitly Implicit fallthrough warning was enabled globally which broke the build. Make it explicit with a `fall through` comment. Signed-off-by: Santosh Sivaraj Reviewed-by: Stephen Rothwell Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20190729055536.25591-1-santosh@fossix.org commit 2e9a06dda10aea81a17c623f08534dac6735434a Author: Vince Weaver Date: Thu Jul 25 11:57:43 2019 -0400 perf tools: Fix perf.data documentation units for memory size The perf.data-file-format documentation incorrectly says the HEADER_TOTAL_MEM results are in bytes. The results are in kilobytes (perf reads the value from /proc/meminfo) Signed-off-by: Vince Weaver Cc: Alexander Shishkin Cc: Jiri Olsa Cc: Namhyung Kim Cc: Peter Zijlstra Link: http://lkml.kernel.org/r/alpine.DEB.2.21.1907251155500.22624@macbook-air Signed-off-by: Arnaldo Carvalho de Melo commit 20f9781f491360e7459c589705a2e4b1f136bee9 Author: Numfor Mbiziwo-Tiapo Date: Wed Jul 24 16:44:58 2019 -0700 perf header: Fix use of unitialized value warning When building our local version of perf with MSAN (Memory Sanitizer) and running the perf record command, MSAN throws a use of uninitialized value warning in "tools/perf/util/util.c:333:6". This warning stems from the "buf" variable being passed into "write". It originated as the variable "ev" with the type union perf_event* defined in the "perf_event__synthesize_attr" function in "tools/perf/util/header.c". In the "perf_event__synthesize_attr" function they allocate space with a malloc call using ev, then go on to only assign some of the member variables before passing "ev" on as a parameter to the "process" function therefore "ev" contains uninitialized memory. Changing the malloc call to zalloc to initialize all the members of "ev" which gets rid of the warning. To reproduce this warning, build perf by running: make -C tools/perf CLANG=1 CC=clang EXTRA_CFLAGS="-fsanitize=memory\ -fsanitize-memory-track-origins" (Additionally, llvm might have to be installed and clang might have to be specified as the compiler - export CC=/usr/bin/clang) then running: tools/perf/perf record -o - ls / | tools/perf/perf --no-pager annotate\ -i - --stdio Please see the cover letter for why false positive warnings may be generated. Signed-off-by: Numfor Mbiziwo-Tiapo Cc: Alexander Shishkin Cc: Ian Rogers Cc: Jiri Olsa Cc: Mark Drayton Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Song Liu Cc: Stephane Eranian Link: http://lkml.kernel.org/r/20190724234500.253358-2-nums@google.com Signed-off-by: Arnaldo Carvalho de Melo commit 7622236ceb167aa3857395f9bdaf871442aa467e Author: Vince Weaver Date: Tue Jul 23 11:06:01 2019 -0400 perf header: Fix divide by zero error if f_header.attr_size==0 So I have been having lots of trouble with hand-crafted perf.data files causing segfaults and the like, so I have started fuzzing the perf tool. First issue found: If f_header.attr_size is 0 in the perf.data file, then perf will crash with a divide-by-zero error. Committer note: Added a pr_err() to tell the user why the command failed. Signed-off-by: Vince Weaver Cc: Alexander Shishkin Cc: Jiri Olsa Cc: Namhyung Kim Cc: Peter Zijlstra Link: http://lkml.kernel.org/r/alpine.DEB.2.21.1907231100440.14532@macbook-air Signed-off-by: Arnaldo Carvalho de Melo commit e54599c93dbf487ef80ba2833c5760c22bd20c32 Author: Arnaldo Carvalho de Melo Date: Fri Jul 26 15:44:41 2019 -0300 tools headers UAPI: Sync if_link.h with the kernel To pick the changes in: 07a4ddec3ce9 ("bonding: add an option to specify a delay between peer notifications") And silence this build warning: Kernel ABI header at 'tools/include/uapi/linux/if_link.h' differs from latest version at 'include/uapi/linux/if_link.h' Cc: Adrian Hunter Cc: David S. Miller Cc: Jiri Olsa Cc: Luis Cláudio Gonçalves Cc: Namhyung Kim Cc: Vincent Bernat Link: https://lkml.kernel.org/n/tip-3liw4exxh8goc0rq9xryl2kv@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit c093de6bd3c50d3dd597ff9fa5cf7a30acbb3eb7 Author: Arnaldo Carvalho de Melo Date: Fri Jul 26 15:41:09 2019 -0300 tools headers UAPI: Sync sched.h with the kernel To get the changes in: a509a7cd7974 ("sched/uclamp: Extend sched_setattr() to support utilization clamping") 1d6362fa0cfc ("sched/core: Allow sched_setattr() to use the current policy") 7f192e3cd316 ("fork: add clone3") And silence this perf build warning: Warning: Kernel ABI header at 'tools/include/uapi/linux/sched.h' differs from latest version at 'include/uapi/linux/sched.h' diff -u tools/include/uapi/linux/sched.h include/uapi/linux/sched.h No changes in tools/ due to the above. Cc: Adrian Hunter Cc: Christian Brauner Cc: Jiri Olsa Cc: Luis Cláudio Gonçalves Cc: Namhyung Kim Cc: Patrick Bellasi Link: https://lkml.kernel.org/n/tip-mtrpsjrux5hgyr5uf8l1aa46@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 0f58163c9d5702efbc242d144fd038e54b4c6ad0 Author: Arnaldo Carvalho de Melo Date: Fri Jul 26 15:31:25 2019 -0300 tools headers UAPI: Sync usbdevice_fs.h with the kernels to get new ioctl To get the changes in: 6d101f24f1dd ("USB: add usbfs ioctl to retrieve the connection parameters") And address this perf build warning: Warning: Kernel ABI header at 'tools/include/uapi/linux/usbdevice_fs.h' differs from latest version at 'include/uapi/linux/usbdevice_fs.h' diff -u tools/include/uapi/linux/usbdevice_fs.h include/uapi/linux/usbdevice_fs.h Which ends up autogenerating a ioctl_cmd->string table used by 'perf trace': $ tools/perf/trace/beauty/usbdevfs_ioctl.sh > before $ cp include/uapi/linux/usbdevice_fs.h tools/include/uapi/linux/usbdevice_fs.h $ tools/perf/trace/beauty/usbdevfs_ioctl.sh > after $ diff -u before after --- before 2019-07-26 15:26:55.513636844 -0300 +++ after 2019-07-26 15:29:11.650518677 -0300 @@ -23,6 +23,7 @@ [2] = "BULK", [30] = "DROP_PRIVILEGES", [31] = "GET_SPEED", + [32] = "CONNINFO_EX", [3] = "RESETEP", [4] = "SETINTERFACE", [5] = "SETCONFIGURATION", $ Now 'perf trace' ioctl beautifier will translate this new ioctl to a string and at some point will allow filtering the 'ioctl' syscall with something like this in a system wide strace-like sessin: # perf trace -e ioctl/cmd=USBDEVFS_CONNINFO_EX/ Cc: Adrian Hunter Cc: Dmitry Torokhov Cc: Greg Kroah-Hartman Cc: Jiri Olsa Cc: Luis Cláudio Gonçalves Cc: Namhyung Kim Link: https://lkml.kernel.org/n/tip-tkdfbgzqypwco96b309c0ovd@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 7ee526152db7a75d7b8713346dac76ffc3662b29 Author: Arnaldo Carvalho de Melo Date: Fri Jul 26 15:29:56 2019 -0300 tools perf beauty: Fix usbdevfs_ioctl table generator to handle _IOC() In addition to _IOW() and _IOR(), to handle this case: #define USBDEVFS_CONNINFO_EX(len) _IOC(_IOC_READ, 'U', 32, len) That will happen in the next sync of this header file. Cc: Adrian Hunter Cc: Jiri Olsa Cc: Luis Cláudio Gonçalves Cc: Namhyung Kim Link: https://lkml.kernel.org/n/tip-3br5e4t64e4lp0goo84che3s@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 95dc663aa6382fec92674e748682cefeeb2bfc22 Author: Arnaldo Carvalho de Melo Date: Fri Jul 26 15:00:24 2019 -0300 tools headers UAPI: Update tools's copy of drm.h headers Picking the changes from: c5d3e39caa45 ("drm/i915: Engine discovery query") a88b6e4cbafd ("drm/i915: Allow specification of parallel execbuf") ee1136908e9b ("drm/i915/execlists: Virtual engine bonding") 6d06779e8672 ("drm/i915: Load balancing across a virtual engine") b81dde719439 ("drm/i915: Allow userspace to clone contexts on creation") 8319f44c0525 ("drm/i915: Re-expose SINGLE_TIMELINE flags for context creation") e620f7b3a263 ("drm/i915: Extend I915_CONTEXT_PARAM_SSEU to support local ctx->engine[]") 976b55f0e1db ("drm/i915: Allow a context to define its set of engines") 7f3f317a66ca ("drm/i915: Restore control over ppgtt for context creation ABI") 75b3f1cb50bd ("drm: Fix drm.h uapi header for GNU/kFreeBSD") Silencing these perf build warnings: Warning: Kernel ABI header at 'tools/include/uapi/drm/drm.h' differs from latest version at 'include/uapi/drm/drm.h' diff -u tools/include/uapi/drm/drm.h include/uapi/drm/drm.h Warning: Kernel ABI header at 'tools/include/uapi/drm/i915_drm.h' differs from latest version at 'include/uapi/drm/i915_drm.h' diff -u tools/include/uapi/drm/i915_drm.h include/uapi/drm/i915_drm.h Now 'perf trace' and other code that might use the tools/perf/trace/beauty autogenerated tables will be able to translate this new ioctl code into a string: $ tools/perf/trace/beauty/drm_ioctl.sh > before $ cp include/uapi/drm/i915_drm.h tools/include/uapi/drm/i915_drm.h $ tools/perf/trace/beauty/drm_ioctl.sh > after $ diff -u before after --- before 2019-07-26 13:02:22.052723640 -0300 +++ after 2019-07-26 13:02:35.354906036 -0300 @@ -163,4 +163,6 @@ [DRM_COMMAND_BASE + 0x37] = "I915_PERF_ADD_CONFIG", [DRM_COMMAND_BASE + 0x38] = "I915_PERF_REMOVE_CONFIG", [DRM_COMMAND_BASE + 0x39] = "I915_QUERY", + [DRM_COMMAND_BASE + 0x3a] = "I915_GEM_VM_CREATE", + [DRM_COMMAND_BASE + 0x3b] = "I915_GEM_VM_DESTROY", }; $ Cc: Adrian Hunter Cc: Chris Wilson Cc: Eric Anholt Cc: James Clarke Cc: Jiri Olsa Cc: Luis Cláudio Gonçalves Cc: Namhyung Kim Cc: Tvrtko Ursulin Link: https://lkml.kernel.org/n/tip-a9173whgu3h1vo24jgdg5do8@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit b830f94f7303a49d509d5b1bb34ecb2e648b23c4 Author: Arnaldo Carvalho de Melo Date: Fri Jul 26 12:49:00 2019 -0300 tools headers UAPI: Update tools's copy of mman.h headers To pick up the changes from: 8aa3c927ec10 ("mm/mmap: move common defines to mman-common.h") 22fcea6f85f2 ("mm: move MAP_SYNC to asm-generic/mman-common.h") 0bf5f9492389 ("mm: fix the MAP_UNINITIALIZED flag") To address the following perf build warnings: Warning: Kernel ABI header at 'tools/include/uapi/asm-generic/mman-common.h' differs from latest version at 'include/uapi/asm-generic/mman-common.h' diff -u tools/include/uapi/asm-generic/mman-common.h include/uapi/asm-generic/mman-common.h Warning: Kernel ABI header at 'tools/include/uapi/asm-generic/mman.h' differs from latest version at 'include/uapi/asm-generic/mman.h' diff -u tools/include/uapi/asm-generic/mman.h include/uapi/asm-generic/mman.h That ends up just moving a bit the auto-generated code->string tables: $ tools/perf/trace/beauty/mmap_flags.sh > before $ cp include/uapi/asm-generic/mman.h tools/include/uapi/asm-generic/mman.h $ cp include/uapi/asm-generic/mman-common.h tools/include/uapi/asm-generic/mman-common.h $ tools/perf/trace/beauty/mmap_flags.sh > after $ diff -u before after --- before 2019-07-26 12:45:02.948335904 -0300 +++ after 2019-07-26 12:48:05.342893539 -0300 @@ -4,15 +4,15 @@ [ilog2(0x02) + 1] = "PRIVATE", [ilog2(0x10) + 1] = "FIXED", [ilog2(0x20) + 1] = "ANONYMOUS", + [ilog2(0x008000) + 1] = "POPULATE", + [ilog2(0x010000) + 1] = "NONBLOCK", + [ilog2(0x020000) + 1] = "STACK", + [ilog2(0x040000) + 1] = "HUGETLB", + [ilog2(0x080000) + 1] = "SYNC", [ilog2(0x100000) + 1] = "FIXED_NOREPLACE", [ilog2(0x0100) + 1] = "GROWSDOWN", [ilog2(0x0800) + 1] = "DENYWRITE", [ilog2(0x1000) + 1] = "EXECUTABLE", [ilog2(0x2000) + 1] = "LOCKED", [ilog2(0x4000) + 1] = "NORESERVE", - [ilog2(0x8000) + 1] = "POPULATE", - [ilog2(0x10000) + 1] = "NONBLOCK", - [ilog2(0x20000) + 1] = "STACK", - [ilog2(0x40000) + 1] = "HUGETLB", - [ilog2(0x80000) + 1] = "SYNC", }; $ Cc: Adrian Hunter Cc: Aneesh Kumar K.V Cc: Christoph Hellwig Cc: Jiri Olsa Cc: Luis Cláudio Gonçalves Cc: Namhyung Kim Link: https://lkml.kernel.org/n/tip-fzqvzni9megaurmsp0k4vy27@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 7d3cd66261665da491d0ee582beabe23df60f983 Author: Ville Syrjälä Date: Wed Jun 19 20:08:39 2019 +0300 drm/i915: Fix various tracepoints for gen2 Gen2 doesn't have a frame counter and apparently we no longer provide a fake .get_vblank_counter() hook for it. That means all tracepoints calling that hook will oops. Update the tracepoints to use intel_crtc_get_vblank_counter() which will gracefully fall back to using the software counter. This is actually a better approach since we now get (hopefully accurate) frame numbers in the traces. This also gets rid of the raw driver->get_vblank_counter() calls, which we need to do in order to switch to the per-crtc vblank vfuncs. v2: Deal with new tracepoints v3: Use a distinct variable name for the internal crtc iterator (Chris) Cc: Shawn Guo Cc: Daniel Vetter Fixes: 967dd4841787 ("drm: remove drm_vblank_no_hw_counter assignment from driver code") Signed-off-by: Ville Syrjälä Reviewed-by: Chris Wilson Link: https://patchwork.freedesktop.org/patch/msgid/20190619170842.20579-2-ville.syrjala@linux.intel.com (cherry picked from commit 4c888e7bd26f58deb27c2e6ddc90000b89ee9393) Signed-off-by: Jani Nikula commit 95eef14cdad150fed43147bcd4f29eea3d0a3f03 Author: Lionel Landwerlin Date: Mon Jun 10 11:19:14 2019 +0300 drm/i915/perf: fix ICL perf register offsets We got the wrong offsets (could they have changed?). New values were computed off an error state by looking up the register offset in the context image as written by the HW. Signed-off-by: Lionel Landwerlin Fixes: 1de401c08fa805 ("drm/i915/perf: enable perf support on ICL") Cc: # v4.18+ Acked-by: Kenneth Graunke Link: https://patchwork.freedesktop.org/patch/msgid/20190610081914.25428-1-lionel.g.landwerlin@intel.com (cherry picked from commit 8dcfdfb4501012a8d36d2157dc73925715f2befb) Signed-off-by: Jani Nikula commit 248f883db61283b4f5a1c92a5e27277377b09f16 Author: Kenneth Graunke Date: Tue Jun 25 10:06:55 2019 +0100 drm/i915: Disable SAMPLER_STATE prefetching on all Gen11 steppings. The Demand Prefetch workaround (binding table prefetching) only applies to Icelake A0/B0. But the Sampler Prefetch workaround needs to be applied to all Gen11 steppings, according to a programming note in the SARCHKMD documentation. Using the Intel Gallium driver, I have seen intermittent failures in the dEQP-GLES31.functional.copy_image.non_compressed.* tests. After applying this workaround, the tests reliably pass. v2: Remove the overlap with a pre-production w/a BSpec: 9663 Signed-off-by: Kenneth Graunke Signed-off-by: Chris Wilson Cc: stable@vger.kernel.org Reviewed-by: Mika Kuoppala Link: https://patchwork.freedesktop.org/patch/msgid/20190625090655.19220-1-chris@chris-wilson.co.uk (cherry picked from commit f9a393875d3af13cc3267477746608dadb7f17c1) Signed-off-by: Jani Nikula commit ac65bdfef14a902b40ff69a35f5c604dba096547 Author: Chris Wilson Date: Wed Jun 19 18:01:35 2019 +0100 drm/i915: Keep rings pinned while the context is active Remember to keep the rings pinned as well as the context image until the GPU is no longer active. v2: Introduce a ring->pin_count primarily to hide the mock_ring that doesn't fit into the normal GGTT vma picture. v3: Order is important in teardown, ringbuffer submission needs to drop the pin count on the engine->kernel_context before it can gleefully free its ring. Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=110946 Fixes: ce476c80b8bf ("drm/i915: Keep contexts pinned until after the next kernel context switch") Signed-off-by: Chris Wilson Cc: Mika Kuoppala Cc: Tvrtko Ursulin Reviewed-by: Tvrtko Ursulin Link: https://patchwork.freedesktop.org/patch/msgid/20190619170135.15281-1-chris@chris-wilson.co.uk (cherry picked from commit 09c5ab384f6fb30f834a5777888b4486dd7f015d) Signed-off-by: Jani Nikula commit 9cdde85804833af77c6afbf7c53f0d959c42eb9f Author: Hyungwoo Yang Date: Wed May 29 21:03:54 2019 -0700 platform/chrome: cros_ec_ishtp: fix crash during suspend Kernel crashes during suspend due to wrong conversion in suspend and resume functions. Use the proper helper to get ishtp_cl_device instance. Cc: # 5.2.x: b12bbdc5: HID: intel-ish-hid: fix wrong driver_data usage Signed-off-by: Hyungwoo Yang Signed-off-by: Enric Balletbo i Serra commit eca92a53a6ab9f27f1b61dcb3e16ebef75f0d5bb Author: Anders Roxell Date: Fri Jul 26 13:27:21 2019 +0200 arm64: module: Mark expected switch fall-through When fall-through warnings was enabled by default the following warnings was starting to show up: ../arch/arm64/kernel/module.c: In function ‘apply_relocate_add’: ../arch/arm64/kernel/module.c:316:19: warning: this statement may fall through [-Wimplicit-fallthrough=] overflow_check = false; ~~~~~~~~~~~~~~~^~~~~~~ ../arch/arm64/kernel/module.c:317:3: note: here case R_AARCH64_MOVW_UABS_G0: ^~~~ ../arch/arm64/kernel/module.c:322:19: warning: this statement may fall through [-Wimplicit-fallthrough=] overflow_check = false; ~~~~~~~~~~~~~~~^~~~~~~ ../arch/arm64/kernel/module.c:323:3: note: here case R_AARCH64_MOVW_UABS_G1: ^~~~ Rework so that the compiler doesn't warn about fall-through. Fixes: d93512ef0f0e ("Makefile: Globally enable fall-through warning") Signed-off-by: Anders Roxell Signed-off-by: Will Deacon commit 6655473920129eb2dd1dded147722316294a699a Author: Anders Roxell Date: Fri Jul 26 13:27:25 2019 +0200 arm64: smp: Mark expected switch fall-through When fall-through warnings was enabled by default the following warning was starting to show up: In file included from ../include/linux/kernel.h:15, from ../include/linux/list.h:9, from ../include/linux/kobject.h:19, from ../include/linux/of.h:17, from ../include/linux/irqdomain.h:35, from ../include/linux/acpi.h:13, from ../arch/arm64/kernel/smp.c:9: ../arch/arm64/kernel/smp.c: In function ‘__cpu_up’: ../include/linux/printk.h:302:2: warning: this statement may fall through [-Wimplicit-fallthrough=] printk(KERN_CRIT pr_fmt(fmt), ##__VA_ARGS__) ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ../arch/arm64/kernel/smp.c:156:4: note: in expansion of macro ‘pr_crit’ pr_crit("CPU%u: may not have shut down cleanly\n", cpu); ^~~~~~~ ../arch/arm64/kernel/smp.c:157:3: note: here case CPU_STUCK_IN_KERNEL: ^~~~ Rework so that the compiler doesn't warn about fall-through. Fixes: d93512ef0f0e ("Makefile: Globally enable fall-through warning") Signed-off-by: Anders Roxell Signed-off-by: Will Deacon commit 75a382f1c9e5092db10ad1e2111633d61b65e578 Author: Will Deacon Date: Mon Jul 29 11:39:45 2019 +0100 arm64: hw_breakpoint: Fix warnings about implicit fallthrough Now that -Wimplicit-fallthrough is passed to GCC by default, the kernel build has suddenly got noisy. Annotate the two fall-through cases in our hw_breakpoint implementation, since they are both intentional. Reported-by: Anders Roxell Signed-off-by: Will Deacon commit 0d7fd70f26039bd4b33444ca47f0e69ce3ae0354 Author: Will Deacon Date: Mon Jul 29 11:43:48 2019 +0100 drivers/perf: arm_pmu: Fix failure path in PM notifier Handling of the CPU_PM_ENTER_FAILED transition in the Arm PMU PM notifier code incorrectly skips restoration of the counters. Fix the logic so that CPU_PM_ENTER_FAILED follows the same path as CPU_PM_EXIT. Cc: Fixes: da4e4f18afe0f372 ("drivers/perf: arm_pmu: implement CPU_PM notifier") Reported-by: Anders Roxell Acked-by: Lorenzo Pieralisi Signed-off-by: Will Deacon commit 849adec41203ac5837c40c2d7e08490ffdef3c2c Author: Will Deacon Date: Mon Jul 29 11:06:17 2019 +0100 arm64: compat: Allow single-byte watchpoints on all addresses Commit d968d2b801d8 ("ARM: 7497/1: hw_breakpoint: allow single-byte watchpoints on all addresses") changed the validation requirements for hardware watchpoints on arch/arm/. Update our compat layer to implement the same relaxation. Cc: Signed-off-by: Will Deacon commit cdb2d3ee0436d74fa9092f2df46aaa6f9e03c969 Author: Anders Roxell Date: Fri Jul 26 13:27:10 2019 +0200 arm64: KVM: hyp: debug-sr: Mark expected switch fall-through When fall-through warnings was enabled by default the following warnings was starting to show up: ../arch/arm64/kvm/hyp/debug-sr.c: In function ‘__debug_save_state’: ../arch/arm64/kvm/hyp/debug-sr.c:20:19: warning: this statement may fall through [-Wimplicit-fallthrough=] case 15: ptr[15] = read_debug(reg, 15); \ ../arch/arm64/kvm/hyp/debug-sr.c:113:2: note: in expansion of macro ‘save_debug’ save_debug(dbg->dbg_bcr, dbgbcr, brps); ^~~~~~~~~~ ../arch/arm64/kvm/hyp/debug-sr.c:21:2: note: here case 14: ptr[14] = read_debug(reg, 14); \ ^~~~ ../arch/arm64/kvm/hyp/debug-sr.c:113:2: note: in expansion of macro ‘save_debug’ save_debug(dbg->dbg_bcr, dbgbcr, brps); ^~~~~~~~~~ ../arch/arm64/kvm/hyp/debug-sr.c:21:19: warning: this statement may fall through [-Wimplicit-fallthrough=] case 14: ptr[14] = read_debug(reg, 14); \ ../arch/arm64/kvm/hyp/debug-sr.c:113:2: note: in expansion of macro ‘save_debug’ save_debug(dbg->dbg_bcr, dbgbcr, brps); ^~~~~~~~~~ ../arch/arm64/kvm/hyp/debug-sr.c:22:2: note: here case 13: ptr[13] = read_debug(reg, 13); \ ^~~~ ../arch/arm64/kvm/hyp/debug-sr.c:113:2: note: in expansion of macro ‘save_debug’ save_debug(dbg->dbg_bcr, dbgbcr, brps); ^~~~~~~~~~ Rework to add a 'Fall through' comment where the compiler warned about fall-through, hence silencing the warning. Fixes: d93512ef0f0e ("Makefile: Globally enable fall-through warning") Signed-off-by: Anders Roxell [maz: fixed commit message] Signed-off-by: Marc Zyngier commit 2aa4e410795cb94b6577fe0e251b5f5226499310 Author: Ben Segal Date: Thu Jul 18 12:27:00 2019 +0000 habanalabs: fix host memory polling in BE architecture This patch fix a bug in the host memory polling macro. The bug is that the memory being polled can be written by the device, which always writes it in LE. However, if the host is running Linux in BE mode, we need to convert the value that was written by the device before matching it to the required value that the caller has given to the macro. Signed-off-by: Ben Segal Reviewed-by: Oded Gabbay Signed-off-by: Oded Gabbay commit 75035fe22b808a520e1d712ebe913684ba406e01 Author: Ben Segal Date: Tue Jul 23 11:22:42 2019 +0300 habanalabs: fix F/W download in BE architecture writeX macros might perform byte-swapping in BE architectures. As our F/W is in LE format, we need to make sure no byte-swapping will occur. There is a standard kernel function (called memcpy_toio) for copying data to I/O area which is used in a lot of drivers to download F/W to PCIe adapters. That function also makes sure the data is copied "as-is", without byte-swapping. This patch use that function to copy the F/W to the GOYA ASIC instead of writeX macros. Signed-off-by: Ben Segal Reviewed-by: Oded Gabbay Signed-off-by: Oded Gabbay commit f46cc0152501e46d1b3aa5e7eade61145070eab0 Author: Nicolin Chen Date: Fri Jul 26 12:34:33 2019 -0700 dma-contiguous: page-align the size in dma_free_contiguous() According to the original dma_direct_alloc_pages() code: { unsigned int count = PAGE_ALIGN(size) >> PAGE_SHIFT; if (!dma_release_from_contiguous(dev, page, count)) __free_pages(page, get_order(size)); } The count parameter for dma_release_from_contiguous() was page aligned before the right-shifting operation, while the new API dma_free_contiguous() forgets to have PAGE_ALIGN() at the size. So this patch simply adds it to prevent any corner case. Fixes: fdaeec198ada ("dma-contiguous: add dma_{alloc,free}_contiguous() helpers") Signed-off-by: Nicolin Chen Reviewed-by: Christoph Hellwig Signed-off-by: Christoph Hellwig commit c6622a425acd1d2f3a443cd39b490a8777b622d7 Author: Nicolin Chen Date: Fri Jul 26 12:34:32 2019 -0700 dma-contiguous: do not overwrite align in dma_alloc_contiguous() The dma_alloc_contiguous() limits align at CONFIG_CMA_ALIGNMENT for cma_alloc() however it does not restore it for the fallback routine. This will result in a size mismatch between the allocation and free when running into the fallback routines after cma_alloc() fails, if the align is larger than CONFIG_CMA_ALIGNMENT. This patch adds a cma_align to take care of cma_alloc() and prevent the align from being overwritten. Fixes: fdaeec198ada ("dma-contiguous: add dma_{alloc,free}_contiguous() helpers") Reported-by: Dafna Hirschfeld Signed-off-by: Nicolin Chen Signed-off-by: Christoph Hellwig commit 38fb6d0ea34299d97b031ed64fe994158b6f8eb3 Author: Icenowy Zheng Date: Thu Jul 25 11:08:52 2019 +0800 f2fs: use EINVAL for superblock with invalid magic The kernel mount_block_root() function expects -EACESS or -EINVAL for a unmountable filesystem when trying to mount the root with different filesystem types. However, in 5.3-rc1 the behavior when F2FS code cannot find valid block changed to return -EFSCORRUPTED(-EUCLEAN), and this error code makes mount_block_root() fail when trying to probe F2FS. When the magic number of the superblock mismatches, it has a high probability that it's just not a F2FS. In this case return -EINVAL seems to be a better result, and this return value can make mount_block_root() probing work again. Return -EINVAL when the superblock has magic mismatch, -EFSCORRUPTED in other cases (the magic matches but the superblock cannot be recognized). Fixes: 10f966bbf521 ("f2fs: use generic EFSBADCRC/EFSCORRUPTED") Signed-off-by: Icenowy Zheng Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 2e616d9f9ce8d469db4cd0a019cdc2ff3feab577 Author: Darrick J. Wong Date: Sun Jul 28 21:12:32 2019 -0700 xfs: fix stack contents leakage in the v1 inumber ioctls Explicitly initialize the onstack structures to zero so we don't leak kernel memory into userspace when converting the in-core inumbers structure to the v1 inogrp ioctl structure. Add a comment about why we have to use memset to ensure that the padding holes in the structures are set to zero. Fixes: 5f19c7fc6873351 ("xfs: introduce v5 inode group structure") Reported-by: Dan Carpenter Signed-off-by: Darrick J. Wong Reviewed-by: Eric Sandeen commit 622445541b751ce70a952b8486ce4512a792c0a2 Author: Masahiro Yamada Date: Thu Jul 25 17:05:13 2019 +0900 kbuild: detect missing "WITH Linux-syscall-note" for uapi headers UAPI headers licensed under GPL are supposed to have exception "WITH Linux-syscall-note" so that they can be included into non-GPL user space application code. Unfortunately, people often miss to add it. Break 'make headers' when any of exported headers lacks the exception note so that the 0-day bot can easily catch it. Signed-off-by: Masahiro Yamada commit cee3536d24a1d5db66b9f68c3ece0af128187ab4 Author: Michael Ellerman Date: Mon Jul 22 22:26:56 2019 +1000 powerpc: Wire up clone3 syscall Wire up the new clone3 syscall added in commit 7f192e3cd316 ("fork: add clone3"). This requires a ppc_clone3 wrapper, in order to save the non-volatile GPRs before calling into the generic syscall code. Otherwise we hit the BUG_ON in CHECK_FULL_REGS in copy_thread(). Lightly tested using Christian's test code on a Power8 LE VM. Signed-off-by: Michael Ellerman Acked-by: Christian Brauner Link: https://lore.kernel.org/r/20190724140259.23554-1-mpe@ellerman.id.au commit d95da993383c78f7efd25957ba3af23af4b1c613 Author: Chris Packham Date: Mon Jul 8 08:35:58 2019 +1200 gpiolib: Preserve desc->flags when setting state desc->flags may already have values set by of_gpiochip_add() so make sure that this isn't undone when setting the initial direction. Cc: stable@vger.kernel.org Fixes: 3edfb7bd76bd1cba ("gpiolib: Show correct direction from the beginning") Signed-off-by: Chris Packham Link: https://lore.kernel.org/r/20190707203558.10993-1-chris.packham@alliedtelesis.co.nz Signed-off-by: Linus Walleij commit 674fa8daa8c922c42a84b6aa85bf5ddc616accf5 Author: Andrew Jeffery Date: Wed Jul 24 17:31:55 2019 +0930 pinctrl: aspeed-g5: Delay acquisition of regmaps While sorting out some devicetree issues I found that the pinctrl driver was failing to acquire its GFX regmap even though the phandle was present in the devicetree: [ 0.124190] aspeed-g5-pinctrl 1e6e2000.syscon:pinctrl: No GFX phandle found, some mux configurations may fail Without access to the GFX regmap we fail to configure the mux for the VPO function: [ 1.548866] pinctrl core: add 1 pinctrl maps [ 1.549826] aspeed-g5-pinctrl 1e6e2000.syscon:pinctrl: found group selector 164 for VPO [ 1.550638] aspeed-g5-pinctrl 1e6e2000.syscon:pinctrl: request pin 144 (V20) for 1e6e6000.display [ 1.551346] aspeed-g5-pinctrl 1e6e2000.syscon:pinctrl: request pin 145 (U19) for 1e6e6000.display ... [ 1.562057] aspeed-g5-pinctrl 1e6e2000.syscon:pinctrl: request pin 218 (T22) for 1e6e6000.display [ 1.562541] aspeed-g5-pinctrl 1e6e2000.syscon:pinctrl: request pin 219 (R20) for 1e6e6000.display [ 1.563113] Muxing pin 144 for VPO [ 1.563456] Want SCU8C[0x00000001]=0x1, got 0x0 from 0x00000000 [ 1.564624] aspeed_gfx 1e6e6000.display: Error applying setting, reverse things back This turned out to be a simple problem of timing: The ASPEED pinctrl driver is probed during arch_initcall(), while GFX is processed much later. As such the GFX syscon is not yet registered during the pinctrl probe() and we get an -EPROBE_DEFER when we try to look it up, however we must not defer probing the pinctrl driver for the inability to mux some GFX-related functions. Switch to lazily grabbing the regmaps when they're first required by the mux configuration. This generates a bit of noise in the patch as we have to drop the `const` qualifier on arguments for several function prototypes, but has the benefit of working. I've smoke tested this for the ast2500-evb under qemu with a dummy graphics device. We now succeed in our attempts to configure the SoC's VPO pinmux function. Fixes: 7d29ed88acbb ("pinctrl: aspeed: Read and write bits in LPC and GFX controllers") Signed-off-by: Andrew Jeffery Link: https://lore.kernel.org/r/20190724080155.12209-1-andrew@aj.id.au Signed-off-by: Linus Walleij commit 238644ce4b50a16f1c028d2b92ab2947f61d322e Merge: 5f9e832c1370 ffe0bbabb0cf Author: Linus Walleij Date: Sun Jul 28 23:04:19 2019 +0200 Merge tag 'gpio-v5.3-rc3-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux into fixes gpio fixes for v5.3-rc3 - fix for user space handling of active-low flag for GPIO events - fix the stubs for gpiolib: don't WARN() on NULL gpio descriptors if gpiolib is not compiled commit 7a30bdd99f37352b188575b27924c407c6ddff9e Merge: f36cf386e3fe 609488bc979f Author: Thomas Gleixner Date: Sun Jul 28 22:22:40 2019 +0200 Merge branch master from git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git Pick up the spectre documentation so the Grand Schemozzle can be added. commit 609488bc979f99f805f34e9a32c1e3b71179d10b Author: Linus Torvalds Date: Sun Jul 28 12:47:02 2019 -0700 Linux 5.3-rc2 commit f36cf386e3fec258a341d446915862eded3e13d8 Author: Thomas Gleixner Date: Wed Jul 17 21:18:59 2019 +0200 x86/speculation/swapgs: Exclude ATOMs from speculation through SWAPGS Intel provided the following information: On all current Atom processors, instructions that use a segment register value (e.g. a load or store) will not speculatively execute before the last writer of that segment retires. Thus they will not use a speculatively written segment value. That means on ATOMs there is no speculation through SWAPGS, so the SWAPGS entry paths can be excluded from the extra LFENCE if PTI is disabled. Create a separate bug flag for the through SWAPGS speculation and mark all out-of-order ATOMs and AMD/HYGON CPUs as not affected. The in-order ATOMs are excluded from the whole mitigation mess anyway. Reported-by: Andrew Cooper Signed-off-by: Thomas Gleixner Reviewed-by: Tyler Hicks Reviewed-by: Josh Poimboeuf commit c622fc5f54cb0c7ea2e6fedba27ba533b97657d8 Merge: 8e61ea11c23b 173e6ee21e2b Author: Linus Torvalds Date: Sun Jul 28 12:33:15 2019 -0700 Merge tag 'meminit-v5.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux Pull structleak fix from Kees Cook: "Disable gcc-based stack variable auto-init under KASAN (Arnd Bergmann). This fixes a bunch of build warnings under KASAN and the gcc-plugin-based stack auto-initialization features (which are arguably redundant, so better to let KASAN control this)" * tag 'meminit-v5.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux: structleak: disable STRUCTLEAK_BYREF in combination with KASAN_STACK commit 8e61ea11c23b108c8ce062f791dfa737896da346 Merge: 04ce9318898b b25e8a23d4ea Author: Linus Torvalds Date: Sun Jul 28 10:35:04 2019 -0700 Merge tag 'kbuild-fixes-v5.3' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild Pull Kbuild fixes from Masahiro Yamada: - add compile_commands.json to .gitignore - fix false-positive warning from gen_compile_commands.py after allnoconfig build - remove unused code * tag 'kbuild-fixes-v5.3' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild: kbuild: remove unused single-used-m gen_compile_commands: lower the entry count threshold .gitignore: Add compilation database file kbuild: remove unused objectify macro commit 04ce9318898b294001459b5d705795085a9eac64 Merge: 572782b213b2 d4fddac5a51c Author: Linus Torvalds Date: Sun Jul 28 10:26:10 2019 -0700 Merge tag 'char-misc-5.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc Pull char/misc driver fixes from Greg KH: "Here are some small char and misc driver fixes for 5.3-rc2 to resolve some reported issues. Nothing major at all, some binder bugfixes for issues found, some new mei device ids, firmware building warning fixes, habanalabs fixes, a few other build fixes, and a MAINTAINERS update. All of these have been in linux-next with no reported issues" * tag 'char-misc-5.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: test_firmware: fix a memory leak bug hpet: Fix division by zero in hpet_time_div() eeprom: make older eeprom drivers select NVMEM_SYSFS vmw_balloon: Remove Julien from the maintainers list fpga-manager: altera-ps-spi: Fix build error mei: me: add mule creek canyon (EHL) device ids binder: prevent transactions to context manager from its own process. binder: Set end of SG buffer area properly. firmware: Fix missing inline firmware: fix build errors in paged buffer handling code habanalabs: don't reset device when getting VRHOT habanalabs: use %pad for printing a dma_addr_t commit 572782b213b284e05cbbe941a18df055d8d1d898 Merge: ad28fd1cb2bd 61d51456f357 Author: Linus Torvalds Date: Sun Jul 28 10:18:33 2019 -0700 Merge tag 'tty-5.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty Pull tty fixes from Greg KH: "Here are two tty/vt fixes: - delete the netx-serial driver as the arch has been removed, no need to keep the serial driver for it around either. - vt console_lock fix to resolve a reported noisy warning at runtime Both of these have been in linux-next with no reported issues" * tag 'tty-5.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty: vt: Grab console_lock around con_is_bound in show_bind tty: serial: netx: Delete driver commit ad28fd1cb2bd7d67f9240f596ea4740c95545fdf Merge: 29af915cabd4 0ce38c5f929c Author: Linus Torvalds Date: Sun Jul 28 10:00:06 2019 -0700 Merge tag 'spdx-5.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/spdx Pull SPDX fixes from Greg KH: "Here are some small SPDX fixes for 5.3-rc2 for things that came in during the 5.3-rc1 merge window that we previously missed. Only three small patches here: - two uapi patches to resolve some SPDX tags that were not correct - fix an invalid SPDX tag in the iomap Makefile file All have been properly reviewed on the public mailing lists" * tag 'spdx-5.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/spdx: iomap: fix Invalid License ID treewide: remove SPDX "WITH Linux-syscall-note" from kernel-space headers again treewide: add "WITH Linux-syscall-note" to SPDX tag of uapi headers commit 29af915cabd4d51a2306008f84ee447f3a0d4e8f Merge: 5bb575bcc6d1 d39b5bad8658 Author: Linus Torvalds Date: Sun Jul 28 09:52:35 2019 -0700 Merge tag 'usb-5.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb Pull USB fixes from Greg KH: "Here are some small fixes for 5.3-rc2. All of these resolve some reported issues, some more than others :) Included in here is: - xhci fix for an annoying issue with odd devices - reversion of some usb251xb patches that should not have been merged - usb pci quirk additions and fixups - usb storage fix - usb host controller error test fix All of these have been in linux-next with no reported issues" * tag 'usb-5.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: xhci: Fix crash if scatter gather is used with Immediate Data Transfer (IDT). usb: usb251xb: Reallow swap-dx-lanes to apply to the upstream port Revert "usb: usb251xb: Add US port lanes inversion property" Revert "usb: usb251xb: Add US lanes inversion dts-bindings" usb: wusbcore: fix unbalanced get/put cluster_id usb/hcd: Fix a NULL vs IS_ERR() bug in usb_hcd_setup_local_mem() usb-storage: Add a limitation for blk_queue_max_hw_sectors() usb: pci-quirks: Minor cleanup for AMD PLL quirk usb: pci-quirks: Correct AMD PLL quirk detection commit 25e5ef302c24a6fead369c0cfe88c073d7b97ca8 Author: Jean Delvare Date: Sun Jul 28 18:41:38 2019 +0200 eeprom: at24: make spd world-readable again The integration of the at24 driver into the nvmem framework broke the world-readability of spd EEPROMs. Fix it. Signed-off-by: Jean Delvare Cc: stable@vger.kernel.org Fixes: 57d155506dd5 ("eeprom: at24: extend driver to plug into the NVMEM framework") Cc: Andrew Lunn Cc: Srinivas Kandagatla Cc: Greg Kroah-Hartman Cc: Bartosz Golaszewski Cc: Arnd Bergmann Signed-off-by: Bartosz Golaszewski commit 5bb575bcc6d1564340f969c5aa2bff8a500b239f Merge: a9815a4fa2fd 7bd9d465140a Author: Linus Torvalds Date: Sun Jul 28 09:38:55 2019 -0700 Merge tag 'armsoc-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc Pull ARM SoC fixes from Olof Johansson: "Here's the first batch of fixes for this release cycle. Main diffstat here is the re-deletion of netx. I messed up and most likely didn't remove the files from the index when I test-merged this and saw conflicts, and from there on out 'git rerere' remembered the mistake and I missed checking it. Here it's done again as expected. Besides that: - A defconfig refresh + enabling of new drivers for u8500 - i.MX fixlets for i2c/SAI/pinmux - sleep.S build fix for Davinci - Broadcom devicetree build/warning fix" * tag 'armsoc-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: ARM: defconfig: u8500: Add new drivers ARM: defconfig: u8500: Refresh defconfig ARM: dts: bcm: bcm47094: add missing #cells for mdio-bus-mux ARM: davinci: fix sleep.S build error on ARMv4 arm64: dts: imx8mq: fix SAI compatible arm64: dts: imx8mm: Correct SAI3 RXC/TXFS pin's mux option #1 ARM: dts: imx6ul: fix clock frequency property name of I2C buses ARM: Delete netx a second time ARM: dts: imx7ulp: Fix usb-phy unit address format commit ffe0bbabb0cffceceae07484fde1ec2a63b1537c Author: Bartosz Golaszewski Date: Mon Jul 8 10:23:43 2019 +0200 gpio: don't WARN() on NULL descs if gpiolib is disabled If gpiolib is disabled, we use the inline stubs from gpio/consumer.h instead of regular definitions of GPIO API. The stubs for 'optional' variants of gpiod_get routines return NULL in this case as if the relevant GPIO wasn't found. This is correct so far. Calling other (non-gpio_get) stubs from this header triggers a warning because the GPIO descriptor couldn't have been requested. The warning however is unconditional (WARN_ON(1)) and is emitted even if the passed descriptor pointer is NULL. We don't want to force the users of 'optional' gpio_get to check the returned pointer before calling e.g. gpiod_set_value() so let's only WARN on non-NULL descriptors. Cc: stable@vger.kernel.org Reported-by: Claus H. Stovgaard Signed-off-by: Bartosz Golaszewski commit 09f6109ff4f8003af3370dfee0f73fcf6d20087a Merge: 8f9e86ee7959 90c6260c1905 Author: Greg Kroah-Hartman Date: Sun Jul 28 11:07:26 2019 +0200 Merge tag 'iio-fixes-for-5.3a' of git://git.kernel.org/pub/scm/linux/kernel/git/jic23/iio into staging-linus Jonathan writes: First set of IIO fixes in the 5.3 cycle. * cros_ec_accel_legacy - Fix a false double entry for channel scale as both per channel and shared. * gyro_adc - Fix uninitialized return code that got detected by GCC 9.0 having be previously missed. * ingenic_adc - Set the clock divider on probe to avoid an issue seen with false button press detections on JZ4725B SoCs. * max9611 - Backwards parameters in GENMASK. * mpu6050 - Enforce the fact only certain scan modes are actually possible. One counter fix also picked up for William, * generic-counter.rst - Fix some references. * tag 'iio-fixes-for-5.3a' of git://git.kernel.org/pub/scm/linux/kernel/git/jic23/iio: iio: adc: gyroadc: fix uninitialized return code docs: generic-counter.rst: fix broken references for ABI file iio: imu: mpu6050: add missing available scan masks iio: cros_ec_accel_legacy: Fix incorrect channel setting IIO: Ingenic JZ47xx: Set clock divider on probe iio: adc: max9611: Fix misuse of GENMASK macro commit a9815a4fa2fd297cab9fa7a12161b16657290293 Merge: e24ce84e85ab 517c3ba00916 Author: Linus Torvalds Date: Sat Jul 27 21:46:43 2019 -0700 Merge branch 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 fixes from Thomas Gleixner: "A set of x86 fixes and functional updates: - Prevent stale huge I/O TLB mappings on 32bit. A long standing bug which got exposed by KPTI support for 32bit - Prevent bogus access_ok() warnings in arch_stack_walk_user() - Add display quirks for Lenovo devices which have height and width swapped - Add the missing CR2 fixup for 32 bit async pagefaults. Fallout of the CR2 bug fix series. - Unbreak handling of force enabled HPET by moving the 'is HPET counting' check back to the original place. - A more accurate check for running on a hypervisor platform in the MDS mitigation code. Not perfect, but more accurate than the previous one. - Update a stale and confusing comment vs. IRQ stacks" * 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/speculation/mds: Apply more accurate check on hypervisor platform x86/hpet: Undo the early counter is counting check x86/entry/32: Pass cr2 to do_async_page_fault() x86/irq/64: Update stale comment x86/sysfb_efi: Add quirks for some devices with swapped width and height x86/stacktrace: Prevent access_ok() warnings in arch_stack_walk_user() mm/vmalloc: Sync unmappings in __purge_vmap_area_lazy() x86/mm: Sync also unmappings in vmalloc_sync_all() x86/mm: Check for pfn instead of page in vmalloc_sync_one() commit e24ce84e85abe50811f33caecbf104b7d9dffb03 Merge: 750991f9af5b cb361d8cdef6 Author: Linus Torvalds Date: Sat Jul 27 21:22:33 2019 -0700 Merge branch 'sched-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull scheduler fixes from Thomas Gleixner: "Two fixes for the fair scheduling class: - Prevent freeing memory which is accessible by concurrent readers - Make the RCU annotations for numa groups consistent" * 'sched-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: sched/fair: Use RCU accessors consistently for ->numa_group sched/fair: Don't free p->numa_faults with concurrent readers commit 750991f9af5b4019fd0232c23a4815682ff91021 Merge: 431f288ed730 289a2d22b5b6 Author: Linus Torvalds Date: Sat Jul 27 21:17:56 2019 -0700 Merge branch 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull perf fixes from Thomas Gleixner: "A pile of perf related fixes: Kernel: - Fix SLOTS PEBS event constraints for Icelake CPUs - Add the missing mask bit to allow counting hardware generated prefetches on L3 for Icelake CPUs - Make the test for hypervisor platforms more accurate (as far as possible) - Handle PMUs correctly which override event->cpu - Yet another missing fallthrough annotation Tools: perf.data: - Fix loading of compressed data split across adjacent records - Fix buffer size setting for processing CPU topology perf.data header. perf stat: - Fix segfault for event group in repeat mode - Always separate "stalled cycles per insn" line, it was being appended to the "instructions" line. perf script: - Fix --max-blocks man page description. - Improve man page description of metrics. - Fix off by one in brstackinsn IPC computation. perf probe: - Avoid calling freeing routine multiple times for same pointer. perf build: - Do not use -Wshadow on gcc < 4.8, avoiding too strict warnings treated as errors, breaking the build" * 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: perf/x86/intel: Mark expected switch fall-throughs perf/core: Fix creating kernel counters for PMUs that override event->cpu perf/x86: Apply more accurate check on hypervisor platform perf/x86/intel: Fix invalid Bit 13 for Icelake MSR_OFFCORE_RSP_x register perf/x86/intel: Fix SLOTS PEBS event constraint perf build: Do not use -Wshadow on gcc < 4.8 perf probe: Avoid calling freeing routine multiple times for same pointer perf probe: Set pev->nargs to zero after freeing pev->args entries perf session: Fix loading of compressed data split across adjacent records perf stat: Always separate stalled cycles per insn perf stat: Fix segfault for event group in repeat mode perf tools: Fix proper buffer size for feature processing perf script: Fix off by one in brstackinsn IPC computation perf script: Improve man page description of metrics perf script: Fix --max-blocks man page description commit 431f288ed730abfaca5cb73f7e0a2d04459aa65c Merge: 13fbe991b5b1 6c11c6e3d5e9 Author: Linus Torvalds Date: Sat Jul 27 21:10:26 2019 -0700 Merge branch 'locking-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull locking fixes from Thomas Gleixner: "A set of locking fixes: - Address the fallout of the rwsem rework. Missing ACQUIREs and a sanity check to prevent a use-after-free - Add missing checks for unitialized mutexes when mutex debugging is enabled. - Remove the bogus code in the generic SMP variant of arch_futex_atomic_op_inuser() - Fixup the #ifdeffery in lockdep to prevent compile warnings" * 'locking-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: locking/mutex: Test for initialized mutex locking/lockdep: Clean up #ifdef checks locking/lockdep: Hide unused 'class' variable locking/rwsem: Add ACQUIRE comments tty/ldsem, locking/rwsem: Add missing ACQUIRE to read_failed sleep loop lcoking/rwsem: Add missing ACQUIRE to read_slowpath sleep loop locking/rwsem: Add missing ACQUIRE to read_slowpath exit when queue is empty locking/rwsem: Don't call owner_on_cpu() on read-owner futex: Cleanup generic SMP variant of arch_futex_atomic_op_inuser() commit 13fbe991b5b1bbb52ede39be11d5c196721349bf Merge: 88c508344245 882a0db9d143 Author: Linus Torvalds Date: Sat Jul 27 20:49:43 2019 -0700 Merge branch 'core-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull objtool fix from Thomas Gleixner: "A single robustness fix for objtool to handle unbalanced CLAC invocations under all circumstances" * 'core-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: objtool: Improve UACCESS coverage commit 003bd5b4a7b4a94b501e3a1e2e7c9df6b2a94ed4 Author: Heiner Kallweit Date: Sat Jul 27 12:43:31 2019 +0200 r8169: don't use MSI before RTL8168d It was reported that after resuming from suspend network fails with error "do_IRQ: 3.38 No irq handler for vector", see [0]. Enabling WoL can work around the issue, but the only actual fix is to disable MSI. So let's mimic the behavior of the vendor driver and disable MSI on all chip versions before RTL8168d. [0] https://bugzilla.kernel.org/show_bug.cgi?id=204079 Fixes: 6c6aa15fdea5 ("r8169: improve interrupt handling") Reported-by: Dušan Dragić Tested-by: Dušan Dragić Signed-off-by: Heiner Kallweit Signed-off-by: David S. Miller commit 66058b1ca5651c7671bf2ba27fcf6907fb20bd0b Author: Heiner Kallweit Date: Sat Jul 27 12:32:28 2019 +0200 Revert ("r8169: remove 1000/Half from supported modes") This reverts commit a6851c613fd7fccc5d1f28d5d8a0cbe9b0f4e8cc. It was reported that RTL8111b successfully finishes 1000/Full autoneg but no data flows. Reverting the original patch fixes the issue. It seems to be a HW issue with the integrated RTL8211B PHY. This PHY version used also e.g. on RTL8168d, so better revert the original patch. Reported-by: Bernhard Held Signed-off-by: Heiner Kallweit Signed-off-by: David S. Miller commit 8aace4f3eba2a3ceb431e18683ea0e1ecbade5cd Author: René van Dorst Date: Sat Jul 27 11:40:11 2019 +0200 net: phylink: Fix flow control for fixed-link In phylink_parse_fixedlink() the pl->link_config.advertising bits are AND with pl->supported, pl->supported is zeroed and only the speed/duplex modes and MII bits are set. So pl->link_config.advertising always loses the flow control/pause bits. By setting Pause and Asym_Pause bits in pl->supported, the flow control work again when devicetree "pause" is set in fixes-link node and the MAC advertise that is supports pause. Results with this patch. Legend: - DT = 'Pause' is set in the fixed-link in devicetree. - validate() = ‘Yes’ means phylink_set(mask, Pause) is set in the validate(). - flow = results reported my link is Up line. +-----+------------+-------+ | DT | validate() | flow | +-----+------------+-------+ | Yes | Yes | rx/tx | | No | Yes | off | | Yes | No | off | +-----+------------+-------+ Fixes: 9525ae83959b ("phylink: add phylink infrastructure") Signed-off-by: René van Dorst Acked-by: Russell King Signed-off-by: David S. Miller commit 3db1fa8bb489370b6df634a3d548728294139d66 Author: Paul Bolle Date: Sat Jul 27 00:05:41 2019 +0200 gigaset: stop maintaining seperately The Dutch consumer grade ISDN network will be shut down on September 1, 2019. This means I'll be converted to some sort of VOIP shortly. At that point it would be unwise to try to maintain the gigaset driver, even for odd fixes as I do. So I'll stop maintaining it as a seperate driver and bump support to CAPI in staging. De facto this means the driver will be unmaintained, since no-one seems to be working on CAPI. I've lighty tested the hardware specific modules of this driver (bas-gigaset, ser-gigaset, and usb-gigaset) for v5.3-rc1. The basic functionality appears to be working. It's unclear whether anyone still cares. I'm aware of only one person sort of using the driver a few years ago. Thanks to Karsten Keil for the ISDN subsystems gigaset was using (I4L and CAPI). And many thanks to Hansjoerg Lipp and Tilman Schmidt for writing and upstreaming this driver. Signed-off-by: Paul Bolle Signed-off-by: David S. Miller commit c7ba50fe2399f0621fae39eb6f5e6abfbb83c38d Author: Jia-Ju Bai Date: Fri Jul 26 22:17:05 2019 +0800 net: rds: Fix possible null-pointer dereferences in rds_rdma_cm_event_handler_cmn() In rds_rdma_cm_event_handler_cmn(), there are some if statements to check whether conn is NULL, such as on lines 65, 96 and 112. But conn is not checked before being used on line 108: trans->cm_connect_complete(conn, event); and on lines 140-143: rdsdebug("DISCONNECT event - dropping connection " "%pI6c->%pI6c\n", &conn->c_laddr, &conn->c_faddr); rds_conn_drop(conn); Thus, possible null-pointer dereferences may occur. To fix these bugs, conn is checked before being used. These bugs are found by a static analysis tool STCheck written by us. Signed-off-by: Jia-Ju Bai Acked-by: Santosh Shilimkar Signed-off-by: David S. Miller commit 90c6260c1905a68fb596844087f2223bd4657fee Author: Arnd Bergmann Date: Thu Jul 18 15:57:49 2019 +0200 iio: adc: gyroadc: fix uninitialized return code gcc-9 complains about a blatant uninitialized variable use that all earlier compiler versions missed: drivers/iio/adc/rcar-gyroadc.c:510:5: warning: 'ret' may be used uninitialized in this function [-Wmaybe-uninitialized] Return -EINVAL instead here and a few lines above it where we accidentally return 0 on failure. Cc: stable@vger.kernel.org Fixes: 059c53b32329 ("iio: adc: Add Renesas GyroADC driver") Signed-off-by: Arnd Bergmann Reviewed-by: Wolfram Sang Signed-off-by: Jonathan Cameron commit a0d57a552b836206ad7705a1060e6e1ce5a38203 Author: Jia-Ju Bai Date: Fri Jul 26 16:27:36 2019 +0800 isdn: mISDN: hfcsusb: Fix possible null-pointer dereferences in start_isoc_chain() In start_isoc_chain(), usb_alloc_urb() on line 1392 may fail and return NULL. At this time, fifo->iso[i].urb is assigned to NULL. Then, fifo->iso[i].urb is used at some places, such as: LINE 1405: fill_isoc_urb(fifo->iso[i].urb, ...) urb->number_of_packets = num_packets; urb->transfer_flags = URB_ISO_ASAP; urb->actual_length = 0; urb->interval = interval; LINE 1416: fifo->iso[i].urb->... LINE 1419: fifo->iso[i].urb->... Thus, possible null-pointer dereferences may occur. To fix these bugs, "continue" is added to avoid using fifo->iso[i].urb when it is NULL. These bugs are found by a static analysis tool STCheck written by us. Signed-off-by: Jia-Ju Bai Signed-off-by: David S. Miller commit 88c5083442454e5e8a505b11fa16f32d2879651e Merge: 43e317c1bbdf a035d552a93b Author: Linus Torvalds Date: Sat Jul 27 11:04:18 2019 -0700 Merge tag 'Wimplicit-fallthrough-5.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/gustavoars/linux Pull Wimplicit-fallthrough enablement from Gustavo A. R. Silva: "This marks switch cases where we are expecting to fall through, and globally enables the -Wimplicit-fallthrough option in the main Makefile. Finally, some missing-break fixes that have been tagged for -stable: - drm/amdkfd: Fix missing break in switch statement - drm/amdgpu/gfx10: Fix missing break in switch statement With these changes, we completely get rid of all the fall-through warnings in the kernel" * tag 'Wimplicit-fallthrough-5.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/gustavoars/linux: Makefile: Globally enable fall-through warning drm/i915: Mark expected switch fall-throughs drm/amd/display: Mark expected switch fall-throughs drm/amdkfd/kfd_mqd_manager_v10: Avoid fall-through warning drm/amdgpu/gfx10: Fix missing break in switch statement drm/amdkfd: Fix missing break in switch statement perf/x86/intel: Mark expected switch fall-throughs mtd: onenand_base: Mark expected switch fall-through afs: fsclient: Mark expected switch fall-throughs afs: yfsclient: Mark expected switch fall-throughs can: mark expected switch fall-throughs firewire: mark expected switch fall-throughs commit 43e317c1bbdfe1d4d6d19d28f925f400898d41b9 Merge: 5efbd93708df 98abe0227827 Author: Linus Torvalds Date: Sat Jul 27 08:58:04 2019 -0700 Merge tag 's390-5.3-3' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux Pull s390 updates from Heiko Carstens: - Add ABI to kernel image file which allows e.g. the file utility to figure out the kernel version. - Wire up clone3 system call. - Add support for kasan bitops instrumentation. - uapi header cleanup: use __u{16,32,64} instead of uint{16,32,64}_t. - Provide proper ARCH_ZONE_DMA_BITS so the s390 DMA zone is correctly defined with 2 GB instead of the default value of 1 MB. - Farhan Ali leaves the group of vfio-ccw maintainers. - Various small vfio-ccw fixes. - Add missing locking for airq_areas array in virtio code. - Minor qdio improvements. * tag 's390-5.3-3' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux: MAINTAINERS: vfio-ccw: Remove myself as the maintainer s390/mm: use shared variables for sysctl range check virtio/s390: fix race on airq_areas[] s390/dma: provide proper ARCH_ZONE_DMA_BITS value s390/kasan: add bitops instrumentation s390/bitops: make test functions return bool s390: wire up clone3 system call kbuild: enable arch/s390/include/uapi/asm/zcrypt.h for uapi header test s390: use __u{16,32,64} instead of uint{16,32,64}_t in uapi header s390/hypfs: fix a typo in the name of a function s390/qdio: restrict QAOB usage to IQD unicast queues s390/qdio: add sanity checks to the fast-requeue path s390: enable detection of kernel version from bzImage Documentation: fix vfio-ccw doc vfio-ccw: Update documentation for csch/hsch vfio-ccw: Don't call cp_free if we are processing a channel program vfio-ccw: Set pa_nr to 0 if memory allocation fails for pa_iova_pfn vfio-ccw: Fix memory leak and don't call cp_free in cp_init vfio-ccw: Fix misleading comment when setting orb.cmd.c64 commit 5efbd93708df56e0fb92b4398960a5bb1ab62f02 Merge: 523634db145a e1ff7390f58e Author: Linus Torvalds Date: Sat Jul 27 08:49:19 2019 -0700 Merge tag 'devicetree-fixes-for-5.3-2' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux Pull Devicetree fixes from Rob Herring: "The nvmem changes would typically go thru Greg's tree, but they were missed in the merge window. [ Acked by Greg ] Summary: - Fix mismatches in $id values and actual filenames. Now checked by tools. - Convert nvmem binding to DT schema - Fix a typo in of_property_read_bool() kerneldoc - Remove some redundant description in al-fic interrupt-controller" * tag 'devicetree-fixes-for-5.3-2' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux: dt-bindings: Fix more $id value mismatches filenames dt-bindings: nvmem: SID: Fix the examples node names dt-bindings: nvmem: Add YAML schemas for the generic NVMEM bindings of: Fix typo in kerneldoc dt-bindings: interrupt-controller: al-fic: remove redundant binding dt-bindings: clk: allwinner,sun4i-a10-ccu: Correct path in $id commit 523634db145a22cd5562714d4c59ea74686afe38 Merge: 5168afe6ef59 87a30e1f05d7 Author: Linus Torvalds Date: Sat Jul 27 08:25:51 2019 -0700 Merge tag 'libnvdimm-fixes-5.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm Pull libnvdimm fixes from Dan Williams: "A collection of locking and async operations fixes for v5.3-rc2. These had been soaking in a branch targeting the merge window, but missed due to a regression hunt. This fixed up version has otherwise been in -next this past week with no reported issues. In order to gain confidence in the locking changes the pull also includes a debug / instrumentation patch to enable lockdep coverage for libnvdimm subsystem operations that depend on the device_lock for exclusion. As mentioned in the changelog it is a hack, but it works and documents the locking expectations of the sub-system in a way that others can use lockdep to verify. The driver core touches got an ack from Greg. Summary: - Fix duplicate device_unregister() calls (multiple threads competing to do unregister work when scheduling device removal from a sysfs attribute of the self-same device). - Fix badblocks registration order bug. Ensure region badblocks are initialized in advance of namespace registration. - Fix a deadlock between the bus lock and probe operations. - Export device-core infrastructure to coordinate async operations via the device ->dead state. - Add device-core infrastructure to validate device_lock() usage with lockdep" * tag 'libnvdimm-fixes-5.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm: driver-core, libnvdimm: Let device subsystems add local lockdep coverage libnvdimm/bus: Fix wait_nvdimm_bus_probe_idle() ABBA deadlock libnvdimm/bus: Stop holding nvdimm_bus_list_mutex over __nd_ioctl() libnvdimm/bus: Prepare the nd_ioctl() path to be re-entrant libnvdimm/region: Register badblocks before namespaces libnvdimm/bus: Prevent duplicate device_unregister() calls drivers/base: Introduce kill_device() commit 41e6ada93356400ec8bc8dba04818d9e30ee6e9d Author: Mauro Carvalho Chehab Date: Fri Jul 26 08:47:22 2019 -0300 docs: generic-counter.rst: fix broken references for ABI file There are two references to the generic counter ABI, with was added on a separate patch. Both point to a non-existing file. Fix them. Fixes: ea2b23b89579 ("counter: Documentation: Add Generic Counter sysfs documentation") Fixes: 09e7d4ed8991 ("docs: Add Generic Counter interface documentation") Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Cameron commit 74bf71ed792ab0f64631cc65ccdb54c356c36d45 Author: Samuel Thibault Date: Fri Jul 26 23:47:02 2019 +0200 ALSA: hda: Fix 1-minute detection delay when i915 module is not available Distribution installation images such as Debian include different sets of modules which can be downloaded dynamically. Such images may notably include the hda sound modules but not the i915 DRM module, even if the latter was enabled at build time, as reported on https://bugs.debian.org/931507 In such a case hdac_i915 would be linked in and try to load the i915 module, fail since it is not there, but still wait for a whole minute before giving up binding with it. This fixes such as case by only waiting for the binding if the module was properly loaded (or module support is disabled, in which case i915 is already compiled-in anyway). Fixes: f9b54e1961c7 ("ALSA: hda/i915: Allow delayed i915 audio component binding") Signed-off-by: Samuel Thibault Cc: Signed-off-by: Takashi Iwai commit b25e8a23d4ea7e8ade2c349c22efe88da88c0988 Author: Masahiro Yamada Date: Fri Jul 26 11:17:38 2019 +0900 kbuild: remove unused single-used-m This is unused since commit 9f69a496f100 ("kbuild: split out *.mod out of {single,multi}-used-m rules"). Signed-off-by: Masahiro Yamada commit cb36955a5569f1ff17a42ae93264ef391c013a97 Author: Masahiro Yamada Date: Sat Jul 27 12:01:10 2019 +0900 gen_compile_commands: lower the entry count threshold Running gen_compile_commands.py after building the kernel with allnoconfig gave this: $ ./scripts/gen_compile_commands.py WARNING: Found 449 entries. Have you compiled the kernel? Signed-off-by: Masahiro Yamada commit 26c4c71bcd9a9f2baf8334995b31f718854f7f42 Author: Toru Komatsu Date: Wed Jul 24 09:22:33 2019 +0900 .gitignore: Add compilation database file This file is used by clangd to use language server protocol. It can be generated at each compile using scripts/gen_compile_commands.py. Therefore it is different depending on the environment and should be ignored. Signed-off-by: Toru Komatsu Reviewed-by: Nick Desaulniers Signed-off-by: Masahiro Yamada commit b2eff0921805935132bc308d3c769ef2efb321ad Author: Masahiro Yamada Date: Tue Jul 23 13:11:26 2019 +0900 kbuild: remove unused objectify macro Commit 415008af3219 ("docs-rst: convert lsm from DocBook to ReST") removed the last users of this macro. Signed-off-by: Masahiro Yamada commit 5168afe6ef596eaf2ff7a533b780c79ce14445e4 Merge: 40233e7c4473 c6c84f78e2f7 Author: Linus Torvalds Date: Fri Jul 26 19:20:34 2019 -0700 Merge tag 'for-linus-20190726-2' of git://git.kernel.dk/linux-block Pull block DMA segment fix from Jens Axboe: "Here's the virtual boundary segment size fix" * tag 'for-linus-20190726-2' of git://git.kernel.dk/linux-block: block: fix max segment size handling in blk_queue_virt_boundary commit 40233e7c447367ffc615b524187970732848d5e3 Merge: a68983891367 acbc372e6109 Author: Linus Torvalds Date: Fri Jul 26 19:13:38 2019 -0700 Merge tag 'selinux-pr-20190726' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux Pull selinux fix from Paul Moore: "One small SELinux patch to add some proper bounds/overflow checking when adding a new sid/secid" * tag 'selinux-pr-20190726' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux: selinux: check sidtab limit before adding a new entry commit 543b8c468f55f27f3c0178a22a91a51aabbbc428 Author: Jaegeuk Kim Date: Wed Jul 17 18:31:53 2019 -0700 f2fs: fix to read source block before invalidating it f2fs_allocate_data_block() invalidates old block address and enable new block address. Then, if we try to read old block by f2fs_submit_page_bio(), it will give WARN due to reading invalid blocks. Let's make the order sanely back. Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 5d01ab7bac467edfc530e6ccf953921def935c62 Author: Andrii Nakryiko Date: Fri Jul 26 14:24:38 2019 -0700 libbpf: fix erroneous multi-closing of BTF FD Libbpf stores associated BTF FD per each instance of bpf_program. When program is unloaded, that FD is closed. This is wrong, because leads to a race and possibly closing of unrelated files, if application simultaneously opens new files while bpf_programs are unloaded. It's also unnecessary, because struct btf "owns" that FD, and btf__free(), called from bpf_object__close() will close it. Thus the fix is to never have per-program BTF FD and fetch it from obj->btf, when necessary. Fixes: 2993e0515bb4 ("tools/bpf: add support to read .BTF.ext sections") Reported-by: Andrey Ignatov Signed-off-by: Andrii Nakryiko Signed-off-by: Alexei Starovoitov commit e1ff7390f58e609aa113a2452a953f669abce6cc Author: Rob Herring Date: Fri Jul 26 17:36:52 2019 -0600 dt-bindings: Fix more $id value mismatches filenames The path in the schema '$id' values are wrong. Fix them. Signed-off-by: Rob Herring commit ce842e73bccfc61e851c68e155d6365456a4cc16 Author: Maxime Ripard Date: Wed Jul 3 11:54:21 2019 +0200 dt-bindings: nvmem: SID: Fix the examples node names Now that the examples are validated, the examples in the SID binding generates an error since the node names aren't one of the valid ones. Let's switch for one that is ok. Signed-off-by: Maxime Ripard Signed-off-by: Rob Herring commit c61f0256964b173e4dc71d0e24465ebfd68ef6e1 Author: Maxime Ripard Date: Thu Jun 27 16:10:37 2019 +0100 dt-bindings: nvmem: Add YAML schemas for the generic NVMEM bindings The nvmem providers and consumers have a bunch of generic properties that are needed in a device tree. Add a YAML schemas for those. Reviewed-by: Rob Herring Signed-off-by: Maxime Ripard [Srini: Changed licence to (GPL-2.0 OR BSD-2-Clause)] Signed-off-by: Srinivas Kandagatla Signed-off-by: Rob Herring commit f1765a1819ff3489db9500c6d464e682e6844a14 Author: Thierry Reding Date: Fri Jul 26 12:17:44 2019 +0200 of: Fix typo in kerneldoc "Findfrom" is not a word. Replace the function synopsis by something that makes sense. Signed-off-by: Thierry Reding Signed-off-by: Rob Herring commit 0a062ba725cdad3b167782179ee914a8402a0184 Merge: a7cf3d24ee60 280c08991622 Author: David S. Miller Date: Fri Jul 26 14:26:41 2019 -0700 Merge tag 'mlx5-fixes-2019-07-25' of git://git.kernel.org/pub/scm/linux/kernel/git/saeed/linux Saeed Mahameed says: ==================== Mellanox, mlx5 fixes 2019-07-25 This series introduces some fixes to mlx5 driver. 1) Ariel is addressing an issue with enacp flow counter race condition 2) Aya fixes ethtool speed handling 3) Edward fixes modify_cq hw bits alignment 4) Maor fixes RDMA_RX capabilities handling 5) Mark reverses unregister devices order to address an issue with LAG 6) From Tariq, - wrong max num channels indication regression - TLS counters naming and documentation as suggested by Jakub - kTLS, Call WARN_ONCE on netdev mismatch There is one patch in this series that touches nfp driver to align TLS statistics names with latest documentation, Jakub is CC'ed. Please pull and let me know if there is any problem. For -stable v4.9: ('net/mlx5: Use reversed order when unregister devices') For -stable v4.20 ('net/mlx5e: Prevent encap flow counter update async to user query') ('net/mlx5: Fix modify_cq_in alignment') For -stable v5.1 ('net/mlx5e: Fix matching of speed to PRM link modes') For -stable v5.2 ('net/mlx5: Add missing RDMA_RX capabilities') ==================== Signed-off-by: David S. Miller commit a689838913670765f7754bb1ba749acac9541626 Merge: e2921f9f95f1 20122994e38a Author: Linus Torvalds Date: Fri Jul 26 14:20:28 2019 -0700 Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull SCSI fixes from James Bottomley: "Nine fixes: The most important core one is the dma_max_mapping_size fix that corrects the boot problem Gunter Roeck was having. A couple of other driver only fixes are significant, like the cxgbi selector support addition, the alua 2 second delay and the fdomain build fix" * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: scsi: scsi_dh_alua: always use a 2 second delay before retrying RTPG scsi: ibmvfc: fix WARN_ON during event pool release scsi: fcoe: fix a typo scsi: megaraid_sas: Make some functions static scsi: megaraid_sas: fix panic on loading firmware crashdump scsi: megaraid_sas: fix spelling mistake "megarid_sas" -> "megaraid_sas" scsi: core: fix the dma_max_mapping_size call scsi: fdomain: fix building pcmcia front-end scsi: target: cxgbit: add support for IEEE_8021QAZ_APP_SEL_STREAM selector commit a7cf3d24ee6081930feb4c830a7f6f16ebe31c49 Author: Subash Abhinov Kasiviswanathan Date: Thu Jul 25 12:07:12 2019 -0600 net: qualcomm: rmnet: Fix incorrect UL checksum offload logic The udp_ip4_ind bit is set only for IPv4 UDP non-fragmented packets so that the hardware can flip the checksum to 0xFFFF if the computed checksum is 0 per RFC768. However, this bit had to be set for IPv6 UDP non fragmented packets as well per hardware requirements. Otherwise, IPv6 UDP packets with computed checksum as 0 were transmitted by hardware and were dropped in the network. In addition to setting this bit for IPv6 UDP, the field is also appropriately renamed to udp_ind as part of this change. Fixes: 5eb5f8608ef1 ("net: qualcomm: rmnet: Add support for TX checksum offload") Cc: Sean Tranchetti Signed-off-by: Subash Abhinov Kasiviswanathan Signed-off-by: David S. Miller commit 01f5bffad555f8e22a61f4b1261fe09cf1b96994 Author: Haishuang Yan Date: Fri Jul 26 00:40:17 2019 +0800 ip6_tunnel: fix possible use-after-free on xmit ip4ip6/ip6ip6 tunnels run iptunnel_handle_offloads on xmit which can cause a possible use-after-free accessing iph/ipv6h pointer since the packet will be 'uncloned' running pskb_expand_head if it is a cloned gso skb. Fixes: 0e9a709560db ("ip6_tunnel, ip6_gre: fix setting of DSCP on encapsulated packets") Signed-off-by: Haishuang Yan Signed-off-by: David S. Miller commit e2921f9f95f1c1355a39e54dc038ad95b6e032be Merge: 3ea54d9b0d65 4d5308e78527 Author: Linus Torvalds Date: Fri Jul 26 14:12:54 2019 -0700 Merge tag 'drm-fixes-2019-07-26' of git://anongit.freedesktop.org/drm/drm Pull drm fixes from Daniel Vetter: "Dave seems to collect an entire streak of things happening, so again me typing pull summary. Nothing nefarious here, most of the fixes are for new stuff or things users won't see. The amd-display patches are a bit different, and very much look like they should have at least some cc: stable tags. Might be amd is a bit too comfortable with their internal tree and not enough looking at upstream. Dave&me are looking into this, in case something needs rectified with process here. Also no intel fixes pull, but intel CI is general become rather good, still I guess expect a notch more for -rc3. Summary: amdgpu: - fixes for (new in 5.3) hw support (vega20, navi) - disable RAS - lots of display fixes all over (audio, DSC, dongle, clock mgr) ttm: - fix dma_free_attrs calls to appease dma debugging msm: - fixes for dma-api, locking debug and compiler splats core: - fix cmdline mode to not apply rotation if not specified (new in 5.3) - compiler warn fix" * tag 'drm-fixes-2019-07-26' of git://anongit.freedesktop.org/drm/drm: (46 commits) drm/amd/display: Set enabled to false at start of audio disable drm/amdgpu/smu: move fan rpm query into the asic specific code drm/amd/powerplay: custom peak clock freq for navi10 drm: silence variable 'conn' set but not used drm/msm: stop abusing dma_map/unmap for cache drm/msm/dpu: Correct dpu encoder spinlock initialization drm/msm: correct NULL pointer dereference in context_init drm/amd/display: handle active dongle port type is DP++ or DP case drm/amd/display: do not read link setting if edp not connected drm/amd/display: Increase size of audios array drm/amd/display: drop ASSERT() if eDP panel is not connected drm/amd/display: Only enable audio if speaker allocation exists drm/amd/display: Fix dc_create failure handling and 666 color depths drm/amd/display: allocate 4 ddc engines for RV2 drm/amd/display: put back front end initialization sequence drm/amd/display: Wait for flip to complete drm/amd/display: Change min_h_sync_width from 8 to 4 drm/amd/display: use encoder's engine id to find matched free audio device drm/amd/display: fix DMCU hang when going into Modern Standby drm/amd/display: Disable Audio on reinitialize hardware ... commit c5d139697d5d9ecf9c7cd92d7d7838a173508900 Author: Claudiu Manoil Date: Thu Jul 25 16:33:18 2019 +0300 ocelot: Cancel delayed work before wq destruction Make sure the delayed work for stats update is not pending before wq destruction. This fixes the module unload path. The issue is there since day 1. Fixes: a556c76adc05 ("net: mscc: Add initial Ocelot switch support") Signed-off-by: Claudiu Manoil Reviewed-by: Alexandre Belloni Signed-off-by: David S. Miller commit 81af04b432fdfabcdbd2c06be2ee647e3ca41a22 Author: Michal Kalderon Date: Thu Jul 25 13:59:55 2019 +0300 qed: RDMA - Fix the hw_ver returned in device attributes The hw_ver field was initialized to zero. Return the chip revision. This is relevant for rdma driver. Signed-off-by: Michal Kalderon Signed-off-by: David S. Miller commit 9a07406b00cdc6ec689dc142540739575c717f3c Author: Bob Ham Date: Wed Jul 24 07:52:27 2019 -0700 net: usb: qmi_wwan: Add the BroadMobi BM818 card The BroadMobi BM818 M.2 card uses the QMI protocol Signed-off-by: Bob Ham Signed-off-by: Angus Ainslie (Purism) Signed-off-by: David S. Miller commit c6c84f78e2f77be37b9a150ed33be992198741f0 Author: Christoph Hellwig Date: Wed Jul 24 18:26:56 2019 +0200 block: fix max segment size handling in blk_queue_virt_boundary We should only set the max segment size to unlimited if we actually have a virt boundary. Otherwise we accidentally clear that limit when called from the SCSI midlayer, which always calls blk_queue_virt_boundary, even if that mask is 0. Fixes: 7ad388d8e4c7 ("scsi: core: add a host / host template field for the virt boundary") Reported-by: Guenter Roeck Signed-off-by: Christoph Hellwig Signed-off-by: Jens Axboe commit 3ea54d9b0d655dab5b5becc7d6456082089fc166 Merge: 0ed288665686 d2eba640a4b9 Author: Linus Torvalds Date: Fri Jul 26 11:29:24 2019 -0700 Merge tag 'docs-5.3-1' of git://git.lwn.net/linux Pull documentation fixes from Jonathan Corbet: "This is mostly a set of follow-on fixes from Mauro fixing various fallout from the massive RST conversion; a few other small fixes as well" * tag 'docs-5.3-1' of git://git.lwn.net/linux: (21 commits) docs: phy: Drop duplicate 'be made' doc:it_IT: translations in process/ docs/vm: transhuge: fix typo in madvise reference doc:it_IT: rephrase statement doc:it_IT: align translation to mainline docs: load_config.py: ensure subdirs end with "/" docs: virtual: add it to the documentation body docs: remove extra conf.py files docs: load_config.py: avoid needing a conf.py just due to LaTeX docs scripts/sphinx-pre-install: seek for Noto CJK fonts for pdf output scripts/sphinx-pre-install: cleanup Gentoo checks scripts/sphinx-pre-install: fix latexmk dependencies scripts/sphinx-pre-install: don't use LaTeX with CentOS 7 scripts/sphinx-pre-install: fix script for RHEL/CentOS docs: conf.py: only use CJK if the font is available docs: conf.py: add CJK package needed by translations docs: pdf: add all Documentation/*/index.rst to PDF output docs: fix broken doc references due to renames docs: power: add it to to the main documentation index docs: powerpc: convert docs to ReST and rename to *.rst ... commit 0ed288665686a52781c0ff04ddfe402c7a5397e1 Merge: 4792ba1f1ff0 5a46d3f71d5e Author: Linus Torvalds Date: Fri Jul 26 11:20:42 2019 -0700 Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux Pull arm64 fixes from Will Deacon: "There's more here than we usually have at this stage, but that's mainly down to the stacktrace changes which came in slightly too late for the merge window. Summary: - Big bad batch of MAINTAINERS updates - Fix handling of SP alignment fault exceptions - Fix PSTATE.SSBS handling on heterogeneous systems - Fix fallout from moving to the generic vDSO implementation - Fix stack unwinding in the face of frame corruption - Fix off-by-one in IORT code - Minor SVE cleanups" * tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux: ACPI/IORT: Fix off-by-one check in iort_dev_find_its_id() arm64: entry: SP Alignment Fault doesn't write to FAR_EL1 arm64: Force SSBS on context switch MAINTAINERS: Update my email address MAINTAINERS: Update my email address MAINTAINERS: Fix spelling mistake in my name MAINTAINERS: Update my email address to @kernel.org arm64: mm: Drop pte_huge() arm64/sve: Fix a couple of magic numbers for the Z-reg count arm64/sve: Factor out FPSIMD to SVE state conversion arm64: stacktrace: Better handle corrupted stacks arm64: stacktrace: Factor out backtrace initialisation arm64: stacktrace: Constify stacktrace.h functions arm64: vdso: Cleanup Makefiles arm64: vdso: fix flip/flop vdso build bug arm64: vdso: Fix population of AT_SYSINFO_EHDR for compat vdso commit 4792ba1f1ff0db30369f7016c1611fda3f84b895 Merge: 863fa8887bef a3b46b86ca76 Author: Linus Torvalds Date: Fri Jul 26 11:08:37 2019 -0700 Merge tag 'for-5.3-rc1-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux Pull btrfs fixes from David Sterba: "Two regression fixes: - hangs caused by a missing barrier in the locking code - memory leaks of extent_state due to bad handling of a cached pointer" * tag 'for-5.3-rc1-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux: btrfs: fix extent_state leak in btrfs_lock_and_flush_ordered_range btrfs: Fix deadlock caused by missing memory barrier commit 863fa8887befa19c89fadb1dc6666ac34314fbce Merge: 04412819652f 19a1c4092e7c Author: Linus Torvalds Date: Fri Jul 26 10:58:44 2019 -0700 Merge branch 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs Pull vfs umount_tree() leak fix from Al Viro: "Fix braino introduced in 'switch the remnants of releasing the mountpoint away from fs_pin'. The most visible result is leaking struct mount when mounting btrfs, making it impossible to shut down" * 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: fix the struct mount leak in umount_tree() commit 04412819652fe30f900d11e96c67b4adfdf17f6b Merge: 750c930b085b 9c0b2596f2ac Author: Linus Torvalds Date: Fri Jul 26 10:32:12 2019 -0700 Merge tag 'for-linus-20190726' of git://git.kernel.dk/linux-block Pull block fixes from Jens Axboe: - Several io_uring fixes/improvements: - Blocking fix for O_DIRECT (me) - Latter page slowness for registered buffers (me) - Fix poll hang under certain conditions (me) - Defer sequence check fix for wrapped rings (Zhengyuan) - Mismatch in async inc/dec accounting (Zhengyuan) - Memory ordering issue that could cause stall (Zhengyuan) - Track sequential defer in bytes, not pages (Zhengyuan) - NVMe pull request from Christoph - Set of hang fixes for wbt (Josef) - Redundant error message kill for libahci (Ding) - Remove unused blk_mq_sched_started_request() and related ops (Marcos) - drbd dynamic alloc shash descriptor to reduce stack use (Arnd) - blkcg ->pd_stat() non-debug print (Tejun) - bcache memory leak fix (Wei) - Comment fix (Akinobu) - BFQ perf regression fix (Paolo) * tag 'for-linus-20190726' of git://git.kernel.dk/linux-block: (24 commits) io_uring: ensure ->list is initialized for poll commands Revert "nvme-pci: don't create a read hctx mapping without read queues" nvme: fix multipath crash when ANA is deactivated nvme: fix memory leak caused by incorrect subsystem free nvme: ignore subnqn for ADATA SX6000LNP drbd: dynamically allocate shash descriptor block: blk-mq: Remove blk_mq_sched_started_request and started_request bcache: fix possible memory leak in bch_cached_dev_run() io_uring: track io length in async_list based on bytes io_uring: don't use iov_iter_advance() for fixed buffers block: properly handle IOCB_NOWAIT for async O_DIRECT IO blk-mq: allow REQ_NOWAIT to return an error inline io_uring: add a memory barrier before atomic_read rq-qos: use a mb for got_token rq-qos: set ourself TASK_UNINTERRUPTIBLE after we schedule rq-qos: don't reset has_sleepers on spurious wakeups rq-qos: fix missed wake-ups in rq_qos_throttle wait: add wq_has_single_sleeper helper block, bfq: check also in-flight I/O in dispatch plugging block: fix sysfs module parameters directory path in comment ... commit 750c930b085ba56cfac3649e8e0dff72a8c5f8a5 Merge: b381c016c5cf 3f8809499bf0 Author: Linus Torvalds Date: Fri Jul 26 10:23:45 2019 -0700 Merge tag 'sound-5.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "All relatively small changes: - a regression fix for PCM link code with CONFIG_REFCOUNT_FULL; stumbled on a slight difference between atomic_t and refcount_t - a couple of HD-audio stabilization patches addressing the too slow PM resume seen on some Intel chips - a series of ALSA compress-offload API fixes, including the regression by the previous capture stream support - trivial LINE6 USB-audio driver fixes, a new Conexant HD-audio chip coverage, and a fix in AC97 bus error path" * tag 'sound-5.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: ALSA: hda - Add a conexant codec entry to let mute led work ALSA: hda - Fix intermittent CORB/RIRB stall on Intel chips ALSA: ac97: Fix double free of ac97_codec_device ALSA: compress: Be more restrictive about when a drain is allowed ALSA: compress: Don't allow paritial drain operations on capture streams ALSA: compress: Prevent bypasses of set_params ALSA: compress: Fix regression on compressed capture streams ALSA: line6: Fix a typo ALSA: pcm: Fix refcount_inc() on zero usage ALSA: line6: Fix wrong altsetting for LINE6_PODHD500_1 ALSA: hda - Optimize resume for codecs without jack detection commit b381c016c5cfea94f2ad22c0c2195306a70d54ac Merge: 55d31aaec0da 66929812955b Author: Linus Torvalds Date: Fri Jul 26 10:04:19 2019 -0700 Merge tag 'iommu-fixes-v5.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu Pull IOMMU fixes from Joerg Roedel: - revert an Intel VT-d patch that caused boot problems on some machines - fix AMD IOMMU interrupts with x2apic enabled - fix a potential crash when Intel VT-d domain allocation fails - fix crash in Intel VT-d driver when accessing a domain without a flush queue - formatting fix for new Intel VT-d debugfs code - fix for use-after-free bug in IOVA code - fix for a NULL-pointer dereference in Intel VT-d driver when PCI hotplug is used - compilation fix for one of the previous fixes * tag 'iommu-fixes-v5.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu: iommu/amd: Add support for X2APIC IOMMU interrupts iommu/iova: Fix compilation error with !CONFIG_IOMMU_IOVA iommu/vt-d: Print pasid table entries MSB to LSB in debugfs iommu/iova: Remove stale cached32_node iommu/vt-d: Check if domain->pgd was allocated iommu/vt-d: Don't queue_iova() if there is no flush queue iommu/vt-d: Avoid duplicated pci dma alias consideration Revert "iommu/vt-d: Consolidate domain_init() to avoid duplication" commit 55d31aaec0da46801e7337779bb3ebe88b034ef3 Merge: 6108cd475ca8 94bccc340710 Author: Linus Torvalds Date: Fri Jul 26 09:43:43 2019 -0700 Merge branch 'for-linus-5.3' of git://git.kernel.org/pub/scm/linux/kernel/git/konrad/ibft Pull iscsi_ibft fix from Konrad Rzeszutek Wilk: "One tiny fix to enable iSCSI IBFT to be compiled under ARM" * 'for-linus-5.3' of git://git.kernel.org/pub/scm/linux/kernel/git/konrad/ibft: iscsi_ibft: make ISCSI_IBFT depend on ACPI instead of ISCSI_IBFT_FIND commit 6108cd475ca8323fa9d9b584c44a5229a9a26aa5 Merge: 6789f873ed37 223b2b5030f3 Author: Linus Torvalds Date: Fri Jul 26 09:36:01 2019 -0700 Merge tag 'hwmon-for-v5.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging Pull hwmon fixes from Guenter Roeck: "A couple of hwmon bug fixes: - Update k8temp documentation URL - Register address fixes in nct6775 driver - Fix potential division by zero in occ driver" * tag 'hwmon-for-v5.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging: hwmon: (k8temp) documentation: update URL of datasheet hwmon: (nct6775) Fix register address and added missed tolerance for nct6106 hwmon: (occ) Fix division by zero issue commit e0d99c4d24fd8861da724b88ebd18a9fae8a2260 Author: Arnaldo Carvalho de Melo Date: Fri Jul 26 12:43:23 2019 -0300 tools headers UAPI: Update tools's copy of kvm.h headers Picking the changes from: 66bb8a065f5a ("KVM: x86: PMU Event Filter") f087a02941fe ("KVM: nVMX: Stash L1's CR3 in vmcs01.GUEST_CR3 on nested entry w/o EPT") 99adb567632b ("KVM: arm/arm64: Add save/restore support for firmware workaround state") Silencing this perf build warning: Warning: Kernel ABI header at 'tools/arch/arm/include/uapi/asm/kvm.h' differs from latest version at 'arch/arm/include/uapi/asm/kvm.h' diff -u tools/arch/arm/include/uapi/asm/kvm.h arch/arm/include/uapi/asm/kvm.h Warning: Kernel ABI header at 'tools/arch/arm64/include/uapi/asm/kvm.h' differs from latest version at 'arch/arm64/include/uapi/asm/kvm.h' diff -u tools/arch/arm64/include/uapi/asm/kvm.h arch/arm64/include/uapi/asm/kvm.h Warning: Kernel ABI header at 'tools/arch/x86/include/uapi/asm/vmx.h' differs from latest version at 'arch/x86/include/uapi/asm/vmx.h' diff -u tools/arch/x86/include/uapi/asm/vmx.h arch/x86/include/uapi/asm/vmx.h Warning: Kernel ABI header at 'tools/arch/x86/include/uapi/asm/kvm.h' differs from latest version at 'arch/x86/include/uapi/asm/kvm.h' diff -u tools/arch/x86/include/uapi/asm/kvm.h arch/x86/include/uapi/asm/kvm.h Warning: Kernel ABI header at 'tools/include/uapi/linux/kvm.h' differs from latest version at 'include/uapi/linux/kvm.h' diff -u tools/include/uapi/linux/kvm.h include/uapi/linux/kvm.h Now 'perf trace' and other code that might use the tools/perf/trace/beauty autogenerated tables will be able to translate this new ioctl code into a string: $ tools/perf/trace/beauty/kvm_ioctl.sh > before $ $ cp include/uapi/linux/kvm.h tools/include/uapi/linux/kvm.h $ tools/perf/trace/beauty/kvm_ioctl.sh > after $ diff -u before after --- before 2019-07-26 12:32:47.959220236 -0300 +++ after 2019-07-26 12:33:05.766464871 -0300 @@ -79,6 +79,7 @@ [0xac] = "SET_ONE_REG", [0xad] = "KVMCLOCK_CTRL", [0xb0] = "GET_REG_LIST", + [0xb2] = "SET_PMU_EVENT_FILTER", [0xb7] = "SMI", [0xba] = "MEMORY_ENCRYPT_OP", [0xbb] = "MEMORY_ENCRYPT_REG_REGION", $ Cc: Adrian Hunter Cc: Andre Przywara Cc: Brendan Gregg Cc: Eric Hankland Cc: Jiri Olsa Cc: Luis Cláudio Gonçalves Cc: Marc Zyngier Cc: Namhyung Kim Cc: Paolo Bonzini Cc: Sean Christopherson Link: https://lkml.kernel.org/n/tip-py1gcmt6rboehlwg6zvagfg2@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 820571af721990e354649368e641313f85a29976 Author: Arnaldo Carvalho de Melo Date: Fri Jul 26 12:31:28 2019 -0300 tools include UAPI: Sync x86's syscalls_64.tbl and generic unistd.h to pick up clone3 and pidfd_open 05a70a8ec287 ("unistd: protect clone3 via __ARCH_WANT_SYS_CLONE3") 8f3220a80654 ("arch: wire-up clone3() syscall") 7615d9e1780e ("arch: wire-up pidfd_open()") Silencing the following tools/perf build warnings Warning: Kernel ABI header at 'tools/include/uapi/asm-generic/unistd.h' differs from latest version at 'include/uapi/asm-generic/unistd.h' diff -u tools/include/uapi/asm-generic/unistd.h include/uapi/asm-generic/unistd.h Warning: Kernel ABI header at 'tools/perf/arch/x86/entry/syscalls/syscall_64.tbl' differs from latest version at 'arch/x86/entry/syscalls/syscall_64.tbl' diff -u tools/perf/arch/x86/entry/syscalls/syscall_64.tbl arch/x86/entry/syscalls/syscall_64.tbl Now 'perf trace -e pidfd*,clone*' will trace those syscalls as well as the others with those prefixes. $ diff -u /tmp/build/perf/arch/x86/include/generated/asm/syscalls_64.c.before /tmp/build/perf/arch/x86/include/generated/asm/syscalls_64.c --- /tmp/build/perf/arch/x86/include/generated/asm/syscalls_64.c.before 2019-07-26 12:24:55.020944201 -0300 +++ /tmp/build/perf/arch/x86/include/generated/asm/syscalls_64.c 2019-07-26 12:25:03.919047217 -0300 @@ -344,5 +344,7 @@ [431] = "fsconfig", [432] = "fsmount", [433] = "fspick", + [434] = "pidfd_open", + [435] = "clone3", }; -#define SYSCALLTBL_x86_64_MAX_ID 433 +#define SYSCALLTBL_x86_64_MAX_ID 435 $ Cc: Adrian Hunter Cc: Brendan Gregg Cc: Christian Brauner Cc: Jiri Olsa Cc: Luis Cláudio Gonçalves Cc: Namhyung Kim Link: https://lkml.kernel.org/n/tip-0isnnqxtr1ihz6p8wzjiy47d@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 6701c619fa082e6660ecd7573fbad2177380c7cc Author: Zenghui Yu Date: Sat Jul 13 04:40:54 2019 +0000 KVM: arm64: Update kvm_arm_exception_class and esr_class_str for new EC We've added two ESR exception classes for new ARM hardware extensions: ESR_ELx_EC_PAC and ESR_ELx_EC_SVE, but failed to update the strings used in tracing and other debug. Let's update "kvm_arm_exception_class" for these two EC, which the new EC will be visible to user-space via kvm_exit trace events Also update to "esr_class_str" for ESR_ELx_EC_PAC, by which we can get more readable debug info. Cc: Marc Zyngier Cc: Catalin Marinas Cc: Will Deacon Cc: Mark Rutland Cc: Dave Martin Reviewed-by: James Morse Signed-off-by: Zenghui Yu Signed-off-by: Marc Zyngier commit 1a8248c74c81a15a32dc3344fb5c622e19072791 Author: Anders Roxell Date: Fri Jul 26 13:28:31 2019 +0200 KVM: arm: vgic-v3: Mark expected switch fall-through When fall-through warnings was enabled by default the following warnings was starting to show up: ../virt/kvm/arm/hyp/vgic-v3-sr.c: In function ‘__vgic_v3_save_aprs’: ../virt/kvm/arm/hyp/vgic-v3-sr.c:351:24: warning: this statement may fall through [-Wimplicit-fallthrough=] cpu_if->vgic_ap0r[2] = __vgic_v3_read_ap0rn(2); ~~~~~~~~~~~~~~~~~~~~~^~~~~~~~~~~~~~~~~~~~~~~~~ ../virt/kvm/arm/hyp/vgic-v3-sr.c:352:2: note: here case 6: ^~~~ ../virt/kvm/arm/hyp/vgic-v3-sr.c:353:24: warning: this statement may fall through [-Wimplicit-fallthrough=] cpu_if->vgic_ap0r[1] = __vgic_v3_read_ap0rn(1); ~~~~~~~~~~~~~~~~~~~~~^~~~~~~~~~~~~~~~~~~~~~~~~ ../virt/kvm/arm/hyp/vgic-v3-sr.c:354:2: note: here default: ^~~~~~~ Rework so that the compiler doesn't warn about fall-through. Fixes: d93512ef0f0e ("Makefile: Globally enable fall-through warning") Signed-off-by: Anders Roxell Signed-off-by: Marc Zyngier commit 3d584a3c85d6fe2cf878f220d4ad7145e7f89218 Author: Anders Roxell Date: Fri Jul 26 13:27:05 2019 +0200 arm64: KVM: regmap: Fix unexpected switch fall-through When fall-through warnings was enabled by default, commit d93512ef0f0e ("Makefile: Globally enable fall-through warning"), the following warnings was starting to show up: In file included from ../arch/arm64/include/asm/kvm_emulate.h:19, from ../arch/arm64/kvm/regmap.c:13: ../arch/arm64/kvm/regmap.c: In function ‘vcpu_write_spsr32’: ../arch/arm64/include/asm/kvm_hyp.h:31:3: warning: this statement may fall through [-Wimplicit-fallthrough=] asm volatile(ALTERNATIVE(__msr_s(r##nvh, "%x0"), \ ^~~ ../arch/arm64/include/asm/kvm_hyp.h:46:31: note: in expansion of macro ‘write_sysreg_elx’ #define write_sysreg_el1(v,r) write_sysreg_elx(v, r, _EL1, _EL12) ^~~~~~~~~~~~~~~~ ../arch/arm64/kvm/regmap.c:180:3: note: in expansion of macro ‘write_sysreg_el1’ write_sysreg_el1(v, SYS_SPSR); ^~~~~~~~~~~~~~~~ ../arch/arm64/kvm/regmap.c:181:2: note: here case KVM_SPSR_ABT: ^~~~ In file included from ../arch/arm64/include/asm/cputype.h:132, from ../arch/arm64/include/asm/cache.h:8, from ../include/linux/cache.h:6, from ../include/linux/printk.h:9, from ../include/linux/kernel.h:15, from ../include/asm-generic/bug.h:18, from ../arch/arm64/include/asm/bug.h:26, from ../include/linux/bug.h:5, from ../include/linux/mmdebug.h:5, from ../include/linux/mm.h:9, from ../arch/arm64/kvm/regmap.c:11: ../arch/arm64/include/asm/sysreg.h:837:2: warning: this statement may fall through [-Wimplicit-fallthrough=] asm volatile("msr " __stringify(r) ", %x0" \ ^~~ ../arch/arm64/kvm/regmap.c:182:3: note: in expansion of macro ‘write_sysreg’ write_sysreg(v, spsr_abt); ^~~~~~~~~~~~ ../arch/arm64/kvm/regmap.c:183:2: note: here case KVM_SPSR_UND: ^~~~ Rework to add a 'break;' in the swich-case since it didn't have that, leading to an interresting set of bugs. Cc: stable@vger.kernel.org # v4.17+ Fixes: a892819560c4 ("KVM: arm64: Prepare to handle deferred save/restore of 32-bit registers") Signed-off-by: Anders Roxell [maz: reworked commit message, fixed stable range] Signed-off-by: Marc Zyngier commit d2eba640a4b96bc1bdc0f4a500b8b8d5e16725c8 Author: Guido Günther Date: Fri Jul 26 11:55:34 2019 +0200 docs: phy: Drop duplicate 'be made' Fix duplicate words. Signed-off-by: Guido Günther Signed-off-by: Jonathan Corbet commit b5fa9fc9e809f84bb20439730162eccfed906a76 Author: Wen Yang Date: Mon Jul 8 14:19:04 2019 +0800 irqchip/renesas-rza1: Fix an use-after-free in rza1_irqc_probe() The gic_node is still being used in the rza1_irqc_parse_map() call after the of_node_put() call, which may result in use-after-free. Fixes: a644ccb819bc ("irqchip: Add Renesas RZ/A1 Interrupt Controller driver") Signed-off-by: Wen Yang Reviewed-by: Geert Uytterhoeven Signed-off-by: Marc Zyngier commit 9a446ef08f3bfc0c3deb9c6be840af2528ef8cf8 Author: Lucas Stach Date: Fri Jul 12 15:29:05 2019 +0200 irqchip/irq-imx-gpcv2: Forward irq type to parent The GPCv2 is a stacked IRQ controller below the ARM GIC. It doesn't care about the IRQ type itself, but needs to forward the type to the parent IRQ controller, so this one can be configured correctly. Signed-off-by: Lucas Stach Signed-off-by: Marc Zyngier commit 321275f0d8f5939f2a98749fe03ee97ac97e73d0 Author: Nishka Dasgupta Date: Tue Jul 23 16:09:10 2019 +0530 irqchip/irq-mbigen: Add of_node_put() before return Each iteration of for_each_child_of_node puts the previous node, but in the case of a return from the middle of the loop, there is no put, thus causing a memory leak. Add an of_node_put before the return in three places. Issue found with Coccinelle. Signed-off-by: Nishka Dasgupta Signed-off-by: Marc Zyngier commit 34f8eb92ca053cbba2887bb7e4dbf2b2cd6eb733 Author: Nianyao Tang Date: Fri Jul 26 17:32:57 2019 +0800 irqchip/gic-v3-its: Free unused vpt_page when alloc vpe table fail In its_vpe_init, when its_alloc_vpe_table fails, we should free vpt_page allocated just before, instead of vpe->vpt_page. Let's fix it. Cc: Thomas Gleixner Cc: Jason Cooper Cc: Marc Zyngier Signed-off-by: Nianyao Tang Signed-off-by: Shaokun Zhang Signed-off-by: Marc Zyngier commit 52f8c8b32ea2f2044efcb4214c1857e29f421c5d Author: Anders Roxell Date: Fri Jul 26 13:28:26 2019 +0200 irqchip/gic-v3: Mark expected switch fall-through When fall-through warnings was enabled by default the following warning was starting to show up: In file included from ../arch/arm64/include/asm/cputype.h:132, from ../arch/arm64/include/asm/cache.h:8, from ../include/linux/cache.h:6, from ../include/linux/printk.h:9, from ../include/linux/kernel.h:15, from ../include/linux/list.h:9, from ../include/linux/kobject.h:19, from ../include/linux/of.h:17, from ../include/linux/irqdomain.h:35, from ../include/linux/acpi.h:13, from ../drivers/irqchip/irq-gic-v3.c:9: ../drivers/irqchip/irq-gic-v3.c: In function ‘gic_cpu_sys_reg_init’: ../arch/arm64/include/asm/sysreg.h:853:2: warning: this statement may fall through [-Wimplicit-fallthrough=] asm volatile(__msr_s(r, "%x0") : : "rZ" (__val)); \ ^~~ ../arch/arm64/include/asm/arch_gicv3.h:20:29: note: in expansion of macro ‘write_sysreg_s’ #define write_gicreg(v, r) write_sysreg_s(v, SYS_ ## r) ^~~~~~~~~~~~~~ ../drivers/irqchip/irq-gic-v3.c:773:4: note: in expansion of macro ‘write_gicreg’ write_gicreg(0, ICC_AP0R2_EL1); ^~~~~~~~~~~~ ../drivers/irqchip/irq-gic-v3.c:774:3: note: here case 6: ^~~~ Rework so that the compiler doesn't warn about fall-through. Fixes: d93512ef0f0e ("Makefile: Globally enable fall-through warning") Signed-off-by: Anders Roxell Signed-off-by: Marc Zyngier commit 1e112c35e3c96db7c8ca6ddaa96574f00c06e7db Author: Peter Ujfalusi Date: Fri Jul 26 09:42:43 2019 +0300 ASoC: ti: davinci-mcasp: Correct slot_width posed constraint The slot_width is a property for the bus while the constraint for SNDRV_PCM_HW_PARAM_SAMPLE_BITS is for the in memory format. Applying slot_width constraint to sample_bits works most of the time, but it will blacklist valid formats in some cases. With slot_width 24 we can support S24_3LE and S24_LE formats as they both look the same on the bus, but a a 24 constraint on sample_bits would not allow S24_LE as it is stored in 32bits in memory. Implement a simple hw_rule function to allow all formats which require less or equal number of bits on the bus as slot_width (if configured). Signed-off-by: Peter Ujfalusi Link: https://lore.kernel.org/r/20190726064244.3762-2-peter.ujfalusi@ti.com Signed-off-by: Mark Brown commit 789e162a6255325325bd321ab0cd51dc7e285054 Author: Cheng-Yi Chiang Date: Fri Jul 26 12:42:02 2019 +0800 ASoC: rockchip: Fix mono capture This reverts commit db51707b9c9aeedd310ebce60f15d5bb006567e0. Revert "ASoC: rockchip: i2s: Support mono capture" Previous discussion in https://patchwork.kernel.org/patch/10147153/ explains the issue of the patch. While device is configured as 1-ch, hardware is still generating a 2-ch stream. When user space reads the data and assumes it is a 1-ch stream, the rate will be slower by 2x. Revert the change so 1-ch is not supported. User space can selectively take one channel data out of two channel if 1-ch is preferred. Currently, both channels record identical data. Signed-off-by: Cheng-Yi Chiang Link: https://lore.kernel.org/r/20190726044202.26866-1-cychiang@chromium.org Signed-off-by: Mark Brown commit e51b69808b7ec06fc61f5a332f338d94b64b0537 Author: Christophe JAILLET Date: Thu Jul 25 07:35:23 2019 +0200 ASoC: Intel: Fix some acpi vs apci typo in somme comments Fix some typo to have the filaname given in a comment match the real name of the file. Some 'acpi' have erroneously been written 'apci' Signed-off-by: Christophe JAILLET Link: https://lore.kernel.org/r/20190725053523.16542-1-christophe.jaillet@wanadoo.fr Signed-off-by: Mark Brown commit 34a2a80ff30b5d2330abfa8980c7f0cc15a8158a Author: Peter Ujfalusi Date: Thu Jul 25 11:34:23 2019 +0300 ASoC: ti: davinci-mcasp: Fix clk PDIR handling for i2s master mode When running McASP as master capture alone will not record any audio unless a parallel playback stream is running. As soon as the playback stops the captured data is going to be silent again. In McASP master mode we need to set the PDIR for the clock pins and fix the mcasp_set_axr_pdir() to skip the bits in the PDIR registers above AMUTE. This went unnoticed as most of the boards uses McASP as slave and neither of these issues are visible (audible) in those setups. Fixes: ca3d9433349e ("ASoC: davinci-mcasp: Update PDIR (pin direction) register handling") Signed-off-by: Peter Ujfalusi Link: https://lore.kernel.org/r/20190725083423.7321-1-peter.ujfalusi@ti.com Signed-off-by: Mark Brown commit 19a1c4092e7ca1ad1a72ac5535f902c483372cd5 Author: Al Viro Date: Wed Jul 24 12:45:46 2019 -0400 fix the struct mount leak in umount_tree() We need to drop everything we remove from the tree, whether mnt_has_parent() is true or not. Usually the bug manifests as a slow memory leak (leaked struct mount for initramfs); it becomes much more visible in mount_subtree() users, such as btrfs. There we leak a struct mount for btrfs superblock being mounted, which prevents fs shutdown on subsequent umount. Fixes: 56cbb429d911 ("switch the remnants of releasing the mountpoint away from fs_pin") Reported-by: Nikolay Borisov Tested-by: Nikolay Borisov Signed-off-by: Al Viro commit e6f4051123fd33901e9655a675b22aefcdc5d277 Author: Manikanta Pubbisetty Date: Mon Jul 22 12:44:50 2019 +0530 {nl,mac}80211: fix interface combinations on crypto controlled devices Commit 33d915d9e8ce ("{nl,mac}80211: allow 4addr AP operation on crypto controlled devices") has introduced a change which allows 4addr operation on crypto controlled devices (ex: ath10k). This change has inadvertently impacted the interface combinations logic on such devices. General rule is that software interfaces like AP/VLAN should not be listed under supported interface combinations and should not be considered during validation of these combinations; because of the aforementioned change, AP/VLAN interfaces(if present) will be checked against interfaces supported by the device and blocks valid interface combinations. Consider a case where an AP and AP/VLAN are up and running; when a second AP device is brought up on the same physical device, this AP will be checked against the AP/VLAN interface (which will not be part of supported interface combinations of the device) and blocks second AP to come up. Add a new API cfg80211_iftype_allowed() to fix the problem, this API works for all devices with/without SW crypto control. Signed-off-by: Manikanta Pubbisetty Fixes: 33d915d9e8ce ("{nl,mac}80211: allow 4addr AP operation on crypto controlled devices") Link: https://lore.kernel.org/r/1563779690-9716-1-git-send-email-mpubbise@codeaurora.org Signed-off-by: Johannes Berg commit 73f628ec9e6bcc45b77c53fe6d0c0ec55eaf82af Author: Michael S. Tsirkin Date: Fri Jul 26 07:49:29 2019 -0400 vhost: disable metadata prefetch optimization This seems to cause guest and host memory corruption. Disable for now until we get a better handle on that. Signed-off-by: Michael S. Tsirkin commit 98abe0227827f45cddb21875b2ffa9aeca3848b3 Author: Farhan Ali Date: Wed Jul 24 17:32:03 2019 -0400 MAINTAINERS: vfio-ccw: Remove myself as the maintainer I will not be able to continue with my maintainership responsibilities going forward, so remove myself as the maintainer. Signed-off-by: Farhan Ali Acked-by: Cornelia Huck Signed-off-by: Christian Borntraeger Signed-off-by: Heiko Carstens commit ac7a0fcea39d29125b83b73583463e5ab70fdb37 Author: Vasily Gorbik Date: Wed Jun 26 00:00:42 2019 +0200 s390/mm: use shared variables for sysctl range check Since commit eec4844fae7c ("proc/sysctl: add shared variables for range check") special shared variables are available for sysctl range check. Reuse them for /proc/sys/vm/allocate_pgste proc handler. Acked-by: Christian Borntraeger Signed-off-by: Vasily Gorbik Signed-off-by: Heiko Carstens commit 4f419eb14272e0698e8c55bb5f3f266cc2a21c81 Author: Halil Pasic Date: Tue Jul 23 17:11:01 2019 +0200 virtio/s390: fix race on airq_areas[] The access to airq_areas was racy ever since the adapter interrupts got introduced to virtio-ccw, but since commit 39c7dcb15892 ("virtio/s390: make airq summary indicators DMA") this became an issue in practice as well. Namely before that commit the airq_info that got overwritten was still functional. After that commit however the two infos share a summary_indicator, which aggravates the situation. Which means auto-online mechanism occasionally hangs the boot with virtio_blk. Signed-off-by: Halil Pasic Reported-by: Marc Hartmayer Reviewed-by: Cornelia Huck Cc: stable@vger.kernel.org Fixes: 96b14536d935 ("virtio-ccw: virtio-ccw adapter interrupt support.") Signed-off-by: Heiko Carstens commit 1a2dcff881059dedc14fafc8a442664c8dbd60f1 Author: Halil Pasic Date: Wed Jul 24 00:51:55 2019 +0200 s390/dma: provide proper ARCH_ZONE_DMA_BITS value On s390 ZONE_DMA is up to 2G, i.e. ARCH_ZONE_DMA_BITS should be 31 bits. The current value is 24 and makes __dma_direct_alloc_pages() take a wrong turn first (but __dma_direct_alloc_pages() recovers then). Let's correct ARCH_ZONE_DMA_BITS value and avoid wrong turns. Signed-off-by: Halil Pasic Reported-by: Petr Tesarik Fixes: c61e9637340e ("dma-direct: add support for allocation from ZONE_DMA and ZONE_DMA32") Signed-off-by: Heiko Carstens commit a3b46b86ca76d7f9d487e6a0b594fd1984e0796e Author: Naohiro Aota Date: Fri Jul 26 16:47:05 2019 +0900 btrfs: fix extent_state leak in btrfs_lock_and_flush_ordered_range btrfs_lock_and_flush_ordered_range() loads given "*cached_state" into cachedp, which, in general, is NULL. Then, lock_extent_bits() updates "cachedp", but it never goes backs to the caller. Thus the caller still see its "cached_state" to be NULL and never free the state allocated under btrfs_lock_and_flush_ordered_range(). As a result, we will see massive state leak with e.g. fstests btrfs/005. Fix this bug by properly handling the pointers. Fixes: bd80d94efb83 ("btrfs: Always use a cached extent_state in btrfs_lock_and_flush_ordered_range") Reviewed-by: Nikolay Borisov Signed-off-by: Naohiro Aota Signed-off-by: David Sterba commit 09e088a4903bd0dd911b4f1732b250130cdaffed Author: YueHaibing Date: Wed Jul 24 22:08:50 2019 +0800 xen/pciback: remove set but not used variable 'old_state' Fixes gcc '-Wunused-but-set-variable' warning: drivers/xen/xen-pciback/conf_space_capability.c: In function pm_ctrl_write: drivers/xen/xen-pciback/conf_space_capability.c:119:25: warning: variable old_state set but not used [-Wunused-but-set-variable] It is never used so can be removed. Reported-by: Hulk Robot Signed-off-by: YueHaibing Reviewed-by: Boris Ostrovsky Signed-off-by: Juergen Gross commit 4d5308e7852741318e4d40fb8d43d9311b3984ae Merge: f480de3f4a2b 92e6475ae0a0 Author: Dave Airlie Date: Fri Jul 26 14:10:24 2019 +1000 Merge tag 'drm-fixes-5.3-2019-07-24' of git://people.freedesktop.org/~agd5f/linux into drm-fixes drm-fixes-5.3-2019-07-24: amdgpu: - RAS fixes for vega20 - Navi VCN fix - DC audio fixes - DC DSC fixes - DC dongle fixes - DC clk mgr fixes - Fix DDC lines on some RV2 boards - GDS fixes for compute - Navi SMU fixes ttm: - Use the same attributes when freeing d_page->vaddr Signed-off-by: Dave Airlie From: Alex Deucher Link: https://patchwork.freedesktop.org/patch/msgid/20190724210527.3415-1-alexander.deucher@amd.com commit f480de3f4a2b1ec184f7b5178943adf31080fc2c Merge: 5f9e832c1370 bbb6fc43f131 Author: Dave Airlie Date: Fri Jul 26 14:09:49 2019 +1000 Merge tag 'drm-misc-fixes-2019-07-25' of git://anongit.freedesktop.org/drm/drm-misc into drm-fixes - pick up the cmdline fix which missed the merge window (Dmitry) - a handful of msm fixes so i don't have to spin up msm-fixes (Various) - fix -Wunused-but-set-variable warning in drm_framebuffer (Qian) Cc: Dmitry Osipenko Cc: Rob Clark Cc: Qian Cai Signed-off-by: Dave Airlie From: Sean Paul Link: https://patchwork.freedesktop.org/patch/msgid/20190725160909.GA106249@art_vandelay commit a035d552a93bb9ef6048733bb9f2a0dc857ff869 Author: Gustavo A. R. Silva Date: Thu Jun 6 19:46:17 2019 -0500 Makefile: Globally enable fall-through warning Now that all the fall-through warnings have been addressed in the kernel, enable the fall-through warning globally. Also, update the deprecated.rst file to include implicit fall-through as 'deprecated' so people can be pointed to a single location for justification. Cc: Masahiro Yamada Cc: Andrew Morton Cc: Michal Marek Cc: Kees Cook Cc: linux-kbuild@vger.kernel.org Signed-off-by: Gustavo A. R. Silva commit 2defb94edb44784b0b5064633e05c97fdb1b0e0f Author: Gustavo A. R. Silva Date: Mon Jul 22 13:03:46 2019 -0500 drm/i915: Mark expected switch fall-throughs In preparation to enabling -Wimplicit-fallthrough, mark switch cases where we are expecting to fall through. This patch fixes the following warnings: drivers/gpu/drm/i915/gem/i915_gem_mman.c: In function ‘i915_gem_fault’: drivers/gpu/drm/i915/gem/i915_gem_mman.c:342:6: warning: this statement may fall through [-Wimplicit-fallthrough=] if (!i915_terminally_wedged(i915)) ^ drivers/gpu/drm/i915/gem/i915_gem_mman.c:345:2: note: here case -EAGAIN: ^~~~ drivers/gpu/drm/i915/gem/i915_gem_pages.c: In function ‘i915_gem_object_map’: ./include/linux/compiler.h:78:22: warning: this statement may fall through [-Wimplicit-fallthrough=] # define unlikely(x) __builtin_expect(!!(x), 0) ^~~~~~~~~~~~~~~~~~~~~~~~~~ ./include/asm-generic/bug.h:136:2: note: in expansion of macro ‘unlikely’ unlikely(__ret_warn_on); \ ^~~~~~~~ drivers/gpu/drm/i915/i915_utils.h:49:25: note: in expansion of macro ‘WARN’ #define MISSING_CASE(x) WARN(1, "Missing case (%s == %ld)\n", \ ^~~~ drivers/gpu/drm/i915/gem/i915_gem_pages.c:270:3: note: in expansion of macro ‘MISSING_CASE’ MISSING_CASE(type); ^~~~~~~~~~~~ drivers/gpu/drm/i915/gem/i915_gem_pages.c:272:2: note: here case I915_MAP_WB: ^~~~ drivers/gpu/drm/i915/i915_gpu_error.c: In function ‘error_record_engine_registers’: ./include/linux/compiler.h:78:22: warning: this statement may fall through [-Wimplicit-fallthrough=] # define unlikely(x) __builtin_expect(!!(x), 0) ^~~~~~~~~~~~~~~~~~~~~~~~~~ ./include/asm-generic/bug.h:136:2: note: in expansion of macro ‘unlikely’ unlikely(__ret_warn_on); \ ^~~~~~~~ drivers/gpu/drm/i915/i915_utils.h:49:25: note: in expansion of macro ‘WARN’ #define MISSING_CASE(x) WARN(1, "Missing case (%s == %ld)\n", \ ^~~~ drivers/gpu/drm/i915/i915_gpu_error.c:1196:5: note: in expansion of macro ‘MISSING_CASE’ MISSING_CASE(engine->id); ^~~~~~~~~~~~ drivers/gpu/drm/i915/i915_gpu_error.c:1197:4: note: here case RCS0: ^~~~ drivers/gpu/drm/i915/display/intel_dp.c: In function ‘intel_dp_get_fia_supported_lane_count’: ./include/linux/compiler.h:78:22: warning: this statement may fall through [-Wimplicit-fallthrough=] # define unlikely(x) __builtin_expect(!!(x), 0) ^~~~~~~~~~~~~~~~~~~~~~~~~~ ./include/asm-generic/bug.h:136:2: note: in expansion of macro ‘unlikely’ unlikely(__ret_warn_on); \ ^~~~~~~~ drivers/gpu/drm/i915/i915_utils.h:49:25: note: in expansion of macro ‘WARN’ #define MISSING_CASE(x) WARN(1, "Missing case (%s == %ld)\n", \ ^~~~ drivers/gpu/drm/i915/display/intel_dp.c:233:3: note: in expansion of macro ‘MISSING_CASE’ MISSING_CASE(lane_info); ^~~~~~~~~~~~ drivers/gpu/drm/i915/display/intel_dp.c:234:2: note: here case 1: ^~~~ drivers/gpu/drm/i915/display/intel_display.c: In function ‘check_digital_port_conflicts’: CC [M] drivers/gpu/drm/nouveau/nvkm/engine/disp/cursgv100.o drivers/gpu/drm/i915/display/intel_display.c:12043:7: warning: this statement may fall through [-Wimplicit-fallthrough=] if (WARN_ON(!HAS_DDI(to_i915(dev)))) ^ drivers/gpu/drm/i915/display/intel_display.c:12046:3: note: here case INTEL_OUTPUT_DP: ^~~~ Also, notice that the Makefile is modified to stop ignoring fall-through warnings. The -Wimplicit-fallthrough option will be enabled globally in v5.3. Warning level 3 was used: -Wimplicit-fallthrough=3 This patch is part of the ongoing efforts to enable -Wimplicit-fallthrough. Reviewed-by: Kees Cook Signed-off-by: Gustavo A. R. Silva commit 9e87891799dc4b203ad680ff431bfcce679c89be Author: Gustavo A. R. Silva Date: Thu Jul 25 19:13:51 2019 -0500 drm/amd/display: Mark expected switch fall-throughs In preparation to enabling -Wimplicit-fallthrough, mark switch cases where we are expecting to fall through. Warning level 3 was used: -Wimplicit-fallthrough=3 This patch is part of the ongoing efforts to enable -Wimplicit-fallthrough. Signed-off-by: Gustavo A. R. Silva commit 12fce1ab4ad97773a19b7de4f5f4953cb74e9881 Author: Gustavo A. R. Silva Date: Mon Jul 22 11:26:31 2019 -0500 drm/amdkfd/kfd_mqd_manager_v10: Avoid fall-through warning In preparation to enabling -Wimplicit-fallthrough, this patch silences the following warning: drivers/gpu/drm/amd/amdgpu/../amdkfd/kfd_mqd_manager_v10.c: In function ‘mqd_manager_init_v10’: ./include/linux/dynamic_debug.h:122:52: warning: this statement may fall through [-Wimplicit-fallthrough=] #define __dynamic_func_call(id, fmt, func, ...) do { \ ^ ./include/linux/dynamic_debug.h:143:2: note: in expansion of macro ‘__dynamic_func_call’ __dynamic_func_call(__UNIQUE_ID(ddebug), fmt, func, ##__VA_ARGS__) ^~~~~~~~~~~~~~~~~~~ ./include/linux/dynamic_debug.h:153:2: note: in expansion of macro ‘_dynamic_func_call’ _dynamic_func_call(fmt, __dynamic_pr_debug, \ ^~~~~~~~~~~~~~~~~~ ./include/linux/printk.h:336:2: note: in expansion of macro ‘dynamic_pr_debug’ dynamic_pr_debug(fmt, ##__VA_ARGS__) ^~~~~~~~~~~~~~~~ drivers/gpu/drm/amd/amdgpu/../amdkfd/kfd_mqd_manager_v10.c:432:3: note: in expansion of macro ‘pr_debug’ pr_debug("%s@%i\n", __func__, __LINE__); ^~~~~~~~ drivers/gpu/drm/amd/amdgpu/../amdkfd/kfd_mqd_manager_v10.c:433:2: note: here case KFD_MQD_TYPE_COMPUTE: ^~~~ by removing the call to pr_debug() in KFD_MQD_TYPE_CP: "The mqd init for CP and COMPUTE will have the same routine." [1] This bug was found thanks to the ongoing efforts to enable -Wimplicit-fallthrough. [1] https://lore.kernel.org/lkml/c735a1cc-a545-50fb-44e7-c0ad93ee8ee7@amd.com/ Reviewed-by: Alex Deucher Signed-off-by: Gustavo A. R. Silva commit d64062b57eeb58d4928aed945515bf53f7944913 Author: Gustavo A. R. Silva Date: Sun Jul 21 17:37:33 2019 -0500 drm/amdgpu/gfx10: Fix missing break in switch statement Add missing break statement in order to prevent the code from falling through to case AMDGPU_IRQ_STATE_ENABLE. This bug was found thanks to the ongoing efforts to enable -Wimplicit-fallthrough. Fixes: a644d85a5cd4 ("drm/amdgpu: add gfx v10 implementation (v10)") Cc: stable@vger.kernel.org Reviewed-by: Alex Deucher Signed-off-by: Gustavo A. R. Silva commit 737298d18836fd14b8820de6504536c998986bcd Author: Gustavo A. R. Silva Date: Sun Jul 21 16:41:37 2019 -0500 drm/amdkfd: Fix missing break in switch statement Add missing break statement in order to prevent the code from falling through to case CHIP_NAVI10. This bug was found thanks to the ongoing efforts to enable -Wimplicit-fallthrough. Fixes: 14328aa58ce5 ("drm/amdkfd: Add navi10 support to amdkfd. (v3)") Cc: stable@vger.kernel.org Reviewed-by: Alex Deucher Signed-off-by: Gustavo A. R. Silva commit 7b26b91d3b2320a64af63b6ec989ee3bed59f0d3 Author: Gustavo A. R. Silva Date: Mon Jun 24 11:11:07 2019 -0500 perf/x86/intel: Mark expected switch fall-throughs In preparation to enabling -Wimplicit-fallthrough, mark switch cases where we are expecting to fall through. This patch fixes the following warnings: arch/x86/events/intel/core.c: In function ‘intel_pmu_init’: arch/x86/events/intel/core.c:4959:8: warning: this statement may fall through [-Wimplicit-fallthrough=] pmem = true; ~~~~~^~~~~~ arch/x86/events/intel/core.c:4960:2: note: here case INTEL_FAM6_SKYLAKE_MOBILE: ^~~~ arch/x86/events/intel/core.c:5008:8: warning: this statement may fall through [-Wimplicit-fallthrough=] pmem = true; ~~~~~^~~~~~ arch/x86/events/intel/core.c:5009:2: note: here case INTEL_FAM6_ICELAKE_MOBILE: ^~~~ Warning level 3 was used: -Wimplicit-fallthrough=3 This patch is part of the ongoing efforts to enable -Wimplicit-fallthrough. Signed-off-by: Gustavo A. R. Silva commit cc4070449a5bd700c02de4a9d37adb40e116773d Author: Gustavo A. R. Silva Date: Tue Jun 4 08:58:02 2019 -0500 mtd: onenand_base: Mark expected switch fall-through In preparation to enabling -Wimplicit-fallthrough, mark switch cases where we are expecting to fall through. This patch fixes the following warning: drivers/mtd/nand/onenand/onenand_base.c: In function ‘onenand_check_features’: drivers/mtd/nand/onenand/onenand_base.c:3264:17: warning: this statement may fall through [-Wimplicit-fallthrough=] this->options |= ONENAND_HAS_NOP_1; drivers/mtd/nand/onenand/onenand_base.c:3265:2: note: here case ONENAND_DEVICE_DENSITY_4Gb: ^~~~ Warning level 3 was used: -Wimplicit-fallthrough=3 This patch is part of the ongoing efforts to enable -Wimplicit-fallthrough. Cc: Jonathan Bakker Signed-off-by: Gustavo A. R. Silva commit 2988160827b780eec3f958ade2100cc223d4d2d6 Author: Gustavo A. R. Silva Date: Sun May 19 18:43:53 2019 -0500 afs: fsclient: Mark expected switch fall-throughs In preparation to enabling -Wimplicit-fallthrough, mark switch cases where we are expecting to fall through. This patch fixes the following warnings: Warning level 3 was used: -Wimplicit-fallthrough=3 fs/afs/fsclient.c: In function ‘afs_deliver_fs_fetch_acl’: fs/afs/fsclient.c:2199:19: warning: this statement may fall through [-Wimplicit-fallthrough=] call->unmarshall++; ~~~~~~~~~~~~~~~~^~ fs/afs/fsclient.c:2202:2: note: here case 1: ^~~~ fs/afs/fsclient.c:2216:19: warning: this statement may fall through [-Wimplicit-fallthrough=] call->unmarshall++; ~~~~~~~~~~~~~~~~^~ fs/afs/fsclient.c:2219:2: note: here case 2: ^~~~ fs/afs/fsclient.c:2225:19: warning: this statement may fall through [-Wimplicit-fallthrough=] call->unmarshall++; ~~~~~~~~~~~~~~~~^~ fs/afs/fsclient.c:2228:2: note: here case 3: ^~~~ This patch is part of the ongoing efforts to enable -Wimplicit-fallthrough. Signed-off-by: Gustavo A. R. Silva commit 35a3a90cc56cee54fb4d45afbbc6dfea0835de0c Author: Gustavo A. R. Silva Date: Sun May 19 18:56:50 2019 -0500 afs: yfsclient: Mark expected switch fall-throughs In preparation to enabling -Wimplicit-fallthrough, mark switch cases where we are expecting to fall through. This patch fixes the following warnings: fs/afs/yfsclient.c: In function ‘yfs_deliver_fs_fetch_opaque_acl’: fs/afs/yfsclient.c:1984:19: warning: this statement may fall through [-Wimplicit-fallthrough=] call->unmarshall++; ~~~~~~~~~~~~~~~~^~ fs/afs/yfsclient.c:1987:2: note: here case 1: ^~~~ fs/afs/yfsclient.c:2005:19: warning: this statement may fall through [-Wimplicit-fallthrough=] call->unmarshall++; ~~~~~~~~~~~~~~~~^~ fs/afs/yfsclient.c:2008:2: note: here case 2: ^~~~ fs/afs/yfsclient.c:2014:19: warning: this statement may fall through [-Wimplicit-fallthrough=] call->unmarshall++; ~~~~~~~~~~~~~~~~^~ fs/afs/yfsclient.c:2017:2: note: here case 3: ^~~~ fs/afs/yfsclient.c:2035:19: warning: this statement may fall through [-Wimplicit-fallthrough=] call->unmarshall++; ~~~~~~~~~~~~~~~~^~ fs/afs/yfsclient.c:2038:2: note: here case 4: ^~~~ fs/afs/yfsclient.c:2047:19: warning: this statement may fall through [-Wimplicit-fallthrough=] call->unmarshall++; ~~~~~~~~~~~~~~~~^~ fs/afs/yfsclient.c:2050:2: note: here case 5: ^~~~ Warning level 3 was used: -Wimplicit-fallthrough=3 Also, fix some commenting style issues. This patch is part of the ongoing efforts to enable -Wimplicit-fallthrough. Signed-off-by: Gustavo A. R. Silva commit 5a8dadbcfa6b04ea3be6f0ffa04eba173c865378 Author: Gustavo A. R. Silva Date: Tue Jan 29 11:59:28 2019 -0600 can: mark expected switch fall-throughs In preparation to enabling -Wimplicit-fallthrough, mark switch cases where we are expecting to fall through. This patch fixes the following warnings: drivers/net/can/peak_canfd/peak_pciefd_main.c:668:3: warning: this statement may fall through [-Wimplicit-fallthrough=] drivers/net/can/spi/mcp251x.c:875:7: warning: this statement may fall through [-Wimplicit-fallthrough=] drivers/net/can/usb/peak_usb/pcan_usb.c:422:6: warning: this statement may fall through [-Wimplicit-fallthrough=] drivers/net/can/at91_can.c:895:6: warning: this statement may fall through [-Wimplicit-fallthrough=] drivers/net/can/at91_can.c:953:15: warning: this statement may fall through [-Wimplicit-fallthrough=] drivers/net/can/usb/peak_usb/pcan_usb.c: In function ‘pcan_usb_decode_error’: drivers/net/can/usb/peak_usb/pcan_usb.c:422:6: warning: this statement may fall through [-Wimplicit-fallthrough=] if (n & PCAN_USB_ERROR_BUS_LIGHT) { ^ drivers/net/can/usb/peak_usb/pcan_usb.c:428:2: note: here case CAN_STATE_ERROR_WARNING: ^~~~ Warning level 3 was used: -Wimplicit-fallthrough=3 This patch is part of the ongoing efforts to enabling -Wimplicit-fallthrough. Notice that in some cases spelling mistakes were fixed. In other cases, the /* fall through */ comment is placed at the bottom of the case statement, which is what GCC is expecting to find. Signed-off-by: Gustavo A. R. Silva commit eba6120de93b8d5f2987fac1f533c35b53eaa771 Author: Gustavo A. R. Silva Date: Mon Feb 11 11:48:21 2019 -0600 firewire: mark expected switch fall-throughs In preparation to enabling -Wimplicit-fallthrough, mark switch cases where we are expecting to fall through. This patch fixes the following warnings: drivers/firewire/core-device.c: In function ‘set_broadcast_channel’: drivers/firewire/core-device.c:969:7: warning: this statement may fall through [-Wimplicit-fallthrough=] if (data & cpu_to_be32(1 << 31)) { ^ drivers/firewire/core-device.c:974:3: note: here case RCODE_ADDRESS_ERROR: ^~~~ drivers/firewire/core-iso.c: In function ‘manage_channel’: drivers/firewire/core-iso.c:308:7: warning: this statement may fall through [-Wimplicit-fallthrough=] if ((data[0] & bit) == (data[1] & bit)) ^ drivers/firewire/core-iso.c:312:3: note: here default: ^~~~~~~ drivers/firewire/core-topology.c: In function ‘count_ports’: drivers/firewire/core-topology.c:69:23: warning: this statement may fall through [-Wimplicit-fallthrough=] (*child_port_count)++; ~~~~~~~~~~~~~~~~~~~^~ drivers/firewire/core-topology.c:70:3: note: here case SELFID_PORT_PARENT: ^~~~ Warning level 3 was used: -Wimplicit-fallthrough=3 Notice that in some cases, the code comment is modified in accordance with what GCC is expecting to find. This patch is part of the ongoing efforts to enable -Wimplicit-fallthrough. Cc: Kees Cook Cc: Mathieu Malaterre Signed-off-by: Stefan Richter (reworded a comment) Signed-off-by: Gustavo A. R. Silva commit 28ba934d28cf46c1ea92f6aff28e8d9ec52e194e Merge: 47d858d0bdcd cb8ffde5694a Author: David S. Miller Date: Thu Jul 25 17:35:03 2019 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf Alexei Starovoitov says: ==================== pull-request: bpf 2019-07-25 The following pull-request contains BPF updates for your *net* tree. The main changes are: 1) fix segfault in libbpf, from Andrii. 2) fix gso_segs access, from Eric. 3) tls/sockmap fixes, from Jakub and John. ==================== Signed-off-by: David S. Miller commit 47d858d0bdcd47cc1c6c9eeca91b091dd9e55637 Author: Haishuang Yan Date: Thu Jul 25 11:07:56 2019 +0800 ipip: validate header length in ipip_tunnel_xmit We need the same checks introduced by commit cb9f1b783850 ("ip: validate header length on virtual device xmit") for ipip tunnel. Fixes: cb9f1b783850b ("ip: validate header length on virtual device xmit") Signed-off-by: Haishuang Yan Signed-off-by: David S. Miller commit 53db1cced401e4c65d49edf198e00daa9fc837e6 Author: Jakub Kicinski Date: Wed Jul 24 17:07:14 2019 -0700 selftests/net: add missing gitignores (ipv6_flowlabel) ipv6_flowlabel and ipv6_flowlabel_mgr are missing from gitignore. Quentin points out that the original commit 3fb321fde22d ("selftests/net: ipv6 flowlabel") did add ignore entries, they are just missing the "ipv6_" prefix. Signed-off-by: Jakub Kicinski Reviewed-by: Quentin Monnet Acked-by: Willem de Bruijn Signed-off-by: David S. Miller commit d1f0b5dce8fda09a7f5f04c1878f181d548e42f5 Author: Sudarsana Reddy Kalluru Date: Tue Jul 23 19:32:41 2019 -0700 bnx2x: Disable multi-cos feature. Commit 3968d38917eb ("bnx2x: Fix Multi-Cos.") which enabled multi-cos feature after prolonged time in driver added some regression causing numerous issues (sudden reboots, tx timeout etc.) reported by customers. We plan to backout this commit and submit proper fix once we have root cause of issues reported with this feature enabled. Fixes: 3968d38917eb ("bnx2x: Fix Multi-Cos.") Signed-off-by: Sudarsana Reddy Kalluru Signed-off-by: Manish Chopra Signed-off-by: David S. Miller commit 173e6ee21e2b3f477f07548a79c43b8d9cfbb37d Author: Arnd Bergmann Date: Mon Jul 22 13:41:20 2019 +0200 structleak: disable STRUCTLEAK_BYREF in combination with KASAN_STACK The combination of KASAN_STACK and GCC_PLUGIN_STRUCTLEAK_BYREF leads to much larger kernel stack usage, as seen from the warnings about functions that now exceed the 2048 byte limit: drivers/media/i2c/tvp5150.c:253:1: error: the frame size of 3936 bytes is larger than 2048 bytes drivers/media/tuners/r820t.c:1327:1: error: the frame size of 2816 bytes is larger than 2048 bytes drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_n.c:16552:1: error: the frame size of 3144 bytes is larger than 2048 bytes [-Werror=frame-larger-than=] fs/ocfs2/aops.c:1892:1: error: the frame size of 2088 bytes is larger than 2048 bytes fs/ocfs2/dlm/dlmrecovery.c:737:1: error: the frame size of 2088 bytes is larger than 2048 bytes fs/ocfs2/namei.c:1677:1: error: the frame size of 2584 bytes is larger than 2048 bytes fs/ocfs2/super.c:1186:1: error: the frame size of 2640 bytes is larger than 2048 bytes fs/ocfs2/xattr.c:3678:1: error: the frame size of 2176 bytes is larger than 2048 bytes net/bluetooth/l2cap_core.c:7056:1: error: the frame size of 2144 bytes is larger than 2048 bytes [-Werror=frame-larger-than=] net/bluetooth/l2cap_core.c: In function 'l2cap_recv_frame': net/bridge/br_netlink.c:1505:1: error: the frame size of 2448 bytes is larger than 2048 bytes net/ieee802154/nl802154.c:548:1: error: the frame size of 2232 bytes is larger than 2048 bytes net/wireless/nl80211.c:1726:1: error: the frame size of 2224 bytes is larger than 2048 bytes net/wireless/nl80211.c:2357:1: error: the frame size of 4584 bytes is larger than 2048 bytes net/wireless/nl80211.c:5108:1: error: the frame size of 2760 bytes is larger than 2048 bytes net/wireless/nl80211.c:6472:1: error: the frame size of 2112 bytes is larger than 2048 bytes The structleak plugin was previously disabled for CONFIG_COMPILE_TEST, but meant we missed some bugs, so this time we should address them. The frame size warnings are distracting, and risking a kernel stack overflow is generally not beneficial to performance, so it may be best to disallow that particular combination. This can be done by turning off either one. I picked the dependency in GCC_PLUGIN_STRUCTLEAK_BYREF and GCC_PLUGIN_STRUCTLEAK_BYREF_ALL, as this option is designed to make uninitialized stack usage less harmful when enabled on its own, but it also prevents KASAN from detecting those cases in which it was in fact needed. KASAN_STACK is currently implied by KASAN on gcc, but could be made a user selectable option if we want to allow combining (non-stack) KASAN with GCC_PLUGIN_STRUCTLEAK_BYREF. Note that it would be possible to specifically address the files that print the warning, but presumably the overall stack usage is still significantly higher than in other configurations, so this would not address the full problem. I could not test this with CONFIG_INIT_STACK_ALL, which may or may not suffer from a similar problem. Fixes: 81a56f6dcd20 ("gcc-plugins: structleak: Generalize to all variable types") Signed-off-by: Arnd Bergmann Link: https://lore.kernel.org/r/20190722114134.3123901-1-arnd@arndb.de Signed-off-by: Kees Cook commit 280c089916228a005af7f95c1716ea1fea1027b5 Author: Tariq Toukan Date: Mon Jul 22 13:43:03 2019 +0300 Documentation: TLS: fix stat counters description Add missing description of counters. Split tx_tls_encrypted counter into two, to give packets and bytes indications. Fixes: f42c104f2ec9 ("Documentation: add TLS offload documentation") Suggested-by: Jakub Kicinski Signed-off-by: Tariq Toukan Signed-off-by: Saeed Mahameed commit 4ea52e25089724abf7ee2d6c0c52064e49252b64 Author: Tariq Toukan Date: Thu Jul 18 16:34:05 2019 +0300 nfp: tls: rename tls packet counters Align to the naming convention in TLS documentation. Fixes: 51a5e563298d ("nfp: tls: add basic statistics") Suggested-by: Jakub Kicinski Signed-off-by: Tariq Toukan Signed-off-by: Saeed Mahameed commit 304ecc9a34b81a8b03b685f4460d0f9c1d6d4df9 Author: Tariq Toukan Date: Thu Jul 18 16:32:31 2019 +0300 net/mlx5e: kTLS, Call WARN_ONCE on netdev mismatch A netdev mismatch in the processed TLS SKB should not occur, and indicates a kernel bug. Add WARN_ONCE to spot such cases. Fixes: d2ead1f360e8 ("net/mlx5e: Add kTLS TX HW offload support") Suggested-by: Jakub Kicinski Signed-off-by: Tariq Toukan Signed-off-by: Saeed Mahameed commit 90bb769291161cf25a818d69cf608c181654473e Author: Ariel Levkovich Date: Sat Jul 6 18:06:15 2019 +0300 net/mlx5e: Prevent encap flow counter update async to user query This patch prevents a race between user invoked cached counters query and a neighbor last usage updater. The cached flow counter stats can be queried by calling "mlx5_fc_query_cached" which provides the number of bytes and packets that passed via this flow since the last time this counter was queried. It does so by reducting the last saved stats from the current, cached stats and then updating the last saved stats with the cached stats. It also provide the lastuse value for that flow. Since "mlx5e_tc_update_neigh_used_value" needs to retrieve the last usage time of encapsulation flows, it calls the flow counter query method periodically and async to user queries of the flow counter using cls_flower. This call is causing the driver to update the last reported bytes and packets from the cache and therefore, future user queries of the flow stats will return lower than expected number for bytes and packets since the last saved stats in the driver was updated async to the last saved stats in cls_flower. This causes wrong stats presentation of encapsulation flows to user. Since the neighbor usage updater only needs the lastuse stats from the cached counter, the fix is to use a dedicated lastuse query call that returns the lastuse value without synching between the cached stats and the last saved stats. Fixes: f6dfb4c3f216 ("net/mlx5e: Update neighbour 'used' state using HW flow rules counters") Signed-off-by: Ariel Levkovich Reviewed-by: Roi Dayan Signed-off-by: Saeed Mahameed commit 4b95840a6ced0634082f6d962ba9aa0ce797f12f Author: Aya Levin Date: Sun Jun 16 13:20:29 2019 +0300 net/mlx5e: Fix matching of speed to PRM link modes Speed translation is performed based on legacy or extended PTYS register. Translate speed with respect to: 1) Capability bit of extended PTYS table. 2) User request: a) When auto-negotiation is turned on, inspect advertisement whether it contains extended link modes. b) When auto-negotiation is turned off, speed > 100Gbps (maximal speed supported in legacy mode). With both conditions fulfilled translation is done with extended PTYS table otherwise use legacy PTYS table. Without this patch 25/50/100 Gbps speed cannot be set, since try to configure in extended mode but read from legacy mode. Fixes: dd1b9e09c12b ("net/mlx5: ethtool, Allow legacy link-modes configuration via non-extended ptys") Signed-off-by: Aya Levin Signed-off-by: Saeed Mahameed commit 694826e366349d5b27599f591d3bd3a53512306e Author: Tariq Toukan Date: Sun Jul 14 11:43:43 2019 +0300 net/mlx5e: Fix wrong max num channels indication No XSK support in the enhanced IPoIB driver and representors. Add a profile property to specify this, and enhance the logic that calculates the max number of channels to take it into account. Fixes: db05815b36cb ("net/mlx5e: Add XSK zero-copy support") Signed-off-by: Tariq Toukan Signed-off-by: Saeed Mahameed commit 7a32f2962c56d9d8a836b4469855caeee8766bd4 Author: Edward Srouji Date: Tue Jul 23 10:12:55 2019 +0300 net/mlx5: Fix modify_cq_in alignment Fix modify_cq_in alignment to match the device specification. After this fix the 'cq_umem_valid' field will be in the right offset. Cc: # 4.19 Fixes: bd37197554eb ("net/mlx5: Update mlx5_ifc with DEVX UID bits") Signed-off-by: Edward Srouji Reviewed-by: Yishai Hadas Signed-off-by: Leon Romanovsky Signed-off-by: Saeed Mahameed commit 987f6c69dd923069d443f6a37225f5b1630a30f2 Author: Maor Gottlieb Date: Sun Jul 14 11:33:07 2019 +0300 net/mlx5: Add missing RDMA_RX capabilities New flow table type RDMA_RX was added but the MLX5_CAP_FLOW_TABLE_TYPE didn't handle this new flow table type. This means that MLX5_CAP_FLOW_TABLE_TYPE returns an empty capability to this flow table type. Update both the macro and the maximum supported flow table type to RDMA_RX. Fixes: d83eb50e29de ("net/mlx5: Add support in RDMA RX steering") Signed-off-by: Maor Gottlieb Signed-off-by: Saeed Mahameed commit 08aa5e7da6bce1a1963f63cf32c2e7ad434ad578 Author: Mark Zhang Date: Tue Jul 9 05:37:12 2019 +0300 net/mlx5: Use reversed order when unregister devices When lag is active, which is controlled by the bonded mlx5e netdev, mlx5 interface unregestering must happen in the reverse order where rdma is unregistered (unloaded) first, to guarantee all references to the lag context in hardware is removed, then remove mlx5e netdev interface which will cleanup the lag context from hardware. Without this fix during destroy of LAG interface, we observed following errors: * mlx5_cmd_check:752:(pid 12556): DESTROY_LAG(0x843) op_mod(0x0) failed, status bad parameter(0x3), syndrome (0xe4ac33) * mlx5_cmd_check:752:(pid 12556): DESTROY_LAG(0x843) op_mod(0x0) failed, status bad parameter(0x3), syndrome (0xa5aee8). Fixes: a31208b1e11d ("net/mlx5_core: New init and exit flow for mlx5_core") Reviewed-by: Parav Pandit Reviewed-by: Leon Romanovsky Signed-off-by: Mark Zhang Signed-off-by: Saeed Mahameed commit de4ee728465f7c0c29241550e083139b2ce9159c Author: Christoph Hellwig Date: Wed Jul 24 08:52:55 2019 +0200 nouveau: unlock mmap_sem on all errors from nouveau_range_fault Currently nouveau_svm_fault expects nouveau_range_fault to never unlock mmap_sem, but the latter unlocks it for a random selection of error codes. Fix this up by always unlocking mmap_sem for non-zero return values in nouveau_range_fault, and only unlocking it in the caller for successful returns. Link: https://lore.kernel.org/r/20190724065258.16603-5-hch@lst.de Tested-by: Ralph Campbell Signed-off-by: Christoph Hellwig Reviewed-by: Jason Gunthorpe Signed-off-by: Jason Gunthorpe commit 5fbcf5015db8e9f04a9da6d40322622fa229da54 Author: Christoph Hellwig Date: Wed Jul 24 08:52:54 2019 +0200 nouveau: remove the block parameter to nouveau_range_fault The parameter is always false, so remove it as well as the -EAGAIN handling that can only happen for the non-blocking case. Link: https://lore.kernel.org/r/20190724065258.16603-4-hch@lst.de Tested-by: Ralph Campbell Signed-off-by: Christoph Hellwig Reviewed-by: Jason Gunthorpe Signed-off-by: Jason Gunthorpe commit 02712bc3250849c1cf99d626aea98f610e695f34 Author: Christoph Hellwig Date: Wed Jul 24 08:52:53 2019 +0200 mm/hmm: move hmm_vma_range_done and hmm_vma_fault to nouveau These two functions are marked as a legacy APIs to get rid of, but seem to suit the current nouveau flow. Move it to the only user in preparation for fixing a locking bug involving caller and callee. All comments referring to the old API have been removed as this now is a driver private helper. Link: https://lore.kernel.org/r/20190724065258.16603-3-hch@lst.de Tested-by: Ralph Campbell Signed-off-by: Christoph Hellwig Reviewed-by: Jason Gunthorpe Signed-off-by: Jason Gunthorpe commit 2bcbeaefde2f0384d6ad351c151b1a9fe7791a0a Author: Christoph Hellwig Date: Wed Jul 24 08:52:52 2019 +0200 mm/hmm: always return EBUSY for invalid ranges in hmm_range_{fault,snapshot} We should not have two different error codes for the same condition. EAGAIN must be reserved for the FAULT_FLAG_ALLOW_RETRY retry case and signals to the caller that the mmap_sem has been unlocked. Use EBUSY for the !valid case so that callers can get the locking right. Link: https://lore.kernel.org/r/20190724065258.16603-2-hch@lst.de Tested-by: Ralph Campbell Signed-off-by: Christoph Hellwig Reviewed-by: Ralph Campbell Reviewed-by: Jason Gunthorpe Reviewed-by: Felix Kuehling [jgg: elaborated commit message] Signed-off-by: Jason Gunthorpe commit 83fbae60fd3885c6e8da5863582d0317731c5528 Author: Chris Packham Date: Wed Jul 24 11:35:01 2019 +1200 fsl/fman: Remove comment referring to non-existent function fm_set_max_frm() existed in the Freescale SDK as a callback for an early_param. When this code was ported to the upstream kernel the early_param was converted to a module_param making the reference to the function incorrect. The rest of the comment already does a good job of explaining the parameter so removing the reference to the non-existent function seems like the best thing to do. Signed-off-by: Chris Packham Signed-off-by: David S. Miller commit 3008e06fdf0973770370f97d5f1fba3701d8281d Author: Navid Emamdoost Date: Tue Jul 23 17:11:51 2019 -0500 st_nci_hci_connectivity_event_received: null check the allocation devm_kzalloc may fail and return NULL. So the null check is needed. Signed-off-by: Navid Emamdoost Signed-off-by: David S. Miller commit 9891d06836e67324c9e9c4675ed90fc8b8110034 Author: Navid Emamdoost Date: Tue Jul 23 17:04:30 2019 -0500 st21nfca_connectivity_event_received: null check the allocation devm_kzalloc may fail and return null. So the null check is needed. Signed-off-by: Navid Emamdoost Signed-off-by: David S. Miller commit 4b663366246be1d1d4b1b8b01245b2e88ad9e706 Author: Alexis Bauvin Date: Tue Jul 23 16:23:01 2019 +0200 tun: mark small packets as owned by the tap sock - v1 -> v2: Move skb_set_owner_w to __tun_build_skb to reduce patch size Small packets going out of a tap device go through an optimized code path that uses build_skb() rather than sock_alloc_send_pskb(). The latter calls skb_set_owner_w(), but the small packet code path does not. The net effect is that small packets are not owned by the userland application's socket (e.g. QEMU), while large packets are. This can be seen with a TCP session, where packets are not owned when the window size is small enough (around PAGE_SIZE), while they are once the window grows (note that this requires the host to support virtio tso for the guest to offload segmentation). All this leads to inconsistent behaviour in the kernel, especially on netfilter modules that uses sk->socket (e.g. xt_owner). Fixes: 66ccbc9c87c2 ("tap: use build_skb() for small packet") Signed-off-by: Alexis Bauvin Acked-by: Jason Wang Signed-off-by: David S. Miller commit 16b2084a8afa1432d14ba72b7c97d7908e178178 Merge: c8ec4632c6ac f8be17b81d44 Author: David S. Miller Date: Thu Jul 25 11:34:39 2019 -0700 Merge branch 'dim-fixes' Leon Romanovsky says: ==================== DIM fixes for 5.3 Those two fixes for recently merged DIM patches, both exposed through RDMa DIM usage. ==================== Signed-off-by: David S. Miller commit f8be17b81d44aed1f9ea68c3fc70f501c9616e2d Author: Leon Romanovsky Date: Tue Jul 23 10:22:48 2019 +0300 lib/dim: Fix -Wunused-const-variable warnings DIM causes to the following warnings during kernel compilation which indicates that tx_profile and rx_profile are supposed to be declared in *.c and not in *.h files. In file included from ./include/rdma/ib_verbs.h:64, from ./include/linux/mlx5/device.h:37, from ./include/linux/mlx5/driver.h:51, from ./include/linux/mlx5/vport.h:36, from drivers/infiniband/hw/mlx5/ib_virt.c:34: ./include/linux/dim.h:326:1: warning: _tx_profile_ defined but not used [-Wunused-const-variable=] 326 | tx_profile[DIM_CQ_PERIOD_NUM_MODES][NET_DIM_PARAMS_NUM_PROFILES] = { | ^~~~~~~~~~ ./include/linux/dim.h:320:1: warning: _rx_profile_ defined but not used [-Wunused-const-variable=] 320 | rx_profile[DIM_CQ_PERIOD_NUM_MODES][NET_DIM_PARAMS_NUM_PROFILES] = { | ^~~~~~~~~~ Fixes: 4f75da3666c0 ("linux/dim: Move implementation to .c files") Signed-off-by: Leon Romanovsky Reviewed-by: Bart Van Assche Acked-by: Saeed Mahameed Signed-off-by: David S. Miller commit f06d0ca45827a5790d7508de4759aed976933d4d Author: Yamin Friedman Date: Tue Jul 23 10:22:47 2019 +0300 linux/dim: Fix overflow in dim calculation While using net_dim, a dim_sample was used without ever initializing the comps value. Added use of DIV_ROUND_DOWN_ULL() to prevent potential overflow, it should not be a problem to save the final result in an int because after the division by epms the value should not be larger than a few thousand. [ 1040.127124] UBSAN: Undefined behaviour in lib/dim/dim.c:78:23 [ 1040.130118] signed integer overflow: [ 1040.131643] 134718714 * 100 cannot be represented in type 'int' Fixes: 398c2b05bbee ("linux/dim: Add completions count to dim_sample") Signed-off-by: Yamin Friedman Signed-off-by: Leon Romanovsky Acked-by: Saeed Mahameed Signed-off-by: David S. Miller commit c8ec4632c6ac9cda0e8c3d51aa41eeab66585bd5 Author: Cong Wang Date: Mon Jul 22 21:43:00 2019 -0700 ife: error out when nla attributes are empty act_ife at least requires TCA_IFE_PARMS, so we have to bail out when there is no attribute passed in. Reported-by: syzbot+fbb5b288c9cb6a2eeac4@syzkaller.appspotmail.com Fixes: ef6980b6becb ("introduce IFE action") Cc: Jamal Hadi Salim Cc: Jiri Pirko Signed-off-by: Cong Wang Signed-off-by: David S. Miller commit 66013e8ec6850f9c62df6aea555fe7668e84dc3c Author: Rajneesh Bhardwaj Date: Fri Jun 14 13:39:40 2019 +0530 platform/x86: intel_pmc_core: Add ICL-NNPI support to PMC Core Ice Lake Neural Network Processor for deep learning inference a.k.a. ICL-NNPI can re-use Ice Lake Mobile regmap to enable Intel PMC Core driver on it. Cc: Darren Hart Cc: Andy Shevchenko Cc: platform-driver-x86@vger.kernel.org Link: https://lkml.org/lkml/2019/6/5/1034 Signed-off-by: Rajneesh Bhardwaj Signed-off-by: Andy Shevchenko commit 6acf5d76ab685e921771abbbae5353929f3ebbe6 Author: Lubomir Rintel Date: Tue Jul 23 11:20:22 2019 +0200 Platform: OLPC: add SPI MODULE_DEVICE_TABLE The SPI bus creates a device with the modalias of "xo1.75-ec". This fixes XO-1.75 EC driver autoloading Fixes: 0c3d931b3ab9 ("Platform: OLPC: Add XO-1.75 EC driver") Signed-off-by: Lubomir Rintel Signed-off-by: Andy Shevchenko commit cb8ffde5694ae5fffb456eae932aac442aa3a207 Author: Andrii Nakryiko Date: Wed Jul 24 14:47:53 2019 -0700 libbpf: silence GCC8 warning about string truncation Despite a proper NULL-termination after strncpy(..., ..., IFNAMSIZ - 1), GCC8 still complains about *expected* string truncation: xsk.c:330:2: error: 'strncpy' output may be truncated copying 15 bytes from a string of length 15 [-Werror=stringop-truncation] strncpy(ifr.ifr_name, xsk->ifname, IFNAMSIZ - 1); This patch gets rid of the issue altogether by using memcpy instead. There is no performance regression, as strncpy will still copy and fill all of the bytes anyway. v1->v2: - rebase against bpf tree. Cc: Magnus Karlsson Signed-off-by: Andrii Nakryiko Acked-by: Magnus Karlsson Acked-by: Song Liu Signed-off-by: Alexei Starovoitov commit 8732d85a69a0411f16a4b78df8fdc7b09c50a849 Author: Mattias Jacobsson <2pi@mok.nu> Date: Fri Jul 19 19:51:45 2019 +0200 platform/x86: wmi: add missing struct parameter description Add a description for the context parameter in the struct wmi_device_id. Reported-by: kbuild test robot Fixes: a48e23385fcf ("platform/x86: wmi: add context pointer field to struct wmi_device_id") Signed-off-by: Mattias Jacobsson <2pi@mok.nu> Signed-off-by: Andy Shevchenko commit edbfe83def34153a05439ecb3352ae0bb65024de Author: Jean Delvare Date: Sat Jun 29 11:41:36 2019 +0200 platform/x86: pcengines-apuv2: Fix softdep statement Only first MODULE_SOFTDEP statement is handled per module. Multiple dependencies must be expressed in a single statement. Signed-off-by: Jean Delvare Cc: "Enrico Weigelt, metux IT consult" Cc: Darren Hart Cc: Andy Shevchenko [andy: massaged commit message] Signed-off-by: Andy Shevchenko commit 9c0b2596f2ac30967af0b8bb9f038b65926a6f00 Merge: 36703247d5f5 8fe34be14ecb Author: Jens Axboe Date: Thu Jul 25 10:23:15 2019 -0600 Merge branch 'nvme-5.3' of git://git.infradead.org/nvme into for-linus Pull NVMe fixes from Christoph. * 'nvme-5.3' of git://git.infradead.org/nvme: Revert "nvme-pci: don't create a read hctx mapping without read queues" nvme: fix multipath crash when ANA is deactivated nvme: fix memory leak caused by incorrect subsystem free nvme: ignore subnqn for ADATA SX6000LNP commit 36703247d5f52a679df9da51192b6950fe81689f Author: Jens Axboe Date: Thu Jul 25 10:20:18 2019 -0600 io_uring: ensure ->list is initialized for poll commands Daniel reports that when testing an http server that uses io_uring to poll for incoming connections, sometimes it hard crashes. This is due to an uninitialized list member for the io_uring request. Normally this doesn't trigger and none of the test cases caught it. Reported-by: Daniel Kozak Tested-by: Daniel Kozak Signed-off-by: Jens Axboe commit 6789f873ed373319cbf83b56455baf00769bb79a Merge: a51edf751b66 fdc757015782 Author: Linus Torvalds Date: Thu Jul 25 09:07:32 2019 -0700 Merge tag 'pm-5.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull power management fixes from Rafael Wysocki "These fix two issues related to the RAPL MMIO interface support added recently and one cpufreq driver issue. Specifics: - Initialize the power capping subsystem and the RAPL driver earlier in case the int340X thermal driver is built-in and attempts to register an MMIO interface for RAPL which must not happen before the requisite infrastructure is ready (Zhang Rui) - Fix the int340X thermal driver's RAPL MMIO interface registration error path (Rafael Wysocki) - Fix possible use-after-free in the pasemi cpufreq driver (Wen Yang)" * tag 'pm-5.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: cpufreq/pasemi: fix use-after-free in pas_cpufreq_cpu_init() int340X/processor_thermal_device: Fix proc_thermal_rapl_remove() powercap: Invoke powercap_init() and rapl_init() earlier commit a51edf751b660f3fc1d0724bc4cb839bdaf5576c Merge: da3cc2e6f168 26091eef3c17 Author: Linus Torvalds Date: Thu Jul 25 09:02:34 2019 -0700 Merge tag 'riscv/for-v5.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux Pull RISC-V updates from Paul Walmsley: "Four minor RISC-V-related changes: - Add support for the new clone3 syscall for RV64, relying on the generic support - Add DT data for the gigabit Ethernet controller on the SiFive FU540 and the HiFive Unleashed board - Update MAINTAINERS to add me to the arch/riscv maintainers' list - Add support for PCIe message-signaled interrupts by reusing the generic header file" * tag 'riscv/for-v5.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux: riscv: dts: Add DT node for SiFive FU540 Ethernet controller driver riscv: include generic support for MSI irqdomains MAINTAINERS: Add Paul as a RISC-V maintainer riscv: enable sys_clone3 syscall for rv64 commit da3cc2e6f168fd52630892f4672f2f26bd217198 Merge: a29a0a467e2c aecea57f84b0 Author: Linus Torvalds Date: Thu Jul 25 08:58:32 2019 -0700 Merge tag 'ktest-v5.3' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-ktest Pull ktest fixlets from Steven Rostedt: "This contains only simple spelling fixes" * tag 'ktest-v5.3' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-ktest: ktest: Fix some typos in config-bisect.pl commit a29a0a467e2c02fe4287c2d4eff86c9eb6beff0c Merge: bed38c3e2dca d7852fbd0f04 Author: Linus Torvalds Date: Thu Jul 25 08:36:29 2019 -0700 Merge branch 'access-creds' The access() (and faccessat()) credentials change can cause an unnecessary load on the RCU machinery because every access() call ends up freeing the temporary access credential using RCU. This isn't really noticeable on small machines, but if you have hundreds of cores you can cause huge slowdowns due to RCU storms. It's easy to avoid: the temporary access crededntials aren't actually normally accessed using RCU at all, so we can avoid the whole issue by just marking them as such. * access-creds: access: avoid the RCU grace period for the temporary subjective credentials commit 6e7ca09b583de4be6c27d9d4b06e8c5dd46a58fa Author: Nikolay Borisov Date: Thu Jul 25 11:27:29 2019 +0300 btrfs: Fix deadlock caused by missing memory barrier Commit 06297d8cefca ("btrfs: switch extent_buffer blocking_writers from atomic to int") changed the type of blocking_writers but forgot to adjust relevant code in btrfs_tree_unlock by converting the smp_mb__after_atomic to smp_mb. This opened up the possibility of a deadlock due to re-ordering of setting blocking_writers and checking/waking up the waiter. This particular lockup is explained in a comment above waitqueue_active() function. Fix it by converting the memory barrier to a full smp_mb, accounting for the fact that blocking_writers is a simple integer. Fixes: 06297d8cefca ("btrfs: switch extent_buffer blocking_writers from atomic to int") Tested-by: Johannes Thumshirn Signed-off-by: Nikolay Borisov Reviewed-by: David Sterba Signed-off-by: David Sterba commit b7165bd0d6cbb93732559be6ea8774653b204480 Author: Yishai Hadas Date: Tue Jul 23 09:57:29 2019 +0300 IB/mlx5: Fix RSS Toeplitz setup to be aligned with the HW specification The specification for the Toeplitz function doesn't require to set the key explicitly to be symmetric. In case a symmetric functionality is required a symmetric key can be simply used. Wrongly forcing the algorithm to symmetric causes the wrong packet distribution and a performance degradation. Link: https://lore.kernel.org/r/20190723065733.4899-7-leon@kernel.org Cc: # 4.7 Fixes: 28d6137008b2 ("IB/mlx5: Add RSS QP support") Signed-off-by: Yishai Hadas Reviewed-by: Alex Vainman Signed-off-by: Leon Romanovsky Signed-off-by: Jason Gunthorpe commit d191152f43a5869d7dbb50dd2a7a4b3b8b71f1f0 Author: Parav Pandit Date: Tue Jul 23 09:57:33 2019 +0300 IB/counters: Always initialize the port counter object Port counter objects should be initialized even if alloc_stats is unsupported, otherwise QP bind operations in user space can trigger a NULL pointer deference if they try to bind QP on RDMA device which doesn't support counters. Fixes: f34a55e497e8 ("RDMA/core: Get sum value of all counters when perform a sysfs stat read") Link: https://lore.kernel.org/r/20190723065733.4899-11-leon@kernel.org Signed-off-by: Parav Pandit Reviewed-by: Mark Zhang Signed-off-by: Leon Romanovsky Signed-off-by: Jason Gunthorpe commit a379d1ce32f1c97b19d68cffbd195e025dbb9d43 Author: Parav Pandit Date: Tue Jul 23 09:57:32 2019 +0300 IB/core: Fix querying total rdma stats rdma_counter_init() may fail for a device. In such case while calculating total sum, ignore NULL hstats. This fixes below observed call trace. BUG: kernel NULL pointer dereference, address: 00000000000000a0 PGD 8000001009b30067 P4D 8000001009b30067 PUD 10549c9067 PMD 0 Oops: 0000 [#1] SMP PTI CPU: 55 PID: 20887 Comm: cat Kdump: loaded Not tainted 5.2.0-rc6-jdc+ #13 RIP: 0010:rdma_counter_get_hwstat_value+0xf2/0x150 [ib_core] Call Trace: show_hw_stats+0x5e/0x130 [ib_core] dev_attr_show+0x15/0x50 sysfs_kf_seq_show+0xc6/0x1a0 seq_read+0x132/0x370 vfs_read+0x89/0x140 ksys_read+0x5c/0xd0 do_syscall_64+0x5a/0x240 entry_SYSCALL_64_after_hwframe+0x49/0xbe Fixes: f34a55e497e8 ("RDMA/core: Get sum value of all counters when perform a sysfs stat read") Link: https://lore.kernel.org/r/20190723065733.4899-10-leon@kernel.org Signed-off-by: Parav Pandit Reviewed-by: Mark Zhang Signed-off-by: Leon Romanovsky Signed-off-by: Jason Gunthorpe commit 296e3a2aad09d328f22e54655c3d736033fe1ae8 Author: Moni Shoua Date: Tue Jul 23 09:57:30 2019 +0300 IB/mlx5: Prevent concurrent MR updates during invalidation The device requires that memory registration work requests that update the address translation table of a MR will be fenced if posted together. This scenario can happen when address ranges are invalidated by the mmu in separate concurrent calls to the invalidation callback. We prefer to block concurrent address updates for a single MR over fencing since making the decision if a WQE needs fencing will be more expensive and fencing all WQEs is a too radical choice. Further, it isn't clear that this code can even run safely concurrently, so a lock is a safer choice. Fixes: b4cfe447d47b ("IB/mlx5: Implement on demand paging by adding support for MMU notifiers") Link: https://lore.kernel.org/r/20190723065733.4899-8-leon@kernel.org Signed-off-by: Moni Shoua Reviewed-by: Artemy Kovalyov Signed-off-by: Leon Romanovsky Reviewed-by: Jason Gunthorpe Signed-off-by: Jason Gunthorpe commit 289a2d22b5b611d85030795802a710e9f520df29 Author: Gustavo A. R. Silva Date: Mon Jun 24 11:19:13 2019 -0500 perf/x86/intel: Mark expected switch fall-throughs In preparation to enabling -Wimplicit-fallthrough, mark switch cases where we are expecting to fall through. This patch fixes the following warnings: arch/x86/events/intel/core.c: In function ‘intel_pmu_init’: arch/x86/events/intel/core.c:4959:8: warning: this statement may fall through [-Wimplicit-fallthrough=] arch/x86/events/intel/core.c:5008:8: warning: this statement may fall through [-Wimplicit-fallthrough=] Warning level 3 was used: -Wimplicit-fallthrough=3 This patch is part of the ongoing efforts to enable -Wimplicit-fallthrough. Signed-off-by: Gustavo A. R. Silva Signed-off-by: Peter Zijlstra (Intel) Cc: Alexander Shishkin Cc: Arnaldo Carvalho de Melo Cc: Borislav Petkov Cc: H. Peter Anvin Cc: Jiri Olsa Cc: Kan Liang Cc: Kees Cook Cc: Linus Torvalds Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Thomas Gleixner Link: https://lkml.kernel.org/r/20190624161913.GA32270@embeddedor Signed-off-by: Ingo Molnar commit 4ce54af8b33d3e21ca935fc1b89b58cbba956051 Author: Leonard Crestez Date: Wed Jul 24 15:53:24 2019 +0300 perf/core: Fix creating kernel counters for PMUs that override event->cpu Some hardware PMU drivers will override perf_event.cpu inside their event_init callback. This causes a lockdep splat when initialized through the kernel API: WARNING: CPU: 0 PID: 250 at kernel/events/core.c:2917 ctx_sched_out+0x78/0x208 pc : ctx_sched_out+0x78/0x208 Call trace: ctx_sched_out+0x78/0x208 __perf_install_in_context+0x160/0x248 remote_function+0x58/0x68 generic_exec_single+0x100/0x180 smp_call_function_single+0x174/0x1b8 perf_install_in_context+0x178/0x188 perf_event_create_kernel_counter+0x118/0x160 Fix this by calling perf_install_in_context with event->cpu, just like perf_event_open Signed-off-by: Leonard Crestez Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Mark Rutland Cc: Alexander Shishkin Cc: Arnaldo Carvalho de Melo Cc: Frank Li Cc: Jiri Olsa Cc: Linus Torvalds Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: Will Deacon Link: https://lkml.kernel.org/r/c4ebe0503623066896d7046def4d6b1e06e0eb2e.1563972056.git.leonard.crestez@nxp.com Signed-off-by: Ingo Molnar commit 5ea3f6fb37b79da33ac9211df336fd2b9f47c39f Author: Zhenzhong Duan Date: Thu Jul 25 10:39:26 2019 +0800 perf/x86: Apply more accurate check on hypervisor platform check_msr is used to fix a bug report in guest where KVM doesn't support LBR MSR and cause #GP. The msr check is bypassed on real HW to workaround a false failure, see commit d0e1a507bdc7 ("perf/x86/intel: Disable check_msr for real HW") When running a guest with CONFIG_HYPERVISOR_GUEST not set or "nopv" enabled, current check isn't enough and #GP could trigger. Signed-off-by: Zhenzhong Duan Signed-off-by: Peter Zijlstra (Intel) Cc: Alexander Shishkin Cc: Arnaldo Carvalho de Melo Cc: Boris Ostrovsky Cc: Borislav Petkov Cc: Jiri Olsa Cc: Juergen Gross Cc: Linus Torvalds Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Thomas Gleixner Link: https://lkml.kernel.org/r/1564022366-18293-1-git-send-email-zhenzhong.duan@oracle.com Signed-off-by: Ingo Molnar commit 3b238a64c3009fed36eaea1af629d9377759d87d Author: Yunying Sun Date: Wed Jul 24 16:29:32 2019 +0800 perf/x86/intel: Fix invalid Bit 13 for Icelake MSR_OFFCORE_RSP_x register The Intel SDM states that bit 13 of Icelake's MSR_OFFCORE_RSP_x register is valid, and used for counting hardware generated prefetches of L3 cache. Update the bitmask to allow bit 13. Before: $ perf stat -e cpu/event=0xb7,umask=0x1,config1=0x1bfff/u sleep 3 Performance counter stats for 'sleep 3': cpu/event=0xb7,umask=0x1,config1=0x1bfff/u After: $ perf stat -e cpu/event=0xb7,umask=0x1,config1=0x1bfff/u sleep 3 Performance counter stats for 'sleep 3': 9,293 cpu/event=0xb7,umask=0x1,config1=0x1bfff/u Signed-off-by: Yunying Sun Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Kan Liang Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: acme@kernel.org Cc: alexander.shishkin@linux.intel.com Cc: bp@alien8.de Cc: hpa@zytor.com Cc: jolsa@redhat.com Cc: namhyung@kernel.org Link: https://lkml.kernel.org/r/20190724082932.12833-1-yunying.sun@intel.com Signed-off-by: Ingo Molnar commit 3d0c3953601d250175c7684ec0d9df612061dae5 Author: Kan Liang Date: Tue Jul 23 13:04:29 2019 -0700 perf/x86/intel: Fix SLOTS PEBS event constraint Sampling SLOTS event and ref-cycles event in a group on Icelake gives EINVAL. SLOTS event is the event stands for the fixed counter 3, not fixed counter 2. Wrong mask was set to SLOTS event in intel_icl_pebs_event_constraints[]. Reported-by: Andi Kleen Signed-off-by: Kan Liang Signed-off-by: Peter Zijlstra (Intel) Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Thomas Gleixner Fixes: 6017608936c1 ("perf/x86/intel: Add Icelake support") Link: https://lkml.kernel.org/r/20190723200429.8180-1-kan.liang@linux.intel.com Signed-off-by: Ingo Molnar commit 6c11c6e3d5e9e5caf8686cd6a5e4552cfc3ea326 Author: Sebastian Andrzej Siewior Date: Wed Jul 3 11:21:26 2019 +0200 locking/mutex: Test for initialized mutex An uninitialized/ zeroed mutex will go unnoticed because there is no check for it. There is a magic check in the unlock's slowpath path which might go unnoticed if the unlock happens in the fastpath. Add a ->magic check early in the mutex_lock() and mutex_trylock() path. Signed-off-by: Sebastian Andrzej Siewior Signed-off-by: Peter Zijlstra (Intel) Acked-by: Will Deacon Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Thomas Gleixner Link: https://lkml.kernel.org/r/20190703092125.lsdf4gpsh2plhavb@linutronix.de Signed-off-by: Ingo Molnar commit 30a35f79faadfeb1b89a7fdb3875f14063519041 Author: Arnd Bergmann Date: Fri Jun 28 12:29:03 2019 +0200 locking/lockdep: Clean up #ifdef checks As Will Deacon points out, CONFIG_PROVE_LOCKING implies TRACE_IRQFLAGS, so the conditions I added in the previous patch, and some others in the same file can be simplified by only checking for the former. No functional change. Signed-off-by: Arnd Bergmann Signed-off-by: Peter Zijlstra (Intel) Acked-by: Will Deacon Cc: Andrew Morton Cc: Bart Van Assche Cc: Frederic Weisbecker Cc: Linus Torvalds Cc: Paul E. McKenney Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: Waiman Long Cc: Yuyang Du Fixes: 886532aee3cd ("locking/lockdep: Move mark_lock() inside CONFIG_TRACE_IRQFLAGS && CONFIG_PROVE_LOCKING") Link: https://lkml.kernel.org/r/20190628102919.2345242-1-arnd@arndb.de Signed-off-by: Ingo Molnar commit 68037aa78208f34bda4e5cd76c357f718b838cbb Author: Arnd Bergmann Date: Mon Jul 15 11:27:49 2019 +0200 locking/lockdep: Hide unused 'class' variable The usage is now hidden in an #ifdef, so we need to move the variable itself in there as well to avoid this warning: kernel/locking/lockdep_proc.c:203:21: error: unused variable 'class' [-Werror,-Wunused-variable] Signed-off-by: Arnd Bergmann Signed-off-by: Peter Zijlstra (Intel) Cc: Andrew Morton Cc: Bart Van Assche Cc: Linus Torvalds Cc: Paul E. McKenney Cc: Peter Zijlstra Cc: Qian Cai Cc: Thomas Gleixner Cc: Waiman Long Cc: Will Deacon Cc: Will Deacon Cc: Yuyang Du Cc: frederic@kernel.org Fixes: 68d41d8c94a3 ("locking/lockdep: Fix lock used or unused stats error") Link: https://lkml.kernel.org/r/20190715092809.736834-1-arnd@arndb.de Signed-off-by: Ingo Molnar commit 6ffddfb9e1de21c3d0c0cfa4fe4a20dd3291a812 Author: Peter Zijlstra Date: Thu Jul 18 15:08:53 2019 +0200 locking/rwsem: Add ACQUIRE comments Since we just reviewed read_slowpath for ACQUIRE correctness, add a few coments to retain our findings. Signed-off-by: Peter Zijlstra (Intel) Acked-by: Will Deacon Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Thomas Gleixner Signed-off-by: Ingo Molnar commit 952041a8639a7a3a73a2b6573cb8aa8518bc39f8 Author: Peter Zijlstra Date: Thu Jul 18 15:03:15 2019 +0200 tty/ldsem, locking/rwsem: Add missing ACQUIRE to read_failed sleep loop While reviewing rwsem down_slowpath, Will noticed ldsem had a copy of a bug we just found for rwsem. X = 0; CPU0 CPU1 rwsem_down_read() for (;;) { set_current_state(TASK_UNINTERRUPTIBLE); X = 1; rwsem_up_write(); rwsem_mark_wake() atomic_long_add(adjustment, &sem->count); smp_store_release(&waiter->task, NULL); if (!waiter.task) break; ... } r = X; Allows 'r == 0'. Reported-by: Will Deacon Signed-off-by: Peter Zijlstra (Intel) Acked-by: Will Deacon Cc: Linus Torvalds Cc: Peter Hurley Cc: Peter Zijlstra Cc: Thomas Gleixner Fixes: 4898e640caf0 ("tty: Add timed, writer-prioritized rw semaphore") Signed-off-by: Ingo Molnar commit 99143f82a255e7f054bead8443462fae76dd829e Author: Peter Zijlstra Date: Thu Jul 18 14:56:17 2019 +0200 lcoking/rwsem: Add missing ACQUIRE to read_slowpath sleep loop While reviewing another read_slowpath patch, both Will and I noticed another missing ACQUIRE, namely: X = 0; CPU0 CPU1 rwsem_down_read() for (;;) { set_current_state(TASK_UNINTERRUPTIBLE); X = 1; rwsem_up_write(); rwsem_mark_wake() atomic_long_add(adjustment, &sem->count); smp_store_release(&waiter->task, NULL); if (!waiter.task) break; ... } r = X; Allows 'r == 0'. Reported-by: Peter Zijlstra (Intel) Reported-by: Will Deacon Signed-off-by: Peter Zijlstra (Intel) Acked-by: Will Deacon Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Thomas Gleixner Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Ingo Molnar commit e1b98fa316648420d0434d9ff5b92ad6609ba6c3 Author: Jan Stancek Date: Thu Jul 18 10:51:25 2019 +0200 locking/rwsem: Add missing ACQUIRE to read_slowpath exit when queue is empty LTP mtest06 has been observed to occasionally hit "still mapped when deleted" and following BUG_ON on arm64. The extra mapcount originated from pagefault handler, which handled pagefault for vma that has already been detached. vma is detached under mmap_sem write lock by detach_vmas_to_be_unmapped(), which also invalidates vmacache. When the pagefault handler (under mmap_sem read lock) calls find_vma(), vmacache_valid() wrongly reports vmacache as valid. After rwsem down_read() returns via 'queue empty' path (as of v5.2), it does so without an ACQUIRE on sem->count: down_read() __down_read() rwsem_down_read_failed() __rwsem_down_read_failed_common() raw_spin_lock_irq(&sem->wait_lock); if (list_empty(&sem->wait_list)) { if (atomic_long_read(&sem->count) >= 0) { raw_spin_unlock_irq(&sem->wait_lock); return sem; The problem can be reproduced by running LTP mtest06 in a loop and building the kernel (-j $NCPUS) in parallel. It does reproduces since v4.20 on arm64 HPE Apollo 70 (224 CPUs, 256GB RAM, 2 nodes). It triggers reliably in about an hour. The patched kernel ran fine for 10+ hours. Signed-off-by: Jan Stancek Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Will Deacon Acked-by: Waiman Long Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: dbueso@suse.de Fixes: 4b486b535c33 ("locking/rwsem: Exit read lock slowpath if queue empty & no writer") Link: https://lkml.kernel.org/r/50b8914e20d1d62bb2dee42d342836c2c16ebee7.1563438048.git.jstancek@redhat.com Signed-off-by: Ingo Molnar commit 78134300579a45f527ca173ec8fdb4701b69f16e Author: Waiman Long Date: Sat Jul 20 11:04:10 2019 -0400 locking/rwsem: Don't call owner_on_cpu() on read-owner For writer, the owner value is cleared on unlock. For reader, it is left intact on unlock for providing better debugging aid on crash dump and the unlock of one reader may not mean the lock is free. As a result, the owner_on_cpu() shouldn't be used on read-owner as the task pointer value may not be valid and it might have been freed. That is the case in rwsem_spin_on_owner(), but not in rwsem_can_spin_on_owner(). This can lead to use-after-free error from KASAN. For example, BUG: KASAN: use-after-free in rwsem_down_write_slowpath (/home/miguel/kernel/linux/kernel/locking/rwsem.c:669 /home/miguel/kernel/linux/kernel/locking/rwsem.c:1125) Fix this by checking for RWSEM_READER_OWNED flag before calling owner_on_cpu(). Reported-by: Luis Henriques Tested-by: Luis Henriques Signed-off-by: Waiman Long Signed-off-by: Peter Zijlstra (Intel) Cc: Borislav Petkov Cc: Davidlohr Bueso Cc: H. Peter Anvin Cc: Jeff Layton Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: Tim Chen Cc: Will Deacon Cc: huang ying Fixes: 94a9717b3c40e ("locking/rwsem: Make rwsem->owner an atomic_long_t") Link: https://lkml.kernel.org/r/81e82d5b-5074-77e8-7204-28479bbe0df0@redhat.com Signed-off-by: Ingo Molnar commit cb361d8cdef69990f6b4504dc1fd9a594d983c97 Author: Jann Horn Date: Tue Jul 16 17:20:47 2019 +0200 sched/fair: Use RCU accessors consistently for ->numa_group The old code used RCU annotations and accessors inconsistently for ->numa_group, which can lead to use-after-frees and NULL dereferences. Let all accesses to ->numa_group use proper RCU helpers to prevent such issues. Signed-off-by: Jann Horn Signed-off-by: Peter Zijlstra (Intel) Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Petr Mladek Cc: Sergey Senozhatsky Cc: Thomas Gleixner Cc: Will Deacon Fixes: 8c8a743c5087 ("sched/numa: Use {cpu, pid} to create task groups for shared faults") Link: https://lkml.kernel.org/r/20190716152047.14424-3-jannh@google.com Signed-off-by: Ingo Molnar commit 16d51a590a8ce3befb1308e0e7ab77f3b661af33 Author: Jann Horn Date: Tue Jul 16 17:20:45 2019 +0200 sched/fair: Don't free p->numa_faults with concurrent readers When going through execve(), zero out the NUMA fault statistics instead of freeing them. During execve, the task is reachable through procfs and the scheduler. A concurrent /proc/*/sched reader can read data from a freed ->numa_faults allocation (confirmed by KASAN) and write it back to userspace. I believe that it would also be possible for a use-after-free read to occur through a race between a NUMA fault and execve(): task_numa_fault() can lead to task_numa_compare(), which invokes task_weight() on the currently running task of a different CPU. Another way to fix this would be to make ->numa_faults RCU-managed or add extra locking, but it seems easier to wipe the NUMA fault statistics on execve. Signed-off-by: Jann Horn Signed-off-by: Peter Zijlstra (Intel) Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Petr Mladek Cc: Sergey Senozhatsky Cc: Thomas Gleixner Cc: Will Deacon Fixes: 82727018b0d3 ("sched/numa: Call task_numa_free() from do_execve()") Link: https://lkml.kernel.org/r/20190716152047.14424-1-jannh@google.com Signed-off-by: Ingo Molnar commit 2a6fc3cb5cb68597f1072bfeef28d2ca02310220 Author: Dmitry Osipenko Date: Fri Jul 5 18:11:39 2019 +0300 drm/tegra: Fix gpiod_get_from_of_node() regression That function now returns ERR_PTR instead of NULL if "hpd-gpio" is not present in device-tree. The offending patch missed to adapt the Tegra's DRM driver for the API change. Fixes: 025bf37725f1 ("gpio: Fix return value mismatch of function gpiod_get_from_of_node()") Signed-off-by: Dmitry Osipenko Acked-by: Jon Hunter Signed-off-by: Thierry Reding commit d105ef8120dd522c3233a1395ee0b318ed0929e8 Author: YueHaibing Date: Tue Jul 9 16:32:58 2019 +0800 dmaengine: tegra210-adma: Fix unused function warnings If CONFIG_PM is not set, build warnings: drivers/dma/tegra210-adma.c:747:12: warning: tegra_adma_runtime_resume defined but not used [-Wunused-function] static int tegra_adma_runtime_resume(struct device *dev) drivers/dma/tegra210-adma.c:715:12: warning: tegra_adma_runtime_suspend defined but not used [-Wunused-function] static int tegra_adma_runtime_suspend(struct device *dev) Mark the two function as __maybe_unused. Reported-by: Hulk Robot Signed-off-by: YueHaibing Fixes: 3145d73e69ba ("dmaengine: tegra210-adma: remove PM_CLK dependency") Fixes: f46b195799b5 ("dmaengine: tegra-adma: Add support for Tegra210 ADMA") Reported-by: Arnd Bergmann Acked-by: Jon Hunter Link: https://lore.kernel.org/r/20190709083258.57112-1-yuehaibing@huawei.com Signed-off-by: Vinod Koul commit d4fddac5a51c378c5d3e68658816c37132611e1f Author: Wenwen Wang Date: Sun Jul 14 01:11:35 2019 -0500 test_firmware: fix a memory leak bug In test_firmware_init(), the buffer pointed to by the global pointer 'test_fw_config' is allocated through kzalloc(). Then, the buffer is initialized in __test_firmware_config_init(). In the case that the initialization fails, the following execution in test_firmware_init() needs to be terminated with an error code returned to indicate this failure. However, the allocated buffer is not freed on this execution path, leading to a memory leak bug. To fix the above issue, free the allocated buffer before returning from test_firmware_init(). Signed-off-by: Wenwen Wang Link: https://lore.kernel.org/r/1563084696-6865-1-git-send-email-wang6495@umn.edu Signed-off-by: Greg Kroah-Hartman commit 0c7d37f4d9b8446956e97b7c5e61173cdb7c8522 Author: Kefeng Wang Date: Thu Jul 11 21:27:57 2019 +0800 hpet: Fix division by zero in hpet_time_div() The base value in do_div() called by hpet_time_div() is truncated from unsigned long to uint32_t, resulting in a divide-by-zero exception. UBSAN: Undefined behaviour in ../drivers/char/hpet.c:572:2 division by zero CPU: 1 PID: 23682 Comm: syz-executor.3 Not tainted 4.4.184.x86_64+ #4 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu1 04/01/2014 0000000000000000 b573382df1853d00 ffff8800a3287b98 ffffffff81ad7561 ffff8800a3287c00 ffffffff838b35b0 ffffffff838b3860 ffff8800a3287c20 0000000000000000 ffff8800a3287bb0 ffffffff81b8f25e ffffffff838b35a0 Call Trace: [] __dump_stack lib/dump_stack.c:15 [inline] [] dump_stack+0xc1/0x120 lib/dump_stack.c:51 [] ubsan_epilogue+0x12/0x8d lib/ubsan.c:166 [] __ubsan_handle_divrem_overflow+0x282/0x2c8 lib/ubsan.c:262 [] hpet_time_div drivers/char/hpet.c:572 [inline] [] hpet_ioctl_common drivers/char/hpet.c:663 [inline] [] hpet_ioctl_common.cold+0xa8/0xad drivers/char/hpet.c:577 [] hpet_ioctl+0xc6/0x180 drivers/char/hpet.c:676 [] vfs_ioctl fs/ioctl.c:43 [inline] [] file_ioctl fs/ioctl.c:470 [inline] [] do_vfs_ioctl+0x6e0/0xf70 fs/ioctl.c:605 [] SYSC_ioctl fs/ioctl.c:622 [inline] [] SyS_ioctl+0x94/0xc0 fs/ioctl.c:613 [] tracesys_phase2+0x90/0x95 The main C reproducer autogenerated by syzkaller, syscall(__NR_mmap, 0x20000000, 0x1000000, 3, 0x32, -1, 0); memcpy((void*)0x20000100, "/dev/hpet\000", 10); syscall(__NR_openat, 0xffffffffffffff9c, 0x20000100, 0, 0); syscall(__NR_ioctl, r[0], 0x40086806, 0x40000000000000); Fix it by using div64_ul(). Signed-off-by: Kefeng Wang Signed-off-by: Zhang HongJun Cc: stable Reviewed-by: Arnd Bergmann Link: https://lore.kernel.org/r/20190711132757.130092-1-wangkefeng.wang@huawei.com Signed-off-by: Greg Kroah-Hartman commit 1b5621832f9bd9899370ea6928462cd02ebe7dc0 Author: Arseny Solokha Date: Tue Jul 16 18:12:36 2019 +0700 eeprom: make older eeprom drivers select NVMEM_SYSFS misc/eeprom/{at24,at25,eeprom_93xx46} drivers all register their corresponding devices in the nvmem framework in compat mode which requires nvmem sysfs interface to be present. The latter, however, has been split out from nvmem under a separate Kconfig in commit ae0c2d725512 ("nvmem: core: add NVMEM_SYSFS Kconfig"). As a result, probing certain I2C-attached EEPROMs now fails with at24: probe of 0-0050 failed with error -38 because of a stub implementation of nvmem_sysfs_setup_compat() in drivers/nvmem/nvmem.h. Update the nvmem dependency for these drivers so they could load again: at24 0-0050: 32768 byte 24c256 EEPROM, writable, 64 bytes/write Cc: Adrian Bunk Cc: Bartosz Golaszewski Cc: Srinivas Kandagatla Cc: stable@vger.kernel.org # v5.2+ Signed-off-by: Arseny Solokha Link: https://lore.kernel.org/r/20190716111236.27803-1-asolokha@kb.kras.ru Signed-off-by: Greg Kroah-Hartman commit 61d51456f35760a09e8aa1e6ddd247f1547015d3 Author: Daniel Vetter Date: Thu Jul 18 10:09:03 2019 +0200 vt: Grab console_lock around con_is_bound in show_bind Not really harmful not to, but also not harm in grabbing the lock. And this shuts up a new WARNING I introduced in commit ddde3c18b700 ("vt: More locking checks"). Reported-by: Jens Remus Cc: linux-kernel@vger.kernel.org Cc: dri-devel@lists.freedesktop.org Cc: linux-fbdev@vger.kernel.org Cc: linux-s390@vger.kernel.org Cc: Nicolas Pitre Cc: Martin Hostettler Cc: Adam Borowski Cc: Mikulas Patocka Cc: Daniel Vetter Cc: Sam Ravnborg Fixes: ddde3c18b700 ("vt: More locking checks") Signed-off-by: Daniel Vetter Tested-by: Jens Remus Acked-by: Sam Ravnborg Link: https://lore.kernel.org/r/20190718080903.22622-1-daniel.vetter@ffwll.ch Signed-off-by: Greg Kroah-Hartman commit 10b0f1c227ed8236555318cb26933881b7e907f9 Author: Nadav Amit Date: Tue Jul 2 03:05:19 2019 -0700 vmw_balloon: Remove Julien from the maintainers list Julien will not be a maintainer anymore. Signed-off-by: Nadav Amit Link: https://lore.kernel.org/r/20190702100519.7464-1-namit@vmware.com Signed-off-by: Greg Kroah-Hartman commit 8f9e86ee795971eabbf372e6d804d6b8578287a7 Author: Tetsuo Handa Date: Mon Jul 1 19:55:19 2019 +0900 staging: android: ion: Bail out upon SIGKILL when allocating memory. syzbot found that a thread can stall for minutes inside ion_system_heap_allocate() after that thread was killed by SIGKILL [1]. Let's check for SIGKILL before doing memory allocation. [1] https://syzkaller.appspot.com/bug?id=a0e3436829698d5824231251fad9d8e998f94f5e Signed-off-by: Tetsuo Handa Cc: stable Reported-by: syzbot Acked-by: Laura Abbott Acked-by: Sumit Semwal Link: https://lore.kernel.org/r/d088f188-5f32-d8fc-b9a0-0b404f7501cc@I-love.SAKURA.ne.jp Signed-off-by: Greg Kroah-Hartman commit 517c3ba00916383af6411aec99442c307c23f684 Author: Zhenzhong Duan Date: Thu Jul 25 10:39:09 2019 +0800 x86/speculation/mds: Apply more accurate check on hypervisor platform X86_HYPER_NATIVE isn't accurate for checking if running on native platform, e.g. CONFIG_HYPERVISOR_GUEST isn't set or "nopv" is enabled. Checking the CPU feature bit X86_FEATURE_HYPERVISOR to determine if it's running on native platform is more accurate. This still doesn't cover the platforms on which X86_FEATURE_HYPERVISOR is unsupported, e.g. VMware, but there is nothing which can be done about this scenario. Fixes: 8a4b06d391b0 ("x86/speculation/mds: Add sysfs reporting for MDS") Signed-off-by: Zhenzhong Duan Signed-off-by: Thomas Gleixner Cc: stable@vger.kernel.org Link: https://lkml.kernel.org/r/1564022349-17338-1-git-send-email-zhenzhong.duan@oracle.com commit 643d83f0a3518d6fbcf88f970de0340a5aa6b5a2 Author: Thomas Gleixner Date: Thu Jul 25 08:28:45 2019 +0200 x86/hpet: Undo the early counter is counting check Rui reported that on a Pentium D machine which has HPET forced enabled because it is not advertised by ACPI, the early counter is counting check leads to a silent boot hang. The reason is that the ordering of checking the counter first and then reconfiguring the HPET fails to work on that machine. As the HPET is not advertised and presumably not initialized by the BIOS the early enable and the following reconfiguration seems to bring it into a broken state. Adding clocksource=jiffies to the command line results in the following clocksource watchdog warning: clocksource: timekeeping watchdog on CPU1: Marking clocksource 'tsc-early' as unstable because the skew is too large: clocksource: 'hpet' wd_now: 33 wd_last: 33 mask: ffffffff That clearly shows that the HPET is not counting after it got reconfigured and reenabled. If the counter is not working then the HPET timer is not expiring either, which explains the boot hang. Move the counter is counting check after the full configuration again to unbreak these systems. Reported-by: Rui Salvaterra Fixes: 3222daf970f3 ("x86/hpet: Separate counter check out of clocksource register code") Signed-off-by: Thomas Gleixner Tested-by: Rui Salvaterra Link: https://lkml.kernel.org/r/alpine.DEB.2.21.1907250810530.1791@nanos.tec.linutronix.de commit 4a2b8560e3dff8637ccb09524650864f60ebab7f Author: Linus Walleij Date: Mon Jul 22 08:51:46 2019 +0200 tty: serial: netx: Delete driver The Netx ARM machine was deleted from the kernel. This driver had no users and has to go. Cc: Robert Schwebel Cc: Sascha Hauer Signed-off-by: Linus Walleij Signed-off-by: Arnd Bergmann Link: https://lore.kernel.org/r/20190722065146.4844-1-linus.walleij@linaro.org Signed-off-by: Greg Kroah-Hartman commit d39b5bad8658d6d94cb2d98a44a7e159db4f5030 Author: Mathias Nyman Date: Thu Jul 25 11:54:21 2019 +0300 xhci: Fix crash if scatter gather is used with Immediate Data Transfer (IDT). A second regression was found in the immediate data transfer (IDT) support which was added to 5.2 kernel IDT is used to transfer small amounts of data (up to 8 bytes) in the field normally used for data dma address, thus avoiding dma mapping. If the data was not already dma mapped, then IDT support assumed data was in urb->transfer_buffer, and did not take into accound that even small amounts of data (8 bytes) can be in a scatterlist instead. This caused a NULL pointer dereference when sg_dma_len() was used with non-dma mapped data. Solve this by not using IDT if scatter gather buffer list is used. Fixes: 33e39350ebd2 ("usb: xhci: add Immediate Data Transfer support") Cc: # v5.2 Reported-by: Maik Stohn Tested-by: Maik Stohn CC: Nicolas Saenz Julienne Signed-off-by: Mathias Nyman Link: https://lore.kernel.org/r/1564044861-1445-1-git-send-email-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit 4849ee6129702dcb05d36f9c7c61b4661fcd751f Author: Lucas Stach Date: Fri Jul 19 10:44:07 2019 +0200 usb: usb251xb: Reallow swap-dx-lanes to apply to the upstream port This is a partial revert of 73d31def1aab "usb: usb251xb: Create a ports field collector method", which broke a existing devicetree (arch/arm64/boot/dts/freescale/imx8mq.dtsi). There is no reason why the swap-dx-lanes property should not apply to the upstream port. The reason given in the breaking commit was that it's inconsitent with respect to other port properties, but in fact it is not. All other properties which only apply to the downstream ports explicitly reject port 0, so there is pretty strong precedence that the driver referred to the upstream port as port 0. So there is no inconsistency in this property at all, other than the swapping being also applicable to the upstream port. CC: stable@vger.kernel.org #5.2 Signed-off-by: Lucas Stach Link: https://lore.kernel.org/r/20190719084407.28041-3-l.stach@pengutronix.de Signed-off-by: Greg Kroah-Hartman commit 79f6fafad4e2a874015cb67d735f9f87f1834367 Author: Lucas Stach Date: Fri Jul 19 10:44:06 2019 +0200 Revert "usb: usb251xb: Add US port lanes inversion property" This property isn't needed and not yet used anywhere. The swap-dx-lanes property is perfectly fine for doing the swap on the upstream port lanes. CC: stable@vger.kernel.org #5.2 Signed-off-by: Lucas Stach Link: https://lore.kernel.org/r/20190719084407.28041-2-l.stach@pengutronix.de Signed-off-by: Greg Kroah-Hartman commit bafe64e5f0edaa689e72e2f8dc236641da37fed4 Author: Lucas Stach Date: Fri Jul 19 10:44:05 2019 +0200 Revert "usb: usb251xb: Add US lanes inversion dts-bindings" This reverts commit 3342ce35a1, as there is no need for this separate property and it breaks compatibility with existing devicetree files (arch/arm64/boot/dts/freescale/imx8mq.dtsi). CC: stable@vger.kernel.org #5.2 Fixes: 3342ce35a183 ("usb: usb251xb: Add US lanes inversion dts-bindings") Signed-off-by: Lucas Stach Link: https://lore.kernel.org/r/20190719084407.28041-1-l.stach@pengutronix.de Signed-off-by: Greg Kroah-Hartman commit 0ce38c5f929c83dff8ea805f6c6ef2eb97b66431 Author: Masahiro Yamada Date: Thu Jul 25 16:58:33 2019 +0900 iomap: fix Invalid License ID Detected by: $ ./scripts/spdxcheck.py fs/iomap/Makefile: 1:27 Invalid License ID: GPL-2.0-or-newer Fixes: 1c230208f53d ("iomap: start moving code to fs/iomap/") Signed-off-by: Masahiro Yamada Reviewed-by: Thomas Gleixner Signed-off-by: Greg Kroah-Hartman commit dc3bf49ea330414724e429e4e9b291899c134e3b Author: Masahiro Yamada Date: Thu Jul 25 16:58:32 2019 +0900 treewide: remove SPDX "WITH Linux-syscall-note" from kernel-space headers again The "WITH Linux-syscall-note" exception exists for headers exported to user space. It is strange to add it to non-exported headers. Commit 687a3e4d8e61 ("treewide: remove SPDX "WITH Linux-syscall-note" from kernel-space headers") did cleanups some months ago, but it looks like we need to do this periodically. This patch was generated by the following script: git grep -l -e Linux-syscall-note \ -- :*.h :^arch/*/include/uapi/asm/*.h :^include/uapi/ :^tools | while read file do sed -i -e 's/(\(GPL-[^[:space:]]*\) WITH Linux-syscall-note)/\1/g' \ -e 's/ WITH Linux-syscall-note//g' $file done I did not commit drivers/staging/android/uapi/ion.h . This header is not currently exported, but somebody may plan to move it to include/uapi/ when the time comes. I am not sure. Anyway, it will be better to check the license inconsistency in drivers/staging/android/uapi/. Signed-off-by: Masahiro Yamada Reviewed-by: Thomas Gleixner Signed-off-by: Greg Kroah-Hartman commit d9c5252295218df4cfe64353aa860d7b5c8700ef Author: Masahiro Yamada Date: Thu Jul 25 16:58:31 2019 +0900 treewide: add "WITH Linux-syscall-note" to SPDX tag of uapi headers UAPI headers licensed under GPL are supposed to have exception "WITH Linux-syscall-note" so that they can be included into non-GPL user space application code. The exception note is missing in some UAPI headers. Some of them slipped in by the treewide conversion commit b24413180f56 ("License cleanup: add SPDX GPL-2.0 license identifier to files with no license"). Just run: $ git show --oneline b24413180f56 -- arch/x86/include/uapi/asm/ I believe they are not intentional, and should be fixed too. This patch was generated by the following script: git grep -l --not -e Linux-syscall-note --and -e SPDX-License-Identifier \ -- :arch/*/include/uapi/asm/*.h :include/uapi/ :^*/Kbuild | while read file do sed -i -e '/[[:space:]]OR[[:space:]]/s/\(GPL-[^[:space:]]*\)/(\1 WITH Linux-syscall-note)/g' \ -e '/[[:space:]]or[[:space:]]/s/\(GPL-[^[:space:]]*\)/(\1 WITH Linux-syscall-note)/g' \ -e '/[[:space:]]OR[[:space:]]/!{/[[:space:]]or[[:space:]]/!s/\(GPL-[^[:space:]]*\)/\1 WITH Linux-syscall-note/g}' $file done After this patch is applied, there are 5 UAPI headers that do not contain "WITH Linux-syscall-note". They are kept untouched since this exception applies only to GPL variants. $ git grep --not -e Linux-syscall-note --and -e SPDX-License-Identifier \ -- :arch/*/include/uapi/asm/*.h :include/uapi/ :^*/Kbuild include/uapi/drm/panfrost_drm.h:/* SPDX-License-Identifier: MIT */ include/uapi/linux/batman_adv.h:/* SPDX-License-Identifier: MIT */ include/uapi/linux/qemu_fw_cfg.h:/* SPDX-License-Identifier: BSD-3-Clause */ include/uapi/linux/vbox_err.h:/* SPDX-License-Identifier: MIT */ include/uapi/linux/virtio_iommu.h:/* SPDX-License-Identifier: BSD-3-Clause */ Signed-off-by: Masahiro Yamada Reviewed-by: Thomas Gleixner Signed-off-by: Greg Kroah-Hartman commit fdc75701578269f6931975aebf4069d9d8c77d34 Merge: c528adefd645 e0a12445d1cb Author: Rafael J. Wysocki Date: Thu Jul 25 10:46:07 2019 +0200 Merge branch 'pm-cpufreq' * pm-cpufreq: cpufreq/pasemi: fix use-after-free in pas_cpufreq_cpu_init() commit f90bf1ece48a736097ea224430578fe586a9544c Author: Phong Tran Date: Wed Jul 24 09:06:01 2019 +0700 usb: wusbcore: fix unbalanced get/put cluster_id syzboot reported that https://syzkaller.appspot.com/bug?extid=fd2bd7df88c606eea4ef There is not consitency parameter in cluste_id_get/put calling. In case of getting the id with result is failure, the wusbhc->cluster_id will not be updated and this can not be used for wusb_cluster_id_put(). Tested report https://groups.google.com/d/msg/syzkaller-bugs/0znZopp3-9k/oxOrhLkLEgAJ Reproduce and gdb got the details: 139 addr = wusb_cluster_id_get(); (gdb) n 140 if (addr == 0) (gdb) print addr $1 = 254 '\376' (gdb) n 142 result = __hwahc_set_cluster_id(hwahc, addr); (gdb) print result $2 = -71 (gdb) break wusb_cluster_id_put Breakpoint 3 at 0xffffffff836e3f20: file drivers/usb/wusbcore/wusbhc.c, line 384. (gdb) s Thread 2 hit Breakpoint 3, wusb_cluster_id_put (id=0 '\000') at drivers/usb/wusbcore/wusbhc.c:384 384 id = 0xff - id; (gdb) n 385 BUG_ON(id >= CLUSTER_IDS); (gdb) print id $3 = 255 '\377' Reported-by: syzbot+fd2bd7df88c606eea4ef@syzkaller.appspotmail.com Signed-off-by: Phong Tran Cc: stable Link: https://lore.kernel.org/r/20190724020601.15257-1-tranmanphong@gmail.com Signed-off-by: Greg Kroah-Hartman commit 94b9a70d32db0d1e8eeaeb27d74a5ae712644da9 Author: Dan Carpenter Date: Fri Jun 7 16:57:09 2019 +0300 usb/hcd: Fix a NULL vs IS_ERR() bug in usb_hcd_setup_local_mem() The devm_memremap() function doesn't return NULL, it returns error pointers. Fixes: b0310c2f09bb ("USB: use genalloc for USB HCs with local memory") Signed-off-by: Dan Carpenter Acked-by: Sebastian Andrzej Siewior Link: https://lore.kernel.org/r/20190607135709.GC16718@mwanda Signed-off-by: Greg Kroah-Hartman commit d74ffae8b8dd17eaa8b82fc163e6aa2076dc8fb1 Author: Yoshihiro Shimoda Date: Mon Jul 22 19:58:25 2019 +0900 usb-storage: Add a limitation for blk_queue_max_hw_sectors() This patch fixes an issue that the following error happens on swiotlb environment: xhci-hcd ee000000.usb: swiotlb buffer is full (sz: 524288 bytes), total 32768 (slots), used 1338 (slots) On the kernel v5.1, block settings of a usb-storage with SuperSpeed were the following so that the block layer will allocate buffers up to 64 KiB, and then the issue didn't happen. max_segment_size = 65536 max_hw_sectors_kb = 1024 After the commit 09324d32d2a0 ("block: force an unlimited segment size on queues with a virt boundary") is applied, the block settings are the following. So, the block layer will allocate buffers up to 1024 KiB, and then the issue happens: max_segment_size = 4294967295 max_hw_sectors_kb = 1024 To fix the issue, the usb-storage driver checks the maximum size of a mapping for the device and then adjusts the max_hw_sectors_kb if required. After this patch is applied, the block settings will be the following, and then the issue doesn't happen. max_segment_size = 4294967295 max_hw_sectors_kb = 256 Fixes: 09324d32d2a0 ("block: force an unlimited segment size on queues with a virt boundary") Cc: stable Signed-off-by: Yoshihiro Shimoda Acked-by: Alan Stern Reviewed-by: Christoph Hellwig Link: https://lore.kernel.org/r/1563793105-20597-1-git-send-email-yoshihiro.shimoda.uh@renesas.com Signed-off-by: Greg Kroah-Hartman commit 4fbb8aa75836c3361987f431d9451aecc1830bdd Author: Ryan Kennedy Date: Thu Jul 4 11:35:29 2019 -0400 usb: pci-quirks: Minor cleanup for AMD PLL quirk usb_amd_find_chipset_info() is used for chipset detection for several quirks. It is strange that its return value indicates the need for the PLL quirk, which means it is often ignored. This patch adds a function specifically for checking the PLL quirk like the other ones. Additionally, rename probe_result to something more appropriate. Signed-off-by: Ryan Kennedy Acked-by: Alan Stern Link: https://lore.kernel.org/r/20190704153529.9429-3-ryan5544@gmail.com Signed-off-by: Greg Kroah-Hartman commit f3dccdaade4118070a3a47bef6b18321431f9ac6 Author: Ryan Kennedy Date: Thu Jul 4 11:35:28 2019 -0400 usb: pci-quirks: Correct AMD PLL quirk detection The AMD PLL USB quirk is incorrectly enabled on newer Ryzen chipsets. The logic in usb_amd_find_chipset_info currently checks for unaffected chipsets rather than affected ones. This broke once a new chipset was added in e788787ef. It makes more sense to reverse the logic so it won't need to be updated as new chipsets are added. Note that the core of the workaround in usb_amd_quirk_pll does correctly check the chipset. Signed-off-by: Ryan Kennedy Fixes: e788787ef4f9 ("usb:xhci:Add quirk for Certain failing HP keyboard on reset after resume") Cc: stable Acked-by: Alan Stern Link: https://lore.kernel.org/r/20190704153529.9429-2-ryan5544@gmail.com Signed-off-by: Greg Kroah-Hartman commit 25f8c834e2a6871920cc1ca113f02fb301d007c3 Author: Dmitry Torokhov Date: Fri Jul 12 11:37:17 2019 -0700 Input: synaptics - enable RMI mode for HP Spectre X360 The 2016 kabylake HP Spectre X360 (model number 13-w013dx) works much better with psmouse.synaptics_intertouch=1 kernel parameter, so let's enable RMI4 mode automatically. Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=204115 Reported-by: Nate Graham Cc: stable@vger.kernel.org Signed-off-by: Dmitry Torokhov commit 92e3e884887c0d278042fbbb6f6c9b41d6addb71 Author: Jan Sebastian Götte Date: Wed Jul 17 23:41:37 2019 +0900 Staging: fbtft: Fix GPIO handling Commit c440eee1a7a1 ("Staging: fbtft: Switch to the gpio descriptor interface") breaks GPIO handling. In several places, checks to only set a GPIO if it was configured ended up backwards. I have tested this fix. The fixed driver works with a ili9486 display connected to a raspberry pi via SPI. Fixes: c440eee1a7a1d ("Staging: fbtft: Switch to the gpio descriptor interface") Tested-by: Jan Sebastian Götte Reviewed-by: Nicolas Saenz Julienne Signed-off-by: Jan Sebastian Götte Link: https://lore.kernel.org/r/75ada52f-afa1-08bc-d0ce-966fc1110e70@jaseg.net Signed-off-by: Greg Kroah-Hartman commit 610504301235e6d7c5a8505d1d3401bed0403d05 Author: Christophe JAILLET Date: Sun Jul 21 19:08:24 2019 +0200 staging: unisys: visornic: Update the description of 'poll_for_irq()' Commit e99e88a9d2b06 ("treewide: setup_timer() -> timer_setup()") has updated the parameters of 'poll_for_irq()' but not the comment above the function. Update the comment and fix a typo. s/visronic/visornic/ Signed-off-by: Christophe JAILLET Reviewed-By: Enrico Weigelt Link: https://lore.kernel.org/r/20190721170824.3412-1-christophe.jaillet@wanadoo.fr Signed-off-by: Greg Kroah-Hartman commit fb2b055b7e6e44efda737c7c92f46c0868bb04e5 Author: Adham Abozaeid Date: Mon Jul 22 21:38:44 2019 +0000 staging: wilc1000: flush the workqueue before deinit the host Before deinitializing the host interface, the workqueue should be flushed to handle any pending deferred work Signed-off-by: Adham Abozaeid Cc: stable Link: https://lore.kernel.org/r/20190722213837.21952-1-adham.abozaeid@microchip.com Signed-off-by: Greg Kroah-Hartman commit 66665bb9979246729562a09fcdbb101c83127989 Author: Ivan Bornyakov Date: Wed Jul 10 23:45:18 2019 +0300 staging: gasket: apex: fix copy-paste typo In sysfs_show() case-branches ATTR_KERNEL_HIB_PAGE_TABLE_SIZE and ATTR_KERNEL_HIB_SIMPLE_PAGE_TABLE_SIZE do the same. It looks like copy-paste mistake. Signed-off-by: Ivan Bornyakov Cc: stable Link: https://lore.kernel.org/r/20190710204518.16814-1-brnkv.i1@gmail.com Signed-off-by: Greg Kroah-Hartman commit b918d1c2706619cb0712a61cc8c05148b68b24b2 Author: Phil Reid Date: Tue Jul 16 08:24:37 2019 +0800 Staging: fbtft: Fix reset assertion when using gpio descriptor Typically gpiod_set_value calls would assert the reset line and then release it using the symantics of: gpiod_set_value(par->gpio.reset, 0); ... delay gpiod_set_value(par->gpio.reset, 1); And the gpio binding would specify the polarity. Prior to conversion to gpiod calls the polarity in the DT was ignored and assumed to be active low. Fix it so that DT polarity is respected. Fixes: c440eee1a7a1 ("Staging: fbtft: Switch to the gpio descriptor interface") Reviewed-by: Nicolas Saenz Julienne Tested-by: Nicolas Saenz Julienne Tested-by: Jan Sebastian Götte Signed-off-by: Phil Reid Cc: stable Link: https://lore.kernel.org/r/1563236677-5045-3-git-send-email-preid@electromag.com.au Signed-off-by: Greg Kroah-Hartman commit dbc4f989c878fe101fb7920e9609e8ec44e097cd Author: Phil Reid Date: Tue Jul 16 08:24:36 2019 +0800 Staging: fbtft: Fix probing of gpio descriptor Conversion to use gpio descriptors broke all gpio lookups as devm_gpiod_get_index was converted to use dev->driver->name for the gpio name lookup. Fix this by using the name param. In addition gpiod_get post-fixes the -gpios to the name so that shouldn't be included in the call. However this then breaks the of_find_property call to see if the gpio entry exists as all fbtft treats all gpios as optional. So use devm_gpiod_get_index_optional instead which achieves the same thing and is simpler. Nishad confirmed the changes where only ever compile tested. Fixes: c440eee1a7a1 ("Staging: fbtft: Switch to the gpio descriptor interface") Reviewed-by: Nicolas Saenz Julienne Tested-by: Nicolas Saenz Julienne Tested-by: Jan Sebastian Götte Signed-off-by: Phil Reid Cc: stable Link: https://lore.kernel.org/r/1563236677-5045-2-git-send-email-preid@electromag.com.au Signed-off-by: Greg Kroah-Hartman commit 3f8809499bf02ef7874254c5e23fc764a47a21a0 Author: Hui Wang Date: Thu Jul 25 14:57:37 2019 +0800 ALSA: hda - Add a conexant codec entry to let mute led work This conexant codec isn't in the supported codec list yet, the hda generic driver can drive this codec well, but on a Lenovo machine with mute/mic-mute leds, we need to apply CXT_FIXUP_THINKPAD_ACPI to make the leds work. After adding this codec to the list, the driver patch_conexant.c will apply THINKPAD_ACPI to this machine. Cc: stable@vger.kernel.org Signed-off-by: Hui Wang Signed-off-by: Takashi Iwai commit 67d86835840a533ce868c42a7f05507e66ba95f0 Author: Phil Sutter Date: Tue Jul 23 15:27:53 2019 +0200 netfilter: nft_meta_bridge: Eliminate 'out' label The label is used just once and the code it points at is not reused, no point in keeping it. Signed-off-by: Phil Sutter Signed-off-by: Pablo Neira Ayuso commit cb81572e8cb50c5fb98b0b962cdfe48fff71fd37 Author: Phil Sutter Date: Tue Jul 23 15:27:52 2019 +0200 netfilter: nf_tables: Make nft_meta expression more robust nft_meta_get_eval()'s tendency to bail out setting NFT_BREAK verdict in situations where required data is missing leads to unexpected behaviour with inverted checks like so: | meta iifname != eth0 accept This rule will never match if there is no input interface (or it is not known) which is not intuitive and, what's worse, breaks consistency of iptables-nft with iptables-legacy. Fix this by falling back to placing a value in dreg which never matches (avoiding accidental matches), i.e. zero for interface index and an empty string for interface name. Signed-off-by: Phil Sutter Signed-off-by: Pablo Neira Ayuso commit 882a0db9d143e5e8dac54b96e83135bccd1f68d1 Author: Peter Zijlstra Date: Wed Jul 24 17:47:26 2019 -0500 objtool: Improve UACCESS coverage A clang build reported an (obvious) double CLAC while a GCC build did not; it turns out that objtool only re-visits instructions if the first visit was with AC=0. If OTOH the first visit was with AC=1, it completely ignores any subsequent visit, even when it has AC=0. Fix this by using a visited mask instead of a boolean, and (explicitly) mark the AC state. $ ./objtool check -b --no-fp --retpoline --uaccess drivers/gpu/drm/i915/gem/i915_gem_execbuffer.o drivers/gpu/drm/i915/gem/i915_gem_execbuffer.o: warning: objtool: .altinstr_replacement+0x22: redundant UACCESS disable drivers/gpu/drm/i915/gem/i915_gem_execbuffer.o: warning: objtool: eb_copy_relocations.isra.34()+0xea: (alt) drivers/gpu/drm/i915/gem/i915_gem_execbuffer.o: warning: objtool: .altinstr_replacement+0xffffffffffffffff: (branch) drivers/gpu/drm/i915/gem/i915_gem_execbuffer.o: warning: objtool: eb_copy_relocations.isra.34()+0xd9: (alt) drivers/gpu/drm/i915/gem/i915_gem_execbuffer.o: warning: objtool: eb_copy_relocations.isra.34()+0xb2: (branch) drivers/gpu/drm/i915/gem/i915_gem_execbuffer.o: warning: objtool: eb_copy_relocations.isra.34()+0x39: (branch) drivers/gpu/drm/i915/gem/i915_gem_execbuffer.o: warning: objtool: eb_copy_relocations.isra.34()+0x0: <=== (func) Reported-by: Josh Poimboeuf Reported-by: Thomas Gleixner Reported-by: Sedat Dilek Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Josh Poimboeuf Signed-off-by: Thomas Gleixner Tested-by: Nathan Chancellor Tested-by: Nick Desaulniers Tested-by: Sedat Dilek Link: https://github.com/ClangBuiltLinux/linux/issues/617 Link: https://lkml.kernel.org/r/5359166aad2d53f3145cd442d83d0e5115e0cd17.1564007838.git.jpoimboe@redhat.com commit e3cacb73e626d885b8cf24103fed0ae26518e3c4 Author: Max Filippov Date: Wed Jul 24 17:39:47 2019 -0700 xtensa: fix build for cores with coprocessors Assembly entry/return abstraction change didn't add asmmacro.h include statement to coprocessor.S, resulting in references to undefined macros abi_entry and abi_ret on cores that define XTENSA_HAVE_COPROCESSORS. Fix that by including asm/asmmacro.h from the coprocessor.S. Signed-off-by: Max Filippov commit 4638faac032756f7eab5524be7be56bee77e426b Author: Cong Wang Date: Mon Jul 22 20:41:22 2019 -0700 netrom: hold sock when setting skb->destructor sock_efree() releases the sock refcnt, if we don't hold this refcnt when setting skb->destructor to it, the refcnt would not be balanced. This leads to several bug reports from syzbot. I have checked other users of sock_efree(), all of them hold the sock refcnt. Fixes: c8c8218ec5af ("netrom: fix a memory leak in nr_rx_frame()") Reported-and-tested-by: Reported-and-tested-by: Reported-and-tested-by: Reported-and-tested-by: Cc: Ralf Baechle Signed-off-by: Cong Wang Signed-off-by: David S. Miller commit 260637903f47f20c5918bb5c1eea52b2a28ea863 Author: Arnd Bergmann Date: Mon Jul 22 17:00:01 2019 +0200 ovs: datapath: hide clang frame-overflow warnings Some functions in the datapath code are factored out so that each one has a stack frame smaller than 1024 bytes with gcc. However, when compiling with clang, the functions are inlined more aggressively and combined again so we get net/openvswitch/datapath.c:1124:12: error: stack frame size of 1528 bytes in function 'ovs_flow_cmd_set' [-Werror,-Wframe-larger-than=] Marking both get_flow_actions() and ovs_nla_init_match_and_action() as 'noinline_for_stack' gives us the same behavior that we see with gcc, and no warning. Note that this does not mean we actually use less stack, as the functions call each other, and we still get three copies of the large 'struct sw_flow_key' type on the stack. The comment tells us that this was previously considered safe, presumably since the netlink parsing functions are called with a known backchain that does not also use a lot of stack space. Fixes: 9cc9a5cb176c ("datapath: Avoid using stack larger than 1024.") Signed-off-by: Arnd Bergmann Signed-off-by: David S. Miller commit 47b79bbb19e1cfc615823ccaac258cdd2c810c47 Author: Jakub Kicinski Date: Wed Jul 24 11:02:48 2019 -0700 net/tls: add myself as a co-maintainer I've been spending quite a bit of time fixing and preventing bit rot in the core TLS code. TLS seems to only be growing in importance, I'd like to help ensuring the quality of our implementation. Signed-off-by: Jakub Kicinski Acked-by: Alexei Starovoitov Acked-by: Daniel Borkmann Acked-by: John Fastabend Acked-by: Simon Horman Signed-off-by: David S. Miller commit f972037e71246c5e0916eef835174d58ffc517e4 Author: Andreas Schwab Date: Wed Jul 24 17:32:57 2019 +0200 net: phy: mscc: initialize stats array The memory allocated for the stats array may contain arbitrary data. Fixes: e4f9ba642f0b ("net: phy: mscc: add support for VSC8514 PHY.") Fixes: 00d70d8e0e78 ("net: phy: mscc: add support for VSC8574 PHY") Fixes: a5afc1678044 ("net: phy: mscc: add support for VSC8584 PHY") Fixes: f76178dc5218 ("net: phy: mscc: add ethtool statistics counters") Signed-off-by: Andreas Schwab Reviewed-by: Andrew Lunn Signed-off-by: David S. Miller commit 2756d9143aa517b97961e85412882b8ce31371a6 Author: Takashi Iwai Date: Fri Jul 19 10:27:54 2019 +0200 ALSA: hda - Fix intermittent CORB/RIRB stall on Intel chips It turned out that the recent Intel HD-audio controller chips show a significant stall during the system PM resume intermittently. It doesn't happen so often and usually it may read back successfully after one or more seconds, but in some rare worst cases the driver went into fallback mode. After trial-and-error, we found out that the communication stall seems covered by issuing the sync after each verb write, as already done for AMD and other chipsets. So this patch enables the write-sync flag for the recent Intel chips, Skylake and onward, as a workaround. Also, since Broxton and co have the very same driver flags as Skylake, refer to the Skylake driver flags instead of defining the same contents again for simplification. BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=201901 Reported-and-tested-by: Todd Brandt Cc: Signed-off-by: Takashi Iwai commit c7fa7f567cab6532be285a5df104617d80bce245 Author: Arseny Solokha Date: Wed Jul 24 20:31:39 2019 +0700 net: phylink: don't start and stop SGMII PHYs in SFP modules twice SFP modules connected using the SGMII interface have their own PHYs which are handled by the struct phylink's phydev field. On the other hand, for the modules connected using 1000Base-X interface that field is not set. Since commit ce0aa27ff3f6 ("sfp: add sfp-bus to bridge between network devices and sfp cages") phylink_start() ends up setting the phydev field using the sfp-bus infrastructure, which eventually calls phy_start() on it, and then calling phy_start() again on the same phydev from phylink_start() itself. Similar call sequence holds for phylink_stop(), only in the reverse order. This results in WARNs during network interface bringup and shutdown when a copper SFP module is connected, as phy_start() and phy_stop() are called twice in a row for the same phy_device: % ip link set up dev eth0 ------------[ cut here ]------------ called from state UP WARNING: CPU: 1 PID: 155 at drivers/net/phy/phy.c:895 phy_start+0x74/0xc0 Modules linked in: CPU: 1 PID: 155 Comm: backend Not tainted 5.2.0+ #1 NIP: c0227bf0 LR: c0227bf0 CTR: c004d224 REGS: df547720 TRAP: 0700 Not tainted (5.2.0+) MSR: 00029000 CR: 24002822 XER: 00000000 GPR00: c0227bf0 df5477d8 df5d7080 00000014 df9d2370 df9d5ac4 1f4eb000 00000001 GPR08: c061fe58 00000000 00000000 df5477d8 0000003c 100c8768 00000000 00000000 GPR16: df486a00 c046f1c8 c046eea0 00000000 c046e904 c0239604 db68449c 00000000 GPR24: e9083204 00000000 00000001 db684460 e9083404 00000000 db6dce00 db6dcc00 NIP [c0227bf0] phy_start+0x74/0xc0 LR [c0227bf0] phy_start+0x74/0xc0 Call Trace: [df5477d8] [c0227bf0] phy_start+0x74/0xc0 (unreliable) [df5477e8] [c023cad0] startup_gfar+0x398/0x3f4 [df547828] [c023cf08] gfar_enet_open+0x364/0x374 [df547898] [c029d870] __dev_open+0xe4/0x140 [df5478c8] [c029db70] __dev_change_flags+0xf0/0x188 [df5478f8] [c029dc28] dev_change_flags+0x20/0x54 [df547918] [c02ae304] do_setlink+0x310/0x818 [df547a08] [c02b1eb8] __rtnl_newlink+0x384/0x6b0 [df547c28] [c02b222c] rtnl_newlink+0x48/0x68 [df547c48] [c02ad7c8] rtnetlink_rcv_msg+0x240/0x27c [df547c98] [c02cc068] netlink_rcv_skb+0x8c/0xf0 [df547cd8] [c02cba3c] netlink_unicast+0x114/0x19c [df547d08] [c02cbd74] netlink_sendmsg+0x2b0/0x2c0 [df547d58] [c027b668] sock_sendmsg_nosec+0x20/0x40 [df547d68] [c027d080] ___sys_sendmsg+0x17c/0x1dc [df547e98] [c027df7c] __sys_sendmsg+0x68/0x84 [df547ef8] [c027e430] sys_socketcall+0x1a0/0x204 [df547f38] [c000d1d8] ret_from_syscall+0x0/0x38 --- interrupt: c01 at 0xfd4e030 LR = 0xfd4e010 Instruction dump: 813f0188 38800000 2b890005 419d0014 3d40c046 5529103a 394aa208 7c8a482e 3c60c046 3863a1b8 4cc63182 4be009a1 <0fe00000> 48000030 3c60c046 3863a1d0 ---[ end trace d4c095aeaf6ea998 ]--- and % ip link set down dev eth0 ------------[ cut here ]------------ called from state HALTED WARNING: CPU: 1 PID: 184 at drivers/net/phy/phy.c:858 phy_stop+0x3c/0x88 <...> Call Trace: [df581788] [c0228450] phy_stop+0x3c/0x88 (unreliable) [df581798] [c022d548] sfp_sm_phy_detach+0x1c/0x44 [df5817a8] [c022e8cc] sfp_sm_event+0x4b0/0x87c [df581848] [c022f04c] sfp_upstream_stop+0x34/0x44 [df581858] [c0225608] phylink_stop+0x7c/0xe4 [df581868] [c023c57c] stop_gfar+0x7c/0x94 [df581888] [c023c5b8] gfar_close+0x24/0x94 [df5818a8] [c0298688] __dev_close_many+0xdc/0xf8 [df5818c8] [c029db58] __dev_change_flags+0xd8/0x188 [df5818f8] [c029dc28] dev_change_flags+0x20/0x54 [df581918] [c02ae304] do_setlink+0x310/0x818 [df581a08] [c02b1eb8] __rtnl_newlink+0x384/0x6b0 [df581c28] [c02b222c] rtnl_newlink+0x48/0x68 [df581c48] [c02ad7c8] rtnetlink_rcv_msg+0x240/0x27c [df581c98] [c02cc068] netlink_rcv_skb+0x8c/0xf0 [df581cd8] [c02cba3c] netlink_unicast+0x114/0x19c [df581d08] [c02cbd74] netlink_sendmsg+0x2b0/0x2c0 [df581d58] [c027b668] sock_sendmsg_nosec+0x20/0x40 [df581d68] [c027d080] ___sys_sendmsg+0x17c/0x1dc [df581e98] [c027df7c] __sys_sendmsg+0x68/0x84 [df581ef8] [c027e430] sys_socketcall+0x1a0/0x204 [df581f38] [c000d1d8] ret_from_syscall+0x0/0x38 <...> ---[ end trace d4c095aeaf6ea999 ]--- SFP modules with the 1000Base-X interface are not affected. Place explicit calls to phy_start() and phy_stop() before enabling or after disabling an attached SFP module, where phydev is not yet set (or is already unset), so they will be made only from the inside of sfp-bus, if needed. Fixes: 217962615662 ("net: phy: warn if phy_start is called from invalid state") Signed-off-by: Arseny Solokha Acked-by: Russell King Signed-off-by: David S. Miller commit 09ea26792a5712732845b9c6b799a30b7b33efd1 Merge: 3bc817d665ac b7a14297f102 Author: David S. Miller Date: Wed Jul 24 14:14:50 2019 -0700 Merge tag 'linux-can-fixes-for-5.3-20190724' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can Marc Kleine-Budde says: ==================== pull-request: can 2019-07-24 this is a pull reqeust of 7 patches for net/master. The first patch is by Rasmus Villemoes add a missing netif_carrier_off() to register_candev() so that generic netdev trigger based LEDs are initially off. Nikita Yushchenko's patch for the rcar_canfd driver fixes a possible IRQ storm on high load. The patch by Weitao Hou for the mcp251x driver add missing error checking to the work queue allocation. Both Wen Yang's and Joakim Zhang's patch for the flexcan driver fix a problem with the stop-mode. Stephane Grosjean contributes a patch for the peak_usb driver to fix a potential double kfree_skb(). The last patch is by YueHaibing and fixes the error path in can-gw's cgw_module_init() function. ==================== Signed-off-by: David S. Miller commit 3bc817d665ac6d9de89f59df522ad86f5b5dfc03 Author: Haishuang Yan Date: Wed Jul 24 20:00:42 2019 +0800 ip6_gre: reload ipv6h in prepare_ip6gre_xmit_ipv6 Since ip6_tnl_parse_tlv_enc_lim() can call pskb_may_pull() which may change skb->data, so we need to re-load ipv6h at the right place. Fixes: 898b29798e36 ("ip6_gre: Refactor ip6gre xmit codes") Cc: William Tu Signed-off-by: Haishuang Yan Acked-by: William Tu Signed-off-by: David S. Miller commit c7148c03db80e44da7197ec5f558f630333c5cad Author: Pavel Machek Date: Wed Jul 24 13:56:37 2019 -0700 net/ipv4: cleanup error condition testing Cleanup testing for error condition. Signed-off-by: Pavel Machek Signed-off-by: David S. Miller commit 71be7b0e7d4069822c89146daed800686db8f147 Author: Asmaa Mnebhi Date: Wed Jul 24 15:32:57 2019 -0400 Fix uninitialized variable in ipmb_dev_int.c ret at line 112 of ipmb_dev_int.c is uninitialized which results in a warning during build regressions. This warning was found by build regression/improvement testing for v5.3-rc1. Reported-by: build regression/improvement testing for v5.3-rc1. Fixes: 51bd6f291583 ("Add support for IPMB driver") Signed-off-by: Asmaa Mnebhi Message-Id: <571dbb67cf58411d567953d9fb3739eb4789238b.1563996586.git.Asmaa@mellanox.com> Signed-off-by: Corey Minyard commit 50ce73cfbb4aa47ed14d223e3dd6a66ea5c792a1 Author: Talel Shenhar Date: Thu Jul 11 09:38:59 2019 +0300 dt-bindings: interrupt-controller: al-fic: remove redundant binding Remove dt binding description for standard binding. Signed-off-by: Talel Shenhar Signed-off-by: Rob Herring commit 527d37e9e575bc0e9024de9b499385e7bb31f1ad Author: Joe Lawrence Date: Wed Jul 24 16:05:58 2019 -0400 selftests/livepatch: add test skip handling Add a skip() message function that stops the test, logs an explanation, and sets the "skip" return code (4). Before loading a livepatch self-test kernel module, first verify that we've built and installed it by running a 'modprobe --dry-run'. This should catch a few environment issues, including !CONFIG_LIVEPATCH and !CONFIG_TEST_LIVEPATCH. In these cases, exit gracefully with the new skip() function. Reported-by: Jiri Benc Suggested-by: Shuah Khan Reviewed-by: Petr Mladek Signed-off-by: Joe Lawrence Signed-off-by: Shuah Khan commit b9332dad987018745a0c0bb718d12dacfa760489 Author: Yishai Hadas Date: Tue Jul 23 09:57:28 2019 +0300 IB/mlx5: Fix clean_mr() to work in the expected order Any dma map underlying the MR should only be freed once the MR is fenced at the hardware. As of the above we first destroy the MKEY and just after that can safely call to dma_unmap_single(). Link: https://lore.kernel.org/r/20190723065733.4899-6-leon@kernel.org Cc: # 4.3 Fixes: 8a187ee52b04 ("IB/mlx5: Support the new memory registration API") Signed-off-by: Yishai Hadas Reviewed-by: Artemy Kovalyov Signed-off-by: Leon Romanovsky Reviewed-by: Jason Gunthorpe Signed-off-by: Jason Gunthorpe commit 9ec4483a3f0f71a228a5933bc040441322bfb090 Author: Yishai Hadas Date: Tue Jul 23 09:57:27 2019 +0300 IB/mlx5: Move MRs to a kernel PD when freeing them to the MR cache Fix unreg_umr to move the MR to a kernel owned PD (i.e. the UMR PD) which can't be accessed by userspace. This ensures that nothing can continue to access the MR once it has been placed in the kernels cache for reuse. MRs in the cache continue to have their HW state, including DMA tables, present. Even though the MR has been invalidated, changing the PD provides an additional layer of protection against use of the MR. Link: https://lore.kernel.org/r/20190723065733.4899-5-leon@kernel.org Cc: # 3.10 Fixes: e126ba97dba9 ("mlx5: Add driver for Mellanox Connect-IB adapters") Signed-off-by: Yishai Hadas Reviewed-by: Artemy Kovalyov Signed-off-by: Leon Romanovsky Reviewed-by: Jason Gunthorpe Signed-off-by: Jason Gunthorpe commit afd1417404fba6dbfa6c0a8e5763bd348da682e4 Author: Yishai Hadas Date: Tue Jul 23 09:57:26 2019 +0300 IB/mlx5: Use direct mkey destroy command upon UMR unreg failure Use a direct firmware command to destroy the mkey in case the unreg UMR operation has failed. This prevents a case that a mkey will leak out from the cache post a failure to be destroyed by a UMR WR. In case the MR cache limit didn't reach a call to add another entry to the cache instead of the destroyed one is issued. In addition, replaced a warn message to WARN_ON() as this flow is fatal and can't happen unless some bug around. Link: https://lore.kernel.org/r/20190723065733.4899-4-leon@kernel.org Cc: # 4.10 Fixes: 49780d42dfc9 ("IB/mlx5: Expose MR cache for mlx5_ib") Signed-off-by: Yishai Hadas Reviewed-by: Artemy Kovalyov Signed-off-by: Leon Romanovsky Reviewed-by: Jason Gunthorpe Signed-off-by: Jason Gunthorpe commit 6a053953739d23694474a5f9c81d1a30093da81a Author: Yishai Hadas Date: Tue Jul 23 09:57:25 2019 +0300 IB/mlx5: Fix unreg_umr to ignore the mkey state Fix unreg_umr to ignore the mkey state and do not fail if was freed. This prevents a case that a user space application already changed the mkey state to free and then the UMR operation will fail leaving the mkey in an inappropriate state. Link: https://lore.kernel.org/r/20190723065733.4899-3-leon@kernel.org Cc: # 3.19 Fixes: 968e78dd9644 ("IB/mlx5: Enhance UMR support to allow partial page table update") Signed-off-by: Yishai Hadas Reviewed-by: Artemy Kovalyov Signed-off-by: Leon Romanovsky Reviewed-by: Jason Gunthorpe Signed-off-by: Jason Gunthorpe commit aecea57f84b0586b62c010bea946468d77f6bf0f Author: Masanari Iida Date: Tue Jul 23 12:24:45 2019 +0900 ktest: Fix some typos in config-bisect.pl This patch fixes some spelling typos in config-bisect.pl Link: http://lkml.kernel.org/r/20190723032445.14220-1-standby24x7@gmail.com Acked-by: Randy Dunlap Signed-off-by: Masanari Iida Signed-off-by: Steven Rostedt (VMware) commit 8d8bef50365847134b51c1ec46786bc2873e4e47 Author: Lukas Wunner Date: Wed Jul 3 12:29:31 2019 +0200 spi: bcm2835: Fix 3-wire mode if DMA is enabled Commit 6935224da248 ("spi: bcm2835: enable support of 3-wire mode") added 3-wire support to the BCM2835 SPI driver by setting the REN bit (Read Enable) in the CS register when receiving data. The REN bit puts the transmitter in high-impedance state. The driver recognizes that data is to be received by checking whether the rx_buf of a transfer is non-NULL. Commit 3ecd37edaa2a ("spi: bcm2835: enable dma modes for transfers meeting certain conditions") subsequently broke 3-wire support because it set the SPI_MASTER_MUST_RX flag which causes spi_map_msg() to replace rx_buf with a dummy buffer if it is NULL. As a result, rx_buf is *always* non-NULL if DMA is enabled. Reinstate 3-wire support by not only checking whether rx_buf is non-NULL, but also checking that it is not the dummy buffer. Fixes: 3ecd37edaa2a ("spi: bcm2835: enable dma modes for transfers meeting certain conditions") Reported-by: Nuno Sá Signed-off-by: Lukas Wunner Cc: stable@vger.kernel.org # v4.2+ Cc: Martin Sperl Acked-by: Stefan Wahren Link: https://lore.kernel.org/r/328318841455e505370ef8ecad97b646c033dc8a.1562148527.git.lukas@wunner.de Signed-off-by: Mark Brown commit 2e05ec4834f9bb7fe3575e4c48acebebfa1e24d9 Author: Masanari Iida Date: Wed Jul 24 23:15:54 2019 +0900 selftests: mlxsw: Fix typo in qos_mc_aware.sh This patch fixes some spelling typo in qos_mc_aware.sh Signed-off-by: Masanari Iida Acked-by: Randy Dunlap Reviewed-by: Ido Schimmel Signed-off-by: Shuah Khan commit d7852fbd0f0423937fa287a598bfde188bb68c22 Author: Linus Torvalds Date: Thu Jul 11 09:54:40 2019 -0700 access: avoid the RCU grace period for the temporary subjective credentials It turns out that 'access()' (and 'faccessat()') can cause a lot of RCU work because it installs a temporary credential that gets allocated and freed for each system call. The allocation and freeing overhead is mostly benign, but because credentials can be accessed under the RCU read lock, the freeing involves a RCU grace period. Which is not a huge deal normally, but if you have a lot of access() calls, this causes a fair amount of seconday damage: instead of having a nice alloc/free patterns that hits in hot per-CPU slab caches, you have all those delayed free's, and on big machines with hundreds of cores, the RCU overhead can end up being enormous. But it turns out that all of this is entirely unnecessary. Exactly because access() only installs the credential as the thread-local subjective credential, the temporary cred pointer doesn't actually need to be RCU free'd at all. Once we're done using it, we can just free it synchronously and avoid all the RCU overhead. So add a 'non_rcu' flag to 'struct cred', which can be set by users that know they only use it in non-RCU context (there are other potential users for this). We can make it a union with the rcu freeing list head that we need for the RCU case, so this doesn't need any extra storage. Note that this also makes 'get_current_cred()' clear the new non_rcu flag, in case we have filesystems that take a long-term reference to the cred and then expect the RCU delayed freeing afterwards. It's not entirely clear that this is required, but it makes for clear semantics: the subjective cred remains non-RCU as long as you only access it synchronously using the thread-local accessors, but you _can_ use it as a generic cred if you want to. It is possible that we should just remove the whole RCU markings for ->cred entirely. Only ->real_cred is really supposed to be accessed through RCU, and the long-term cred copies that nfs uses might want to explicitly re-enable RCU freeing if required, rather than have get_current_cred() do it implicitly. But this is a "minimal semantic changes" change for the immediate problem. Acked-by: Peter Zijlstra (Intel) Acked-by: Eric Dumazet Acked-by: Paul E. McKenney Cc: Oleg Nesterov Cc: Jan Glauber Cc: Jiri Kosina Cc: Jayachandran Chandrasekharan Nair Cc: Greg KH Cc: Kees Cook Cc: David Howells Cc: Miklos Szeredi Cc: Al Viro Signed-off-by: Linus Torvalds commit bed38c3e2dca01b358a62b5e73b46e875742fd75 Merge: 76260774575c 3a855b7ac7d5 Author: Linus Torvalds Date: Wed Jul 24 09:58:39 2019 -0700 Merge tag 'powerpc-5.3-2' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux Pull powerpc fixes from Michael Ellerman: "An assortment of non-regression fixes that have accumulated since the start of the merge window. - A fix for a user triggerable oops on machines where transactional memory is disabled, eg. Power9 bare metal, Power8 with TM disabled on the command line, or all Power7 or earlier machines. - Three fixes for handling of PMU and power saving registers when running nested KVM on Power9. - Two fixes for bugs found while stress testing the XIVE interrupt controller code, also on Power9. - A fix to allow guests to boot under Qemu/KVM on Power9 using the the Hash MMU with >= 1TB of memory. - Two fixes for bugs in the recent DMA cleanup, one of which could lead to checkstops. - And finally three fixes for the PAPR SCM nvdimm driver. Thanks to: Alexey Kardashevskiy, Andrea Arcangeli, Cédric Le Goater, Christoph Hellwig, David Gibson, Gautham R. Shenoy, Michael Neuling, Oliver O'Halloran, Satheesh Rajendran, Shawn Anastasio, Suraj Jitindar Singh, Vaibhav Jain" * tag 'powerpc-5.3-2' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux: powerpc/papr_scm: Force a scm-unbind if initial scm-bind fails powerpc/papr_scm: Update drc_pmem_unbind() to use H_SCM_UNBIND_ALL powerpc/pseries: Update SCM hcall op-codes in hvcall.h powerpc/tm: Fix oops on sigreturn on systems without TM powerpc/dma: Fix invalid DMA mmap behavior KVM: PPC: Book3S HV: XIVE: fix rollback when kvmppc_xive_create fails powerpc/xive: Fix loop exit-condition in xive_find_target_in_mask() powerpc: fix off by one in max_zone_pfn initialization for ZONE_DMA KVM: PPC: Book3S HV: Save and restore guest visible PSSCR bits on pseries powerpc/pmu: Set pmcregs_in_use in paca when running as LPAR KVM: PPC: Book3S HV: Always save guest pmu for guest capable of nesting powerpc/mm: Limit rma_size to 1TB when running without HV mode commit 76260774575c0ff7464bf5a4beabc9852180799f Merge: c2626876c24f 266e85a5ec91 Author: Linus Torvalds Date: Wed Jul 24 09:46:13 2019 -0700 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm Pull KVM fixes from Paolo Bonzini: "Bugfixes, a pvspinlock optimization, and documentation moving" * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: KVM: X86: Boost queue head vCPU to mitigate lock waiter preemption Documentation: move Documentation/virtual to Documentation/virt KVM: nVMX: Set cached_vmcs12 and cached_shadow_vmcs12 NULL after free KVM: X86: Dynamically allocate user_fpu KVM: X86: Fix fpu state crash in kvm guest Revert "kvm: x86: Use task structs fpu field for user" KVM: nVMX: Clear pending KVM_REQ_GET_VMCS12_PAGES when leaving nested commit c2626876c24fe1f326381e3f1d48301bfc627d8e Merge: ad5e427e0f6b 06532750010e Author: Linus Torvalds Date: Wed Jul 24 09:28:55 2019 -0700 Merge tag 'dma-mapping-5.3-2' of git://git.infradead.org/users/hch/dma-mapping Pull dma-mapping regression fix from Christoph Hellwig: "Ensure that dma_addressing_limited doesn't crash on devices without a dma mask (Eric Auger)" * tag 'dma-mapping-5.3-2' of git://git.infradead.org/users/hch/dma-mapping: dma-mapping: use dma_get_mask in dma_addressing_limited commit a853c0a0b013af3fee0f028cff3c44e275ce9abd Author: Axel Lin Date: Thu Jul 11 19:35:17 2019 +0800 regulator: lp87565: Fix probe failure for "ti,lp87565" The "ti,lp87565" compatible string is still in of_lp87565_match_table, but current code will return -EINVAL because lp87565->dev_type is unknown. This was working in earlier kernel versions, so fix it. Fixes: 7ee63bd74750 ("regulator: lp87565: Add 4-phase lp87561 regulator support") Signed-off-by: Axel Lin Link: https://lore.kernel.org/r/20190711113517.26077-1-axel.lin@ingics.com Signed-off-by: Mark Brown commit 40aa5383e393d72f6aa3943a4e7b1aae25a1e43b Author: Ricard Wanderlof Date: Wed Jul 24 11:38:44 2019 +0200 ASoC: Fail card instantiation if DAI format setup fails If the DAI format setup fails, there is no valid communication format between CPU and CODEC, so fail card instantiation, rather than continue with a card that will most likely not function properly. Signed-off-by: Ricard Wanderlof Link: https://lore.kernel.org/r/alpine.DEB.2.20.1907241132350.6338@lnxricardw1.se.axis.com Signed-off-by: Mark Brown commit 27988c96687667e74df1a9a3b8662519bc1c29c9 Merge: 8f46e22b5ac6 5f9e832c1370 Author: Mark Brown Date: Wed Jul 24 17:00:06 2019 +0100 Merge tag 'v5.3-rc1' into regulator-5.3 Linus 5.3-rc1 commit ad3c7b18c5b362be5dbd0f2c0bcf1fd5fd659315 Author: Christoph Hellwig Date: Tue Jul 23 11:33:12 2019 +0200 arm: use swiotlb for bounce buffering on LPAE configs The DMA API requires that 32-bit DMA masks are always supported, but on arm LPAE configs they do not currently work when memory is present above 4GB. Wire up the swiotlb code like for all other architectures to provide the bounce buffering in that case. Fixes: 21e07dba9fb11 ("scsi: reduce use of block bounce buffers"). Reported-by: Roger Quadros Signed-off-by: Christoph Hellwig Tested-by: Vignesh Raghavendra commit 66d7780f18eae0232827fcffeaded39a6a168236 Author: Christoph Hellwig Date: Mon Jul 8 11:51:56 2019 -0700 dma-mapping: check pfn validity in dma_common_{mmap,get_sgtable} Check that the pfn returned from arch_dma_coherent_to_pfn refers to a valid page and reject the mmap / get_sgtable requests otherwise. Based on the arm implementation of the mmap and get_sgtable methods. Signed-off-by: Christoph Hellwig Tested-by: Vignesh Raghavendra commit acbc372e6109c803cbee4733769d02008381740f Author: Ondrej Mosnacek Date: Tue Jul 23 08:50:59 2019 +0200 selinux: check sidtab limit before adding a new entry We need to error out when trying to add an entry above SIDTAB_MAX in sidtab_reverse_lookup() to avoid overflow on the odd chance that this happens. Cc: stable@vger.kernel.org Fixes: ee1a84fdfeed ("selinux: overhaul sidtab to fix bug and improve performance") Signed-off-by: Ondrej Mosnacek Reviewed-by: Kees Cook Signed-off-by: Paul Moore commit c7842d1080a31ab02950be74d3c6960139ff0f7f Author: Rob Herring Date: Tue Jul 23 17:03:44 2019 -0600 dt-bindings: clk: allwinner,sun4i-a10-ccu: Correct path in $id The path in the schema '$id' value is wrong. Fix it. Cc: Michael Turquette Cc: Stephen Boyd Cc: Chen-Yu Tsai Cc: linux-clk@vger.kernel.org Acked-by: Maxime Ripard Signed-off-by: Rob Herring commit 266e85a5ec9100dcd9ae03601453bbc96fefee5d Author: Wanpeng Li Date: Wed Jul 24 17:43:13 2019 +0800 KVM: X86: Boost queue head vCPU to mitigate lock waiter preemption Commit 11752adb (locking/pvqspinlock: Implement hybrid PV queued/unfair locks) introduces hybrid PV queued/unfair locks - queued mode (no starvation) - unfair mode (good performance on not heavily contended lock) The lock waiter goes into the unfair mode especially in VMs with over-commit vCPUs since increaing over-commitment increase the likehood that the queue head vCPU may have been preempted and not actively spinning. However, reschedule queue head vCPU timely to acquire the lock still can get better performance than just depending on lock stealing in over-subscribe scenario. Testing on 80 HT 2 socket Xeon Skylake server, with 80 vCPUs VM 80GB RAM: ebizzy -M vanilla boosting improved 1VM 23520 25040 6% 2VM 8000 13600 70% 3VM 3100 5400 74% The lock holder vCPU yields to the queue head vCPU when unlock, to boost queue head vCPU which is involuntary preemption or the one which is voluntary halt due to fail to acquire the lock after a short spin in the guest. Cc: Waiman Long Cc: Peter Zijlstra Cc: Paolo Bonzini Cc: Radim Krčmář Signed-off-by: Wanpeng Li Signed-off-by: Paolo Bonzini commit b8f70953c1251d8b16276995816a95639f598e70 Author: Matt Mullins Date: Tue Jul 23 21:20:58 2019 -0700 x86/entry/32: Pass cr2 to do_async_page_fault() Commit a0d14b8909de ("x86/mm, tracing: Fix CR2 corruption") added the address parameter to do_async_page_fault(), but does not pass it from the 32-bit entry point. To plumb it through, factor-out common_exception_read_cr2 in the same fashion as common_exception, and uses it from both page_fault and async_page_fault. For a 32-bit KVM guest, this fixes: Run /sbin/init as init process Starting init: /sbin/init exists but couldn't execute it (error -14) Fixes: a0d14b8909de ("x86/mm, tracing: Fix CR2 corruption") Signed-off-by: Matt Mullins Signed-off-by: Thomas Gleixner Acked-by: Peter Zijlstra (Intel) Link: https://lkml.kernel.org/r/20190724042058.24506-1-mmullins@fb.com commit f3b5720cabafe90b8b7cffbc7b8fec1c17d4ff4b Author: Dmitry Torokhov Date: Wed Jul 24 10:29:03 2019 +0300 Input: elantech - annotate fall-through case in elantech_use_host_notify() This avoids a warning when building with -Wimplicit-fallthrough. Fixes: 883a2a80f79c ("Input: elantech - enable SMBus on new (2018+) systems") Reported-by: Stephen Rothwell Signed-off-by: Dmitry Torokhov commit 3d139703d397f6281368047ba7ad1c8bf95aa8ab Author: YueHaibing Date: Mon Jul 8 15:13:56 2019 +0800 fpga-manager: altera-ps-spi: Fix build error If BITREVERSE is m and FPGA_MGR_ALTERA_PS_SPI is y, build fails: drivers/fpga/altera-ps-spi.o: In function `altera_ps_write': altera-ps-spi.c:(.text+0x4ec): undefined reference to `byte_rev_table' Select BITREVERSE to fix this. Reported-by: Hulk Robot Fixes: fcfe18f885f6 ("fpga-manager: altera-ps-spi: use bitrev8x4") Signed-off-by: YueHaibing Cc: stable Acked-by: Moritz Fischer Link: https://lore.kernel.org/r/20190708071356.50928-1-yuehaibing@huawei.com Signed-off-by: Greg Kroah-Hartman commit 1be8624a0cbef720e8da39a15971e01abffc865b Author: Alexander Usyskin Date: Fri Jul 12 12:58:14 2019 +0300 mei: me: add mule creek canyon (EHL) device ids Add Mule Creek Canyon (PCH) MEI device ids for Elkhart Lake (EHL) Platform. Signed-off-by: Alexander Usyskin Signed-off-by: Tomas Winkler Cc: stable Link: https://lore.kernel.org/r/20190712095814.20746-1-tomas.winkler@intel.com Signed-off-by: Greg Kroah-Hartman commit b7a14297f102b6e2ce6f16feffebbb9bde1e9b55 Author: YueHaibing Date: Sat May 18 17:35:43 2019 +0800 can: gw: Fix error path of cgw_module_init This patch add error path for cgw_module_init to avoid possible crash if some error occurs. Fixes: c1aabdf379bc ("can-gw: add netlink based CAN routing") Signed-off-by: YueHaibing Acked-by: Oliver Hartkopp Signed-off-by: Marc Kleine-Budde commit fee6a8923ae0d318a7f7950c6c6c28a96cea099b Author: Stephane Grosjean Date: Fri Jul 5 15:32:16 2019 +0200 can: peak_usb: fix potential double kfree_skb() When closing the CAN device while tx skbs are inflight, echo skb could be released twice. By calling close_candev() before unlinking all pending tx urbs, then the internal echo_skb[] array is fully and correctly cleared before the USB write callback and, therefore, can_get_echo_skb() are called, for each aborted URB. Fixes: bb4785551f64 ("can: usb: PEAK-System Technik USB adapters driver core") Signed-off-by: Stephane Grosjean Cc: linux-stable Signed-off-by: Marc Kleine-Budde commit 5f186c257fa4808bb7f14e643b9fba3e11f08a30 Author: Joakim Zhang Date: Tue Jul 2 01:45:41 2019 +0000 can: flexcan: fix stop mode acknowledgment To enter stop mode, the CPU should manually assert a global Stop Mode request and check the acknowledgment asserted by FlexCAN. The CPU must only consider the FlexCAN in stop mode when both request and acknowledgment conditions are satisfied. Fixes: de3578c198c6 ("can: flexcan: add self wakeup support") Reported-by: Marc Kleine-Budde Signed-off-by: Joakim Zhang Cc: linux-stable # >= v5.0 Signed-off-by: Marc Kleine-Budde commit e9f2a856e102fa27715b94bcc2240f686536d29b Author: Wen Yang Date: Sat Jul 6 11:37:20 2019 +0800 can: flexcan: fix an use-after-free in flexcan_setup_stop_mode() The gpr_np variable is still being used in dev_dbg() after the of_node_put() call, which may result in use-after-free. Fixes: de3578c198c6 ("can: flexcan: add self wakeup support") Signed-off-by: Wen Yang Cc: linux-stable # >= v5.0 Signed-off-by: Marc Kleine-Budde commit 375f755899b8fc21196197e02aab26257df26e85 Author: Weitao Hou Date: Tue Jun 25 20:50:48 2019 +0800 can: mcp251x: add error check when wq alloc failed add error check when workqueue alloc failed, and remove redundant code to make it clear. Fixes: e0000163e30e ("can: Driver for the Microchip MCP251x SPI CAN controllers") Signed-off-by: Weitao Hou Acked-by: Willem de Bruijn Tested-by: Sean Nyekjaer Signed-off-by: Marc Kleine-Budde commit d4b890aec4bea7334ca2ca56fd3b12fb48a00cd1 Author: Nikita Yushchenko Date: Wed Jun 26 16:08:48 2019 +0300 can: rcar_canfd: fix possible IRQ storm on high load We have observed rcar_canfd driver entering IRQ storm under high load, with following scenario: - rcar_canfd_global_interrupt() in entered due to Rx available, - napi_schedule_prep() is called, and sets NAPIF_STATE_SCHED in state - Rx fifo interrupts are masked, - rcar_canfd_global_interrupt() is entered again, this time due to error interrupt (e.g. due to overflow), - since scheduled napi poller has not yet executed, condition for calling napi_schedule_prep() from rcar_canfd_global_interrupt() remains true, thus napi_schedule_prep() gets called and sets NAPIF_STATE_MISSED flag in state, - later, napi poller function rcar_canfd_rx_poll() gets executed, and calls napi_complete_done(), - due to NAPIF_STATE_MISSED flag in state, this call does not clear NAPIF_STATE_SCHED flag from state, - on return from napi_complete_done(), rcar_canfd_rx_poll() unmasks Rx interrutps, - Rx interrupt happens, rcar_canfd_global_interrupt() gets called and calls napi_schedule_prep(), - since NAPIF_STATE_SCHED is set in state at this time, this call returns false, - due to that false return, rcar_canfd_global_interrupt() returns without masking Rx interrupt - and this results into IRQ storm: unmasked Rx interrupt happens again and again is misprocessed in the same way. This patch fixes that scenario by unmasking Rx interrupts only when napi_complete_done() returns true, which means it has cleared NAPIF_STATE_SCHED in state. Fixes: dd3bd23eb438 ("can: rcar_canfd: Add Renesas R-Car CAN FD driver") Signed-off-by: Nikita Yushchenko Cc: linux-stable Signed-off-by: Marc Kleine-Budde commit c63845609c4700488e5eacd6ab4d06d5d420e5ef Author: Rasmus Villemoes Date: Mon Jun 24 08:34:13 2019 +0000 can: dev: call netif_carrier_off() in register_candev() CONFIG_CAN_LEDS is deprecated. When trying to use the generic netdev trigger as suggested, there's a small inconsistency with the link property: The LED is on initially, stays on when the device is brought up, and then turns off (as expected) when the device is brought down. Make sure the LED always reflects the state of the CAN device. Signed-off-by: Rasmus Villemoes Acked-by: Willem de Bruijn Signed-off-by: Marc Kleine-Budde commit 49ed96943a8e0c62cc5a9b0a6cfc88be87d1fcec Author: Hridya Valsaraju Date: Mon Jul 15 12:18:04 2019 -0700 binder: prevent transactions to context manager from its own process. Currently, a transaction to context manager from its own process is prevented by checking if its binder_proc struct is the same as that of the sender. However, this would not catch cases where the process opens the binder device again and uses the new fd to send a transaction to the context manager. Reported-by: syzbot+8b3c354d33c4ac78bfad@syzkaller.appspotmail.com Signed-off-by: Hridya Valsaraju Acked-by: Todd Kjos Cc: stable Link: https://lore.kernel.org/r/20190715191804.112933-1-hridya@google.com Signed-off-by: Greg Kroah-Hartman commit a56587065094fd96eb4c2b5ad65571daad32156d Author: Martijn Coenen Date: Tue Jul 9 13:09:23 2019 +0200 binder: Set end of SG buffer area properly. In case the target node requests a security context, the extra_buffers_size is increased with the size of the security context. But, that size is not available for use by regular scatter-gather buffers; make sure the ending of that buffer is marked correctly. Acked-by: Todd Kjos Fixes: ec74136ded79 ("binder: create node flag to request sender's security context") Signed-off-by: Martijn Coenen Cc: stable@vger.kernel.org # 5.1+ Link: https://lore.kernel.org/r/20190709110923.220736-1-maco@android.com Signed-off-by: Greg Kroah-Hartman commit 2f5947dfcaecb99f2dd559156eecbeb7b95e4c02 Author: Christoph Hellwig Date: Wed Jul 24 09:24:49 2019 +0200 Documentation: move Documentation/virtual to Documentation/virt Renaming docs seems to be en vogue at the moment, so fix on of the grossly misnamed directories. We usually never use "virtual" as a shortcut for virtualization in the kernel, but always virt, as seen in the virt/ top-level directory. Fix up the documentation to match that. Fixes: ed16648eb5b8 ("Move kvm, uml, and lguest subdirectories under a common "virtual" directory, I.E:") Signed-off-by: Christoph Hellwig Signed-off-by: Paolo Bonzini commit 89bbc6f1eb90809b1538b3a9c54030c558180e3b Author: Tony Lindgren Date: Mon Jul 22 03:44:42 2019 -0700 ARM: dts: Fix incorrect dcan register mapping for am3, am4 and dra7 We are currently using a wrong register for dcan revision. Although this is currently only used for detecting the dcan module, let's fix it to avoid confusion. Tested-by: Keerthy Signed-off-by: Tony Lindgren commit 2e8647bbe1c8233a20c32fd2648258f2c05c7335 Author: Tony Lindgren Date: Mon Jul 22 03:44:47 2019 -0700 ARM: dts: Fix flags for gpio7 The ti,no-idle-on-init and ti,no-reset-on-init flags need to be at the interconnect target module level for the modules that have it defined. Otherwise we get the following warnings: dts flag should be at module level for ti,no-idle-on-init dts flag should be at module level for ti,no-reset-on-init Reviewed-by: Suman Anna Tested-by: Keerthy Signed-off-by: Tony Lindgren commit e212abd452a4af3174fcd469d46656f83e135a19 Author: Tony Lindgren Date: Mon Jul 22 03:44:52 2019 -0700 bus: ti-sysc: Fix using configured sysc mask value We have cases where there are no softreset bits like with am335x lcdc. In that case ti,sysc-mask = <0> needs to be handled properly. Tested-by: Keerthy Signed-off-by: Tony Lindgren commit 6ee8241d17c68b94a91efabfd6bdfe63bb1b79c1 Author: Tony Lindgren Date: Mon Jul 22 03:44:42 2019 -0700 bus: ti-sysc: Fix handling of forced idle For some devices we can get the following warning on boot: ti-sysc 48485200.target-module: sysc_disable_module: invalid midlemode Fix this by treating SYSC_IDLE_FORCE like we do for the other bits for idlemodes mask. Fixes: d59b60564cbf ("bus: ti-sysc: Add generic enable/disable functions") Cc: Roger Quadros Reviewed-by: Suman Anna Tested-by: Keerthy Signed-off-by: Tony Lindgren commit afd58b162e48076e3fe66d08a69eefbd6fe71643 Author: Tony Lindgren Date: Mon Jul 22 03:44:52 2019 -0700 ARM: OMAP2+: Fix missing SYSC_HAS_RESET_STATUS for dra7 epwmss TRM says PWMSS_SYSCONFIG bit for SOFTRESET changes to zero when reset is completed. Let's configure it as otherwise we get warnings on boot when we check the data against dts provided data. Eventually the legacy platform data will be just dropped, but let's fix the warning first. Reviewed-by: Suman Anna Tested-by: Keerthy Signed-off-by: Tony Lindgren commit 20122994e38aef0ae50555884d287adde6641c94 Author: Hannes Reinecke Date: Fri Jul 12 08:53:47 2019 +0200 scsi: scsi_dh_alua: always use a 2 second delay before retrying RTPG Retrying immediately after we've received a 'transitioning' sense code is pretty much pointless, we should always use a delay before retrying. So ensure the default delay is applied before retrying. Signed-off-by: Hannes Reinecke Tested-by: Zhangguanghui Signed-off-by: Martin K. Petersen commit 5578257ca0e21056821e6481bd534ba267b84e58 Author: Tyrel Datwyler Date: Wed Jul 17 14:48:27 2019 -0500 scsi: ibmvfc: fix WARN_ON during event pool release While removing an ibmvfc client adapter a WARN_ON like the following WARN_ON is seen in the kernel log: WARNING: CPU: 6 PID: 5421 at ./include/linux/dma-mapping.h:541 ibmvfc_free_event_pool+0x12c/0x1f0 [ibmvfc] CPU: 6 PID: 5421 Comm: rmmod Tainted: G E 4.17.0-rc1-next-20180419-autotest #1 NIP: d00000000290328c LR: d00000000290325c CTR: c00000000036ee20 REGS: c000000288d1b7e0 TRAP: 0700 Tainted: G E (4.17.0-rc1-next-20180419-autotest) MSR: 800000010282b033 CR: 44008828 XER: 20000000 CFAR: c00000000036e408 SOFTE: 1 GPR00: d00000000290325c c000000288d1ba60 d000000002917900 c000000289d75448 GPR04: 0000000000000071 c0000000ff870000 0000000018040000 0000000000000001 GPR08: 0000000000000000 c00000000156e838 0000000000000001 d00000000290c640 GPR12: c00000000036ee20 c00000001ec4dc00 0000000000000000 0000000000000000 GPR16: 0000000000000000 0000000000000000 00000100276901e0 0000000010020598 GPR20: 0000000010020550 0000000010020538 0000000010020578 00000000100205b0 GPR24: 0000000000000000 0000000000000000 0000000010020590 5deadbeef0000100 GPR28: 5deadbeef0000200 d000000002910b00 0000000000000071 c0000002822f87d8 NIP [d00000000290328c] ibmvfc_free_event_pool+0x12c/0x1f0 [ibmvfc] LR [d00000000290325c] ibmvfc_free_event_pool+0xfc/0x1f0 [ibmvfc] Call Trace: [c000000288d1ba60] [d00000000290325c] ibmvfc_free_event_pool+0xfc/0x1f0 [ibmvfc] (unreliable) [c000000288d1baf0] [d000000002909390] ibmvfc_abort_task_set+0x7b0/0x8b0 [ibmvfc] [c000000288d1bb70] [c0000000000d8c68] vio_bus_remove+0x68/0x100 [c000000288d1bbb0] [c0000000007da7c4] device_release_driver_internal+0x1f4/0x2d0 [c000000288d1bc00] [c0000000007da95c] driver_detach+0x7c/0x100 [c000000288d1bc40] [c0000000007d8af4] bus_remove_driver+0x84/0x140 [c000000288d1bcb0] [c0000000007db6ac] driver_unregister+0x4c/0xa0 [c000000288d1bd20] [c0000000000d6e7c] vio_unregister_driver+0x2c/0x50 [c000000288d1bd50] [d00000000290ba0c] cleanup_module+0x24/0x15e0 [ibmvfc] [c000000288d1bd70] [c0000000001dadb0] sys_delete_module+0x220/0x2d0 [c000000288d1be30] [c00000000000b284] system_call+0x58/0x6c Instruction dump: e8410018 e87f0068 809f0078 e8bf0080 e8df0088 2fa30000 419e008c e9230200 2fa90000 419e0080 894d098a 794a07e0 <0b0a0000> e9290008 2fa90000 419e0028 This is tripped as a result of irqs being disabled during the call to dma_free_coherent() by ibmvfc_free_event_pool(). At this point in the code path we have quiesced the adapter and its overly paranoid anyways to be holding the host lock. Reported-by: Abdul Haleem Signed-off-by: Tyrel Datwyler Signed-off-by: Martin K. Petersen commit 5523ca8f624dc9268bda109d37cbdc3efb5e79be Author: Christophe JAILLET Date: Sun Jul 21 14:50:39 2019 +0200 scsi: fcoe: fix a typo #define relative to FCOE CTLR start with FCOE_CTLR, except FCOE_CTRL_SOL_TOV. This is likely a typo and CTRL should be CTLR here as well. Signed-off-by: Christophe JAILLET Reviewed-by: Hannes Reinecke Signed-off-by: Martin K. Petersen commit e45ab43b1d404c5a9bacf565652421e8541c9f26 Author: YueHaibing Date: Tue Jul 23 22:34:50 2019 +0800 scsi: megaraid_sas: Make some functions static Fix sparse warnings: drivers/scsi/megaraid/megaraid_sas_fusion.c:541:1: warning: symbol 'megasas_alloc_cmdlist_fusion' was not declared. Should it be static? drivers/scsi/megaraid/megaraid_sas_fusion.c:580:1: warning: symbol 'megasas_alloc_request_fusion' was not declared. Should it be static? drivers/scsi/megaraid/megaraid_sas_fusion.c:661:1: warning: symbol 'megasas_alloc_reply_fusion' was not declared. Should it be static? drivers/scsi/megaraid/megaraid_sas_fusion.c:738:1: warning: symbol 'megasas_alloc_rdpq_fusion' was not declared. Should it be static? drivers/scsi/megaraid/megaraid_sas_fusion.c:920:1: warning: symbol 'megasas_alloc_cmds_fusion' was not declared. Should it be static? drivers/scsi/megaraid/megaraid_sas_fusion.c:1740:1: warning: symbol 'megasas_init_adapter_fusion' was not declared. Should it be static? drivers/scsi/megaraid/megaraid_sas_fusion.c:1966:1: warning: symbol 'map_cmd_status' was not declared. Should it be static? drivers/scsi/megaraid/megaraid_sas_fusion.c:2379:1: warning: symbol 'megasas_set_pd_lba' was not declared. Should it be static? drivers/scsi/megaraid/megaraid_sas_fusion.c:2718:1: warning: symbol 'megasas_build_ldio_fusion' was not declared. Should it be static? drivers/scsi/megaraid/megaraid_sas_fusion.c:3215:1: warning: symbol 'megasas_build_io_fusion' was not declared. Should it be static? drivers/scsi/megaraid/megaraid_sas_fusion.c:3328:6: warning: symbol 'megasas_prepare_secondRaid1_IO' was not declared. Should it be static? Reported-by: Hulk Robot Signed-off-by: YueHaibing Acked-by: Sumit Saxena Signed-off-by: Martin K. Petersen commit 3b5f307ef3cb5022bfe3c8ca5b8f2114d5bf6c29 Author: Junxiao Bi Date: Mon Jul 22 09:15:24 2019 -0700 scsi: megaraid_sas: fix panic on loading firmware crashdump While loading fw crashdump in function fw_crash_buffer_show(), left bytes in one dma chunk was not checked, if copying size over it, overflow access will cause kernel panic. Signed-off-by: Junxiao Bi Acked-by: Sumit Saxena Signed-off-by: Martin K. Petersen commit 359603a3847e58843881db87e5f464bb85539e95 Author: Colin Ian King Date: Sat Jul 20 22:58:40 2019 +0100 scsi: megaraid_sas: fix spelling mistake "megarid_sas" -> "megaraid_sas" Fix spelling mistake in kernel warning message and replace printk with with pr_warn. Signed-off-by: Colin Ian King Acked-by: Sumit Saxena Signed-off-by: Martin K. Petersen commit ad5e427e0f6b702e52c11d1f7b2b7be3bac7de82 Merge: 7b5cf701ea9c 69245c97560b Author: Linus Torvalds Date: Tue Jul 23 15:34:59 2019 -0700 Merge branch 'parisc-5.3-3' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux Pull parisc fixes from Helge Deller: - Fix build issues when kprobes are enabled - Speed up ITLB/DTLB cache flushes when running on machines with combined TLBs * 'parisc-5.3-3' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux: parisc: Flush ITLB in flush_tlb_all_local() only on split TLB machines parisc: add kprobe_fault_handler() commit decb705e01a5d325c9876b9674043cde4b54f0db Author: Ilya Maximets Date: Tue Jul 23 15:08:10 2019 +0300 libbpf: fix using uninitialized ioctl results 'channels.max_combined' initialized only on ioctl success and errno is only valid on ioctl failure. The code doesn't produce any runtime issues, but makes memory sanitizers angry: Conditional jump or move depends on uninitialised value(s) at 0x55C056F: xsk_get_max_queues (xsk.c:336) by 0x55C05B2: xsk_create_bpf_maps (xsk.c:354) by 0x55C089F: xsk_setup_xdp_prog (xsk.c:447) by 0x55C0E57: xsk_socket__create (xsk.c:601) Uninitialised value was created by a stack allocation at 0x55C04CD: xsk_get_max_queues (xsk.c:318) Additionally fixed warning on uninitialized bytes in ioctl arguments: Syscall param ioctl(SIOCETHTOOL) points to uninitialised byte(s) at 0x648D45B: ioctl (in /usr/lib64/libc-2.28.so) by 0x55C0546: xsk_get_max_queues (xsk.c:330) by 0x55C05B2: xsk_create_bpf_maps (xsk.c:354) by 0x55C089F: xsk_setup_xdp_prog (xsk.c:447) by 0x55C0E57: xsk_socket__create (xsk.c:601) Address 0x1ffefff378 is on thread 1's stack in frame #1, created by xsk_get_max_queues (xsk.c:318) Uninitialised value was created by a stack allocation at 0x55C04CD: xsk_get_max_queues (xsk.c:318) CC: Magnus Karlsson Fixes: 1cad07884239 ("libbpf: add support for using AF_XDP sockets") Signed-off-by: Ilya Maximets Acked-by: Andrii Nakryiko Signed-off-by: Alexei Starovoitov commit 49902052fc6b9babf5b60fb5e31b821299f3f675 Merge: 7b5cf701ea9c 39e7317e37f7 Author: Ingo Molnar Date: Tue Jul 23 23:41:33 2019 +0200 Merge tag 'perf-urgent-for-mingo-5.3-20190723' of git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux into perf/urgent Pull perf/urgent fixes from Arnaldo Carvalho de Melo: perf.data: Alexey Budankov: - Fix loading of compressed data split across adjacent records Jiri Olsa: - Fix buffer size setting for processing CPU topology perf.data header. perf stat: Jiri Olsa: - Fix segfault for event group in repeat mode Cong Wang: - Always separate "stalled cycles per insn" line, it was being appended to the "instructions" line. perf script: Andi Kleen: - Fix --max-blocks man page description. - Improve man page description of metrics. - Fix off by one in brstackinsn IPC computation. perf probe: Arnaldo Carvalho de Melo: - Avoid calling freeing routine multiple times for same pointer. perf build: - Do not use -Wshadow on gcc < 4.8, avoiding too strict warnings treated as errors, breaking the build. Signed-off-by: Arnaldo Carvalho de Melo Signed-off-by: Ingo Molnar commit 7c8b87f012614697596b78841c0d0b1520b1f88a Merge: d9b8aadaffa6 be69483bf4f3 Author: Alexei Starovoitov Date: Tue Jul 23 14:12:38 2019 -0700 Merge branch 'fix-gso_segs' Eric Dumazet says: ==================== First patch changes the kernel, second patch adds a new test. Note that other patches might be needed to take care of similar issues in sock_ops_convert_ctx_access() and SOCK_OPS_GET_FIELD() ==================== Signed-off-by: Alexei Starovoitov commit be69483bf4f3abaaca5d5ba460dbb50239463552 Author: Eric Dumazet Date: Tue Jul 23 03:15:38 2019 -0700 selftests/bpf: add another gso_segs access Use BPF_REG_1 for source and destination of gso_segs read, to exercise "bpf: fix access to skb_shared_info->gso_segs" fix. Signed-off-by: Eric Dumazet Suggested-by: Stanislav Fomichev Signed-off-by: Alexei Starovoitov commit 06a22d897d82f12776d44dbf0850f5895469cb2a Author: Eric Dumazet Date: Tue Jul 23 03:15:37 2019 -0700 bpf: fix access to skb_shared_info->gso_segs It is possible we reach bpf_convert_ctx_access() with si->dst_reg == si->src_reg Therefore, we need to load BPF_REG_AX before eventually mangling si->src_reg. syzbot generated this x86 code : 3: 55 push %rbp 4: 48 89 e5 mov %rsp,%rbp 7: 48 81 ec 00 00 00 00 sub $0x0,%rsp // Might be avoided ? e: 53 push %rbx f: 41 55 push %r13 11: 41 56 push %r14 13: 41 57 push %r15 15: 6a 00 pushq $0x0 17: 31 c0 xor %eax,%eax 19: 48 8b bf c0 00 00 00 mov 0xc0(%rdi),%rdi 20: 44 8b 97 bc 00 00 00 mov 0xbc(%rdi),%r10d 27: 4c 01 d7 add %r10,%rdi 2a: 48 0f b7 7f 06 movzwq 0x6(%rdi),%rdi // Crash 2f: 5b pop %rbx 30: 41 5f pop %r15 32: 41 5e pop %r14 34: 41 5d pop %r13 36: 5b pop %rbx 37: c9 leaveq 38: c3 retq Fixes: d9ff286a0f59 ("bpf: allow BPF programs access skb_shared_info->gso_segs field") Signed-off-by: Eric Dumazet Reported-by: syzbot Signed-off-by: Alexei Starovoitov commit d86afb89305de205b0d2f20c2160adf039e9508d Author: Andy Shevchenko Date: Tue Jul 23 23:03:43 2019 +0300 net: thunderx: Use fwnode_get_mac_address() Replace the custom implementation with fwnode_get_mac_address, which works on both DT and ACPI platforms. While here, replace memcpy() by ether_addr_copy(). Signed-off-by: Andy Shevchenko Signed-off-by: David S. Miller commit d9b8aadaffa65809d146cf0f8632a22a946367d7 Author: Ilya Leoshkevich Date: Fri Jul 19 11:18:15 2019 +0200 bpf: fix narrower loads on s390 The very first check in test_pkt_md_access is failing on s390, which happens because loading a part of a struct __sk_buff field produces an incorrect result. The preprocessed code of the check is: { __u8 tmp = *((volatile __u8 *)&skb->len + ((sizeof(skb->len) - sizeof(__u8)) / sizeof(__u8))); if (tmp != ((*(volatile __u32 *)&skb->len) & 0xFF)) return 2; }; clang generates the following code for it: 0: 71 21 00 03 00 00 00 00 r2 = *(u8 *)(r1 + 3) 1: 61 31 00 00 00 00 00 00 r3 = *(u32 *)(r1 + 0) 2: 57 30 00 00 00 00 00 ff r3 &= 255 3: 5d 23 00 1d 00 00 00 00 if r2 != r3 goto +29 Finally, verifier transforms it to: 0: (61) r2 = *(u32 *)(r1 +104) 1: (bc) w2 = w2 2: (74) w2 >>= 24 3: (bc) w2 = w2 4: (54) w2 &= 255 5: (bc) w2 = w2 The problem is that when verifier emits the code to replace a partial load of a struct __sk_buff field (*(u8 *)(r1 + 3)) with a full load of struct sk_buff field (*(u32 *)(r1 + 104)), an optional shift and a bitwise AND, it assumes that the machine is little endian and incorrectly decides to use a shift. Adjust shift count calculation to account for endianness. Fixes: 31fd85816dbe ("bpf: permits narrower load from bpf program context fields") Signed-off-by: Ilya Leoshkevich Signed-off-by: Alexei Starovoitov commit a261e3797506bd561700be643fe1a85bf81e9661 Author: Takashi Iwai Date: Tue Jul 23 17:15:25 2019 +0200 sky2: Disable MSI on ASUS P6T The onboard sky2 NIC on ASUS P6T WS PRO doesn't work after PM resume due to the infamous IRQ problem. Disabling MSI works around it, so let's add it to the blacklist. Unfortunately the BIOS on the machine doesn't fill the standard DMI_SYS_* entry, so we pick up DMI_BOARD_* entries instead. BugLink: https://bugzilla.suse.com/show_bug.cgi?id=1142496 Reported-and-tested-by: Marcus Seyfarth Signed-off-by: Takashi Iwai Signed-off-by: David S. Miller commit 7ba771e3e246fa8787abf2cce9064ec8c9b38133 Author: Nishka Dasgupta Date: Tue Jul 23 16:14:48 2019 +0530 net: dsa: sja1105: sja1105_main: Add of_node_put() Each iteration of for_each_child_of_node puts the previous node, but in the case of a return from the middle of the loop, there is no put, thus causing a memory leak. Hence add an of_node_put before the return. Issue found with Coccinelle. Signed-off-by: Nishka Dasgupta Signed-off-by: David S. Miller commit 78e420408d12eddd0e72613fc717f7994736ea9a Author: Nishka Dasgupta Date: Tue Jul 23 16:13:07 2019 +0530 net: dsa: mv88e6xxx: chip: Add of_node_put() before return Each iteration of for_each_available_child_of_node puts the previous node, but in the case of a return from the middle of the loop, there is no put, thus causing a memory leak. Hence add an of_node_put before the return. Issue found with Coccinelle. Signed-off-by: Nishka Dasgupta Signed-off-by: David S. Miller commit 92e6475ae0a0383b012eb21c1aaf0e5456b1a3d9 Author: Nicholas Kazlauskas Date: Wed Jul 3 10:02:39 2019 -0400 drm/amd/display: Set enabled to false at start of audio disable [Why] In an effort to stop redundant calls to dce110_disable_audio_stream the audio->enabled flag was added to the audio resource struct. While this state probably shouldn't have been tracked on the audio struct itself it still works fine for some sequences. However, it does not work for cases where we're freeing the audio resource (such as hotplugs) or when dynamic audio is enabled. In these cases the pipe_ctx->stream_res.audio = NULL before we can set audio->enabled = false. The next time we acquire the audio resource such as on hotplug the audio will not be enabled for the stream since DC thinks it's still enabled. Audio state tracking should cover this sequence. [How] Set audio->enabled = false at the start as long as we have pipe_ctx->stream_res.audio. Signed-off-by: Nicholas Kazlauskas Reviewed-by: Zhan Liu Acked-by: Leo Li Signed-off-by: Alex Deucher commit 8eadf9bbab45ca29d823a974c1e3118a864b5e47 Merge: b3e487c0cf42 1be79d89b7ae Author: David S. Miller Date: Tue Jul 23 13:06:49 2019 -0700 Merge branch 'selftests-forwarding-GRE-multipath-fixes' Ido Schimmel says: ==================== selftests: forwarding: GRE multipath fixes Patch #1 ensures IPv4 forwarding is enabled during the test. Patch #2 fixes the flower filters used to measure the distribution of the traffic between the two nexthops, so that the test will pass regardless if traffic is offloaded or not. ==================== Signed-off-by: David S. Miller commit 1be79d89b7ae96e004911bd228ce8c2b5cc6415f Author: Ido Schimmel Date: Tue Jul 23 11:19:26 2019 +0300 selftests: forwarding: gre_multipath: Fix flower filters The TC filters used in the test do not work with veth devices because the outer Ethertype is 802.1Q and not IPv4. The test passes with mlxsw netdevs since the hardware always looks at "The first Ethertype that does not point to either: VLAN, CNTAG or configurable Ethertype". Fix this by matching on the VLAN ID instead, but on the ingress side. The reason why this is not performed at egress is explained in the commit cited below. Fixes: 541ad323db3a ("selftests: forwarding: gre_multipath: Update next-hop statistics match criteria") Signed-off-by: Ido Schimmel Reported-by: Stephen Suryaputra Tested-by: Stephen Suryaputra Signed-off-by: David S. Miller commit efa7b79f675da0efafe3f32ba0d6efe916cf4867 Author: Ido Schimmel Date: Tue Jul 23 11:19:25 2019 +0300 selftests: forwarding: gre_multipath: Enable IPv4 forwarding The test did not enable IPv4 forwarding during its setup phase, which causes the test to fail on machines where IPv4 forwarding is disabled. Fixes: 54818c4c4b93 ("selftests: forwarding: Test multipath tunneling") Signed-off-by: Ido Schimmel Reported-by: Stephen Suryaputra Tested-by: Stephen Suryaputra Signed-off-by: David S. Miller commit 7bd9d465140a93c0a21ba2d2f426451c78bfcc7d Merge: 02a0242549aa 8d0148473dec Author: Olof Johansson Date: Tue Jul 23 10:13:23 2019 -0700 Merge tag 'imx-fixes-5.3' of git://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux into arm/fixes i.MX fixes for 5.3: - Fix i.MX8MM SAI3 RXC/TXFS pinmux configuration. - Fix i.MX7ULP usb-phy unit address to drop extra '0x' notation. - Fix typo of clock frequency property name in a few i.MX6UL board I2C buses. - Drop "fsl,imx6sx-sai" from i.MX8M SAI device, as it's not compatible with i.MX6SX SAI. * tag 'imx-fixes-5.3' of git://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux: arm64: dts: imx8mq: fix SAI compatible arm64: dts: imx8mm: Correct SAI3 RXC/TXFS pin's mux option #1 ARM: dts: imx6ul: fix clock frequency property name of I2C buses ARM: dts: imx7ulp: Fix usb-phy unit address format Link: https://lore.kernel.org/r/20190723090827.GU15632@dragon Signed-off-by: Olof Johansson commit 02a0242549aaec4490e9280cebbb1474b36281ca Author: Linus Walleij Date: Tue Jul 23 10:15:23 2019 +0200 ARM: defconfig: u8500: Add new drivers This enables the new or updates driver options for U8500 that got merged into v5.3-rc1: - CMA, MCDE driver, LIMA driver and the Samsung S6D16D0 driver enabled by default bringing up the new graphics support. Include the LOGO so we can see when the graphics are live. - We use the IIO hwmon bridge for reflecting temperature in the system. - Set MUSB to PIO mode as this is the one working most stable for the time being. - HWSPINLOCK needs to be set to get the hardware semaphore driver to compile and link properly. Link: https://lore.kernel.org/r/20190723081523.13079-2-linus.walleij@linaro.org Signed-off-by: Linus Walleij Signed-off-by: Olof Johansson commit 14d017bee4accf6ba80ed01b190e4f61b47d9327 Author: Linus Walleij Date: Tue Jul 23 10:15:22 2019 +0200 ARM: defconfig: u8500: Refresh defconfig This refreshes the outdated U8500 defconfig: some options moved around, PS/2 mouse is no longer default on, crypto options moved around etc. Link: https://lore.kernel.org/r/20190723081523.13079-1-linus.walleij@linaro.org Signed-off-by: Linus Walleij Signed-off-by: Olof Johansson commit 3a9d2569e45cb02769cda26fee4a02126867c934 Author: Arnd Bergmann Date: Mon Jul 22 16:55:52 2019 +0200 ARM: dts: bcm: bcm47094: add missing #cells for mdio-bus-mux The mdio-bus-mux has no #address-cells/#size-cells property, which causes a few dtc warnings: arch/arm/boot/dts/bcm47094-linksys-panamera.dts:129.4-18: Warning (reg_format): /mdio-bus-mux/mdio@200:reg: property has invalid length (4 bytes) (#address-cells == 2, #size-cells == 1) arch/arm/boot/dts/bcm47094-linksys-panamera.dtb: Warning (pci_device_bus_num): Failed prerequisite 'reg_format' arch/arm/boot/dts/bcm47094-linksys-panamera.dtb: Warning (i2c_bus_reg): Failed prerequisite 'reg_format' arch/arm/boot/dts/bcm47094-linksys-panamera.dtb: Warning (spi_bus_reg): Failed prerequisite 'reg_format' arch/arm/boot/dts/bcm47094-linksys-panamera.dts:128.22-132.5: Warning (avoid_default_addr_size): /mdio-bus-mux/mdio@200: Relying on default #address-cells value arch/arm/boot/dts/bcm47094-linksys-panamera.dts:128.22-132.5: Warning (avoid_default_addr_size): /mdio-bus-mux/mdio@200: Relying on default #size-cells value Add the normal cell numbers. Link: https://lore.kernel.org/r/20190722145618.1155492-1-arnd@arndb.de Fixes: 2bebdfcdcd0f ("ARM: dts: BCM5301X: Add support for Linksys EA9500") Signed-off-by: Arnd Bergmann Signed-off-by: Olof Johansson commit d64b212ea960db4276a1d8372bd98cb861dfcbb0 Author: Arnd Bergmann Date: Mon Jul 22 16:51:50 2019 +0200 ARM: davinci: fix sleep.S build error on ARMv4 When building a multiplatform kernel that includes armv4 support, the default target CPU does not support the blx instruction, which leads to a build failure: arch/arm/mach-davinci/sleep.S: Assembler messages: arch/arm/mach-davinci/sleep.S:56: Error: selected processor does not support `blx ip' in ARM mode Add a .arch statement in the sources to make this file build. Link: https://lore.kernel.org/r/20190722145211.1154785-1-arnd@arndb.de Acked-by: Sekhar Nori Signed-off-by: Arnd Bergmann Signed-off-by: Olof Johansson commit 399ea57a4c8bc5fdb71a024a6870b5767b2ef6d8 Author: Colin Ian King Date: Mon Jul 1 14:04:31 2019 +0100 selftests/x86: fix spelling mistake "FAILT" -> "FAIL" There is an spelling mistake in an a test error message. Fix it. Acked-by: Andy Lutomirski Signed-off-by: Colin Ian King Signed-off-by: Shuah Khan commit 36876b30d2143121322cd199cc23f27143912deb Author: Masanari Iida Date: Tue Jul 23 19:22:52 2019 +0900 selftests: kmod: Fix typo in kmod.sh This patch fixes some spelling typos in kmod.sh Signed-off-by: Masanari Iida Acked-by: Randy Dunlap Signed-off-by: Shuah Khan commit 8fe34be14ecb5eb0ef8d8d44aa7ab62d9e2911ca Author: yangerkun Date: Tue Jul 23 11:23:13 2019 +0800 Revert "nvme-pci: don't create a read hctx mapping without read queues" This reverts commit 0298d5435276e7795b0b939d74827f6e775e7009. With this patch, set 'poll_queues > hard queues' will lead to 'nr_read_queues = 0' in nvme_calc_irq_sets. Then poll_queues setting can fail since dev->tagset.nr_maps equals to 2 and nvme_pci_map_queues will not do map for poll queues. Signed-off-by: yangerkun Signed-off-by: Christoph Hellwig commit 66b20ac0a1a10769d059d6903202f53494e3d902 Author: Marta Rybczynska Date: Tue Jul 23 07:41:20 2019 +0200 nvme: fix multipath crash when ANA is deactivated Fix a crash with multipath activated. It happends when ANA log page is larger than MDTS and because of that ANA is disabled. The driver then tries to access unallocated buffer when connecting to a nvme target. The signature is as follows: [ 300.433586] nvme nvme0: ANA log page size (8208) larger than MDTS (8192). [ 300.435387] nvme nvme0: disabling ANA support. [ 300.437835] nvme nvme0: creating 4 I/O queues. [ 300.459132] nvme nvme0: new ctrl: NQN "nqn.0.0.0", addr 10.91.0.1:8009 [ 300.464609] BUG: unable to handle kernel NULL pointer dereference at 0000000000000008 [ 300.466342] #PF error: [normal kernel read fault] [ 300.467385] PGD 0 P4D 0 [ 300.467987] Oops: 0000 [#1] SMP PTI [ 300.468787] CPU: 3 PID: 50 Comm: kworker/u8:1 Not tainted 5.0.20kalray+ #4 [ 300.470264] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 [ 300.471532] Workqueue: nvme-wq nvme_scan_work [nvme_core] [ 300.472724] RIP: 0010:nvme_parse_ana_log+0x21/0x140 [nvme_core] [ 300.474038] Code: 45 01 d2 d8 48 98 c3 66 90 0f 1f 44 00 00 41 57 41 56 41 55 41 54 55 53 48 89 fb 48 83 ec 08 48 8b af 20 0a 00 00 48 89 34 24 <66> 83 7d 08 00 0f 84 c6 00 00 00 44 8b 7d 14 49 89 d5 8b 55 10 48 [ 300.477374] RSP: 0018:ffffa50e80fd7cb8 EFLAGS: 00010296 [ 300.478334] RAX: 0000000000000001 RBX: ffff9130f1872258 RCX: 0000000000000000 [ 300.479784] RDX: ffffffffc06c4c30 RSI: ffff9130edad4280 RDI: ffff9130f1872258 [ 300.481488] RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000044 [ 300.483203] R10: 0000000000000220 R11: 0000000000000040 R12: ffff9130f18722c0 [ 300.484928] R13: ffff9130f18722d0 R14: ffff9130edad4280 R15: ffff9130f18722c0 [ 300.486626] FS: 0000000000000000(0000) GS:ffff9130f7b80000(0000) knlGS:0000000000000000 [ 300.488538] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 300.489907] CR2: 0000000000000008 CR3: 00000002365e6000 CR4: 00000000000006e0 [ 300.491612] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 300.493303] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 300.494991] Call Trace: [ 300.495645] nvme_mpath_add_disk+0x5c/0xb0 [nvme_core] [ 300.496880] nvme_validate_ns+0x2ef/0x550 [nvme_core] [ 300.498105] ? nvme_identify_ctrl.isra.45+0x6a/0xb0 [nvme_core] [ 300.499539] nvme_scan_work+0x2b4/0x370 [nvme_core] [ 300.500717] ? __switch_to_asm+0x35/0x70 [ 300.501663] process_one_work+0x171/0x380 [ 300.502340] worker_thread+0x49/0x3f0 [ 300.503079] kthread+0xf8/0x130 [ 300.503795] ? max_active_store+0x80/0x80 [ 300.504690] ? kthread_bind+0x10/0x10 [ 300.505502] ret_from_fork+0x35/0x40 [ 300.506280] Modules linked in: nvme_tcp nvme_rdma rdma_cm iw_cm ib_cm ib_core nvme_fabrics nvme_core xt_physdev ip6table_raw ip6table_mangle ip6table_filter ip6_tables xt_comment iptable_nat nf_nat_ipv4 nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 xt_CHECKSUM iptable_mangle iptable_filter veth ebtable_filter ebtable_nat ebtables iptable_raw vxlan ip6_udp_tunnel udp_tunnel sunrpc joydev pcspkr virtio_balloon br_netfilter bridge stp llc ip_tables xfs libcrc32c ata_generic pata_acpi virtio_net virtio_console net_failover virtio_blk failover ata_piix serio_raw libata virtio_pci virtio_ring virtio [ 300.514984] CR2: 0000000000000008 [ 300.515569] ---[ end trace faa2eefad7e7f218 ]--- [ 300.516354] RIP: 0010:nvme_parse_ana_log+0x21/0x140 [nvme_core] [ 300.517330] Code: 45 01 d2 d8 48 98 c3 66 90 0f 1f 44 00 00 41 57 41 56 41 55 41 54 55 53 48 89 fb 48 83 ec 08 48 8b af 20 0a 00 00 48 89 34 24 <66> 83 7d 08 00 0f 84 c6 00 00 00 44 8b 7d 14 49 89 d5 8b 55 10 48 [ 300.520353] RSP: 0018:ffffa50e80fd7cb8 EFLAGS: 00010296 [ 300.521229] RAX: 0000000000000001 RBX: ffff9130f1872258 RCX: 0000000000000000 [ 300.522399] RDX: ffffffffc06c4c30 RSI: ffff9130edad4280 RDI: ffff9130f1872258 [ 300.523560] RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000044 [ 300.524734] R10: 0000000000000220 R11: 0000000000000040 R12: ffff9130f18722c0 [ 300.525915] R13: ffff9130f18722d0 R14: ffff9130edad4280 R15: ffff9130f18722c0 [ 300.527084] FS: 0000000000000000(0000) GS:ffff9130f7b80000(0000) knlGS:0000000000000000 [ 300.528396] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 300.529440] CR2: 0000000000000008 CR3: 00000002365e6000 CR4: 00000000000006e0 [ 300.530739] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 300.531989] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 300.533264] Kernel panic - not syncing: Fatal exception [ 300.534338] Kernel Offset: 0x17c00000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff) [ 300.536227] ---[ end Kernel panic - not syncing: Fatal exception ]--- Condition check refactoring from Christoph Hellwig. Signed-off-by: Marta Rybczynska Tested-by: Jean-Baptiste Riaux Signed-off-by: Christoph Hellwig commit e654dfd38c1ecf58d8d019f3c053189413484a5b Author: Logan Gunthorpe Date: Thu Jul 18 17:53:50 2019 -0600 nvme: fix memory leak caused by incorrect subsystem free When freeing the subsystem after finding another match with __nvme_find_get_subsystem(), use put_device() instead of __nvme_release_subsystem() which calls kfree() directly. Per the documentation, put_device() should always be used after device_initialization() is called. Otherwise, leaks like the one below which was detected by kmemleak may occur. Once the call of __nvme_release_subsystem() is removed it no longer makes sense to keep the helper, so fold it back into nvme_release_subsystem(). unreferenced object 0xffff8883d12bfbc0 (size 16): comm "nvme", pid 2635, jiffies 4294933602 (age 739.952s) hex dump (first 16 bytes): 6e 76 6d 65 2d 73 75 62 73 79 73 32 00 88 ff ff nvme-subsys2.... backtrace: [<000000007d8fc208>] __kmalloc_track_caller+0x16d/0x2a0 [<0000000081169e5f>] kvasprintf+0xad/0x130 [<0000000025626f25>] kvasprintf_const+0x47/0x120 [<00000000fa66ad36>] kobject_set_name_vargs+0x44/0x120 [<000000004881f8b3>] dev_set_name+0x98/0xc0 [<000000007124dae3>] nvme_init_identify+0x1995/0x38e0 [<000000009315020a>] nvme_loop_configure_admin_queue+0x4fa/0x5e0 [<000000001a63e766>] nvme_loop_create_ctrl+0x489/0xf80 [<00000000a46ecc23>] nvmf_dev_write+0x1a12/0x2220 [<000000002259b3d5>] __vfs_write+0x66/0x120 [<000000002f6df81e>] vfs_write+0x154/0x490 [<000000007e8cfc19>] ksys_write+0x10a/0x240 [<00000000ff5c7b85>] __x64_sys_write+0x73/0xb0 [<00000000fee6d692>] do_syscall_64+0xaa/0x470 [<00000000997e1ede>] entry_SYSCALL_64_after_hwframe+0x49/0xbe Fixes: ab9e00cc72fa ("nvme: track subsystems") Signed-off-by: Logan Gunthorpe Reviewed-by: Sagi Grimberg Signed-off-by: Christoph Hellwig commit 08b903b5fd0c49e5f224a9bf085b6329ec3c55c0 Author: Misha Nasledov Date: Mon Jul 15 00:11:49 2019 -0700 nvme: ignore subnqn for ADATA SX6000LNP The ADATA SX6000LNP NVMe SSDs have the same subnqn and, due to this, a system with more than one of these SSDs will only have one usable. [ 0.942706] nvme nvme1: ignoring ctrl due to duplicate subnqn (nqn.2018-05.com.example:nvme:nvm-subsystem-OUI00E04C). [ 0.943017] nvme nvme1: Removing after probe failure status: -22 02:00.0 Non-Volatile memory controller [0108]: Realtek Semiconductor Co., Ltd. Device [10ec:5762] (rev 01) 71:00.0 Non-Volatile memory controller [0108]: Realtek Semiconductor Co., Ltd. Device [10ec:5762] (rev 01) There are no firmware updates available from the vendor, unfortunately. Applying the NVME_QUIRK_IGNORE_DEV_SUBNQN quirk for these SSDs resolves the issue, and they all work after this patch: /dev/nvme0n1 2J1120050420 ADATA SX6000LNP [...] /dev/nvme1n1 2J1120050540 ADATA SX6000LNP [...] Signed-off-by: Misha Nasledov Signed-off-by: Christoph Hellwig commit 06532750010e06dd4b6d69983773677df7fc5291 Author: Eric Auger Date: Mon Jul 22 18:51:49 2019 +0200 dma-mapping: use dma_get_mask in dma_addressing_limited We currently have cases where the dma_addressing_limited() gets called with dma_mask unset. This causes a NULL pointer dereference. Use dma_get_mask() accessor to prevent the crash. Fixes: b866455423e0 ("dma-mapping: add a dma_addressing_limited helper") Signed-off-by: Eric Auger Acked-by: Michael S. Tsirkin Signed-off-by: Christoph Hellwig commit 66929812955bbec808c94d7a3916f41638a98a0a Author: Suthikulpanit, Suravee Date: Tue Jul 16 04:29:16 2019 +0000 iommu/amd: Add support for X2APIC IOMMU interrupts AMD IOMMU requires IntCapXT registers to be setup in order to generate its own interrupts (for Event Log, PPR Log, and GA Log) with 32-bit APIC destination ID. Without this support, AMD IOMMU MSI interrupts will not be routed correctly when booting the system in X2APIC mode. Cc: Joerg Roedel Fixes: 90fcffd9cf5e ('iommu/amd: Add support for IOMMU XT mode') Signed-off-by: Suravee Suthikulpanit Signed-off-by: Joerg Roedel commit 5a46d3f71d5e5a9f82eabc682f996f1281705ac7 Author: Lorenzo Pieralisi Date: Mon Jul 22 17:25:48 2019 +0100 ACPI/IORT: Fix off-by-one check in iort_dev_find_its_id() Static analysis identified that index comparison against ITS entries in iort_dev_find_its_id() is off by one. Update the comparison condition and clarify the resulting error message. Fixes: 4bf2efd26d76 ("ACPI: Add new IORT functions to support MSI domain handling") Link: https://lore.kernel.org/linux-arm-kernel/20190613065410.GB16334@mwanda/ Reviewed-by: Hanjun Guo Reported-by: Dan Carpenter Signed-off-by: Lorenzo Pieralisi Cc: Dan Carpenter Cc: Will Deacon Cc: Hanjun Guo Cc: Sudeep Holla Cc: Catalin Marinas Cc: Robin Murphy Signed-off-by: Will Deacon commit 883a2a80f79ca5c0c105605fafabd1f3df99b34c Author: Kai-Heng Feng Date: Mon Jul 22 10:56:55 2019 +0300 Input: elantech - enable SMBus on new (2018+) systems There are some new HP laptops with Elantech touchpad that don't support multitouch. Currently we use ETP_NEW_IC_SMBUS_HOST_NOTIFY() to check if SMBus is supported, but in addition to firmware version, the bus type also informs us whether the IC can support SMBus. To avoid breaking old ICs, we will only enable SMbus support based the bus type on systems manufactured after 2018. Lastly, let's consolidate all checks into elantech_use_host_notify() and use it to determine whether to use PS/2 or SMBus. Signed-off-by: Kai-Heng Feng Acked-by: Benjamin Tissoires Cc: stable@vger.kernel.org Signed-off-by: Dmitry Torokhov commit b1cbb2f09d7b3f1726215987d5b28f5aea9548da Author: Nikolas Nyby Date: Tue Jul 23 16:42:57 2019 +0300 Input: applespi - fix trivial typo in struct description This fixes a typo in the keyboard_protocol description. coodinate -> coordinate. Signed-off-by: Nikolas Nyby Signed-off-by: Dmitry Torokhov commit 020834bebbcb5db4026757556710ea58ccb76a06 Author: Arnd Bergmann Date: Tue Jul 23 16:41:35 2019 +0300 Input: applespi - select CRC16 module In some rare randconfig builds, CRC16 is disabled, which leads to a link error: drivers/input/keyboard/applespi.o: In function `applespi_send_cmd_msg': applespi.c:(.text+0x449f): undefined reference to `crc16' drivers/input/keyboard/applespi.o: In function `applespi_verify_crc': applespi.c:(.text+0x7538): undefined reference to `crc16' This symbol is meant to be selected for each user in Kconfig, so do that here as well. Fixes: 038b1a05eae6 ("Input: add Apple SPI keyboard and trackpad driver") Signed-off-by: Arnd Bergmann Signed-off-by: Dmitry Torokhov commit 77ce56e2bfaa64127ae5e23ef136c0168b818777 Author: Arnd Bergmann Date: Mon Jul 22 14:26:34 2019 +0200 drbd: dynamically allocate shash descriptor Building with clang and KASAN, we get a warning about an overly large stack frame on 32-bit architectures: drivers/block/drbd/drbd_receiver.c:921:31: error: stack frame size of 1280 bytes in function 'conn_connect' [-Werror,-Wframe-larger-than=] We already allocate other data dynamically in this function, so just do the same for the shash descriptor, which makes up most of this memory. Link: https://lore.kernel.org/lkml/20190617132440.2721536-1-arnd@arndb.de/ Reviewed-by: Kees Cook Reviewed-by: Roland Kammerer Signed-off-by: Arnd Bergmann Signed-off-by: Jens Axboe commit 327fe1d42b83f8a06b33ba30159582b49af5fc8e Author: Marcos Paulo de Souza Date: Tue Jul 23 00:27:41 2019 -0300 block: blk-mq: Remove blk_mq_sched_started_request and started_request blk_mq_sched_completed_request is a function that checks if the elevator related to the request has started_request implemented, but currently, none of the available IO schedulers implement started_request, so remove both. Signed-off-by: Marcos Paulo de Souza Signed-off-by: Jens Axboe commit 607975b30db41aad6edc846ed567191aa6b7d893 Author: Ding Xiang Date: Tue Jul 23 15:44:41 2019 +0800 ALSA: ac97: Fix double free of ac97_codec_device put_device will call ac97_codec_release to free ac97_codec_device and other resources, so remove the kfree and other redundant code. Fixes: 74426fbff66e ("ALSA: ac97: add an ac97 bus") Signed-off-by: Ding Xiang Cc: Signed-off-by: Takashi Iwai commit 39e7317e37f7f0be366d1201c283f968c17268da Author: Arnaldo Carvalho de Melo Date: Fri Jul 19 15:34:30 2019 -0300 perf build: Do not use -Wshadow on gcc < 4.8 As it is too strict, see https://lkml.org/lkml/2006/11/28/253 and https://gcc.gnu.org/gcc-4.8/changes.html, that takes into account Linus's comments (search for Wshadow) for the reasoning about -Wshadow not being interesting before gcc 4.8. Acked-by: Andrii Nakryiko Cc: Adrian Hunter Cc: Jiri Olsa Cc: Namhyung Kim Link: https://lkml.kernel.org/r/20190719183417.GQ3624@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit d95daf5accf4a72005daa13fbb1d1bd8709f2861 Author: Arnaldo Carvalho de Melo Date: Thu Jul 18 11:28:37 2019 -0300 perf probe: Avoid calling freeing routine multiple times for same pointer When perf_add_probe_events() we call cleanup_perf_probe_events() for the pev pointer it receives, then, as part of handling this failure the main 'perf probe' goes on and calls cleanup_params() and that will again call cleanup_perf_probe_events()for the same pointer, so just set nevents to zero when handling the failure of perf_add_probe_events() to avoid the double free. Cc: Adrian Hunter Cc: Jiri Olsa Cc: Masami Hiramatsu Cc: Namhyung Kim Link: https://lkml.kernel.org/n/tip-x8qgma4g813z96dvtw9w219q@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit df8350ed56a26f502a9636f37faf699a12ee906e Author: Arnaldo Carvalho de Melo Date: Thu Jul 18 11:22:58 2019 -0300 perf probe: Set pev->nargs to zero after freeing pev->args entries So that, when perf_add_probe_events() fails, like in: # perf probe icmp_rcv:64 "type=icmph->type" Failed to find 'icmph' in this function. Error: Failed to add events. Segmentation fault (core dumped) # We don't segfault. clear_perf_probe_event() was zeroing the whole pev, and since the switch to zfree() for the members in the pev, that memset() was removed, which left nargs with its original value, in the above case 1. With the memset the same pev could be passed to clear_perf_probe_event() multiple times, since all it would have would be zeroes, and free() accepts zero, the loop would not happen and we would just memset it again to zeroes. Without it we got that segfault, so zero nargs to keep it like it was, next cset will avoid calling clear_perf_probe_event() for the same pevs in case of failure. Cc: Adrian Hunter Cc: Jiri Olsa Cc: Masami Hiramatsu Cc: Namhyung Kim Fixes: d8f9da240495 ("perf tools: Use zfree() where applicable") Link: https://lkml.kernel.org/n/tip-802f2jypnwqsvyavvivs8464@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 872c8ee8f0f47222f7b10da96eea84d0486540a3 Author: Alexey Budankov Date: Tue Jul 9 17:48:14 2019 +0300 perf session: Fix loading of compressed data split across adjacent records Fix decompression failure found during the loading of compressed trace collected on larger scale systems (>48 cores). The error happened due to lack of decompression space for a mmaped buffer data chunk split across adjacent PERF_RECORD_COMPRESSED records. $ perf report -i bt.16384.data --stats failed to decompress (B): 63869 -> 0 : Destination buffer is too small user stack dump failure Can't parse sample, err = -14 0x2637e436 [0x4080]: failed to process type: 9 Error: failed to process sample $ perf test 71 71: Zstd perf.data compression/decompression : Ok Signed-off-by: Alexey Budankov Acked-by: Jiri Olsa Cc: Alexander Shishkin Cc: Andi Kleen Cc: Namhyung Kim Cc: Peter Zijlstra Link: http://lkml.kernel.org/r/4d839e1b-9c48-89c4-9702-a12217420611@linux.intel.com Signed-off-by: Arnaldo Carvalho de Melo commit 146540fb545b8464ba1be298e3392daca0d183a2 Author: Cong Wang Date: Fri May 17 15:10:39 2019 -0700 perf stat: Always separate stalled cycles per insn The "stalled cycles per insn" is appended to "instructions" when the CPU has this hardware counter directly. We should always make it a separate line, which also aligns to the output when we hit the "if (total && avg)" branch. Before: $ sudo perf stat --all-cpus --field-separator , --log-fd 1 -einstructions,cycles -- sleep 1 4565048704,,instructions,64114578096,100.00,1.34,insn per cycle,, 3396325133,,cycles,64146628546,100.00,, After: $ sudo ./tools/perf/perf stat --all-cpus --field-separator , --log-fd 1 -einstructions,cycles -- sleep 1 6721924,,instructions,24026790339,100.00,0.22,insn per cycle ,,,,,0.00,stalled cycles per insn 30939953,,cycles,24025512526,100.00,, Signed-off-by: Cong Wang Acked-by: Jiri Olsa Cc: Andi Kleen Link: http://lkml.kernel.org/r/20190517221039.8975-1-xiyou.wangcong@gmail.com Signed-off-by: Arnaldo Carvalho de Melo commit 08ef3af1579d0446db1c1bd08e2c42565addf10f Author: Jiri Olsa Date: Mon Jul 15 16:21:21 2019 +0200 perf stat: Fix segfault for event group in repeat mode Numfor Mbiziwo-Tiapo reported segfault on stat of event group in repeat mode: # perf stat -e '{cycles,instructions}' -r 10 ls It's caused by memory corruption due to not cleaned evsel's id array and index, which needs to be rebuilt in every stat iteration. Currently the ids index grows, while the array (which is also not freed) has the same size. Fixing this by releasing id array and zeroing ids index in perf_evsel__close function. We also need to keep the evsel_list alive for stat record (which is disabled in repeat mode). Reported-by: Numfor Mbiziwo-Tiapo Signed-off-by: Jiri Olsa Cc: Alexander Shishkin Cc: Ian Rogers Cc: Mark Drayton Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Song Liu Cc: Stephane Eranian Link: http://lkml.kernel.org/r/20190715142121.GC6032@krava Signed-off-by: Arnaldo Carvalho de Melo commit 79b2fe5e756163897175a8f57d66b26cd9befd59 Author: Jiri Olsa Date: Mon Jul 15 16:04:26 2019 +0200 perf tools: Fix proper buffer size for feature processing After Song Liu's segfault fix for pipe mode, Arnaldo reported following error: # perf record -o - | perf script 0x514 [0x1ac]: failed to process type: 80 It's caused by wrong buffer size setup in feature processing, which makes cpu topology feature fail, because it's using buffer size to recognize its header version. Reported-by: Arnaldo Carvalho de Melo Signed-off-by: Jiri Olsa Tested-by: Arnaldo Carvalho de Melo Cc: Alexander Shishkin Cc: David Carrillo-Cisneros Cc: Kan Liang Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Song Liu Fixes: e9def1b2e74e ("perf tools: Add feature header record to pipe-mode") Link: http://lkml.kernel.org/r/20190715140426.32509-1-jolsa@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit dde4e732a5b02fa5599c2c0e6c48a0c11789afc4 Author: Andi Kleen Date: Thu Jul 11 11:19:21 2019 -0700 perf script: Fix off by one in brstackinsn IPC computation When we hit the end of a program block, need to count the last instruction too for the IPC computation. This caused large errors for small blocks. % perf script -b ls / > /dev/null Before: % perf script -F +brstackinsn --xed ... 00007f94c9ac70d8 jz 0x7f94c9ac70e3 # PRED 3 cycles [36] 4.33 IPC 00007f94c9ac70e3 testb $0x20, 0x31d(%rbx) 00007f94c9ac70ea jnz 0x7f94c9ac70b0 00007f94c9ac70ec testb $0x8, 0x205ad(%rip) 00007f94c9ac70f3 jz 0x7f94c9ac6ff0 # PRED 1 cycles [37] 3.00 IPC After: % perf script -F +brstackinsn --xed ... 00007f94c9ac70d8 jz 0x7f94c9ac70e3 # PRED 3 cycles [15] 4.67 IPC 00007f94c9ac70e3 testb $0x20, 0x31d(%rbx) 00007f94c9ac70ea jnz 0x7f94c9ac70b0 00007f94c9ac70ec testb $0x8, 0x205ad(%rip) 00007f94c9ac70f3 jz 0x7f94c9ac6ff0 # PRED 1 cycles [16] 4.00 IPC Suggested-by: Denis Bakhvalov Signed-off-by: Andi Kleen Cc: Jiri Olsa Link: http://lkml.kernel.org/r/20190711181922.18765-2-andi@firstfloor.org Signed-off-by: Arnaldo Carvalho de Melo commit 7db7218a7ea577f04c2df92453d47ab5ebfc8863 Author: Andi Kleen Date: Thu Jul 11 11:19:22 2019 -0700 perf script: Improve man page description of metrics Clarify that a metric is based on events, not referring to itself. Also some improvements with the sentences. Signed-off-by: Andi Kleen Cc: Jiri Olsa Link: http://lkml.kernel.org/r/20190711181922.18765-3-andi@firstfloor.org Signed-off-by: Arnaldo Carvalho de Melo commit 5f8eec3225ff7b86763b060164e9ce47b1a71406 Author: Andi Kleen Date: Thu Jul 11 11:19:20 2019 -0700 perf script: Fix --max-blocks man page description The --max-blocks description was using the old name brstackasm. Use brstackinsn instead. Signed-off-by: Andi Kleen Cc: Jiri Olsa Link: http://lkml.kernel.org/r/20190711181922.18765-1-andi@firstfloor.org Signed-off-by: Arnaldo Carvalho de Melo commit 717dedb1dcee92788b81233aa0a221573c95daff Author: Kai Vehmanen Date: Mon Jul 22 09:14:01 2019 -0500 ASoC: SOF: Intel: hda: remove misleading error trace from IRQ thread Downgrade "nothing to do in IRQ thread" message from error to a debug message in the IPC interrupt handler thread. The spurious wake-up can happen if a HDA stream interrupt is raised while the IPC interrupt thread is running. IPC functionality is not impacted by this condition, so debug is a more appropriate trace level. Signed-off-by: Kai Vehmanen Signed-off-by: Pierre-Louis Bossart Link: https://lore.kernel.org/r/20190722141402.7194-21-pierre-louis.bossart@linux.intel.com Signed-off-by: Mark Brown commit 8201f11a1f75e3aa7d5327d0b1d8cb544aeaa62f Author: Stephan Gerhold Date: Mon Jul 22 15:03:52 2019 +0200 ASoC: qcom: apq8016_sbc: Fix oops with multiple DAI links apq8016_sbc_parse_of() sets up multiple DAI links, depending on the number of nodes in the device tree. However, at the moment CPU and platform components are only allocated for the first link. This causes an oops when more than one link is defined: Internal error: Oops: 96000044 [#1] SMP CPU: 0 PID: 1015 Comm: kworker/0:2 Not tainted 5.3.0-rc1 #4 Call trace: apq8016_sbc_platform_probe+0x1a8/0x3f0 platform_drv_probe+0x50/0xa0 ... Move the allocation inside the loop to ensure that each link is properly initialized. Fixes: 98b232ca9e0e ("ASoC: qcom: apq8016_sbc: use modern dai_link style") Signed-off-by: Stephan Gerhold Acked-by: Kuninori Morimoto Link: https://lore.kernel.org/r/20190722130352.95874-1-stephan@gerhold.net Signed-off-by: Mark Brown commit 3b8179944cb0dd53e5223996966746cdc8a60657 Author: Charles Keepax Date: Mon Jul 22 10:24:36 2019 +0100 ALSA: compress: Be more restrictive about when a drain is allowed Draining makes little sense in the situation of hardware overrun, as the hardware will have consumed all its available samples. Additionally, draining whilst the stream is paused would presumably get stuck as no data is being consumed on the DSP side. Signed-off-by: Charles Keepax Acked-by: Vinod Koul Signed-off-by: Takashi Iwai commit a70ab8a8645083f3700814e757f2940a88b7ef88 Author: Charles Keepax Date: Mon Jul 22 10:24:35 2019 +0100 ALSA: compress: Don't allow paritial drain operations on capture streams Partial drain and next track are intended for gapless playback and don't really have an obvious interpretation for a capture stream, so makes sense to not allow those operations on capture streams. Signed-off-by: Charles Keepax Acked-by: Vinod Koul Signed-off-by: Takashi Iwai commit 26c3f1542f5064310ad26794c09321780d00c57d Author: Charles Keepax Date: Mon Jul 22 10:24:34 2019 +0100 ALSA: compress: Prevent bypasses of set_params Currently, whilst in SNDRV_PCM_STATE_OPEN it is possible to call snd_compr_stop, snd_compr_drain and snd_compr_partial_drain, which allow a transition to SNDRV_PCM_STATE_SETUP. The stream should only be able to move to the setup state once it has received a SNDRV_COMPRESS_SET_PARAMS ioctl. Fix this issue by not allowing those ioctls whilst in the open state. Signed-off-by: Charles Keepax Acked-by: Vinod Koul Signed-off-by: Takashi Iwai commit 4475f8c4ab7b248991a60d9c02808dbb813d6be8 Author: Charles Keepax Date: Mon Jul 22 10:24:33 2019 +0100 ALSA: compress: Fix regression on compressed capture streams A previous fix to the stop handling on compressed capture streams causes some knock on issues. The previous fix updated snd_compr_drain_notify to set the state back to PREPARED for capture streams. This causes some issues however as the handling for snd_compr_poll differs between the two states and some user-space applications were relying on the poll failing after the stream had been stopped. To correct this regression whilst still fixing the original problem the patch was addressing, update the capture handling to skip the PREPARED state rather than skipping the SETUP state as it has done until now. Fixes: 4f2ab5e1d13d ("ALSA: compress: Fix stop handling on compressed capture streams") Signed-off-by: Charles Keepax Acked-by: Vinod Koul Signed-off-by: Takashi Iwai commit e32db73c5aca895a43061cf6621076aa798530e3 Author: Maxime Ripard Date: Thu Jul 18 21:24:55 2019 +0200 MAINTAINERS: Update my email address Use my kernel.org address instead of the bootlin one. Signed-off-by: Maxime Ripard commit 9779048d71b18ea85c067a85b648cebb2d29858e Author: Vasily Gorbik Date: Sun Jul 14 20:49:29 2019 +0200 s390/kasan: add bitops instrumentation Add KASAN instrumentation of architecture-specific asm implementation of bitops. It also covers s390 specific *_inv functions. Signed-off-by: Vasily Gorbik Signed-off-by: Heiko Carstens commit 0a5c3c2f47667a14cd1a3127160af709e64e67b2 Author: Vasily Gorbik Date: Sun Jul 14 20:49:26 2019 +0200 s390/bitops: make test functions return bool Make s390/bitops test functions return bool values. That enforces return value range to 0 and 1 and matches with asm-generic/bitops-instrumented.h declarations as well as some other architectures implementations. Signed-off-by: Vasily Gorbik Reviewed-by: Christian Borntraeger Signed-off-by: Heiko Carstens commit 5518aed82d2abd97f8d3ec91d8ba455d939e8cd1 Author: Vasily Gorbik Date: Sun Jul 14 20:49:23 2019 +0200 s390: wire up clone3 system call Tested (64-bit and compat mode) using program from http://lkml.kernel.org/r/20190604212930.jaaztvkent32b7d3@brauner.io with the following: return syscall(__NR_clone, flags, 0, pidfd, 0, 0); changed to: return syscall(__NR_clone, 0, flags, pidfd, 0, 0); due to CLONE_BACKWARDS2. Signed-off-by: Vasily Gorbik Acked-by: Christian Borntraeger Signed-off-by: Heiko Carstens commit a963609e27786e2b0a80e649ca78798bf769c5d3 Author: Heiko Carstens Date: Mon Jul 22 14:16:46 2019 +0200 kbuild: enable arch/s390/include/uapi/asm/zcrypt.h for uapi header test Masahiro Yamada changed the zcrypt.h header file to use __u{16,32,64} instead of uint{16,32,64}_t with ("s390: use __u{16,32,64} instead of uint{16,32,64}_t in uapi header"). This makes all s390 header files pass - remove zcrypt.h from the blacklist. Cc: Masahiro Yamada Signed-off-by: Heiko Carstens commit 061c996239490a402aa31cd116f71a8bf9db1d8c Author: Masahiro Yamada Date: Sun Jul 21 23:20:08 2019 +0900 s390: use __u{16,32,64} instead of uint{16,32,64}_t in uapi header When CONFIG_UAPI_HEADER_TEST=y, exported headers are compile-tested to make sure they can be included from user-space. Currently, zcrypt.h is excluded from the test coverage. To make it join the compile-test, we need to fix the build errors attached below. For a case like this, we decided to use __u{8,16,32,64} variable types in this discussion: https://lkml.org/lkml/2019/6/5/18 Build log: CC usr/include/asm/zcrypt.h.s In file included from :32:0: ./usr/include/asm/zcrypt.h:163:2: error: unknown type name ‘uint16_t’ uint16_t cprb_len; ^~~~~~~~ ./usr/include/asm/zcrypt.h:168:2: error: unknown type name ‘uint32_t’ uint32_t source_id; ^~~~~~~~ ./usr/include/asm/zcrypt.h:169:2: error: unknown type name ‘uint32_t’ uint32_t target_id; ^~~~~~~~ ./usr/include/asm/zcrypt.h:170:2: error: unknown type name ‘uint32_t’ uint32_t ret_code; ^~~~~~~~ ./usr/include/asm/zcrypt.h:171:2: error: unknown type name ‘uint32_t’ uint32_t reserved1; ^~~~~~~~ ./usr/include/asm/zcrypt.h:172:2: error: unknown type name ‘uint32_t’ uint32_t reserved2; ^~~~~~~~ ./usr/include/asm/zcrypt.h:173:2: error: unknown type name ‘uint32_t’ uint32_t payload_len; ^~~~~~~~ ./usr/include/asm/zcrypt.h:182:2: error: unknown type name ‘uint16_t’ uint16_t ap_id; ^~~~~~~~ ./usr/include/asm/zcrypt.h:183:2: error: unknown type name ‘uint16_t’ uint16_t dom_id; ^~~~~~~~ ./usr/include/asm/zcrypt.h:198:2: error: unknown type name ‘uint16_t’ uint16_t targets_num; ^~~~~~~~ ./usr/include/asm/zcrypt.h:199:2: error: unknown type name ‘uint64_t’ uint64_t targets; ^~~~~~~~ ./usr/include/asm/zcrypt.h:200:2: error: unknown type name ‘uint64_t’ uint64_t weight; ^~~~~~~~ ./usr/include/asm/zcrypt.h:201:2: error: unknown type name ‘uint64_t’ uint64_t req_no; ^~~~~~~~ ./usr/include/asm/zcrypt.h:202:2: error: unknown type name ‘uint64_t’ uint64_t req_len; ^~~~~~~~ ./usr/include/asm/zcrypt.h:203:2: error: unknown type name ‘uint64_t’ uint64_t req; ^~~~~~~~ ./usr/include/asm/zcrypt.h:204:2: error: unknown type name ‘uint64_t’ uint64_t resp_len; ^~~~~~~~ ./usr/include/asm/zcrypt.h:205:2: error: unknown type name ‘uint64_t’ uint64_t resp; ^~~~~~~~ Signed-off-by: Masahiro Yamada Signed-off-by: Heiko Carstens commit 3f4b04e3cfd40fb779f2404453f53157ec171da5 Author: Christophe JAILLET Date: Sun Jul 21 14:33:21 2019 +0200 s390/hypfs: fix a typo in the name of a function Everything is about hypfs_..., except 'hpyfs_vm_create_guest()' s/hpy/hyp/ Signed-off-by: Christophe JAILLET Signed-off-by: Christian Borntraeger Signed-off-by: Heiko Carstens commit eed341976014c5d0a689febf3fac81a0f730f643 Merge: 69e96207ebf9 4c4cbbaa693a Author: Heiko Carstens Date: Tue Jul 23 10:44:28 2019 +0200 Merge tag 'vfio-ccw-20190717-2' of https://git.kernel.org/pub/scm/linux/kernel/git/kvms390/vfio-ccw into fixes Fixes in vfio-ccw for older and newer issues. commit 69e96207ebf90ff8d5bac457134b0d4569f6634e Author: Julian Wiedmann Date: Mon Jul 1 14:19:29 2019 +0200 s390/qdio: restrict QAOB usage to IQD unicast queues The IQD mcast queue doesn't support QAOB mode, so skip the qdio_enable_async_operation() setup call for this queue. This avoids the allocation of an unneeded QAOB pointer array, and sets up q->use_cq properly so that drivers are prohibited from using QAOBs for mcast traffic. Take this opportunity to streamline the q->use_cq and aob != 0 checks. The path to qdio_siga_output() is straight-forward, we don't need to worry about being called with bad operands. Signed-off-by: Julian Wiedmann Signed-off-by: Heiko Carstens commit a6ec414a4dd529eeac5c3ea51c661daba3397108 Author: Julian Wiedmann Date: Thu Jul 11 18:17:36 2019 +0200 s390/qdio: add sanity checks to the fast-requeue path If the device driver were to send out a full queue's worth of SBALs, current code would end up discovering the last of those SBALs as PRIMED and erroneously skip the SIGA-w. This immediately stalls the queue. Add a check to not attempt fast-requeue in this case. While at it also make sure that the state of the previous SBAL was successfully extracted before inspecting it. Signed-off-by: Julian Wiedmann Reviewed-by: Jens Remus Signed-off-by: Heiko Carstens commit 6abe28197024f732f1e298b1a593505282505857 Author: Vasily Gorbik Date: Mon Jul 15 15:30:33 2019 +0200 s390: enable detection of kernel version from bzImage Extend "parmarea" to include an offset of the version string, which is stored as 8-byte big endian value. To retrieve version string from bzImage reliably, one should check the presence of "S390EP" ascii string at 0x10008 (available since v3.2), then read the version string offset from 0x10428 (which has been 0 since v3.2 up to now). The string is null terminated. Could be retrieved with the following "file" command magic (requires file v5.34): 8 string \x02\x00\x00\x18\x60\x00\x00\x50\x02\x00\x00\x68\x60\x00\x00\x50\x40\x40\x40\x40\x40\x40\x40\x40 Linux S390 >0x10008 string S390EP >>0x10428 bequad >0 >>>(0x10428.Q) string >\0 \b, version %s Reported-by: Petr Tesarik Suggested-by: Petr Tesarik Reviewed-by: Heiko Carstens Signed-off-by: Vasily Gorbik Signed-off-by: Heiko Carstens commit bca031e2c8aa22a978a2452bf959e27e9fa73dc7 Author: Zenghui Yu Date: Thu Jul 18 08:15:10 2019 +0000 KVM: arm/arm64: Introduce kvm_pmu_vcpu_init() to setup PMU counter index We use "pmc->idx" and the "chained" bitmap to determine if the pmc is chained, in kvm_pmu_pmc_is_chained(). But idx might be uninitialized (and random) when we doing this decision, through a KVM_ARM_VCPU_INIT ioctl -> kvm_pmu_vcpu_reset(). And the test_bit() against this random idx will potentially hit a KASAN BUG [1]. In general, idx is the static property of a PMU counter that is not expected to be modified across resets, as suggested by Julien. It looks more reasonable if we can setup the PMU counter idx for a vcpu in its creation time. Introduce a new function - kvm_pmu_vcpu_init() for this basic setup. Oh, and the KASAN BUG will get fixed this way. [1] https://www.spinics.net/lists/kvm-arm/msg36700.html Fixes: 80f393a23be6 ("KVM: arm/arm64: Support chained PMU counters") Suggested-by: Andrew Murray Suggested-by: Julien Thierry Acked-by: Julien Thierry Signed-off-by: Zenghui Yu Signed-off-by: Marc Zyngier commit 333a2101f47c4360ee78bb827277615d405b1cf7 Author: Takashi Iwai Date: Tue Jul 23 10:11:59 2019 +0200 firmware: Fix missing inline I mistakenly dropped the inline while resolving the patch conflicts in the previous fix patch. Without inline, we get compiler warnings wrt unused functions. Note that Mauro's original patch contained the correct changes; it's all my fault to submit a patch before a morning coffee. Fixes: c8917b8ff09e ("firmware: fix build errors in paged buffer handling code") Signed-off-by: Takashi Iwai Link: https://lore.kernel.org/r/20190723081159.22624-1-tiwai@suse.de Signed-off-by: Greg Kroah-Hartman commit 201c1db90cd643282185a00770f12f95da330eca Author: Joerg Roedel Date: Tue Jul 23 09:51:00 2019 +0200 iommu/iova: Fix compilation error with !CONFIG_IOMMU_IOVA The stub function for !CONFIG_IOMMU_IOVA needs to be 'static inline'. Fixes: effa467870c76 ('iommu/vt-d: Don't queue_iova() if there is no flush queue') Signed-off-by: Joerg Roedel commit e0a12445d1cb186d875410d093a00d215bec6a89 Author: Wen Yang Date: Wed Jul 17 11:55:04 2019 +0800 cpufreq/pasemi: fix use-after-free in pas_cpufreq_cpu_init() The cpu variable is still being used in the of_get_property() call after the of_node_put() call, which may result in use-after-free. Fixes: a9acc26b75f6 ("cpufreq/pasemi: fix possible object reference leak") Signed-off-by: Wen Yang Acked-by: Viresh Kumar Signed-off-by: Rafael J. Wysocki commit 8d0148473dece51675d11dd59b8db5fe4b5d2e7e Author: Lucas Stach Date: Wed Jul 17 11:54:36 2019 +0200 arm64: dts: imx8mq: fix SAI compatible The i.MX8M SAI block is not compatible with the i.MX6SX one, as the register layout has changed due to two version registers being added at the beginning of the address map. Remove the bogus compatible. Fixes: 8c61538dc945 ("arm64: dts: imx8mq: Add SAI2 node") Signed-off-by: Lucas Stach Reviewed-by: Daniel Baluta Signed-off-by: Shawn Guo commit c528adefd645f5cd16fff658c863e2142d775c61 Author: Rafael J. Wysocki Date: Mon Jul 22 12:22:57 2019 +0200 int340X/processor_thermal_device: Fix proc_thermal_rapl_remove() Passing 0 to cpuhp_remove_state() triggers the BUG_ON() in __cpuhp_remove_state_cpuslocked() and the argument passed to powercap_unregister_control_type() is expected to be a valid pointer, so avoid calling these functions with incorrect arguments from proc_thermal_rapl_remove(). Fixes: 555c45fe0d04 ("int340X/processor_thermal_device: add support for MMIO RAPL") Signed-off-by: Rafael J. Wysocki Acked-by: Zhang Rui commit 52d09014bb104a9157c0f5530700291052d2955c Author: Anson Huang Date: Tue Jul 16 11:09:33 2019 +0800 arm64: dts: imx8mm: Correct SAI3 RXC/TXFS pin's mux option #1 According to i.MX8MM reference manual Rev.1, 03/2019: SAI3_RXC pin's mux option #1 should be GPT1_CLK, NOT GPT1_CAPTURE2; SAI3_TXFS pin's mux option #1 should be GPT1_CAPTURE2, NOT GPT1_CLK. Fixes: c1c9d41319c3 ("dt-bindings: imx: Add pinctrl binding doc for imx8mm") Signed-off-by: Anson Huang Signed-off-by: Shawn Guo commit b3e487c0cf425369a48049251af75593a5652dc1 Author: David S. Miller Date: Mon Jul 22 20:44:48 2019 -0700 Revert "net: hns: fix LED configuration for marvell phy" This reverts commit f4e5f775db5a4631300dccd0de5eafb50a77c131. Andrew Lunn says this should be handled another way. Signed-off-by: David S. Miller commit 1b5d9a6e98350e0713b4faa1b04e8f239f63b581 Author: Christoph Hellwig Date: Mon Jul 22 11:20:38 2019 +0200 scsi: core: fix the dma_max_mapping_size call We should only call dma_max_mapping_size for devices that have a DMA mask set, otherwise we can run into a NULL pointer dereference that will crash the system. Also we need to do right shift to get the sectors from the size in bytes, not a left shift. Fixes: bdd17bdef7d8 ("scsi: core: take the DMA max mapping size into account") Reported-by: Bart Van Assche Reported-by: Ming Lei Tested-by: Guilherme G. Piccoli Signed-off-by: Christoph Hellwig Signed-off-by: Martin K. Petersen commit e70bdd81bfe230a1044eaa49f7d9c9450178d635 Author: Arnd Bergmann Date: Mon Jul 22 14:19:08 2019 +0200 scsi: fdomain: fix building pcmcia front-end We get a warning when CONFIG_SCSI_LOWLEVEL is disabled here: WARNING: unmet direct dependencies detected for SCSI_FDOMAIN Depends on [n]: SCSI_LOWLEVEL [=n] && SCSI [=y] Selected by [m]: - PCMCIA_FDOMAIN [=m] && SCSI_LOWLEVEL_PCMCIA [=y] && SCSI [=y] && PCMCIA [=y] && m && MODULES [=y] Move all of SCSI_LOWLEVEL_PCMCIA inside of the existing SCSI_LOWLEVEL section. Very few people use the PCMCIA support these days, and they likely don't mind having to turn on SCSI_LOWLEVEL as well. This way we avoid the link error and get a more sensible structure. Fixes: 7d47fa065e62 ("scsi: fdomain: Add PCMCIA support") Signed-off-by: Arnd Bergmann Signed-off-by: Martin K. Petersen commit df7699c70c1bc1d9333d610fdc91fbbad84b59f2 Author: Jose Abreu Date: Mon Jul 22 16:07:21 2019 +0200 net: stmmac: Do not cut down 1G modes Some glue logic drivers support 1G without having GMAC/GMAC4/XGMAC. Let's allow this speed by default. Reported-by: Ondrej Jirman Tested-by: Ondrej Jirman Fixes: 5b0d7d7da64b ("net: stmmac: Add the missing speeds that XGMAC supports") Signed-off-by: Jose Abreu Signed-off-by: David S. Miller commit 01ad7facb68f6dc309eb344c0d1d19b33df8cff6 Merge: f4e5f775db5a ec5e5ce1e18b Author: David S. Miller Date: Mon Jul 22 18:23:32 2019 -0700 Merge branch 'stmmac-fixes' Jose Abreu says: ==================== net: stmmac: Two fixes Two fixes targeting -net. ==================== Signed-off-by: David S. Miller commit ec5e5ce1e18b44d0c4779619de3552e0afa5a11d Author: Jose Abreu Date: Mon Jul 22 10:39:31 2019 +0200 net: stmmac: Use kcalloc() instead of kmalloc_array() We need the memory to be zeroed upon allocation so use kcalloc() instead. Signed-off-by: Jose Abreu Signed-off-by: David S. Miller commit cbcf0999ae33e7a8e1dba7ca935556634f679ccf Author: Jose Abreu Date: Mon Jul 22 10:39:30 2019 +0200 net: stmmac: RX Descriptors need to be clean before setting buffers RX Descriptors are being cleaned after setting the buffers which may lead to buffer addresses being wiped out. Fix this by clearing earlier the RX Descriptors. Fixes: 2af6106ae949 ("net: stmmac: Introducing support for Page Pool") Signed-off-by: Jose Abreu Signed-off-by: David S. Miller commit f4e5f775db5a4631300dccd0de5eafb50a77c131 Author: Yonglong Liu Date: Mon Jul 22 13:59:12 2019 +0800 net: hns: fix LED configuration for marvell phy Since commit(net: phy: marvell: change default m88e1510 LED configuration), the active LED of Hip07 devices is always off, because Hip07 just use 2 LEDs. This patch adds a phy_register_fixup_for_uid() for m88e1510 to correct the LED configuration. Fixes: 077772468ec1 ("net: phy: marvell: change default m88e1510 LED configuration") Signed-off-by: Yonglong Liu Reviewed-by: linyunsheng Signed-off-by: David S. Miller commit bba18318e7d1d5c8b0bbafd65010a0cee3c65608 Author: Maxime Chevallier Date: Fri Jul 19 16:38:48 2019 +0200 net: mvpp2: Don't check for 3 consecutive Idle frames for 10G links PPv2's XLGMAC can wait for 3 idle frames before triggering a link up event. This can cause the link to be stuck low when there's traffic on the interface, so disable this feature. Fixes: 4bb043262878 ("net: mvpp2: phylink support") Signed-off-by: Maxime Chevallier Signed-off-by: David S. Miller commit e1f1ae8002e4b06addc52443fcd975bbf554ae92 Author: Geert Uytterhoeven Date: Thu Jul 11 15:03:59 2019 +0200 clk: renesas: cpg-mssr: Fix reset control race condition The module reset code in the Renesas CPG/MSSR driver uses read-modify-write (RMW) operations to write to a Software Reset Register (SRCRn), and simple writes to write to a Software Reset Clearing Register (SRSTCLRn), as was mandated by the R-Car Gen2 and Gen3 Hardware User's Manuals. However, this may cause a race condition when two devices are reset in parallel: if the reset for device A completes in the middle of the RMW operation for device B, device A may be reset again, causing subtle failures (e.g. i2c timeouts): thread A thread B -------- -------- val = SRCRn val |= bit A SRCRn = val delay val = SRCRn (bit A is set) SRSTCLRn = bit A (bit A in SRCRn is cleared) val |= bit B SRCRn = val (bit A and B are set) This can be reproduced on e.g. Salvator-XS using: $ while true; do i2cdump -f -y 4 0x6A b > /dev/null; done & $ while true; do i2cdump -f -y 2 0x10 b > /dev/null; done & i2c-rcar e6510000.i2c: error -110 : 40000002 i2c-rcar e66d8000.i2c: error -110 : 40000002 According to the R-Car Gen3 Hardware Manual Errata for Rev. 0.80 of Feb 28, 2018, reflected in Rev. 1.00 of the R-Car Gen3 Hardware User's Manual, writes to SRCRn do not require read-modify-write cycles. Note that the R-Car Gen2 Hardware User's Manual has not been updated yet, and still says a read-modify-write sequence is required. According to the hardware team, the reset hardware block is the same on both R-Car Gen2 and Gen3, though. Hence fix the issue by replacing the read-modify-write operations on SRCRn by simple writes. Reported-by: Yao Lihua Fixes: 6197aa65c4905532 ("clk: renesas: cpg-mssr: Add support for reset control") Signed-off-by: Geert Uytterhoeven Tested-by: Linh Phung Signed-off-by: Stephen Boyd commit c9a67cbb5189e966c70451562b2ca4c3876ab546 Author: Chunyan Zhang Date: Thu Jul 18 13:36:16 2019 +0800 clk: sprd: Select REGMAP_MMIO to avoid compile errors Make REGMAP_MMIO selected to avoid undefined reference to regmap symbols. Fixes: d41f59fd92f2 ("clk: sprd: Add common infrastructure") Signed-off-by: Chunyan Zhang Signed-off-by: Stephen Boyd commit 26091eef3c179f940d2967e9bef6e22c9e1c445f Author: Yash Shah Date: Fri Jul 19 16:40:31 2019 +0530 riscv: dts: Add DT node for SiFive FU540 Ethernet controller driver DT node for SiFive FU540-C000 GEMGXL Ethernet controller driver added Signed-off-by: Yash Shah Reviewed-by: Sagar Kadam Cc: Andrew Lunn [paul.walmsley@sifive.com: changed "phy1" to "phy0" at Andrew Lunn's suggestion] Signed-off-by: Paul Walmsley commit c93d059a80450af99dd6c0e8c36790579343675a Author: Weiyi Lu Date: Fri Jun 28 15:22:34 2019 +0800 clk: mediatek: mt8183: Register 13MHz clock earlier for clocksource The 13MHz clock should be registered before clocksource driver is initialized. Use CLK_OF_DECLARE_DRIVER() to guarantee. Fixes: acddfc2c261b ("clk: mediatek: Add MT8183 clock support") Cc: Signed-off-by: Weiyi Lu Signed-off-by: Stephen Boyd commit 6ee82ef04e38b0d8b09b04bc1b068673deed6582 Author: Sylwester Nawrocki Date: Mon Jul 1 13:46:51 2019 +0200 clk: Add missing documentation of devm_clk_bulk_get_optional() argument Fix an incomplete devm_clk_bulk_get_optional() function documentation by adding description of the num_clks argument as in other *clk_bulk* functions. Fixes: 9bd5ef0bd874 ("clk: Add devm_clk_bulk_get_optional() function") Reported-by: kbuild test robot Signed-off-by: Sylwester Nawrocki Signed-off-by: Stephen Boyd commit 1573eebeaa8055777eb753f9b4d1cbe653380c38 Author: Codrin Ciubotariu Date: Tue Jun 25 12:10:02 2019 +0300 clk: at91: generated: Truncate divisor to GENERATED_MAX_DIV + 1 In clk_generated_determine_rate(), if the divisor is greater than GENERATED_MAX_DIV + 1, then the wrong best_rate will be returned. If clk_generated_set_rate() will be called later with this wrong rate, it will return -EINVAL, so the generated clock won't change its value. Do no let the divisor be greater than GENERATED_MAX_DIV + 1. Fixes: 8c7aa6328947 ("clk: at91: clk-generated: remove useless divisor loop") Signed-off-by: Codrin Ciubotariu Acked-by: Nicolas Ferre Acked-by: Ludovic Desroches Signed-off-by: Stephen Boyd commit 985eaf99eb180a9a194ef2787cc03682c7ad615b Author: Varun Prakash Date: Mon Jun 17 18:47:45 2019 +0530 scsi: target: cxgbit: add support for IEEE_8021QAZ_APP_SEL_STREAM selector IEEE_8021QAZ_APP_SEL_STREAM is a valid selector for iSCSI connections, so add code to use IEEE_8021QAZ_APP_SEL_STREAM selector to get priority mask. Signed-off-by: Varun Prakash Signed-off-by: Martin K. Petersen commit 2b607f7088f915e561225311ff6f9f3dc23411c5 Author: Federico Vaga Date: Fri Jul 12 11:48:22 2019 +0200 doc:it_IT: translations in process/ This patch add translations for: - programming-languages - kernel-docs (It is better to not translate this since English is a requirement to get something useful out of it) Signed-off-by: Federico Vaga Signed-off-by: Jonathan Corbet commit 74af0d0be1d76d407ebda3b357108111bd62ff3e Author: Jeremy Cline Date: Tue Jul 16 10:49:08 2019 -0400 docs/vm: transhuge: fix typo in madvise reference Fix an off-by-one typo in the transparent huge pages admin documentation. Signed-off-by: Jeremy Cline Acked-by: Mike Rapoport Signed-off-by: Jonathan Corbet commit 1bcff32679f60fe2387f63f22b8b35375052bcb0 Author: Alex Deucher Date: Thu Jul 18 15:25:04 2019 -0500 drm/amdgpu/smu: move fan rpm query into the asic specific code On vega20, there is an SMU message to query it. On navi, it's fetched from the metrics table. Reviewed-by: Evan Quan Signed-off-by: Alex Deucher commit b840e4d5fec6fe2019de36b10412b69df9c4d39a Author: Kevin Wang Date: Fri Jul 19 11:39:21 2019 +0800 drm/amd/powerplay: custom peak clock freq for navi10 v2: add function smu_default_set_performance_level as default dpm level handler. change function name smu_set_performance_level to smu_asic_set_performance_level v1: 1.NAVI10_PEAK_SCLK_XTX 1830 Mhz 2.NAVI10_PEAK_SCLK_XT 1755 Mhz 3.NAVI10_PEAK_SCLK_XL 1625 Mhz Signed-off-by: Kevin Wang Reviewed-by: Huang Rui Reviewed-by: Kenneth Feng Reviewed-by: Evan Quan Reviewed-by: Jack Gui Signed-off-by: Alex Deucher commit 251a44888183003b0380df184835a2c00bfa39d7 Author: Wesley Terpstra Date: Mon May 20 10:29:26 2019 -0700 riscv: include generic support for MSI irqdomains Some RISC-V systems include PCIe host controllers that support PCIe message-signaled interrupts. For this to work on Linux, we need to enable PCI_MSI_IRQ_DOMAIN and define struct msi_alloc_info. Support for the latter is enabled by including the architecture-generic msi.h include. Signed-off-by: Wesley Terpstra [paul.walmsley@sifive.com: split initial patch into one arch/riscv patch and one drivers/pci patch] Signed-off-by: Paul Walmsley commit bbb6fc43f131f77fcb7ae8081f6d7c51396a2120 Author: Qian Cai Date: Mon Jul 22 15:14:46 2019 -0400 drm: silence variable 'conn' set but not used The "struct drm_connector" iteration cursor from "for_each_new_connector_in_state" is never used in atomic_remove_fb() which generates a compilation warning, drivers/gpu/drm/drm_framebuffer.c: In function 'atomic_remove_fb': drivers/gpu/drm/drm_framebuffer.c:838:24: warning: variable 'conn' set but not used [-Wunused-but-set-variable] Silence it by marking "conn" __maybe_unused. Signed-off-by: Qian Cai Signed-off-by: Sean Paul Link: https://patchwork.freedesktop.org/patch/msgid/1563822886-13570-1-git-send-email-cai@lca.pw commit f4da5d074c8e51fcafd44889bf1caaa6a71ed6d9 Author: Palmer Dabbelt Date: Thu Jun 27 17:27:53 2019 -0700 MAINTAINERS: Add Paul as a RISC-V maintainer The RISC-V port has grown significantly over the past year. Paul's been helping out for a while ago. We agreed in person that he'd take over collecting the patches and submitting the PRs, but it looks like I forgot to make it official. Signed-off-by: Palmer Dabbelt Signed-off-by: Paul Walmsley commit 48ffc3d12b55bed8d9452a89bc13de4864dc3106 Merge: 143134ba4983 d6f0f2f19a9e Author: Jonathan Corbet Date: Mon Jul 22 13:51:20 2019 -0600 Merge branch 'pdf_fixes_v1' of https://git.linuxtv.org/mchehab/experimental into mauro Bring in a set of post-thrashup fixes from Mauro. commit 143134ba498327e3d389e10f55f56e9c37257c7c Author: Federico Vaga Date: Thu Jul 18 09:47:54 2019 +0200 doc:it_IT: rephrase statement The statement sounds more like a literal translation Signed-off-by: Federico Vaga Signed-off-by: Jonathan Corbet commit 5adcce34f8a3880a7b3b1cfd90b094d8a931bbae Author: Federico Vaga Date: Thu Jul 18 09:47:24 2019 +0200 doc:it_IT: align translation to mainline The patch translates the following patches in Italian: d9d7c0c497b8 docs: Note that :c:func: should no longer be used 83e8b971f81c sphinx.rst: Add note about code snippets embedded in the text cca5e0b8a430 Documentation: PGP: update for newer HW devices Signed-off-by: Federico Vaga Signed-off-by: Jonathan Corbet commit e27a24210aa17b8a0cd462865130fe73afd7e001 Merge: 224d5fd43d25 5f9e832c1370 Author: Jonathan Corbet Date: Mon Jul 22 13:42:10 2019 -0600 Merge tag 'v5.3-rc1' into docs-next Pull in all of the massive docs changes from elsewhere. commit f7af86ccf1882084293b11077deec049fd01da63 Author: Sven Eckelmann Date: Sun Jul 7 23:04:57 2019 +0200 batman-adv: Fix deletion of RTR(4|6) mcast list entries The multicast code uses the lists bat_priv->mcast.want_all_rtr*_list to store all all originator nodes which don't have the flag no-RTR4 or no-RTR6 set. When an originator is purged, it has to be removed from these lists. Since all entries without the BATADV_MCAST_WANT_NO_RTR4/6 are stored in these lists, they have to be handled like entries which have these flags set to force the update routines to remove them from the lists when purging the originator. Not doing so will leave a pointer to a freed memory region inside the list. Trying to operate on these lists will then cause an use-after-free error: BUG: KASAN: use-after-free in batadv_mcast_want_rtr4_update+0x335/0x3a0 [batman_adv] Write of size 8 at addr ffff888007b41a38 by task swapper/0/0 Fixes: 61caf3d109f5 ("batman-adv: mcast: detect, distribute and maintain multicast router presence") Signed-off-by: Sven Eckelmann Acked-by: Linus Lüssing Signed-off-by: Simon Wunderlich commit fa3a03da549a889fc9dbc0d3c5908eb7882cac8f Author: Sven Eckelmann Date: Sun Jul 7 22:15:13 2019 +0200 batman-adv: Fix netlink dumping of all mcast_flags buckets The bucket variable is only updated outside the loop over the mcast_flags buckets. It will only be updated during a dumping run when the dumping has to be interrupted and a new message has to be started. This could result in repeated or missing entries when the multicast flags are dumped to userspace. Fixes: d2d489b7d851 ("batman-adv: Add inconsistent multicast netlink dump detection") Signed-off-by: Sven Eckelmann Signed-off-by: Simon Wunderlich commit 12185dfe44360f814ac4ead9d22ad2af7511b2e9 Author: Thomas Falcon Date: Tue Jul 16 17:25:10 2019 -0500 bonding: Force slave speed check after link state recovery for 802.3ad The following scenario was encountered during testing of logical partition mobility on pseries partitions with bonded ibmvnic adapters in LACP mode. 1. Driver receives a signal that the device has been swapped, and it needs to reset to initialize the new device. 2. Driver reports loss of carrier and begins initialization. 3. Bonding driver receives NETDEV_CHANGE notifier and checks the slave's current speed and duplex settings. Because these are unknown at the time, the bond sets its link state to BOND_LINK_FAIL and handles the speed update, clearing AD_PORT_LACP_ENABLE. 4. Driver finishes recovery and reports that the carrier is on. 5. Bond receives a new notification and checks the speed again. The speeds are valid but miimon has not altered the link state yet. AD_PORT_LACP_ENABLE remains off. Because the slave's link state is still BOND_LINK_FAIL, no further port checks are made when it recovers. Though the slave devices are operational and have valid speed and duplex settings, the bond will not send LACPDU's. The simplest fix I can see is to force another speed check in bond_miimon_commit. This way the bond will update AD_PORT_LACP_ENABLE if needed when transitioning from BOND_LINK_FAIL to BOND_LINK_UP. CC: Jarod Wilson CC: Jay Vosburgh CC: Veaceslav Falico CC: Andy Gospodarek Signed-off-by: Thomas Falcon Signed-off-by: David S. Miller commit 0036bc73ccbe7e600a3468bf8e8879b122252274 Author: Rob Clark Date: Sun Jun 30 05:47:22 2019 -0700 drm/msm: stop abusing dma_map/unmap for cache Recently splats like this started showing up: WARNING: CPU: 4 PID: 251 at drivers/iommu/dma-iommu.c:451 __iommu_dma_unmap+0xb8/0xc0 Modules linked in: ath10k_snoc ath10k_core fuse msm ath mac80211 uvcvideo cfg80211 videobuf2_vmalloc videobuf2_memops vide CPU: 4 PID: 251 Comm: kworker/u16:4 Tainted: G W 5.2.0-rc5-next-20190619+ #2317 Hardware name: LENOVO 81JL/LNVNB161216, BIOS 9UCN23WW(V1.06) 10/25/2018 Workqueue: msm msm_gem_free_work [msm] pstate: 80c00005 (Nzcv daif +PAN +UAO) pc : __iommu_dma_unmap+0xb8/0xc0 lr : __iommu_dma_unmap+0x54/0xc0 sp : ffff0000119abce0 x29: ffff0000119abce0 x28: 0000000000000000 x27: ffff8001f9946648 x26: ffff8001ec271068 x25: 0000000000000000 x24: ffff8001ea3580a8 x23: ffff8001f95ba010 x22: ffff80018e83ba88 x21: ffff8001e548f000 x20: fffffffffffff000 x19: 0000000000001000 x18: 00000000c00001fe x17: 0000000000000000 x16: 0000000000000000 x15: ffff000015b70068 x14: 0000000000000005 x13: 0003142cc1be1768 x12: 0000000000000001 x11: ffff8001f6de9100 x10: 0000000000000009 x9 : ffff000015b78000 x8 : 0000000000000000 x7 : 0000000000000001 x6 : fffffffffffff000 x5 : 0000000000000fff x4 : ffff00001065dbc8 x3 : 000000000000000d x2 : 0000000000001000 x1 : fffffffffffff000 x0 : 0000000000000000 Call trace: __iommu_dma_unmap+0xb8/0xc0 iommu_dma_unmap_sg+0x98/0xb8 put_pages+0x5c/0xf0 [msm] msm_gem_free_work+0x10c/0x150 [msm] process_one_work+0x1e0/0x330 worker_thread+0x40/0x438 kthread+0x12c/0x130 ret_from_fork+0x10/0x18 ---[ end trace afc0dc5ab81a06bf ]--- Not quite sure what triggered that, but we really shouldn't be abusing dma_{map,unmap}_sg() for cache maint. Cc: Stephen Boyd Tested-by: Stephen Boyd Reviewed-by: Jordan Crouse Signed-off-by: Rob Clark Signed-off-by: Sean Paul Link: https://patchwork.freedesktop.org/patch/msgid/20190630124735.27786-1-robdclark@gmail.com commit af0653d56657340a80622aeb96707f7fc8506225 Author: Mao Wenan Date: Fri Jul 19 09:29:38 2019 +0800 RDMA/siw: Remove set but not used variables 'rv' Fixes gcc '-Wunused-but-set-variable' warning: drivers/infiniband/sw/siw/siw_cm.c: In function siw_cep_set_inuse: drivers/infiniband/sw/siw/siw_cm.c:223:6: warning: variable rv set but not used [-Wunused-but-set-variable] Fixes: 6c52fdc244b5 ("rdma/siw: connection management") Link: https://lore.kernel.org/r/20190719012938.100628-1-maowenan@huawei.com Signed-off-by: Mao Wenan Reviewed-by: Bernard Metzler Signed-off-by: Jason Gunthorpe commit b7f406bb883ba7ac3222298f6b44cebc4cfe2dde Author: Chuhong Yuan Date: Wed Jul 17 16:21:01 2019 +0800 IB/mlx5: Replace kfree with kvfree Memory allocated by kvzalloc should not be freed by kfree(), use kvfree() instead. Fixes: 813e90b1aeaa ("IB/mlx5: Add advise_mr() support") Link: https://lore.kernel.org/r/20190717082101.14196-1-hslester96@gmail.com Signed-off-by: Chuhong Yuan Reviewed-by: Jason Gunthorpe Signed-off-by: Jason Gunthorpe commit c56b593d2af4cbd189c6af5fd6790728fade80cc Author: Selvin Xavier Date: Mon Jul 15 05:19:13 2019 -0400 RDMA/bnxt_re: Honor vlan_id in GID entry comparison A GID entry consists of GID, vlan, netdev and smac. Extend GID duplicate check comparisons to consider vlan_id as well to support IPv6 VLAN based link local addresses. Introduce a new structure (bnxt_qplib_gid_info) to hold gid and vlan_id information. The issue is discussed in the following thread https://lore.kernel.org/r/AM0PR05MB4866CFEDCDF3CDA1D7D18AA5D1F20@AM0PR05MB4866.eurprd05.prod.outlook.com Fixes: 823b23da7113 ("IB/core: Allow vlan link local address based RoCE GIDs") Cc: # v5.2+ Link: https://lore.kernel.org/r/20190715091913.15726-1-selvin.xavier@broadcom.com Reported-by: Yi Zhang Co-developed-by: Parav Pandit Signed-off-by: Parav Pandit Signed-off-by: Selvin Xavier Tested-by: Yi Zhang Signed-off-by: Jason Gunthorpe commit f4d46119f214f9a7620b0d18b153d7e0e8c90b4f Author: Kaike Wan Date: Mon Jul 15 12:45:40 2019 -0400 IB/hfi1: Drop all TID RDMA READ RESP packets after r_next_psn When a TID sequence error occurs while receiving TID RDMA READ RESP packets, all packets after flow->flow_state.r_next_psn should be dropped, including those response packets for subsequent segments. The current implementation will drop the subsequent response packets for the segment to complete next, but may accept packets for subsequent segments and therefore mistakenly advance the r_next_psn fields for the corresponding software flows. This may result in failures to complete subsequent segments after the current segment is completed. The fix is to only use the flow pointed by req->clear_tail for checking KDETH PSN instead of finding a flow from the request's flow array. Fixes: b885d5be9ca1 ("IB/hfi1: Unify the software PSN check for TID RDMA READ/WRITE") Cc: Link: https://lore.kernel.org/r/20190715164540.74174.54702.stgit@awfm-01.aw.intel.com Reviewed-by: Mike Marciniszyn Signed-off-by: Kaike Wan Signed-off-by: Mike Marciniszyn Signed-off-by: Jason Gunthorpe commit dc25b239ebeaa3c58e5ceaa732140427d386aa16 Author: Kaike Wan Date: Mon Jul 15 12:45:34 2019 -0400 IB/hfi1: Field not zero-ed when allocating TID flow memory The field flow->resync_npkts is added for TID RDMA WRITE request and zero-ed when a TID RDMA WRITE RESP packet is received by the requester. This field is used to rewind a request during retry in the function hfi1_tid_rdma_restart_req() shared by both TID RDMA WRITE and TID RDMA READ requests. Therefore, when a TID RDMA READ request is retried, this field may not be initialized at all, which causes the retry to start at an incorrect psn, leading to the drop of the retry request by the responder. This patch fixes the problem by zeroing out the field when the flow memory is allocated. Fixes: 838b6fd2d9ca ("IB/hfi1: TID RDMA RcvArray programming and TID allocation") Cc: Link: https://lore.kernel.org/r/20190715164534.74174.6177.stgit@awfm-01.aw.intel.com Reviewed-by: Mike Marciniszyn Signed-off-by: Kaike Wan Signed-off-by: Mike Marciniszyn Signed-off-by: Jason Gunthorpe commit 2b74c878b0eae4c32629c2d5ba69a29f69048313 Author: Kaike Wan Date: Mon Jul 15 12:45:28 2019 -0400 IB/hfi1: Unreserve a flushed OPFN request When an OPFN request is flushed, the request is completed without unreserving itself from the send queue. Subsequently, when a new request is post sent, the following warning will be triggered: WARNING: CPU: 4 PID: 8130 at rdmavt/qp.c:1761 rvt_post_send+0x72a/0x880 [rdmavt] Call Trace: [] dump_stack+0x19/0x1b [] __warn+0xd8/0x100 [] warn_slowpath_null+0x1d/0x20 [] rvt_post_send+0x72a/0x880 [rdmavt] [] ? account_entity_dequeue+0xae/0xd0 [] ? __kmalloc+0x55/0x230 [] ib_uverbs_post_send+0x37c/0x5d0 [ib_uverbs] [] ? rdma_lookup_put_uobject+0x26/0x60 [ib_uverbs] [] ib_uverbs_write+0x286/0x460 [ib_uverbs] [] ? security_file_permission+0x27/0xa0 [] vfs_write+0xc0/0x1f0 [] SyS_write+0x7f/0xf0 [] system_call_fastpath+0x22/0x27 This patch fixes the problem by moving rvt_qp_wqe_unreserve() into rvt_qp_complete_swqe() to simplify the code and make it less error-prone. Fixes: ca95f802ef51 ("IB/hfi1: Unreserve a reserved request when it is completed") Link: https://lore.kernel.org/r/20190715164528.74174.31364.stgit@awfm-01.aw.intel.com Cc: Reviewed-by: Mike Marciniszyn Reviewed-by: Dennis Dalessandro Signed-off-by: Kaike Wan Signed-off-by: Mike Marciniszyn Signed-off-by: Jason Gunthorpe commit cd48a82087231fdba0e77521102386c6ed0168d6 Author: John Fleck Date: Mon Jul 15 12:45:21 2019 -0400 IB/hfi1: Check for error on call to alloc_rsm_map_table The call to alloc_rsm_map_table does not check if the kmalloc fails. Check for a NULL on alloc, and bail if it fails. Fixes: 372cc85a13c9 ("IB/hfi1: Extract RSM map table init from QOS") Link: https://lore.kernel.org/r/20190715164521.74174.27047.stgit@awfm-01.aw.intel.com Cc: Reviewed-by: Mike Marciniszyn Signed-off-by: John Fleck Signed-off-by: Mike Marciniszyn Signed-off-by: Jason Gunthorpe commit 2e7b801eadbf327bf61041c943e5c44a5de4b0e5 Author: Shubhashree Dhar Date: Mon Jun 24 11:57:12 2019 +0530 drm/msm/dpu: Correct dpu encoder spinlock initialization dpu encoder spinlock should be initialized during dpu encoder init instead of dpu encoder setup which is part of modeset init. Signed-off-by: Shubhashree Dhar [seanpaul resolved conflict in old init removal and revised the commit message] Signed-off-by: Sean Paul Link: https://patchwork.freedesktop.org/patch/msgid/1561357632-15361-1-git-send-email-dhar@codeaurora.org commit 60c3becfd1a138fdcfe48f2a5ef41ef0078d481e Author: Xi Wang Date: Thu Jul 11 09:32:17 2019 +0800 RDMA/hns: Fix sg offset non-zero issue When run perftest in many times, the system will report a BUG as follows: BUG: Bad rss-counter state mm:(____ptrval____) idx:0 val:-1 BUG: Bad rss-counter state mm:(____ptrval____) idx:1 val:1 We tested with different kernel version and found it started from the the following commit: commit d10bcf947a3e ("RDMA/umem: Combine contiguous PAGE_SIZE regions in SGEs") In this commit, the sg->offset is always 0 when sg_set_page() is called in ib_umem_get() and the drivers are not allowed to change the sgl, otherwise it will get bad page descriptor when unfolding SGEs in __ib_umem_release() as sg_page_count() will get wrong result while sgl->offset is not 0. However, there is a weird sgl usage in the current hns driver, the driver modified sg->offset after calling ib_umem_get(), which caused we iterate past the wrong number of pages in for_each_sg_page iterator. This patch fixes it by correcting the non-standard sgl usage found in the hns_roce_db_map_user() function. Fixes: d10bcf947a3e ("RDMA/umem: Combine contiguous PAGE_SIZE regions in SGEs") Fixes: 0425e3e6e0c7 ("RDMA/hns: Support flush cqe for hip08 in kernel space") Link: https://lore.kernel.org/r/1562808737-45723-1-git-send-email-oulijun@huawei.com Signed-off-by: Xi Wang Signed-off-by: Jason Gunthorpe commit 7af5cdb158f3398a3220bd2fe81cec8d2be9317c Author: Brian Masney Date: Wed Jun 26 22:05:15 2019 -0400 drm/msm: correct NULL pointer dereference in context_init Correct attempted NULL pointer dereference in context_init() when running without an IOMMU. Reviewed-by: Rob Clark Signed-off-by: Brian Masney Fixes: 295b22ae596c ("drm/msm: Pass the MMU domain index in struct msm_file_private") Signed-off-by: Sean Paul Link: https://patchwork.freedesktop.org/patch/msgid/20190627020515.5660-1-masneyb@onstation.org commit d5121ffebc38a16b2419b664e466a2f3e5c7b457 Author: Wei Yongjun Date: Thu Jul 18 09:27:10 2019 +0000 RDMA/siw: Fix error return code in siw_init_module() Fix to return a negative error code from the error handling case instead of 0, as done elsewhere in this function. Fixes: bdcf26bf9b3a ("rdma/siw: network and RDMA core interface") Link: https://lore.kernel.org/r/20190718092710.85709-1-weiyongjun1@huawei.com Signed-off-by: Wei Yongjun Reviewed-by: Bernard Metzler Reviewed-by: Jason Gunthorpe Signed-off-by: Jason Gunthorpe commit 45004d66f2a28d78f543fb2ffbc133e31dc2d162 Author: Wenwen Wang Date: Mon Jul 22 08:57:44 2019 -0500 ASoC: dapm: fix a memory leak bug In snd_soc_dapm_new_control_unlocked(), a kernel buffer is allocated in dapm_cnew_widget() to hold the new dapm widget. Then, different actions are taken according to the id of the widget, i.e., 'w->id'. If any failure occurs during this process, snd_soc_dapm_new_control_unlocked() should be terminated by going to the 'request_failed' label. However, the allocated kernel buffer is not freed on this code path, leading to a memory leak bug. To fix the above issue, free the buffer before returning from snd_soc_dapm_new_control_unlocked() through the 'request_failed' label. Signed-off-by: Wenwen Wang Link: https://lore.kernel.org/r/1563803864-2809-1-git-send-email-wang6495@umn.edu Signed-off-by: Mark Brown commit 7b5cf701ea9c395c792e2a7e3b7caf4c68b87721 Merge: 44b912cd0b55 b8d3349803ba Author: Linus Torvalds Date: Mon Jul 22 09:30:34 2019 -0700 Merge branch 'sched-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull preemption Kconfig fix from Thomas Gleixner: "The PREEMPT_RT stub config renamed PREEMPT to PREEMPT_LL and defined PREEMPT outside of the menu and made it selectable by both PREEMPT_LL and PREEMPT_RT. Stupid me missed that 114 defconfigs select CONFIG_PREEMPT which obviously can't work anymore. oldconfig builds are affected as well, but it's more obvious as the user gets asked. [old]defconfig silently fixes it up and selects PREEMPT_NONE. Unbreak it by undoing the rename and adding a intermediate config symbol which is selected by both PREEMPT and PREEMPT_RT. That requires to chase down a few #ifdefs, but it's better than tweaking 114 defconfigs and annoying users" * 'sched-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: sched/rt, Kconfig: Unbreak def/oldconfig with CONFIG_PREEMPT=y commit 44b912cd0b55777796c5ae8ae857bd1d5ff83ed5 Merge: 21c730d73471 b191d6491be6 Author: Linus Torvalds Date: Mon Jul 22 09:14:19 2019 -0700 Merge tag 'for-linus-20190722' of git://git.kernel.org/pub/scm/linux/kernel/git/brauner/linux Pull pidfd polling fix from Christian Brauner: "A fix for pidfd polling. It ensures that the task's exit state is visible to all waiters" * tag 'for-linus-20190722' of git://git.kernel.org/pub/scm/linux/kernel/git/brauner/linux: pidfd: fix a poll race when setting exit_state commit 21c730d7347126886c40453feb973161f4ae3fb3 Merge: c92f0380673b 373c3b80e459 Author: Linus Torvalds Date: Mon Jul 22 09:08:38 2019 -0700 Merge tag 'for-5.3-rc1-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux Pull btrfs fixes from David Sterba: - fixes for leaks caused by recently merged patches - one build fix - a fix to prevent mixing of incompatible features * tag 'for-5.3-rc1-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux: btrfs: don't leak extent_map in btrfs_get_io_geometry() btrfs: free checksum hash on in close_ctree btrfs: Fix build error while LIBCRC32C is module btrfs: inode: Don't compress if NODATASUM or NODATACOW set commit b8d3349803ba34afda429e87a837fd95a99b2349 Author: Thomas Gleixner Date: Mon Jul 22 17:59:19 2019 +0200 sched/rt, Kconfig: Unbreak def/oldconfig with CONFIG_PREEMPT=y The merge of the CONFIG_PREEMPT_RT stub renamed CONFIG_PREEMPT to CONFIG_PREEMPT_LL which causes all defconfigs which have CONFIG_PREEMPT=y set to fall back to CONFIG_PREEMPT_NONE because CONFIG_PREEMPT depends on the preemption mode choice wich defaults to NONE. This also affects oldconfig builds. So rather than changing 114 defconfig files and being an annoyance to users, revert the rename and select a new config symbol PREEMPTION. That keeps everything working smoothly and the revelant ifdef's are going to be fixed up step by step. Reported-by: Mark Rutland Fixes: a50a3f4b6a31 ("sched/rt, Kconfig: Introduce CONFIG_PREEMPT_RT") Signed-off-by: Thomas Gleixner commit c92f0380673bd295c9ac73030a17c16b9df3e702 Merge: 83768245a3b1 22be8233b34f Author: Linus Torvalds Date: Mon Jul 22 09:01:47 2019 -0700 Merge tag 'media/v5.3-2' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media Pull media fixes from Mauro Carvalho Chehab: "For two regressions in media core: - v4l2-subdev: fix regression in check_pad() - videodev2.h: change V4L2_PIX_FMT_BGRA444 define: fourcc was already in use" * tag 'media/v5.3-2' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: media: videodev2.h: change V4L2_PIX_FMT_BGRA444 define: fourcc was already in use media: v4l2-subdev: fix regression in check_pad() commit 7f6cade5b6bf47daa315118a05aab613c73462ff Author: Sai Praneeth Prakhya Date: Sun Jul 21 17:22:07 2019 -0700 iommu/vt-d: Print pasid table entries MSB to LSB in debugfs Commit dd5142ca5d24 ("iommu/vt-d: Add debugfs support to show scalable mode DMAR table internals") prints content of pasid table entries from LSB to MSB where as other entries are printed MSB to LSB. So, to maintain uniformity among all entries and to not confuse the user, print MSB first. Cc: Joerg Roedel Cc: Lu Baolu Cc: Sohil Mehta Cc: Jacob Pan Signed-off-by: Sai Praneeth Prakhya Fixes: dd5142ca5d24 ("iommu/vt-d: Add debugfs support to show scalable mode DMAR table internals") Signed-off-by: Joerg Roedel commit ae24fb49d01103c80d6ff3b78714259c1c62c958 Author: Jean-Philippe Brucker Date: Mon Jul 22 15:40:07 2019 +0100 iommu/virtio: Update to most recent specification Following specification review a few things were changed in v8 of the virtio-iommu series [1], but have been omitted when merging the base driver. Add them now: * Remove the EXEC flag. * Add feature bit for the MMIO flag. * Change domain_bits to domain_range. * Add NOMEM status flag. [1] https://lore.kernel.org/linux-iommu/20190530170929.19366-1-jean-philippe.brucker@arm.com/ Fixes: edcd69ab9a32 ("iommu: Add virtio-iommu driver") Reported-by: Eric Auger Signed-off-by: Jean-Philippe Brucker Signed-off-by: Michael S. Tsirkin Reviewed-by: Eric Auger Tested-by: Eric Auger Acked-by: Joerg Roedel commit 9eed17d37c77171cf5ffb95c4257f87df3cd4c8f Author: Chris Wilson Date: Sat Jul 20 19:08:48 2019 +0100 iommu/iova: Remove stale cached32_node Since the cached32_node is allowed to be advanced above dma_32bit_pfn (to provide a shortcut into the limited range), we need to be careful to remove the to be freed node if it is the cached32_node. [ 48.477773] BUG: KASAN: use-after-free in __cached_rbnode_delete_update+0x68/0x110 [ 48.477812] Read of size 8 at addr ffff88870fc19020 by task kworker/u8:1/37 [ 48.477843] [ 48.477879] CPU: 1 PID: 37 Comm: kworker/u8:1 Tainted: G U 5.2.0+ #735 [ 48.477915] Hardware name: Intel Corporation NUC7i5BNK/NUC7i5BNB, BIOS BNKBL357.86A.0052.2017.0918.1346 09/18/2017 [ 48.478047] Workqueue: i915 __i915_gem_free_work [i915] [ 48.478075] Call Trace: [ 48.478111] dump_stack+0x5b/0x90 [ 48.478137] print_address_description+0x67/0x237 [ 48.478178] ? __cached_rbnode_delete_update+0x68/0x110 [ 48.478212] __kasan_report.cold.3+0x1c/0x38 [ 48.478240] ? __cached_rbnode_delete_update+0x68/0x110 [ 48.478280] ? __cached_rbnode_delete_update+0x68/0x110 [ 48.478308] __cached_rbnode_delete_update+0x68/0x110 [ 48.478344] private_free_iova+0x2b/0x60 [ 48.478378] iova_magazine_free_pfns+0x46/0xa0 [ 48.478403] free_iova_fast+0x277/0x340 [ 48.478443] fq_ring_free+0x15a/0x1a0 [ 48.478473] queue_iova+0x19c/0x1f0 [ 48.478597] cleanup_page_dma.isra.64+0x62/0xb0 [i915] [ 48.478712] __gen8_ppgtt_cleanup+0x63/0x80 [i915] [ 48.478826] __gen8_ppgtt_cleanup+0x42/0x80 [i915] [ 48.478940] __gen8_ppgtt_clear+0x433/0x4b0 [i915] [ 48.479053] __gen8_ppgtt_clear+0x462/0x4b0 [i915] [ 48.479081] ? __sg_free_table+0x9e/0xf0 [ 48.479116] ? kfree+0x7f/0x150 [ 48.479234] i915_vma_unbind+0x1e2/0x240 [i915] [ 48.479352] i915_vma_destroy+0x3a/0x280 [i915] [ 48.479465] __i915_gem_free_objects+0xf0/0x2d0 [i915] [ 48.479579] __i915_gem_free_work+0x41/0xa0 [i915] [ 48.479607] process_one_work+0x495/0x710 [ 48.479642] worker_thread+0x4c7/0x6f0 [ 48.479687] ? process_one_work+0x710/0x710 [ 48.479724] kthread+0x1b2/0x1d0 [ 48.479774] ? kthread_create_worker_on_cpu+0xa0/0xa0 [ 48.479820] ret_from_fork+0x1f/0x30 [ 48.479864] [ 48.479907] Allocated by task 631: [ 48.479944] save_stack+0x19/0x80 [ 48.479994] __kasan_kmalloc.constprop.6+0xc1/0xd0 [ 48.480038] kmem_cache_alloc+0x91/0xf0 [ 48.480082] alloc_iova+0x2b/0x1e0 [ 48.480125] alloc_iova_fast+0x58/0x376 [ 48.480166] intel_alloc_iova+0x90/0xc0 [ 48.480214] intel_map_sg+0xde/0x1f0 [ 48.480343] i915_gem_gtt_prepare_pages+0xb8/0x170 [i915] [ 48.480465] huge_get_pages+0x232/0x2b0 [i915] [ 48.480590] ____i915_gem_object_get_pages+0x40/0xb0 [i915] [ 48.480712] __i915_gem_object_get_pages+0x90/0xa0 [i915] [ 48.480834] i915_gem_object_prepare_write+0x2d6/0x330 [i915] [ 48.480955] create_test_object.isra.54+0x1a9/0x3e0 [i915] [ 48.481075] igt_shared_ctx_exec+0x365/0x3c0 [i915] [ 48.481210] __i915_subtests.cold.4+0x30/0x92 [i915] [ 48.481341] __run_selftests.cold.3+0xa9/0x119 [i915] [ 48.481466] i915_live_selftests+0x3c/0x70 [i915] [ 48.481583] i915_pci_probe+0xe7/0x220 [i915] [ 48.481620] pci_device_probe+0xe0/0x180 [ 48.481665] really_probe+0x163/0x4e0 [ 48.481710] device_driver_attach+0x85/0x90 [ 48.481750] __driver_attach+0xa5/0x180 [ 48.481796] bus_for_each_dev+0xda/0x130 [ 48.481831] bus_add_driver+0x205/0x2e0 [ 48.481882] driver_register+0xca/0x140 [ 48.481927] do_one_initcall+0x6c/0x1af [ 48.481970] do_init_module+0x106/0x350 [ 48.482010] load_module+0x3d2c/0x3ea0 [ 48.482058] __do_sys_finit_module+0x110/0x180 [ 48.482102] do_syscall_64+0x62/0x1f0 [ 48.482147] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 48.482190] [ 48.482224] Freed by task 37: [ 48.482273] save_stack+0x19/0x80 [ 48.482318] __kasan_slab_free+0x12e/0x180 [ 48.482363] kmem_cache_free+0x70/0x140 [ 48.482406] __free_iova+0x1d/0x30 [ 48.482445] fq_ring_free+0x15a/0x1a0 [ 48.482490] queue_iova+0x19c/0x1f0 [ 48.482624] cleanup_page_dma.isra.64+0x62/0xb0 [i915] [ 48.482749] __gen8_ppgtt_cleanup+0x63/0x80 [i915] [ 48.482873] __gen8_ppgtt_cleanup+0x42/0x80 [i915] [ 48.482999] __gen8_ppgtt_clear+0x433/0x4b0 [i915] [ 48.483123] __gen8_ppgtt_clear+0x462/0x4b0 [i915] [ 48.483250] i915_vma_unbind+0x1e2/0x240 [i915] [ 48.483378] i915_vma_destroy+0x3a/0x280 [i915] [ 48.483500] __i915_gem_free_objects+0xf0/0x2d0 [i915] [ 48.483622] __i915_gem_free_work+0x41/0xa0 [i915] [ 48.483659] process_one_work+0x495/0x710 [ 48.483704] worker_thread+0x4c7/0x6f0 [ 48.483748] kthread+0x1b2/0x1d0 [ 48.483787] ret_from_fork+0x1f/0x30 [ 48.483831] [ 48.483868] The buggy address belongs to the object at ffff88870fc19000 [ 48.483868] which belongs to the cache iommu_iova of size 40 [ 48.483920] The buggy address is located 32 bytes inside of [ 48.483920] 40-byte region [ffff88870fc19000, ffff88870fc19028) [ 48.483964] The buggy address belongs to the page: [ 48.484006] page:ffffea001c3f0600 refcount:1 mapcount:0 mapping:ffff8888181a91c0 index:0x0 compound_mapcount: 0 [ 48.484045] flags: 0x8000000000010200(slab|head) [ 48.484096] raw: 8000000000010200 ffffea001c421a08 ffffea001c447e88 ffff8888181a91c0 [ 48.484141] raw: 0000000000000000 0000000000120012 00000001ffffffff 0000000000000000 [ 48.484188] page dumped because: kasan: bad access detected [ 48.484230] [ 48.484265] Memory state around the buggy address: [ 48.484314] ffff88870fc18f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 48.484361] ffff88870fc18f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 48.484406] >ffff88870fc19000: fb fb fb fb fb fc fc fc fc fc fc fc fc fc fc fc [ 48.484451] ^ [ 48.484494] ffff88870fc19080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 48.484530] ffff88870fc19100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=108602 Fixes: e60aa7b53845 ("iommu/iova: Extend rbtree node caching") Signed-off-by: Chris Wilson Cc: Robin Murphy Cc: Joerg Roedel Cc: Joerg Roedel Cc: # v4.15+ Reviewed-by: Robin Murphy Signed-off-by: Joerg Roedel commit 83768245a3b158b96d33012b22ab01d193afb2da Merge: 5f9e832c1370 b617158dc096 Author: Linus Torvalds Date: Mon Jul 22 08:49:22 2019 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net Pull networking fixes from David Miller: 1) Several netfilter fixes including a nfnetlink deadlock fix from Florian Westphal and fix for dropping VRF packets from Miaohe Lin. 2) Flow offload fixes from Pablo Neira Ayuso including a fix to restore proper block sharing. 3) Fix r8169 PHY init from Thomas Voegtle. 4) Fix memory leak in mac80211, from Lorenzo Bianconi. 5) Missing NULL check on object allocation in cxgb4, from Navid Emamdoost. 6) Fix scaling of RX power in sfp phy driver, from Andrew Lunn. 7) Check that there is actually an ip header to access in skb->data in VRF, from Peter Kosyh. 8) Remove spurious rcu unlock in hv_netvsc, from Haiyang Zhang. 9) One more tweak the the TCP fragmentation memory limit changes, to be less harmful to applications setting small SO_SNDBUF values. From Eric Dumazet. * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (40 commits) tcp: be more careful in tcp_fragment() hv_netvsc: Fix extra rcu_read_unlock in netvsc_recv_callback() vrf: make sure skb->data contains ip header to make routing connector: remove redundant input callback from cn_dev qed: Prefer pcie_capability_read_word() igc: Prefer pcie_capability_read_word() cxgb4: Prefer pcie_capability_read_word() be2net: Synchronize be_update_queues with dev_watchdog bnx2x: Prevent load reordering in tx completion processing net: phy: sfp: hwmon: Fix scaling of RX power net: sched: verify that q!=NULL before setting q->flags chelsio: Fix a typo in a function name allocate_flower_entry: should check for null deref net: hns3: typo in the name of a constant kbuild: add net/netfilter/nf_tables_offload.h to header-test blacklist. tipc: Fix a typo mac80211: don't warn about CW params when not using them mac80211: fix possible memory leak in ieee80211_assign_beacon nl80211: fix NL80211_HE_MAX_CAPABILITY_LEN nl80211: fix VENDOR_CMD_RAW_DATA ... commit 3ee9eca760e7d0b68c55813243de66bbb499dc3b Author: Dmitry Safonov Date: Tue Jul 16 22:38:06 2019 +0100 iommu/vt-d: Check if domain->pgd was allocated There is a couple of places where on domain_init() failure domain_exit() is called. While currently domain_init() can fail only if alloc_pgtable_page() has failed. Make domain_exit() check if domain->pgd present, before calling domain_unmap(), as it theoretically should crash on clearing pte entries in dma_pte_clear_level(). Cc: David Woodhouse Cc: Joerg Roedel Cc: Lu Baolu Cc: iommu@lists.linux-foundation.org Signed-off-by: Dmitry Safonov Reviewed-by: Lu Baolu Signed-off-by: Joerg Roedel commit effa467870c7612012885df4e246bdb8ffd8e44c Author: Dmitry Safonov Date: Tue Jul 16 22:38:05 2019 +0100 iommu/vt-d: Don't queue_iova() if there is no flush queue Intel VT-d driver was reworked to use common deferred flushing implementation. Previously there was one global per-cpu flush queue, afterwards - one per domain. Before deferring a flush, the queue should be allocated and initialized. Currently only domains with IOMMU_DOMAIN_DMA type initialize their flush queue. It's probably worth to init it for static or unmanaged domains too, but it may be arguable - I'm leaving it to iommu folks. Prevent queuing an iova flush if the domain doesn't have a queue. The defensive check seems to be worth to keep even if queue would be initialized for all kinds of domains. And is easy backportable. On 4.19.43 stable kernel it has a user-visible effect: previously for devices in si domain there were crashes, on sata devices: BUG: spinlock bad magic on CPU#6, swapper/0/1 lock: 0xffff88844f582008, .magic: 00000000, .owner: /-1, .owner_cpu: 0 CPU: 6 PID: 1 Comm: swapper/0 Not tainted 4.19.43 #1 Call Trace: dump_stack+0x61/0x7e spin_bug+0x9d/0xa3 do_raw_spin_lock+0x22/0x8e _raw_spin_lock_irqsave+0x32/0x3a queue_iova+0x45/0x115 intel_unmap+0x107/0x113 intel_unmap_sg+0x6b/0x76 __ata_qc_complete+0x7f/0x103 ata_qc_complete+0x9b/0x26a ata_qc_complete_multiple+0xd0/0xe3 ahci_handle_port_interrupt+0x3ee/0x48a ahci_handle_port_intr+0x73/0xa9 ahci_single_level_irq_intr+0x40/0x60 __handle_irq_event_percpu+0x7f/0x19a handle_irq_event_percpu+0x32/0x72 handle_irq_event+0x38/0x56 handle_edge_irq+0x102/0x121 handle_irq+0x147/0x15c do_IRQ+0x66/0xf2 common_interrupt+0xf/0xf RIP: 0010:__do_softirq+0x8c/0x2df The same for usb devices that use ehci-pci: BUG: spinlock bad magic on CPU#0, swapper/0/1 lock: 0xffff88844f402008, .magic: 00000000, .owner: /-1, .owner_cpu: 0 CPU: 0 PID: 1 Comm: swapper/0 Not tainted 4.19.43 #4 Call Trace: dump_stack+0x61/0x7e spin_bug+0x9d/0xa3 do_raw_spin_lock+0x22/0x8e _raw_spin_lock_irqsave+0x32/0x3a queue_iova+0x77/0x145 intel_unmap+0x107/0x113 intel_unmap_page+0xe/0x10 usb_hcd_unmap_urb_setup_for_dma+0x53/0x9d usb_hcd_unmap_urb_for_dma+0x17/0x100 unmap_urb_for_dma+0x22/0x24 __usb_hcd_giveback_urb+0x51/0xc3 usb_giveback_urb_bh+0x97/0xde tasklet_action_common.isra.4+0x5f/0xa1 tasklet_action+0x2d/0x30 __do_softirq+0x138/0x2df irq_exit+0x7d/0x8b smp_apic_timer_interrupt+0x10f/0x151 apic_timer_interrupt+0xf/0x20 RIP: 0010:_raw_spin_unlock_irqrestore+0x17/0x39 Cc: David Woodhouse Cc: Joerg Roedel Cc: Lu Baolu Cc: iommu@lists.linux-foundation.org Cc: # 4.14+ Fixes: 13cf01744608 ("iommu/vt-d: Make use of iova deferred flushing") Signed-off-by: Dmitry Safonov Reviewed-by: Lu Baolu Signed-off-by: Joerg Roedel commit 5d6fb560729a5d5554e23db8d00eb57cd0021083 Author: Arnd Bergmann Date: Fri Jul 12 11:13:30 2019 +0200 dmaengine: ste_dma40: fix unneeded variable warning clang-9 points out that there are two variables that depending on the configuration may only be used in an ARRAY_SIZE() expression but not referenced: drivers/dma/ste_dma40.c:145:12: error: variable 'd40_backup_regs' is not needed and will not be emitted [-Werror,-Wunneeded-internal-declaration] static u32 d40_backup_regs[] = { ^ drivers/dma/ste_dma40.c:214:12: error: variable 'd40_backup_regs_chan' is not needed and will not be emitted [-Werror,-Wunneeded-internal-declaration] static u32 d40_backup_regs_chan[] = { Mark these __maybe_unused to shut up the warning. Signed-off-by: Arnd Bergmann Reviewed-by: Nathan Chancellor Reviewed-by: Linus Walleij Link: https://lore.kernel.org/r/20190712091357.744515-1-arnd@arndb.de Signed-off-by: Vinod Koul commit 6f4722b1d1ebf274deb0459a36fad57a7d7fab31 Author: Arnd Bergmann Date: Mon Jul 22 14:44:45 2019 +0200 dmaengine: dw-edma: fix endianess confusion When building with 'make C=1', sparse reports an endianess bug: drivers/dma/dw-edma/dw-edma-v0-debugfs.c:60:30: warning: cast removes address space of expression drivers/dma/dw-edma/dw-edma-v0-debugfs.c:86:24: warning: incorrect type in argument 1 (different address spaces) drivers/dma/dw-edma/dw-edma-v0-debugfs.c:86:24: expected void const volatile [noderef] *addr drivers/dma/dw-edma/dw-edma-v0-debugfs.c:86:24: got void *[assigned] ptr drivers/dma/dw-edma/dw-edma-v0-debugfs.c:86:24: warning: incorrect type in argument 1 (different address spaces) drivers/dma/dw-edma/dw-edma-v0-debugfs.c:86:24: expected void const volatile [noderef] *addr drivers/dma/dw-edma/dw-edma-v0-debugfs.c:86:24: got void *[assigned] ptr drivers/dma/dw-edma/dw-edma-v0-debugfs.c:86:24: warning: incorrect type in argument 1 (different address spaces) drivers/dma/dw-edma/dw-edma-v0-debugfs.c:86:24: expected void const volatile [noderef] *addr drivers/dma/dw-edma/dw-edma-v0-debugfs.c:86:24: got void *[assigned] ptr The current code is clearly wrong, as it passes an endian-swapped word into a register function where it gets swapped again. Just pass the variables directly into lower_32_bits()/upper_32_bits(). Fixes: 7e4b8a4fbe2c ("dmaengine: Add Synopsys eDMA IP version 0 support") Link: https://lore.kernel.org/lkml/20190617131820.2470686-1-arnd@arndb.de/ Signed-off-by: Arnd Bergmann Acked-by: Gustavo Pimentel Link: https://lore.kernel.org/r/20190722124457.1093886-3-arnd@arndb.de Signed-off-by: Vinod Koul commit 756c3ef93492af382c541e039c1417b96a3d335e Author: Arnd Bergmann Date: Mon Jul 22 14:44:44 2019 +0200 dmaengine: dw-edma: fix __iomem type confusion The new driver mixes up dma_addr_t and __iomem pointers, which results in warnings on some 32-bit architectures, like: drivers/dma/dw-edma/dw-edma-v0-core.c: In function '__dw_regs': drivers/dma/dw-edma/dw-edma-v0-core.c:28:9: error: cast to pointer from integer of different size [-Werror=int-to-pointer-cast] return (struct dw_edma_v0_regs __iomem *)dw->rg_region.vaddr; Make it use __iomem pointers consistently here, and avoid using dma_addr_t for __iomem tokens altogether. A small complication here is the debugfs code, which passes an __iomem token as the private data for debugfs files, requiring the use of extra __force. Fixes: 7e4b8a4fbe2c ("dmaengine: Add Synopsys eDMA IP version 0 support") Link: https://lore.kernel.org/lkml/20190617131918.2518727-1-arnd@arndb.de/ Signed-off-by: Arnd Bergmann Link: https://lore.kernel.org/r/20190722124457.1093886-2-arnd@arndb.de Signed-off-by: Vinod Koul commit f0414087a1b9933adac40974c3ea50261227b5f0 Author: Arnd Bergmann Date: Mon Jul 22 14:44:43 2019 +0200 dmaengine: dw-edma: fix unnecessary stack usage Putting large constant data on the stack causes unnecessary overhead and stack usage: drivers/dma/dw-edma/dw-edma-v0-debugfs.c:285:6: error: stack frame size of 1376 bytes in function 'dw_edma_v0_debugfs_on' [-Werror,-Wframe-larger-than=] Mark the variable 'static const' in order for the compiler to move it into the .rodata section where it does no such harm. Fixes: 305aebeff879 ("dmaengine: Add Synopsys eDMA IP version 0 debugfs support") Signed-off-by: Arnd Bergmann Acked-by: Gustavo Pimentel Link: https://lore.kernel.org/r/20190722124457.1093886-1-arnd@arndb.de Signed-off-by: Vinod Koul commit 40ca0ce56d4bb889dc43b455c55398468115569a Author: James Morse Date: Mon Jul 22 16:11:48 2019 +0100 arm64: entry: SP Alignment Fault doesn't write to FAR_EL1 Comparing the arm-arm's pseudocode for AArch64.PCAlignmentFault() with AArch64.SPAlignmentFault() shows that SP faults don't copy the faulty-SP to FAR_EL1, but this is where we read from, and the address we provide to user-space with the BUS_ADRALN signal. For user-space this value will be UNKNOWN due to the previous ERET to user-space. If the last value is preserved, on systems with KASLR or KPTI this will be the user-space link-register left in FAR_EL1 by tramp_exit(). Fix this to retrieve the original sp_el0 value, and pass this to do_sp_pc_fault(). SP alignment faults from EL1 will cause us to take the fault again when trying to store the pt_regs. This eventually takes us to the overflow stack. Remove the ESR_ELx_EC_SP_ALIGN check as we will never make it this far. Fixes: 60ffc30d5652 ("arm64: Exception handling") Signed-off-by: James Morse [will: change label name and fleshed out comment] Signed-off-by: Will Deacon commit cfe61801b0f11eb561f1adf452d995efaafbc68b Author: Michael S. Tsirkin Date: Thu Jul 18 08:19:24 2019 -0400 balloon: fix up comments Lots of comments bitrotted. Fix them up. Fixes: 418a3ab1e778 (mm/balloon_compaction: List interfaces) Reviewed-by: Wei Wang Signed-off-by: Michael S. Tsirkin Reviewed-by: Ralph Campbell Acked-by: Nadav Amit commit dd422906799f240bfd400a5d376aa43f7b89c38a Author: Wei Wang Date: Thu Jul 18 17:27:20 2019 +0800 mm/balloon_compaction: avoid duplicate page removal A #GP is reported in the guest when requesting balloon inflation via virtio-balloon. The reason is that the virtio-balloon driver has removed the page from its internal page list (via balloon_page_pop), but balloon_page_enqueue_one also calls "list_del" to do the removal. This is necessary when it's used from balloon_page_enqueue_list, but not from balloon_page_enqueue. Move list_del to balloon_page_enqueue, and update comments accordingly. Fixes: 418a3ab1e778 (mm/balloon_compaction: List interfaces) Signed-off-by: Wei Wang Signed-off-by: Michael S. Tsirkin commit 557529494d79f3f1fadd486dd18d2de0b19be4da Author: Lu Baolu Date: Tue Jul 9 13:22:45 2019 +0800 iommu/vt-d: Avoid duplicated pci dma alias consideration As we have abandoned the home-made lazy domain allocation and delegated the DMA domain life cycle up to the default domain mechanism defined in the generic iommu layer, we needn't consider pci alias anymore when mapping/unmapping the context entries. Without this fix, we see kernel NULL pointer dereference during pci device hot-plug test. Cc: Ashok Raj Cc: Jacob Pan Cc: Kevin Tian Fixes: fa954e6831789 ("iommu/vt-d: Delegate the dma domain to upper layer") Signed-off-by: Lu Baolu Reported-and-tested-by: Xu Pengfei Signed-off-by: Joerg Roedel commit cbdf8a189a66001c36007bf0f5c975d0376c5c3a Author: Marc Zyngier Date: Mon Jul 22 14:53:09 2019 +0100 arm64: Force SSBS on context switch On a CPU that doesn't support SSBS, PSTATE[12] is RES0. In a system where only some of the CPUs implement SSBS, we end-up losing track of the SSBS bit across task migration. To address this issue, let's force the SSBS bit on context switch. Fixes: 8f04e8e6e29c ("arm64: ssbd: Add support for PSTATE.SSBS rather than trapping to EL3") Signed-off-by: Marc Zyngier [will: inverted logic and added comments] Signed-off-by: Will Deacon commit 301e7ee1dec513e5aca12d01c819a1f762918d0a Author: Joerg Roedel Date: Mon Jul 22 16:21:05 2019 +0200 Revert "iommu/vt-d: Consolidate domain_init() to avoid duplication" This reverts commit 123b2ffc376e1b3e9e015c75175b61e88a8b8518. This commit reportedly caused boot failures on some systems and needs to be reverted for now. Signed-off-by: Joerg Roedel commit c8eee4135a456bc031d67cadc454e76880d1afd8 Author: Ilya Leoshkevich Date: Fri Jul 19 11:06:11 2019 +0200 selftests/bpf: fix sendmsg6_prog on s390 "sendmsg6: rewrite IP & port (C)" fails on s390, because the code in sendmsg_v6_prog() assumes that (ctx->user_ip6[0] & 0xFFFF) refers to leading IPv6 address digits, which is not the case on big-endian machines. Since checking bitwise operations doesn't seem to be the point of the test, replace two short comparisons with a single int comparison. Signed-off-by: Ilya Leoshkevich Acked-by: Andrey Ignatov Signed-off-by: Daniel Borkmann commit 5d9e06d60eee95e021ffccf0d2c7ed800ae9dc14 Author: Wei Yongjun Date: Mon Jul 22 22:12:36 2019 +0800 bcache: fix possible memory leak in bch_cached_dev_run() memory malloced in bch_cached_dev_run() and should be freed before leaving from the error handling cases, otherwise it will cause memory leak. Fixes: 0b13efecf5f2 ("bcache: add return value check to bch_cached_dev_run()") Signed-off-by: Wei Yongjun Signed-off-by: Coly Li Signed-off-by: Jens Axboe commit 4be6e05c4d4c2ff87750d3242f69999245d119f8 Author: Arnaldo Carvalho de Melo Date: Fri Jul 19 11:34:07 2019 -0300 libbpf: Avoid designated initializers for unnamed union members As it fails to build in some systems with: libbpf.c: In function 'perf_buffer__new': libbpf.c:4515: error: unknown field 'sample_period' specified in initializer libbpf.c:4516: error: unknown field 'wakeup_events' specified in initializer Doing as: attr.sample_period = 1; I.e. not as a designated initializer makes it build everywhere. Cc: Andrii Nakryiko Cc: Adrian Hunter Cc: Daniel Borkmann Cc: Jiri Olsa Cc: Namhyung Kim Fixes: fb84b8224655 ("libbpf: add perf buffer API") Link: https://lkml.kernel.org/n/tip-hnlmch8qit1ieksfppmr32si@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo Acked-by: Andrii Nakryiko Signed-off-by: Daniel Borkmann commit cdb2f9207109c9c858277fde8b7dc1445b9f952e Author: Arnaldo Carvalho de Melo Date: Fri Jul 19 11:34:06 2019 -0300 libbpf: Fix endianness macro usage for some compilers Using endian.h and its endianness macros makes this code build in a wider range of compilers, as some don't have those macros (__BYTE_ORDER__, __ORDER_LITTLE_ENDIAN__, __ORDER_BIG_ENDIAN__), so use instead endian.h's macros (__BYTE_ORDER, __LITTLE_ENDIAN, __BIG_ENDIAN) which makes this code even shorter :-) Acked-by: Andrii Nakryiko Cc: Adrian Hunter Cc: Alexei Starovoitov Cc: Daniel Borkmann Cc: Jiri Olsa Cc: Namhyung Kim Fixes: 12ef5634a855 ("libbpf: simplify endianness check") Fixes: e6c64855fd7a ("libbpf: add btf__parse_elf API to load .BTF and .BTF.ext") Link: https://lkml.kernel.org/n/tip-eep5n8vgwcdphw3uc058k03u@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo Signed-off-by: Daniel Borkmann commit 57ebc6230f060fd467fd5fd4552de5ebc40cb48c Merge: 1d4126c4e119 d4d34185e710 Author: Daniel Borkmann Date: Mon Jul 22 16:04:17 2019 +0200 Merge branch 'bpf-sockmap-tls-fixes' Jakub Kicinski says: ==================== John says: Resolve a series of splats discovered by syzbot and an unhash TLS issue noted by Eric Dumazet. The main issues revolved around interaction between TLS and sockmap tear down. TLS and sockmap could both reset sk->prot ops creating a condition where a close or unhash op could be called forever. A rare race condition resulting from a missing rcu sync operation was causing a use after free. Then on the TLS side dropping the sock lock and re-acquiring it during the close op could hang. Finally, sockmap must be deployed before tls for current stack assumptions to be met. This is enforced now. A feature series can enable it. To fix this first refactor TLS code so the lock is held for the entire teardown operation. Then add an unhash callback to ensure TLS can not transition from ESTABLISHED to LISTEN state. This transition is a similar bug to the one found and fixed previously in sockmap. Then apply three fixes to sockmap to fix up races on tear down around map free and close. Finally, if sockmap is destroyed before TLS we add a new ULP op update to inform the TLS stack it should not call sockmap ops. This last one appears to be the most commonly found issue from syzbot. v4: - fix some use after frees; - disable disconnect work for offload (ctx lifetime is much more complex); - remove some of the dead code which made it hard to understand (for me) that things work correctly (e.g. the checks TLS is the top ULP); - add selftets. ==================== Signed-off-by: Daniel Borkmann commit d4d34185e710750ad748a0f0a73e8cdac7480bfc Author: Jakub Kicinski Date: Fri Jul 19 10:29:27 2019 -0700 selftests/tls: add shutdown tests Add test for killing the connection via shutdown. Signed-off-by: Jakub Kicinski Reviewed-by: Dirk van der Merwe Signed-off-by: Daniel Borkmann commit 8051bb7f2cbf68ec1289753616703791dd004b5c Author: Jakub Kicinski Date: Fri Jul 19 10:29:26 2019 -0700 selftests/tls: close the socket with open record Add test which sends some data with MSG_MORE and then closes the socket (never calling send without MSG_MORE). This should make sure we clean up open records correctly. Signed-off-by: Jakub Kicinski Reviewed-by: Dirk van der Merwe Signed-off-by: Daniel Borkmann commit 65d41fb317c62b7c8663a134e88eaee439f270d6 Author: Jakub Kicinski Date: Fri Jul 19 10:29:25 2019 -0700 selftests/tls: add a bidirectional test Add a simple test which installs the TLS state for both directions, sends and receives data on both sockets. Signed-off-by: Jakub Kicinski Reviewed-by: Dirk van der Merwe Signed-off-by: Daniel Borkmann commit 78b5dc3d68dcb1d18d805e8f4e565f19ed6d976a Author: Jakub Kicinski Date: Fri Jul 19 10:29:24 2019 -0700 selftests/tls: test error codes around TLS ULP installation Test the error codes returned when TCP connection is not in ESTABLISHED state. Signed-off-by: Jakub Kicinski Reviewed-by: Dirk van der Merwe Signed-off-by: Daniel Borkmann commit cf32526c8842781e32d6652a1e01e83b20490948 Author: Jakub Kicinski Date: Fri Jul 19 10:29:23 2019 -0700 selftests/tls: add a test for ULP but no keys Make sure we test the TLS_BASE/TLS_BASE case both with data and the tear down/clean up path. Signed-off-by: Jakub Kicinski Reviewed-by: Dirk van der Merwe Signed-off-by: Daniel Borkmann commit 95fa145479fbc0a0c1fd3274ceb42ec03c042a4a Author: John Fastabend Date: Fri Jul 19 10:29:22 2019 -0700 bpf: sockmap/tls, close can race with map free When a map free is called and in parallel a socket is closed we have two paths that can potentially reset the socket prot ops, the bpf close() path and the map free path. This creates a problem with which prot ops should be used from the socket closed side. If the map_free side completes first then we want to call the original lowest level ops. However, if the tls path runs first we want to call the sockmap ops. Additionally there was no locking around prot updates in TLS code paths so the prot ops could be changed multiple times once from TLS path and again from sockmap side potentially leaving ops pointed at either TLS or sockmap when psock and/or tls context have already been destroyed. To fix this race first only update ops inside callback lock so that TLS, sockmap and lowest level all agree on prot state. Second and a ULP callback update() so that lower layers can inform the upper layer when they are being removed allowing the upper layer to reset prot ops. This gets us close to allowing sockmap and tls to be stacked in arbitrary order but will save that patch for *next trees. v4: - make sure we don't free things for device; - remove the checks which swap the callbacks back only if TLS is at the top. Reported-by: syzbot+06537213db7ba2745c4a@syzkaller.appspotmail.com Fixes: 02c558b2d5d6 ("bpf: sockmap, support for msg_peek in sk_msg with redirect ingress") Signed-off-by: John Fastabend Signed-off-by: Jakub Kicinski Reviewed-by: Dirk van der Merwe Signed-off-by: Daniel Borkmann commit 0e858739c2d2eedeeac1d35bfa0ec3cc2a7190d8 Author: John Fastabend Date: Fri Jul 19 10:29:21 2019 -0700 bpf: sockmap, only create entry if ulp is not already enabled Sockmap does not currently support adding sockets after TLS has been enabled. There never was a real use case for this so it was never added. But, we lost the test for ULP at some point so add it here and fail the socket insert if TLS is enabled. Future work could make sockmap support this use case but fixup the bug here. Fixes: 604326b41a6fb ("bpf, sockmap: convert to generic sk_msg interface") Signed-off-by: John Fastabend Signed-off-by: Daniel Borkmann commit 2bb90e5cc90e1d09f631aeab041a9cf913a5bbe5 Author: John Fastabend Date: Fri Jul 19 10:29:20 2019 -0700 bpf: sockmap, synchronize_rcu before free'ing map We need to have a synchronize_rcu before free'ing the sockmap because any outstanding psock references will have a pointer to the map and when they use this could trigger a use after free. Fixes: 604326b41a6fb ("bpf, sockmap: convert to generic sk_msg interface") Signed-off-by: John Fastabend Signed-off-by: Daniel Borkmann commit 45a4521dcbd92e71c9e53031b40e34211d3b4feb Author: John Fastabend Date: Fri Jul 19 10:29:19 2019 -0700 bpf: sockmap, sock_map_delete needs to use xchg __sock_map_delete() may be called from a tcp event such as unhash or close from the following trace, tcp_bpf_close() tcp_bpf_remove() sk_psock_unlink() sock_map_delete_from_link() __sock_map_delete() In this case the sock lock is held but this only protects against duplicate removals on the TCP side. If the map is free'd then we have this trace, sock_map_free xchg() <- replaces map entry sock_map_unref() sk_psock_put() sock_map_del_link() The __sock_map_delete() call however uses a read, test, null over the map entry which can result in both paths trying to free the map entry. To fix use xchg in TCP paths as well so we avoid having two references to the same map entry. Fixes: 604326b41a6fb ("bpf, sockmap: convert to generic sk_msg interface") Signed-off-by: John Fastabend Signed-off-by: Daniel Borkmann commit 32857cf57f920cdc03b5095f08febec94cf9c36b Author: John Fastabend Date: Fri Jul 19 10:29:18 2019 -0700 net/tls: fix transition through disconnect with close It is possible (via shutdown()) for TCP socks to go through TCP_CLOSE state via tcp_disconnect() without actually calling tcp_close which would then call the tls close callback. Because of this a user could disconnect a socket then put it in a LISTEN state which would break our assumptions about sockets always being ESTABLISHED state. More directly because close() can call unhash() and unhash is implemented by sockmap if a sockmap socket has TLS enabled we can incorrectly destroy the psock from unhash() and then call its close handler again. But because the psock (sockmap socket representation) is already destroyed we call close handler in sk->prot. However, in some cases (TLS BASE/BASE case) this will still point at the sockmap close handler resulting in a circular call and crash reported by syzbot. To fix both above issues implement the unhash() routine for TLS. v4: - add note about tls offload still needing the fix; - move sk_proto to the cold cache line; - split TX context free into "release" and "free", otherwise the GC work itself is in already freed memory; - more TX before RX for consistency; - reuse tls_ctx_free(); - schedule the GC work after we're done with context to avoid UAF; - don't set the unhash in all modes, all modes "inherit" TLS_BASE's callbacks anyway; - disable the unhash hook for TLS_HW. Fixes: 3c4d7559159bf ("tls: kernel TLS support") Reported-by: Eric Dumazet Signed-off-by: John Fastabend Signed-off-by: Jakub Kicinski Signed-off-by: Daniel Borkmann commit 313ab004805cf52a42673b15852b3842474ccd87 Author: John Fastabend Date: Fri Jul 19 10:29:17 2019 -0700 net/tls: remove sock unlock/lock around strp_done() The tls close() callback currently drops the sock lock to call strp_done(). Split up the RX cleanup into stopping the strparser and releasing most resources, syncing strparser and finally freeing the context. To avoid the need for a strp_done() call on the cleanup path of device offload make sure we don't arm the strparser until we are sure init will be successful. Signed-off-by: John Fastabend Signed-off-by: Jakub Kicinski Reviewed-by: Dirk van der Merwe Signed-off-by: Daniel Borkmann commit f87e62d45e51b12d48d2cb46b5cde8f83b866bc4 Author: John Fastabend Date: Fri Jul 19 10:29:16 2019 -0700 net/tls: remove close callback sock unlock/lock around TX work flush The tls close() callback currently drops the sock lock, makes a cancel_delayed_work_sync() call, and then relocks the sock. By restructuring the code we can avoid droping lock and then reclaiming it. To simplify this we do the following, tls_sk_proto_close set_bit(CLOSING) set_bit(SCHEDULE) cancel_delay_work_sync() <- cancel workqueue lock_sock(sk) ... release_sock(sk) strp_done() Setting the CLOSING bit prevents the SCHEDULE bit from being cleared by any workqueue items e.g. if one happens to be scheduled and run between when we set SCHEDULE bit and cancel work. Then because SCHEDULE bit is set now no new work will be scheduled. Tested with net selftests and bpf selftests. Signed-off-by: John Fastabend Signed-off-by: Jakub Kicinski Reviewed-by: Dirk van der Merwe Signed-off-by: Daniel Borkmann commit ac78fc148d8249dbf382c2127456dd08ec5b161c Author: Jakub Kicinski Date: Fri Jul 19 10:29:15 2019 -0700 net/tls: don't call tls_sk_proto_close for hw record offload The deprecated TOE offload doesn't actually do anything in tls_sk_proto_close() - all TLS code is skipped and context not freed. Remove the callback to make it easier to refactor tls_sk_proto_close(). Signed-off-by: Jakub Kicinski Reviewed-by: Dirk van der Merwe Signed-off-by: Daniel Borkmann commit 318892ac068397f40ff81d9155898da01493b1d2 Author: Jakub Kicinski Date: Fri Jul 19 10:29:14 2019 -0700 net/tls: don't arm strparser immediately in tls_set_sw_offload() In tls_set_device_offload_rx() we prepare the software context for RX fallback and proceed to add the connection to the device. Unfortunately, software context prep includes arming strparser so in case of a later error we have to release the socket lock to call strp_done(). In preparation for not releasing the socket lock half way through callbacks move arming strparser into a separate function. Following patches will make use of that. Signed-off-by: Jakub Kicinski Reviewed-by: Dirk van der Merwe Signed-off-by: Daniel Borkmann commit b191d6491be67cef2b3fa83015561caca1394ab9 Author: Suren Baghdasaryan Date: Wed Jul 17 13:21:00 2019 -0400 pidfd: fix a poll race when setting exit_state There is a race between reading task->exit_state in pidfd_poll and writing it after do_notify_parent calls do_notify_pidfd. Expected sequence of events is: CPU 0 CPU 1 ------------------------------------------------ exit_notify do_notify_parent do_notify_pidfd tsk->exit_state = EXIT_DEAD pidfd_poll if (tsk->exit_state) However nothing prevents the following sequence: CPU 0 CPU 1 ------------------------------------------------ exit_notify do_notify_parent do_notify_pidfd pidfd_poll if (tsk->exit_state) tsk->exit_state = EXIT_DEAD This causes a polling task to wait forever, since poll blocks because exit_state is 0 and the waiting task is not notified again. A stress test continuously doing pidfd poll and process exits uncovered this bug. To fix it, we make sure that the task's exit_state is always set before calling do_notify_pidfd. Fixes: b53b0b9d9a6 ("pidfd: add polling support") Cc: kernel-team@android.com Cc: Oleg Nesterov Signed-off-by: Suren Baghdasaryan Signed-off-by: Joel Fernandes (Google) Link: https://lore.kernel.org/r/20190717172100.261204-1-joel@joelfernandes.org [christian@brauner.io: adapt commit message and drop unneeded changes from wait_task_zombie] Signed-off-by: Christian Brauner commit 4574b0b9abc83a3522b2e91c43b9f0c479855d3a Author: Jean-Philippe Brucker Date: Mon Jul 22 14:44:40 2019 +0100 MAINTAINERS: Update my email address Update MAINTAINERS and .mailmap with my @linaro.org address, since I don't have access to my @arm.com address anymore. Signed-off-by: Jean-Philippe Brucker Signed-off-by: Will Deacon commit cfb7156672dd4de51bcdbc89cfc67c653300f260 Merge: 5f9e832c1370 7aaddd96d5fe Author: Sean Paul Date: Mon Jul 22 09:56:14 2019 -0400 Merge drm-misc-next-fixes-2019-07-18 into drm-misc-fixes Picking up 7aaddd96d5f ("drm/modes: Don't apply cmdline's rotation if it wasn't specified") from drm-misc-next-fixes. It missed the merge window. Signed-off-by: Sean Paul commit 223ecaf140b1dd1c1d2a1a1d96281efc5c906984 Author: Michael Wu Date: Mon Jul 8 13:23:08 2019 +0800 gpiolib: fix incorrect IRQ requesting of an active-low lineevent When a pin is active-low, logical trigger edge should be inverted to match the same interrupt opportunity. For example, a button pushed triggers falling edge in ACTIVE_HIGH case; in ACTIVE_LOW case, the button pushed triggers rising edge. For user space the IRQ requesting doesn't need to do any modification except to configuring GPIOHANDLE_REQUEST_ACTIVE_LOW. For example, we want to catch the event when the button is pushed. The button on the original board drives level to be low when it is pushed, and drives level to be high when it is released. In user space we can do: req.handleflags = GPIOHANDLE_REQUEST_INPUT; req.eventflags = GPIOEVENT_REQUEST_FALLING_EDGE; while (1) { read(fd, &dat, sizeof(dat)); if (dat.id == GPIOEVENT_EVENT_FALLING_EDGE) printf("button pushed\n"); } Run the same logic on another board which the polarity of the button is inverted; it drives level to be high when pushed, and level to be low when released. For this inversion we add flag GPIOHANDLE_REQUEST_ACTIVE_LOW: req.handleflags = GPIOHANDLE_REQUEST_INPUT | GPIOHANDLE_REQUEST_ACTIVE_LOW; req.eventflags = GPIOEVENT_REQUEST_FALLING_EDGE; At the result, there are no any events caught when the button is pushed. By the way, button releasing will emit a "falling" event. The timing of "falling" catching is not expected. Cc: stable@vger.kernel.org Signed-off-by: Michael Wu Tested-by: Bartosz Golaszewski Signed-off-by: Bartosz Golaszewski commit 3a6ffb3c8c3274a39dc8f2514526e645c5d21753 Author: Andreas Koop Date: Mon Jul 22 12:03:06 2019 +0800 mmc: mmc_spi: Enable stable writes While using the mmc_spi driver occasionally errors like this popped up: mmcblk0: error -84 transferring data end_request: I/O error, dev mmcblk0, sector 581756 I looked on the Internet for occurrences of the same problem and came across a helpful post [1]. It includes source code to reproduce the bug. There is also an analysis about the cause. During transmission data in the supplied buffer is being modified. Thus the previously calculated checksum is not correct anymore. After some digging I found out that device drivers are supposed to report they need stable writes. To fix this I set the appropriate flag at queue initialization if CRC checksumming is enabled for that SPI host. [1] https://groups.google.com/forum/#!msg/sim1/gLlzWeXGFr8/KevXinUXfc8J Signed-off-by: Andreas Koop [shihpo: Rebase on top of v5.3-rc1] Signed-off-by: ShihPo Hung Cc: Paul Walmsley CC: stable@vger.kernel.org Signed-off-by: Ulf Hansson commit 3a855b7ac7d5021674aa3e1cc9d3bfd6b604e9c0 Author: Vaibhav Jain Date: Sat Jun 29 21:36:10 2019 +0530 powerpc/papr_scm: Force a scm-unbind if initial scm-bind fails In some cases initial bind of scm memory for an lpar can fail if previously it wasn't released using a scm-unbind hcall. This situation can arise due to panic of the previous kernel or forced lpar fadump. In such cases the H_SCM_BIND_MEM return a H_OVERLAP error. To mitigate such cases the patch updates papr_scm_probe() to force a call to drc_pmem_unbind() in case the initial bind of scm memory fails with EBUSY error. In case scm-bind operation again fails after the forced scm-unbind then we follow the existing error path. We also update drc_pmem_bind() to handle the H_OVERLAP error returned by phyp and indicate it as a EBUSY error back to the caller. Suggested-by: "Oliver O'Halloran" Signed-off-by: Vaibhav Jain Reviewed-by: Oliver O'Halloran Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20190629160610.23402-4-vaibhav@linux.ibm.com commit 0d7fc080ba139a2a639d3732616403ccddfa2d36 Author: Vaibhav Jain Date: Sat Jun 29 21:36:09 2019 +0530 powerpc/papr_scm: Update drc_pmem_unbind() to use H_SCM_UNBIND_ALL The new hcall named H_SCM_UNBIND_ALL has been introduce that can unbind all or specific scm memory assigned to an lpar. This is more efficient than using H_SCM_UNBIND_MEM as currently we don't support partial unbind of scm memory. Hence this patch proposes following changes to drc_pmem_unbind(): * Update drc_pmem_unbind() to replace hcall H_SCM_UNBIND_MEM to H_SCM_UNBIND_ALL. * Update drc_pmem_unbind() to handles cases when PHYP asks the guest kernel to wait for specific amount of time before retrying the hcall via the 'LONG_BUSY' return value. * Ensure appropriate error code is returned back from the function in case of an error. Reviewed-by: Oliver O'Halloran Signed-off-by: Vaibhav Jain Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20190629160610.23402-3-vaibhav@linux.ibm.com commit 6d140e7569db89a1b596c1c2d1c2293d5c594432 Author: Vaibhav Jain Date: Sat Jun 29 21:36:08 2019 +0530 powerpc/pseries: Update SCM hcall op-codes in hvcall.h Update the hvcalls.h to include op-codes for new hcalls introduce to manage SCM memory. Also update existing hcall definitions to reflect current papr specification for SCM. The removed hcall op-codes H_SCM_MEM_QUERY, H_SCM_BLOCK_CLEAR were transient proposals and there support was never implemented by Power-VM nor they were used anywhere in Linux kernel. Hence we don't expect anyone to be impacted by this change. Signed-off-by: Vaibhav Jain Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20190629160610.23402-2-vaibhav@linux.ibm.com commit 8d419adb0511c8f0a2324fefb27752051eacc995 Author: Julien Thierry Date: Wed Jul 17 11:32:15 2019 +0100 MAINTAINERS: Update my email address My @arm.com address will stop working in a couple of weeks. Update MAINTAINERS and .mailmap files with an address I'll have access to. Signed-off-by: Julien Thierry Signed-off-by: Will Deacon commit 01233d47836d96264f3d66eda4514739b0ce7d9d Author: Suzuki K Poulose Date: Wed Jul 17 13:33:30 2019 +0100 MAINTAINERS: Fix spelling mistake in my name Fix a typo in my name for the KVM-ARM reviewers entry. Acked-by: Marc Zyngier Signed-off-by: Suzuki K Poulose Signed-off-by: Will Deacon commit 0aafd138b322d0b1bec3f14cdef4be3374d9fc39 Author: Marc Zyngier Date: Tue Jul 16 18:43:08 2019 +0100 MAINTAINERS: Update my email address to @kernel.org I will soon lose access to my @arm.com email address, so let's update the MAINTAINERS file to point to my @kernel.org address, as well as .mailmap for good measure. Note that my @arm.com address will still work, but someone else will be reading whatever is sent there. Don't say you didn't know! Signed-off-by: Marc Zyngier Signed-off-by: Will Deacon commit 665e985c2f41bebc3e6cee7e04c36a44afbc58f7 Author: Joe Perches Date: Tue Jul 9 22:04:19 2019 -0700 mmc: meson-mx-sdio: Fix misuse of GENMASK macro Arguments are supposed to be ordered high then low. Signed-off-by: Joe Perches Reviewed-by: Neil Armstrong Fixes: ed80a13bb4c4 ("mmc: meson-mx-sdio: Add a driver for the Amlogic Meson8 and Meson8b SoCs") Cc: stable@vger.kernel.org Signed-off-by: Ulf Hansson commit ba2d139b02ba684c6c101de42fed782d6cd2b997 Author: Douglas Anderson Date: Mon Jul 8 12:56:13 2019 -0700 mmc: dw_mmc: Fix occasional hang after tuning on eMMC In commit 46d179525a1f ("mmc: dw_mmc: Wait for data transfer after response errors.") we fixed a tuning-induced hang that I saw when stress testing tuning on certain SD cards. I won't re-hash that whole commit, but the summary is that as a normal part of tuning you need to deal with transfer errors and there were cases where these transfer errors was putting my system into a bad state causing all future transfers to fail. That commit fixed handling of the transfer errors for me. In downstream Chrome OS my fix landed and had the same behavior for all SD/MMC commands. However, it looks like when the commit landed upstream we limited it to only SD tuning commands. Presumably this was to try to get around problems that Alim Akhtar reported on exynos [1]. Unfortunately while stress testing reboots (and suspend/resume) on some rk3288-based Chromebooks I found the same problem on the eMMC on some of my Chromebooks (the ones with Hynix eMMC). Since the eMMC tuning command is different (MMC_SEND_TUNING_BLOCK_HS200 vs. MMC_SEND_TUNING_BLOCK) we were basically getting back into the same situation. I'm hoping that whatever problems exynos was having in the past are somehow magically fixed now and we can make the behavior the same for all commands. [1] https://lkml.kernel.org/r/CAGOxZ53WfNbaMe0_AM0qBqU47kAfgmPBVZC8K8Y-_J3mDMqW4A@mail.gmail.com Fixes: 46d179525a1f ("mmc: dw_mmc: Wait for data transfer after response errors.") Signed-off-by: Douglas Anderson Cc: Marek Szyprowski Cc: Alim Akhtar Cc: Enric Balletbo i Serra Cc: stable@vger.kernel.org Signed-off-by: Ulf Hansson commit fc62113b32c95906b3ea8ba42e91014c7d0c6fa6 Author: Baolin Wang Date: Mon Jul 15 18:00:14 2019 +0800 mmc: host: sdhci-sprd: Fix the missing pm_runtime_put_noidle() When the SD host controller tries to probe again due to the derferred probe mechanism, it will always keep the SD host device as runtime resume state due to missing the runtime put operation in error path last time. Thus add the pm_runtime_put_noidle() in error path to make the PM runtime counter balance, which can make the SD host device's PM runtime work well. Signed-off-by: Baolin Wang Acked-by: Adrian Hunter Fixes: fb8bd90f83c4 ("mmc: sdhci-sprd: Add Spreadtrum's initial host controller") Cc: stable@vger.kernel.org Signed-off-by: Ulf Hansson commit 85697853beb2533ff4b387b4c26154c78425a0ff Merge: c8917b8ff09e 717261e1769d Author: Greg Kroah-Hartman Date: Mon Jul 22 14:08:06 2019 +0200 Merge tag 'misc-habanalabs-fixes-2019-07-22' of git://people.freedesktop.org/~gabbayo/linux into char-misc-linux Oded writes: This tag contains the following fixes: - Fix to VRHOT event handling from the ASIC. No need to reset the ASIC, just notify it in dmesg. - Fix printk specifier for printing dma address * tag 'misc-habanalabs-fixes-2019-07-22' of git://people.freedesktop.org/~gabbayo/linux: habanalabs: don't reset device when getting VRHOT habanalabs: use %pad for printing a dma_addr_t commit 1274204542f683e1d8491ebe9cc86284d5a8ebcc Author: Lubomir Rintel Date: Fri Jul 19 14:27:13 2019 +0200 spi: pxa2xx: Balance runtime PM enable/disable on error Don't undo the PM initialization if we error out before we managed to initialize it. The call to pm_runtime_disable() without being preceded by pm_runtime_enable() would disturb the balance of the Force. In practice, this happens if we fail to allocate any of the GPIOS ("cs", "ready") due to -EPROBE_DEFER because we're getting probled before the GPIO driver. Signed-off-by: Lubomir Rintel Link: https://lore.kernel.org/r/20190719122713.3444318-1-lkundrak@v3.sk Signed-off-by: Mark Brown commit 62ec3d13601bd626ca7a0edef6d45dbb753d94e8 Author: Masahiro Yamada Date: Sun Jul 21 23:23:08 2019 +0900 ASoC: SOF: use __u32 instead of uint32_t in uapi headers When CONFIG_UAPI_HEADER_TEST=y, exported headers are compile-tested to make sure they can be included from user-space. Currently, header.h and fw.h are excluded from the test coverage. To make them join the compile-test, we need to fix the build errors attached below. For a case like this, we decided to use __u{8,16,32,64} variable types in this discussion: https://lkml.org/lkml/2019/6/5/18 Build log: CC usr/include/sound/sof/header.h.s CC usr/include/sound/sof/fw.h.s In file included from :32:0: ./usr/include/sound/sof/header.h:19:2: error: unknown type name ‘uint32_t’ uint32_t magic; /**< 'S', 'O', 'F', '\0' */ ^~~~~~~~ ./usr/include/sound/sof/header.h:20:2: error: unknown type name ‘uint32_t’ uint32_t type; /**< component specific type */ ^~~~~~~~ ./usr/include/sound/sof/header.h:21:2: error: unknown type name ‘uint32_t’ uint32_t size; /**< size in bytes of data excl. this struct */ ^~~~~~~~ ./usr/include/sound/sof/header.h:22:2: error: unknown type name ‘uint32_t’ uint32_t abi; /**< SOF ABI version */ ^~~~~~~~ ./usr/include/sound/sof/header.h:23:2: error: unknown type name ‘uint32_t’ uint32_t reserved[4]; /**< reserved for future use */ ^~~~~~~~ ./usr/include/sound/sof/header.h:24:2: error: unknown type name ‘uint32_t’ uint32_t data[0]; /**< Component data - opaque to core */ ^~~~~~~~ In file included from :32:0: ./usr/include/sound/sof/fw.h:49:2: error: unknown type name ‘uint32_t’ uint32_t size; /* bytes minus this header */ ^~~~~~~~ ./usr/include/sound/sof/fw.h:50:2: error: unknown type name ‘uint32_t’ uint32_t offset; /* offset from base */ ^~~~~~~~ ./usr/include/sound/sof/fw.h:64:2: error: unknown type name ‘uint32_t’ uint32_t size; /* bytes minus this header */ ^~~~~~~~ ./usr/include/sound/sof/fw.h:65:2: error: unknown type name ‘uint32_t’ uint32_t num_blocks; /* number of blocks */ ^~~~~~~~ ./usr/include/sound/sof/fw.h:73:2: error: unknown type name ‘uint32_t’ uint32_t file_size; /* size of file minus this header */ ^~~~~~~~ ./usr/include/sound/sof/fw.h:74:2: error: unknown type name ‘uint32_t’ uint32_t num_modules; /* number of modules */ ^~~~~~~~ ./usr/include/sound/sof/fw.h:75:2: error: unknown type name ‘uint32_t’ uint32_t abi; /* version of header format */ ^~~~~~~~ Signed-off-by: Masahiro Yamada Link: https://lore.kernel.org/r/20190721142308.30306-1-yamada.masahiro@socionext.com Signed-off-by: Mark Brown commit f86621cd6c6f54edfdd62da347b2bbb8d7fddc8d Author: Enric Balletbo i Serra Date: Fri Jul 19 19:39:29 2019 +0200 SoC: rockchip: rockchip_max98090: Enable MICBIAS for headset keypress detection The TS3A227E says that the headset keypress detection needs the MICBIAS power in order to report the key events to ensure proper operation The headset keypress detection needs the MICBIAS power in order to report the key events all the time as long as MIC is present. So MICBIAS pin is forced on when a MICROPHONE is detected. On Veyron Minnie I observed that if the MICBIAS power is not present and the key press detection is activated (just because it is enabled when you insert a headset), it randomly reports a keypress on insert. E.g. (KEY_PLAYPAUSE) Event: (SW_HEADPHONE_INSERT), value 1 Event: (SW_MICROPHONE_INSERT), value 1 Event: -------------- SYN_REPORT ------------ Event: (KEY_PLAYPAUSE), value 1 Userspace thinks that KEY_PLAYPAUSE is pressed and produces the annoying effect that the media player starts a play/pause loop. Note that, although most of the time the key reported is the one associated with BTN_0, not always this is true. On my tests I also saw different keys reported Signed-off-by: Enric Balletbo i Serra Link: https://lore.kernel.org/r/20190719173929.24065-1-enric.balletbo@collabora.com Signed-off-by: Mark Brown commit 48dfd37a0f85400610153101c72222bf01523699 Author: Shengjiu Wang Date: Tue Jul 16 17:45:47 2019 +0800 ASoC: cs42xx8: Fix MFREQ selection issue for async mode When sample rate of TX is different with sample rate of RX in async mode, the MFreq selection will be wrong. For example, sysclk = 24.576MHz, TX rate = 96000Hz, RX rate = 48000Hz. Then ratio of TX = 256, ratio of RX = 512, For MFreq is shared by TX and RX instance, the correct value of MFreq is 2 for both TX and RX. But original method will cause MFreq = 0 for TX, MFreq = 2 for RX. If TX is started after RX, RX will be impacted, RX work abnormal with MFreq = 0. This patch is to select proper MFreq value according to TX rate and RX rate. Fixes: 0c516b4ff85c ("ASoC: cs42xx8: Add codec driver support for CS42448/CS42888") Signed-off-by: Shengjiu Wang Link: https://lore.kernel.org/r/20190716094547.46787-1-shengjiu.wang@nxp.com Signed-off-by: Mark Brown commit 8dd26dff00c0636b1d8621acaeef3f6f3a39dd77 Author: Charles Keepax Date: Thu Jul 18 09:43:33 2019 +0100 ASoC: dapm: Fix handling of custom_stop_condition on DAPM graph walks DPCM uses snd_soc_dapm_dai_get_connected_widgets to build a list of the widgets connected to a specific front end DAI so it can search through this list for available back end DAIs. The custom_stop_condition was added to is_connected_ep to facilitate this list not containing more widgets than is necessary. Doing so both speeds up the DPCM handling as less widgets need to be searched and avoids issues with CODEC to CODEC links as these would be confused with back end DAIs if they appeared in the list of available widgets. custom_stop_condition was implemented by aborting the graph walk when the condition is triggered, however there is an issue with this approach. Whilst walking the graph is_connected_ep should update the endpoints cache on each widget, if the walk is aborted the number of attached end points is unknown for that sub-graph. When the stop condition triggered, the original patch ignored the triggering widget and returned zero connected end points; a later patch updated this to set the triggering widget's cache to 1 and return that. Both of these approaches result in inaccurate values being stored in various end point caches as the values propagate back through the graph, which can result in later issues with widgets powering/not powering unexpectedly. As the original goal was to reduce the size of the widget list passed to the DPCM code, the simplest solution is to limit the functionality of the custom_stop_condition to the widget list. This means the rest of the graph will still be processed resulting in correct end point caches, but only widgets up to the stop condition will be added to the returned widget list. Fixes: 6742064aef7f ("ASoC: dapm: support user-defined stop condition in dai_get_connected_widgets") Fixes: 5fdd022c2026 ("ASoC: dpcm: play nice with CODEC<->CODEC links") Fixes: 09464974eaa8 ("ASoC: dapm: Fix to return correct path list in is_connected_ep.") Signed-off-by: Charles Keepax Link: https://lore.kernel.org/r/20190718084333.15598-1-ckeepax@opensource.cirrus.com Signed-off-by: Mark Brown commit c6bf2ae931adbd3e10967e12142856439a211813 Author: Jan Kiszka Date: Sun Jul 21 16:01:36 2019 +0200 KVM: nVMX: Set cached_vmcs12 and cached_shadow_vmcs12 NULL after free Shall help finding use-after-free bugs earlier. Suggested-by: Liran Alon Signed-off-by: Jan Kiszka Signed-off-by: Paolo Bonzini commit d9a710e5fc4941944d565b013414e9fdc66242b5 Author: Wanpeng Li Date: Mon Jul 22 12:26:21 2019 +0800 KVM: X86: Dynamically allocate user_fpu After reverting commit 240c35a3783a (kvm: x86: Use task structs fpu field for user), struct kvm_vcpu is 19456 bytes on my server, PAGE_ALLOC_COSTLY_ORDER(3) is the order at which allocations are deemed costly to service. In serveless scenario, one host can service hundreds/thoudands firecracker/kata-container instances, howerver, new instance will fail to launch after memory is too fragmented to allocate kvm_vcpu struct on host, this was observed in some cloud provider product environments. This patch dynamically allocates user_fpu, kvm_vcpu is 15168 bytes now on my Skylake server. Cc: Paolo Bonzini Cc: Radim Krčmář Signed-off-by: Wanpeng Li Signed-off-by: Paolo Bonzini commit e751732486eb3f159089a64d1901992b1357e7cc Author: Wanpeng Li Date: Mon Jul 22 12:26:20 2019 +0800 KVM: X86: Fix fpu state crash in kvm guest The idea before commit 240c35a37 (which has just been reverted) was that we have the following FPU states: userspace (QEMU) guest --------------------------------------------------------------------------- processor vcpu->arch.guest_fpu >>> KVM_RUN: kvm_load_guest_fpu vcpu->arch.user_fpu processor >>> preempt out vcpu->arch.user_fpu current->thread.fpu >>> preempt in vcpu->arch.user_fpu processor >>> back to userspace >>> kvm_put_guest_fpu processor vcpu->arch.guest_fpu --------------------------------------------------------------------------- With the new lazy model we want to get the state back to the processor when schedule in from current->thread.fpu. Reported-by: Thomas Lambertz Reported-by: anthony Tested-by: anthony Cc: Paolo Bonzini Cc: Radim Krčmář Cc: Thomas Lambertz Cc: anthony Cc: stable@vger.kernel.org Fixes: 5f409e20b (x86/fpu: Defer FPU state load until return to userspace) Signed-off-by: Wanpeng Li [Add a comment in front of the warning. - Paolo] Signed-off-by: Paolo Bonzini commit ec269475cba7bcdd1eb8fdf8e87f4c6c81a376fe Author: Paolo Bonzini Date: Mon Jul 22 13:31:27 2019 +0200 Revert "kvm: x86: Use task structs fpu field for user" This reverts commit 240c35a3783ab9b3a0afaba0dde7291295680a6b ("kvm: x86: Use task structs fpu field for user", 2018-11-06). The commit is broken and causes QEMU's FPU state to be destroyed when KVM_RUN is preempted. Fixes: 240c35a3783a ("kvm: x86: Use task structs fpu field for user") Cc: stable@vger.kernel.org Signed-off-by: Paolo Bonzini commit cf64527bb33f6cec2ed50f89182fc4688d0056b6 Author: Jan Kiszka Date: Sun Jul 21 13:52:18 2019 +0200 KVM: nVMX: Clear pending KVM_REQ_GET_VMCS12_PAGES when leaving nested Letting this pend may cause nested_get_vmcs12_pages to run against an invalid state, corrupting the effective vmcs of L1. This was triggerable in QEMU after a guest corruption in L2, followed by a L1 reset. Signed-off-by: Jan Kiszka Reviewed-by: Liran Alon Cc: stable@vger.kernel.org Fixes: 7f7f1ba33cf2 ("KVM: x86: do not load vmcs12 pages while still in SMM") Signed-off-by: Paolo Bonzini commit 5a9060e9437be47f92f85a2b5c7cd73314d080e8 Author: Anshuman Khandual Date: Tue Jul 2 11:02:55 2019 +0530 arm64: mm: Drop pte_huge() This helper is required from generic huge_pte_alloc() which is available when arch subscribes ARCH_WANT_GENERAL_HUGETLB. arm64 implements it's own huge_pte_alloc() and does not depend on the generic definition. Drop this helper which is redundant on arm64. Cc: Mark Rutland Cc: Steve Capper Acked-by: Catalin Marinas Signed-off-by: Anshuman Khandual Signed-off-by: Will Deacon commit ed2f3e9ff637c7c9f65b98468a084393683ff93b Author: Dave Martin Date: Wed Jun 12 17:00:34 2019 +0100 arm64/sve: Fix a couple of magic numbers for the Z-reg count There are some hand-written instances of "32" to express the number of SVE Z-registers. Since this code was written a #define was added for this, so convert trivial instances of this magic number as appropriate. No functional change. Reviewed-by: Julien Grall Acked-by: Catalin Marinas Signed-off-by: Dave Martin Signed-off-by: Will Deacon commit d16af870a70e0e399126c6419f92e7badf5e465b Author: Dave Martin Date: Wed Jun 12 17:00:33 2019 +0100 arm64/sve: Factor out FPSIMD to SVE state conversion Currently we convert from FPSIMD to SVE register state in memory in two places. To ease future maintenance, let's consolidate this in one place. Reviewed-by: Julien Grall Acked-by: Catalin Marinas Signed-off-by: Dave Martin Signed-off-by: Will Deacon commit 592700f094be229b5c9cc1192d5cea46eb4c7afc Author: Mark Rutland Date: Tue Jul 2 14:07:29 2019 +0100 arm64: stacktrace: Better handle corrupted stacks The arm64 stacktrace code is careful to only dereference frame records in valid stack ranges, ensuring that a corrupted frame record won't result in a faulting access. However, it's still possible for corrupt frame records to result in infinite loops in the stacktrace code, which is also undesirable. This patch ensures that we complete a stacktrace in finite time, by keeping track of which stacks we have already completed unwinding, and verifying that if the next frame record is on the same stack, it is at a higher address. As this has turned out to be particularly subtle, comments are added to explain the procedure. Signed-off-by: Mark Rutland Reviewed-by: James Morse Tested-by: James Morse Acked-by: Dave Martin Acked-by: Catalin Marinas Cc: Tengfei Fan Signed-off-by: Will Deacon commit f3dcbe67ed424f1cf92065f9ad0cc647f2b44eac Author: Dave Martin Date: Tue Jul 2 14:07:28 2019 +0100 arm64: stacktrace: Factor out backtrace initialisation Some common code is required by each stacktrace user to initialise struct stackframe before the first call to unwind_frame(). In preparation for adding to the common code, this patch factors it out into a separate function start_backtrace(), and modifies the stacktrace callers appropriately. No functional change. Signed-off-by: Dave Martin [Mark: drop tsk argument, update more callsites] Signed-off-by: Mark Rutland Reviewed-by: James Morse Acked-by: Catalin Marinas Signed-off-by: Will Deacon commit 8caa6e2be72313c170f2b30e8475323526dd7ed1 Author: Dave Martin Date: Tue Jul 2 14:07:27 2019 +0100 arm64: stacktrace: Constify stacktrace.h functions on_accessible_stack() and on_task_stack() shouldn't (and don't) modify their task argument, so it can be const. This patch adds the appropriate modifiers. Whitespace violations in the parameter lists are fixed at the same time. No functional change. Acked-by: Catalin Marinas Signed-off-by: Dave Martin [Mark: fixup const location, whitespace] Signed-off-by: Mark Rutland Signed-off-by: Will Deacon commit a88754b23114cfb61efed56ed448c05e4cb7e20d Author: Vincenzo Frascino Date: Fri Jul 19 11:10:18 2019 +0100 arm64: vdso: Cleanup Makefiles The recent changes to the vdso library for arm64 and the introduction of the compat vdso library have generated some misalignment in the Makefiles. Cleanup the Makefiles for vdso and vdso32 libraries: * Removing unused rules. * Unifying the displayed compilation messages. * Simplifying the generic library inclusion path for arm64 vdso. Cc: Catalin Marinas Cc: Will Deacon Signed-off-by: Vincenzo Frascino Signed-off-by: Will Deacon commit 2e2f3c9b864d9f21fb82aa8da5ac9adc1e020f60 Author: Naohiro Aota Date: Fri Jul 12 19:15:56 2019 +0900 arm64: vdso: fix flip/flop vdso build bug Running "make" on an already compiled kernel tree will rebuild the kernel even without any modifications: $ make ARCH=arm64 CROSS_COMPILE=/usr/bin/aarch64-unknown-linux-gnu- arch/arm64/Makefile:58: CROSS_COMPILE_COMPAT not defined or empty, the compat vDSO will not be built CALL scripts/checksyscalls.sh CALL scripts/atomic/check-atomics.sh VDSOCHK arch/arm64/kernel/vdso/vdso.so.dbg VDSOSYM include/generated/vdso-offsets.h CHK include/generated/compile.h CC arch/arm64/kernel/signal.o CC arch/arm64/kernel/vdso.o CC arch/arm64/kernel/signal32.o LD arch/arm64/kernel/vdso/vdso.so.dbg OBJCOPY arch/arm64/kernel/vdso/vdso.so AS arch/arm64/kernel/vdso/vdso.o AR arch/arm64/kernel/vdso/built-in.a AR arch/arm64/kernel/built-in.a GEN .version CHK include/generated/compile.h UPD include/generated/compile.h CC init/version.o AR init/built-in.a LD vmlinux.o This is the same bug fixed in commit 92a4728608a8 ("x86/boot: Fix if_changed build flip/flop bug"). We cannot use two "if_changed" in one target. Fix this build bug by merging two commands into one function. Fixes: a7f71a2c8903 ("arm64: compat: Add vDSO") Fixes: 28b1a824a4f4 ("arm64: vdso: Substitute gettimeofday() with C implementation") Reviewed-by: Masahiro Yamada Reviewed-by: Vincenzo Frascino Tested-by: Vincenzo Frascino Co-developed-by: Vincenzo Frascino Signed-off-by: Vincenzo Frascino Signed-off-by: Naohiro Aota [will: merged in compat fix from Vincenzo and made rule names consistent] Signed-off-by: Will Deacon commit 85751e9e5b1480fc675106aeaf94fadb8028469b Author: Vincenzo Frascino Date: Wed Jul 10 15:01:19 2019 +0100 arm64: vdso: Fix population of AT_SYSINFO_EHDR for compat vdso Prior to the introduction of Unified vDSO support and compat layer for vDSO on arm64, AT_SYSINFO_EHDR was not defined for compat tasks. In the current implementation, AT_SYSINFO_EHDR is defined even if the compat vdso layer is not built, which has been shown to break Android applications using bionic: | 01-01 01:22:14.097 755 755 F libc : Fatal signal 11 (SIGSEGV), | code 1 (SEGV_MAPERR), fault addr 0x3cf2c96c in tid 755 (cameraserver), | pid 755 (cameraserver) | 01-01 01:22:14.112 759 759 F libc : Fatal signal 11 (SIGSEGV), | code 1 (SEGV_MAPERR), fault addr 0x3cf2c96c in tid 759 | (android.hardwar), pid 759 (android.hardwar) | 01-01 01:22:14.120 756 756 F libc : Fatal signal 11 (SIGSEGV) | code 1 (SEGV_MAPERR), fault addr 0x3cf2c96c in tid 756 (drmserver), | pid 756 (drmserver) Restore the old behaviour by making sure that AT_SYSINFO_EHDR for compat tasks is defined only when CONFIG_COMPAT_VDSO is enabled. Reported-by: John Stultz Tested-by: John Stultz Signed-off-by: Vincenzo Frascino Signed-off-by: Will Deacon commit f76cb066edd1eef84edc85e5dd93c8aee71992da Author: Zhang Rui Date: Fri Jul 19 23:25:14 2019 +0800 powercap: Invoke powercap_init() and rapl_init() earlier The MMIO RAPL interface driver depends on both powercap subsystem and the intel_rapl_common code. But when all of them are built-in, the MMIO RAPL interface driver can be loaded before the other two and this breaks the system during boot. Fix this by adjusting the init order of the powercap subsystem and the intel_rapl_common code, so that it can be initialized first. Fixes: 555c45fe0d04 ("int340X/processor_thermal_device: add support for MMIO RAPL") Reported-by: Kenneth R. Crudup Tested-by: Kenneth R. Crudup Signed-off-by: Zhang Rui [ rjw: Subject & changelog ] Signed-off-by: Rafael J. Wysocki commit f9adc23ee91e6f561bb70c6147d8d45bd164d62f Author: Vasily Averin Date: Tue Jul 16 09:22:03 2019 +0300 futex: Cleanup generic SMP variant of arch_futex_atomic_op_inuser() The generic SMP variant of arch_futex_atomic_op_inuser() returns always -ENOSYS so the switch case and surrounding code are pointless. Remove it and just return -ENOSYS. Signed-off-by: Vasily Averin Signed-off-by: Thomas Gleixner Acked-by: Arnd Bergmann Link: https://lkml.kernel.org/r/12bdaca8-99eb-e576-f842-5970ab1d6a92@virtuozzo.com commit 385065734cd417b9d7739b2ebb62c960aeb3ccb5 Author: Cao jin Date: Fri Jul 19 16:16:35 2019 +0800 x86/irq/64: Update stale comment Commit e6401c130931 ("x86/irq/64: Split the IRQ stack into its own pages") missed to update one piece of comment as it did to its peer in Xen, which will confuse people who still need to read comment. Signed-off-by: Cao jin Signed-off-by: Thomas Gleixner Link: https://lkml.kernel.org/r/20190719081635.26528-1-caoj.fnst@cn.fujitsu.com commit d02f1aa39189e0619c3525d5cd03254e61bf606a Author: Hans de Goede Date: Sun Jul 21 17:24:18 2019 +0200 x86/sysfb_efi: Add quirks for some devices with swapped width and height Some Lenovo 2-in-1s with a detachable keyboard have a portrait screen but advertise a landscape resolution and pitch, resulting in a messed up display if the kernel tries to show anything on the efifb (because of the wrong pitch). Fix this by adding a new DMI match table for devices which need to have their width and height swapped. At first it was tried to use the existing table for overriding some of the efifb parameters, but some of the affected devices have variants with different LCD resolutions which will not work with hardcoded override values. Reference: https://bugzilla.redhat.com/show_bug.cgi?id=1730783 Signed-off-by: Hans de Goede Signed-off-by: Thomas Gleixner Cc: stable@vger.kernel.org Link: https://lkml.kernel.org/r/20190721152418.11644-1-hdegoede@redhat.com commit 2af7c85714d8cafadf925d55441458eae312cd6b Author: Eiichi Tsukata Date: Mon Jul 22 17:32:16 2019 +0900 x86/stacktrace: Prevent access_ok() warnings in arch_stack_walk_user() When arch_stack_walk_user() is called from atomic contexts, access_ok() can trigger the following warning if compiled with CONFIG_DEBUG_ATOMIC_SLEEP=y. Reproducer: // CONFIG_DEBUG_ATOMIC_SLEEP=y # cd /sys/kernel/debug/tracing # echo 1 > options/userstacktrace # echo 1 > events/irq/irq_handler_entry/enable WARNING: CPU: 0 PID: 2649 at arch/x86/kernel/stacktrace.c:103 arch_stack_walk_user+0x6e/0xf6 CPU: 0 PID: 2649 Comm: bash Not tainted 5.3.0-rc1+ #99 RIP: 0010:arch_stack_walk_user+0x6e/0xf6 Call Trace: stack_trace_save_user+0x10a/0x16d trace_buffer_unlock_commit_regs+0x185/0x240 trace_event_buffer_commit+0xec/0x330 trace_event_raw_event_irq_handler_entry+0x159/0x1e0 __handle_irq_event_percpu+0x22d/0x440 handle_irq_event_percpu+0x70/0x100 handle_irq_event+0x5a/0x8b handle_edge_irq+0x12f/0x3f0 handle_irq+0x34/0x40 do_IRQ+0xa6/0x1f0 common_interrupt+0xf/0xf Fix it by calling __range_not_ok() directly instead of access_ok() as copy_from_user_nmi() does. This is fine here because the actual copy is inside a pagefault disabled region. Reported-by: Juri Lelli Signed-off-by: Eiichi Tsukata Signed-off-by: Thomas Gleixner Link: https://lkml.kernel.org/r/20190722083216.16192-2-devel@etsukata.com commit 3f8fd02b1bf1d7ba964485a56f2f4b53ae88c167 Author: Joerg Roedel Date: Fri Jul 19 20:46:52 2019 +0200 mm/vmalloc: Sync unmappings in __purge_vmap_area_lazy() On x86-32 with PTI enabled, parts of the kernel page-tables are not shared between processes. This can cause mappings in the vmalloc/ioremap area to persist in some page-tables after the region is unmapped and released. When the region is re-used the processes with the old mappings do not fault in the new mappings but still access the old ones. This causes undefined behavior, in reality often data corruption, kernel oopses and panics and even spontaneous reboots. Fix this problem by activly syncing unmaps in the vmalloc/ioremap area to all page-tables in the system before the regions can be re-used. References: https://bugzilla.suse.com/show_bug.cgi?id=1118689 Fixes: 5d72b4fba40ef ('x86, mm: support huge I/O mapping capability I/F') Signed-off-by: Joerg Roedel Signed-off-by: Thomas Gleixner Reviewed-by: Dave Hansen Link: https://lkml.kernel.org/r/20190719184652.11391-4-joro@8bytes.org commit 8e998fc24de47c55b47a887f6c95ab91acd4a720 Author: Joerg Roedel Date: Fri Jul 19 20:46:51 2019 +0200 x86/mm: Sync also unmappings in vmalloc_sync_all() With huge-page ioremap areas the unmappings also need to be synced between all page-tables. Otherwise it can cause data corruption when a region is unmapped and later re-used. Make the vmalloc_sync_one() function ready to sync unmappings and make sure vmalloc_sync_all() iterates over all page-tables even when an unmapped PMD is found. Fixes: 5d72b4fba40ef ('x86, mm: support huge I/O mapping capability I/F') Signed-off-by: Joerg Roedel Signed-off-by: Thomas Gleixner Reviewed-by: Dave Hansen Link: https://lkml.kernel.org/r/20190719184652.11391-3-joro@8bytes.org commit 51b75b5b563a2637f9d8dc5bd02a31b2ff9e5ea0 Author: Joerg Roedel Date: Fri Jul 19 20:46:50 2019 +0200 x86/mm: Check for pfn instead of page in vmalloc_sync_one() Do not require a struct page for the mapped memory location because it might not exist. This can happen when an ioremapped region is mapped with 2MB pages. Fixes: 5d72b4fba40ef ('x86, mm: support huge I/O mapping capability I/F') Signed-off-by: Joerg Roedel Signed-off-by: Thomas Gleixner Reviewed-by: Dave Hansen Link: https://lkml.kernel.org/r/20190719184652.11391-2-joro@8bytes.org commit 2ca99396333999b9b5c5b91b36cbccacfe571aaf Author: Sébastien Szymanski Date: Thu Jul 4 13:00:53 2019 +0200 ARM: dts: imx6ul: fix clock frequency property name of I2C buses A few boards set clock frequency of their I2C buses with "clock_frequency" property. The right property is "clock-frequency". Signed-off-by: Sébastien Szymanski Reviewed-by: Fabio Estevam Signed-off-by: Shawn Guo commit e4091bdd2fd957793a10449a8682c767578b0430 Author: Christophe JAILLET Date: Sun Jul 21 12:25:58 2019 +0200 ALSA: line6: Fix a typo s/Vairax/Variax/ Signed-off-by: Christophe JAILLET Signed-off-by: Takashi Iwai commit c8917b8ff09e8a4d6ef77e32ce0052f7158baa1f Author: Mauro Rossi Date: Mon Jul 22 07:55:36 2019 +0200 firmware: fix build errors in paged buffer handling code fw_{grow,map}_paged_buf() need to be defined as static inline when CONFIG_FW_LOADER_PAGED_BUF is not enabled, infact fw_free_paged_buf() is also defined as static inline when CONFIG_FW_LOADER_PAGED_BUF is not enabled. Fixes the following mutiple definition building errors for Android kernel: drivers/base/firmware_loader/fallback_efi.o: In function `fw_grow_paged_buf': fallback_efi.c:(.text+0x0): multiple definition of `fw_grow_paged_buf' drivers/base/firmware_loader/main.o:(.text+0x73b): first defined here drivers/base/firmware_loader/fallback_efi.o: In function `fw_map_paged_buf': fallback_efi.c:(.text+0xf): multiple definition of `fw_map_paged_buf' drivers/base/firmware_loader/main.o:(.text+0x74a): first defined here [ slightly corrected the patch description -- tiwai ] Fixes: 5342e7093ff2 ("firmware: Factor out the paged buffer handling code") Fixes: 82fd7a8142a1 ("firmware: Add support for loading compressed files") Signed-off-by: Mauro Rossi Signed-off-by: Takashi Iwai Link: https://lore.kernel.org/r/20190722055536.15342-1-tiwai@suse.de Signed-off-by: Greg Kroah-Hartman commit 9310a7ba6de8cce6209e3e8a3cdf733f824cdd9b Author: Zhengyuan Liu Date: Mon Jul 22 10:23:27 2019 +0800 io_uring: track io length in async_list based on bytes We are using PAGE_SIZE as the unit to determine if the total len in async_list has exceeded max_pages, it's not fair for smaller io sizes. For example, if we are doing 1k-size io streams, we will never exceed max_pages since len >>= PAGE_SHIFT always gets zero. So use original bytes to make it more accurate. Signed-off-by: Zhengyuan Liu Signed-off-by: Jens Axboe commit bd11b3a391e3df6fa958facbe4b3f9f4cca9bd49 Author: Jens Axboe Date: Sat Jul 20 08:37:31 2019 -0600 io_uring: don't use iov_iter_advance() for fixed buffers Hrvoje reports that when a large fixed buffer is registered and IO is being done to the latter pages of said buffer, the IO submission time is much worse: reading to the start of the buffer: 11238 ns reading to the end of the buffer: 1039879 ns In fact, it's worse by two orders of magnitude. The reason for that is how io_uring figures out how to setup the iov_iter. We point the iter at the first bvec, and then use iov_iter_advance() to fast-forward to the offset within that buffer we need. However, that is abysmally slow, as it entails iterating the bvecs that we setup as part of buffer registration. There's really no need to use this generic helper, as we know it's a BVEC type iterator, and we also know that each bvec is PAGE_SIZE in size, apart from possibly the first and last. Hence we can just use a shift on the offset to find the right index, and then adjust the iov_iter appropriately. After this fix, the timings are: reading to the start of the buffer: 10135 ns reading to the end of the buffer: 1377 ns Or about an 755x improvement for the tail page. Reported-by: Hrvoje Zeba Tested-by: Hrvoje Zeba Signed-off-by: Jens Axboe commit 6a43074e2f461c2c49a607f9f6f5218d53f97d1e Author: Jens Axboe Date: Tue Jul 16 13:56:42 2019 -0600 block: properly handle IOCB_NOWAIT for async O_DIRECT IO A caller is supposed to pass in REQ_NOWAIT if we can't block for any given operation, but O_DIRECT for block devices just ignore this. Hence we'll block for various resource shortages on the block layer side, like having to wait for requests. Use the new REQ_NOWAIT_INLINE to ask for this error to be returned inline, so we can handle it appropriately and return -EAGAIN to the caller. Signed-off-by: Jens Axboe commit 893a1c97205a3ece0cbb3f571a3b972080f3b4c7 Author: Jens Axboe Date: Tue Jul 16 13:55:23 2019 -0600 blk-mq: allow REQ_NOWAIT to return an error inline By default, if a caller sets REQ_NOWAIT and we need to block, we'll return -EAGAIN through the bio->bi_end_io() callback. For some use cases, this makes it hard to use. Allow a caller to ask for inline return of errors related to blocking by also setting REQ_NOWAIT_INLINE. Signed-off-by: Jens Axboe commit b617158dc096709d8600c53b6052144d12b89fab Author: Eric Dumazet Date: Fri Jul 19 11:52:33 2019 -0700 tcp: be more careful in tcp_fragment() Some applications set tiny SO_SNDBUF values and expect TCP to just work. Recent patches to address CVE-2019-11478 broke them in case of losses, since retransmits might be prevented. We should allow these flows to make progress. This patch allows the first and last skb in retransmit queue to be split even if memory limits are hit. It also adds the some room due to the fact that tcp_sendmsg() and tcp_sendpage() might overshoot sk_wmem_queued by about one full TSO skb (64KB size). Note this allowance was already present in stable backports for kernels < 4.15 Note for < 4.15 backports : tcp_rtx_queue_tail() will probably look like : static inline struct sk_buff *tcp_rtx_queue_tail(const struct sock *sk) { struct sk_buff *skb = tcp_send_head(sk); return skb ? tcp_write_queue_prev(sk, skb) : tcp_write_queue_tail(sk); } Fixes: f070ef2ac667 ("tcp: tcp_fragment() should apply sane memory limits") Signed-off-by: Eric Dumazet Reported-by: Andrew Prout Tested-by: Andrew Prout Tested-by: Jonathan Lemon Tested-by: Michal Kubecek Acked-by: Neal Cardwell Acked-by: Yuchung Cheng Acked-by: Christoph Paasch Cc: Jonathan Looney Signed-off-by: David S. Miller commit be4363bdf0ce9530f15aa0a03d1060304d116b15 Author: Haiyang Zhang Date: Fri Jul 19 17:33:51 2019 +0000 hv_netvsc: Fix extra rcu_read_unlock in netvsc_recv_callback() There is an extra rcu_read_unlock left in netvsc_recv_callback(), after a previous patch that removes RCU from this function. This patch removes the extra RCU unlock. Fixes: 345ac08990b8 ("hv_netvsc: pass netvsc_device to receive callback") Signed-off-by: Haiyang Zhang Signed-off-by: David S. Miller commit f16d80b75a096c52354c6e0a574993f3b0dfbdfe Author: Michael Neuling Date: Fri Jul 19 15:05:02 2019 +1000 powerpc/tm: Fix oops on sigreturn on systems without TM On systems like P9 powernv where we have no TM (or P8 booted with ppc_tm=off), userspace can construct a signal context which still has the MSR TS bits set. The kernel tries to restore this context which results in the following crash: Unexpected TM Bad Thing exception at c0000000000022fc (msr 0x8000000102a03031) tm_scratch=800000020280f033 Oops: Unrecoverable exception, sig: 6 [#1] LE PAGE_SIZE=64K MMU=Hash SMP NR_CPUS=2048 NUMA pSeries Modules linked in: CPU: 0 PID: 1636 Comm: sigfuz Not tainted 5.2.0-11043-g0a8ad0ffa4 #69 NIP: c0000000000022fc LR: 00007fffb2d67e48 CTR: 0000000000000000 REGS: c00000003fffbd70 TRAP: 0700 Not tainted (5.2.0-11045-g7142b497d8) MSR: 8000000102a03031 CR: 42004242 XER: 00000000 CFAR: c0000000000022e0 IRQMASK: 0 GPR00: 0000000000000072 00007fffb2b6e560 00007fffb2d87f00 0000000000000669 GPR04: 00007fffb2b6e728 0000000000000000 0000000000000000 00007fffb2b6f2a8 GPR08: 0000000000000000 0000000000000000 0000000000000000 0000000000000000 GPR12: 0000000000000000 00007fffb2b76900 0000000000000000 0000000000000000 GPR16: 00007fffb2370000 00007fffb2d84390 00007fffea3a15ac 000001000a250420 GPR20: 00007fffb2b6f260 0000000010001770 0000000000000000 0000000000000000 GPR24: 00007fffb2d843a0 00007fffea3a14a0 0000000000010000 0000000000800000 GPR28: 00007fffea3a14d8 00000000003d0f00 0000000000000000 00007fffb2b6e728 NIP [c0000000000022fc] rfi_flush_fallback+0x7c/0x80 LR [00007fffb2d67e48] 0x7fffb2d67e48 Call Trace: Instruction dump: e96a0220 e96a02a8 e96a0330 e96a03b8 394a0400 4200ffdc 7d2903a6 e92d0c00 e94d0c08 e96d0c10 e82d0c18 7db242a6 <4c000024> 7db243a6 7db142a6 f82d0c18 The problem is the signal code assumes TM is enabled when CONFIG_PPC_TRANSACTIONAL_MEM is enabled. This may not be the case as with P9 powernv or if `ppc_tm=off` is used on P8. This means any local user can crash the system. Fix the problem by returning a bad stack frame to the user if they try to set the MSR TS bits with sigreturn() on systems where TM is not supported. Found with sigfuz kernel selftest on P9. This fixes CVE-2019-13648. Fixes: 2b0a576d15e0 ("powerpc: Add new transactional memory state to the signal context") Cc: stable@vger.kernel.org # v3.9 Reported-by: Praveen Pandey Signed-off-by: Michael Neuling Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20190719050502.405-1-mikey@neuling.org commit ae00fcc51e714ce0fc72382332147ffffcf9a883 Author: Linus Walleij Date: Mon Jul 22 00:41:57 2019 +0200 ARM: Delete netx a second time Commit ceb02dcf676f ARM: delete netx machine deleted the mach-netx machine. Then eight days later it was resurrected by SPDX tag fixes. I think. Taking the liberty to fix some additional debug uart cruft. Link: https://lore.kernel.org/r/20190721224157.6597-1-linus.walleij@linaro.org Fixes: ceb02dcf676f ("ARM: delete netx machine") Acked-By: Robert Schwebel Acked-by: Sascha Hauer Signed-off-by: Linus Walleij Signed-off-by: Olof Johansson commit 223b2b5030f370f219c23c2c4678b419a72434d9 Author: Robert Karszniewicz Date: Sat Jul 20 15:16:52 2019 +0200 hwmon: (k8temp) documentation: update URL of datasheet The old URL is dead. Signed-off-by: Robert Karszniewicz Link: https://lore.kernel.org/r/7139bc7707c24bd4dd7eb323e2da90105a3de9c1.1563522498.git.avoidr@firemail.cc Signed-off-by: Guenter Roeck commit f3d43e2e45fd9d44ba52d20debd12cd4ee9c89bf Author: Björn Gerhart Date: Mon Jul 15 18:33:55 2019 +0200 hwmon: (nct6775) Fix register address and added missed tolerance for nct6106 Fixed address of third NCT6106_REG_WEIGHT_DUTY_STEP, and added missed NCT6106_REG_TOLERANCE_H. Fixes: 6c009501ff200 ("hwmon: (nct6775) Add support for NCT6102D/6106D") Signed-off-by: Bjoern Gerhart Signed-off-by: Guenter Roeck commit 211186cae14de09573b062e478eb9fe215aed8d9 Author: Lei YU Date: Thu Jul 11 10:44:48 2019 +0800 hwmon: (occ) Fix division by zero issue The code in occ_get_powr_avg() invokes div64_u64() without checking the divisor. In case the divisor is zero, kernel gets an "Division by zero in kernel" error. Check the divisor and make it return 0 if the divisor is 0. Fixes: c10e753d43eb ("hwmon (occ): Add sensor types and versions") Signed-off-by: Lei YU Reviewed-by: Eddie James Link: https://lore.kernel.org/r/1562813088-23708-1-git-send-email-mine260309@gmail.com Signed-off-by: Guenter Roeck commit 6e998ef24d603839c29a8f75a31d176142786e03 Author: Fabio Estevam Date: Tue Jun 25 12:40:00 2019 -0300 ARM: dts: imx7ulp: Fix usb-phy unit address format The following warning is seen when building with W=1: arch/arm/boot/dts/imx7ulp.dtsi:189.31-195.5: Warning (simple_bus_reg): /bus@40000000/usb-phy@0x40350000: simple-bus unit address format error, expected "40350000" Fix it as suggested by removing the extra "0x" notation. Fixes: 5b7bd456318a ("ARM: dts: imx7ulp: add imx7ulp USBOTG1 support") Signed-off-by: Fabio Estevam Signed-off-by: Shawn Guo commit 5f9e832c137075045d15cd6899ab0505cfb2ca4b Author: Linus Torvalds Date: Sun Jul 21 14:05:38 2019 -0700 Linus 5.3-rc1 commit 107e47cc80ec37cb332bd41b22b1c7779e22e018 Author: Peter Kosyh Date: Fri Jul 19 11:11:47 2019 +0300 vrf: make sure skb->data contains ip header to make routing vrf_process_v4_outbound() and vrf_process_v6_outbound() do routing using ip/ipv6 addresses, but don't make sure the header is available in skb->data[] (skb_headlen() is less then header size). Case: 1) igb driver from intel. 2) Packet size is greater then 255. 3) MPLS forwards to VRF device. So, patch adds pskb_may_pull() calls in vrf_process_v4/v6_outbound() functions. Signed-off-by: Peter Kosyh Reviewed-by: David Ahern Signed-off-by: David S. Miller commit 903e9d1bffb557220af276eda97b9d6b103ec9e0 Author: Vasily Averin Date: Thu Jul 18 07:26:46 2019 +0300 connector: remove redundant input callback from cn_dev A small cleanup: this callback is never used. Originally fixed by Stanislav Kinsburskiy for OpenVZ7 bug OVZ-6877 cc: stanislav.kinsburskiy@gmail.com Signed-off-by: Vasily Averin Signed-off-by: David S. Miller commit 93428c582604f5d548afa885e72acaa16f03cc8d Author: Frederick Lawler Date: Wed Jul 17 21:07:42 2019 -0500 qed: Prefer pcie_capability_read_word() Commit 8c0d3a02c130 ("PCI: Add accessors for PCI Express Capability") added accessors for the PCI Express Capability so that drivers didn't need to be aware of differences between v1 and v2 of the PCI Express Capability. Replace pci_read_config_word() and pci_write_config_word() calls with pcie_capability_read_word() and pcie_capability_write_word(). Signed-off-by: Frederick Lawler Acked-by: Michal Kalderon  Signed-off-by: David S. Miller commit a16f6d3a150543ddb7d78ab5ee4ca2f301ef9c6b Author: Frederick Lawler Date: Wed Jul 17 21:07:39 2019 -0500 igc: Prefer pcie_capability_read_word() Commit 8c0d3a02c130 ("PCI: Add accessors for PCI Express Capability") added accessors for the PCI Express Capability so that drivers didn't need to be aware of differences between v1 and v2 of the PCI Express Capability. Replace pci_read_config_word() and pci_write_config_word() calls with pcie_capability_read_word() and pcie_capability_write_word(). Signed-off-by: Frederick Lawler Signed-off-by: David S. Miller commit 6133b9204c0ab5bbd38799f3309d5f59f1702561 Author: Frederick Lawler Date: Wed Jul 17 21:07:36 2019 -0500 cxgb4: Prefer pcie_capability_read_word() Commit 8c0d3a02c130 ("PCI: Add accessors for PCI Express Capability") added accessors for the PCI Express Capability so that drivers didn't need to be aware of differences between v1 and v2 of the PCI Express Capability. Replace pci_read_config_word() and pci_write_config_word() calls with pcie_capability_read_word() and pcie_capability_write_word(). Signed-off-by: Frederick Lawler Reviewed-by: Bjorn Helgaas Signed-off-by: David S. Miller commit ffd342e087d5c56882c232f6a1812b5e3d89b37b Author: Benjamin Poirier Date: Thu Jul 18 10:42:18 2019 +0900 be2net: Synchronize be_update_queues with dev_watchdog As pointed out by Firo Yang, a netdev tx timeout may trigger just before an ethtool set_channels operation is started. be_tx_timeout(), which dumps some queue structures, is not written to run concurrently with be_update_queues(), which frees/allocates those queues structures. Add some synchronization between the two. Message-id: Signed-off-by: Benjamin Poirier Signed-off-by: David S. Miller commit ea811b795df24644a8eb760b493c43fba4450677 Author: Brian King Date: Mon Jul 15 16:41:50 2019 -0500 bnx2x: Prevent load reordering in tx completion processing This patch fixes an issue seen on Power systems with bnx2x which results in the skb is NULL WARN_ON in bnx2x_free_tx_pkt firing due to the skb pointer getting loaded in bnx2x_free_tx_pkt prior to the hw_cons load in bnx2x_tx_int. Adding a read memory barrier resolves the issue. Signed-off-by: Brian King Signed-off-by: David S. Miller commit 15a78ba1844a8e052c1226f930133de4cef4e7ad Author: Wenwen Wang Date: Sat Jul 20 07:22:45 2019 -0500 netfilter: ebtables: fix a memory leak bug in compat In compat_do_replace(), a temporary buffer is allocated through vmalloc() to hold entries copied from the user space. The buffer address is firstly saved to 'newinfo->entries', and later on assigned to 'entries_tmp'. Then the entries in this temporary buffer is copied to the internal kernel structure through compat_copy_entries(). If this copy process fails, compat_do_replace() should be terminated. However, the allocated temporary buffer is not freed on this path, leading to a memory leak. To fix the bug, free the buffer before returning from compat_do_replace(). Signed-off-by: Wenwen Wang Reviewed-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit 0cea0e1148fe134a4a3aaf0b1496f09241fb943a Author: Andrew Lunn Date: Sun Jul 21 18:50:08 2019 +0200 net: phy: sfp: hwmon: Fix scaling of RX power The RX power read from the SFP uses units of 0.1uW. This must be scaled to units of uW for HWMON. This requires a divide by 10, not the current 100. With this change in place, sensors(1) and ethtool -m agree: sff2-isa-0000 Adapter: ISA adapter in0: +3.23 V temp1: +33.1 C power1: 270.00 uW power2: 200.00 uW curr1: +0.01 A Laser output power : 0.2743 mW / -5.62 dBm Receiver signal average optical power : 0.2014 mW / -6.96 dBm Reported-by: chris.healy@zii.aero Signed-off-by: Andrew Lunn Fixes: 1323061a018a ("net: phy: sfp: Add HWMON support for module sensors") Signed-off-by: David S. Miller commit 503d81d428bd598430f7f9d02021634e1a8139a0 Author: Vlad Buslov Date: Sun Jul 21 17:44:12 2019 +0300 net: sched: verify that q!=NULL before setting q->flags In function int tc_new_tfilter() q pointer can be NULL when adding filter on a shared block. With recent change that resets TCQ_F_CAN_BYPASS after filter creation, following NULL pointer dereference happens in case parent block is shared: [ 212.925060] BUG: kernel NULL pointer dereference, address: 0000000000000010 [ 212.925445] #PF: supervisor write access in kernel mode [ 212.925709] #PF: error_code(0x0002) - not-present page [ 212.925965] PGD 8000000827923067 P4D 8000000827923067 PUD 827924067 PMD 0 [ 212.926302] Oops: 0002 [#1] SMP KASAN PTI [ 212.926539] CPU: 18 PID: 2617 Comm: tc Tainted: G B 5.2.0+ #512 [ 212.926938] Hardware name: Supermicro SYS-2028TP-DECR/X10DRT-P, BIOS 2.0b 03/30/2017 [ 212.927364] RIP: 0010:tc_new_tfilter+0x698/0xd40 [ 212.927633] Code: 74 0d 48 85 c0 74 08 48 89 ef e8 03 aa 62 00 48 8b 84 24 a0 00 00 00 48 8d 78 10 48 89 44 24 18 e8 4d 0c 6b ff 48 8b 44 24 18 <83> 60 10 f b 48 85 ed 0f 85 3d fe ff ff e9 4f fe ff ff e8 81 26 f8 [ 212.928607] RSP: 0018:ffff88884fd5f5d8 EFLAGS: 00010296 [ 212.928905] RAX: 0000000000000000 RBX: 0000000000000000 RCX: dffffc0000000000 [ 212.929201] RDX: 0000000000000007 RSI: 0000000000000004 RDI: 0000000000000297 [ 212.929402] RBP: ffff88886bedd600 R08: ffffffffb91d4b51 R09: fffffbfff7616e4d [ 212.929609] R10: fffffbfff7616e4c R11: ffffffffbb0b7263 R12: ffff88886bc61040 [ 212.929803] R13: ffff88884fd5f950 R14: ffffc900039c5000 R15: ffff88835e927680 [ 212.929999] FS: 00007fe7c50b6480(0000) GS:ffff88886f980000(0000) knlGS:0000000000000000 [ 212.930235] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 212.930394] CR2: 0000000000000010 CR3: 000000085bd04002 CR4: 00000000001606e0 [ 212.930588] Call Trace: [ 212.930682] ? tc_del_tfilter+0xa40/0xa40 [ 212.930811] ? __lock_acquire+0x5b5/0x2460 [ 212.930948] ? find_held_lock+0x85/0xa0 [ 212.931081] ? tc_del_tfilter+0xa40/0xa40 [ 212.931201] rtnetlink_rcv_msg+0x4ab/0x5f0 [ 212.931332] ? rtnl_dellink+0x490/0x490 [ 212.931454] ? lockdep_hardirqs_on+0x260/0x260 [ 212.931589] ? netlink_deliver_tap+0xab/0x5a0 [ 212.931717] ? match_held_lock+0x1b/0x240 [ 212.931844] netlink_rcv_skb+0xd0/0x200 [ 212.931958] ? rtnl_dellink+0x490/0x490 [ 212.932079] ? netlink_ack+0x440/0x440 [ 212.932205] ? netlink_deliver_tap+0x161/0x5a0 [ 212.932335] ? lock_downgrade+0x360/0x360 [ 212.932457] ? lock_acquire+0xe5/0x210 [ 212.932579] netlink_unicast+0x296/0x350 [ 212.932705] ? netlink_attachskb+0x390/0x390 [ 212.932834] ? _copy_from_iter_full+0xe0/0x3a0 [ 212.932976] netlink_sendmsg+0x394/0x600 [ 212.937998] ? netlink_unicast+0x350/0x350 [ 212.943033] ? move_addr_to_kernel.part.0+0x90/0x90 [ 212.948115] ? netlink_unicast+0x350/0x350 [ 212.953185] sock_sendmsg+0x96/0xa0 [ 212.958099] ___sys_sendmsg+0x482/0x520 [ 212.962881] ? match_held_lock+0x1b/0x240 [ 212.967618] ? copy_msghdr_from_user+0x250/0x250 [ 212.972337] ? lock_downgrade+0x360/0x360 [ 212.976973] ? rwlock_bug.part.0+0x60/0x60 [ 212.981548] ? __mod_node_page_state+0x1f/0xa0 [ 212.986060] ? match_held_lock+0x1b/0x240 [ 212.990567] ? find_held_lock+0x85/0xa0 [ 212.994989] ? do_user_addr_fault+0x349/0x5b0 [ 212.999387] ? lock_downgrade+0x360/0x360 [ 213.003713] ? find_held_lock+0x85/0xa0 [ 213.007972] ? __fget_light+0xa1/0xf0 [ 213.012143] ? sockfd_lookup_light+0x91/0xb0 [ 213.016165] __sys_sendmsg+0xba/0x130 [ 213.020040] ? __sys_sendmsg_sock+0xb0/0xb0 [ 213.023870] ? handle_mm_fault+0x337/0x470 [ 213.027592] ? page_fault+0x8/0x30 [ 213.031316] ? lockdep_hardirqs_off+0xbe/0x100 [ 213.034999] ? mark_held_locks+0x24/0x90 [ 213.038671] ? do_syscall_64+0x1e/0xe0 [ 213.042297] do_syscall_64+0x74/0xe0 [ 213.045828] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 213.049354] RIP: 0033:0x7fe7c527c7b8 [ 213.052792] Code: 89 02 48 c7 c0 ff ff ff ff eb bb 0f 1f 80 00 00 00 00 f3 0f 1e fa 48 8d 05 65 8f 0c 00 8b 00 85 c0 75 17 b8 2e 00 00 00 0f 05 <48> 3d 00 f 0 ff ff 77 58 c3 0f 1f 80 00 00 00 00 48 83 ec 28 89 54 [ 213.060269] RSP: 002b:00007ffc3f7908a8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 213.064144] RAX: ffffffffffffffda RBX: 000000005d34716f RCX: 00007fe7c527c7b8 [ 213.068094] RDX: 0000000000000000 RSI: 00007ffc3f790910 RDI: 0000000000000003 [ 213.072109] RBP: 0000000000000000 R08: 0000000000000001 R09: 00007fe7c5340cc0 [ 213.076113] R10: 0000000000404ec2 R11: 0000000000000246 R12: 0000000000000080 [ 213.080146] R13: 0000000000480640 R14: 0000000000000080 R15: 0000000000000000 [ 213.084147] Modules linked in: act_gact cls_flower sch_ingress nfsv3 nfs_acl nfs lockd grace fscache bridge stp llc sunrpc intel_rapl_msr intel_rapl_common [<1;69;32Msb_edac rdma_ucm rdma_cm x86_pkg_temp_thermal iw_cm intel_powerclamp ib_cm coretemp kvm_intel kvm irqbypass mlx5_ib ib_uverbs ib_core crct10dif_pclmul crc32_pc lmul crc32c_intel ghash_clmulni_intel mlx5_core intel_cstate intel_uncore iTCO_wdt igb iTCO_vendor_support mlxfw mei_me ptp ses intel_rapl_perf mei pcspkr ipmi _ssif i2c_i801 joydev enclosure pps_core lpc_ich ioatdma wmi dca ipmi_si ipmi_devintf ipmi_msghandler acpi_power_meter acpi_pad ast i2c_algo_bit drm_vram_helpe r ttm drm_kms_helper drm mpt3sas raid_class scsi_transport_sas [ 213.112326] CR2: 0000000000000010 [ 213.117429] ---[ end trace adb58eb0a4ee6283 ]--- Verify that q pointer is not NULL before setting the 'flags' field. Fixes: 3f05e6886a59 ("net_sched: unset TCQ_F_CAN_BYPASS when adding filters") Signed-off-by: Vlad Buslov Acked-by: Jiri Pirko Signed-off-by: David S. Miller commit 85d9bf979592d2a8678de3f2dd4004effb3b7f5a Author: Christophe JAILLET Date: Sun Jul 21 15:16:05 2019 +0200 chelsio: Fix a typo in a function name It is likely that 'my3216_poll()' should be 'my3126_poll()'. (1 and 2 switched in 3126. Signed-off-by: Christophe JAILLET Signed-off-by: David S. Miller commit bb1320834b8a80c6ac2697ab418d066981ea08ba Author: Navid Emamdoost Date: Sun Jul 21 01:37:31 2019 -0500 allocate_flower_entry: should check for null deref allocate_flower_entry does not check for allocation success, but tries to deref the result. I only moved the spin_lock under null check, because the caller is checking allocation's status at line 652. Signed-off-by: Navid Emamdoost Signed-off-by: David S. Miller commit 4803d0100196209137c8cff3666d354756525d58 Author: Christophe JAILLET Date: Sun Jul 21 15:08:31 2019 +0200 net: hns3: typo in the name of a constant All constant in 'enum HCLGE_MBX_OPCODE' start with HCLGE, except 'HLCGE_MBX_PUSH_VLAN_INFO' (C and L switched) s/HLC/HCL/ Signed-off-by: Christophe JAILLET Signed-off-by: David S. Miller commit 408d2bbbfd4687c435ee5d4967dbe95bc9be82ed Author: Jeremy Sowden Date: Sun Jul 21 12:31:05 2019 +0100 kbuild: add net/netfilter/nf_tables_offload.h to header-test blacklist. net/netfilter/nf_tables_offload.h includes net/netfilter/nf_tables.h which is itself on the blacklist. Reported-by: Jakub Kicinski Signed-off-by: Jeremy Sowden Acked-by: Pablo Neira Ayuso Signed-off-by: David S. Miller commit bad7f869d864b5c5139b4cc6579f927d780467b5 Author: Christophe JAILLET Date: Sun Jul 21 12:38:11 2019 +0200 tipc: Fix a typo s/tipc_toprsv_listener_data_ready/tipc_topsrv_listener_data_ready/ (r and s switched in topsrv) Signed-off-by: Christophe JAILLET Signed-off-by: David S. Miller commit 953ba0a6382025bb63da18cb358d3b893fa85a51 Merge: 1a03bb532934 d2b3fe42bc62 Author: David S. Miller Date: Sun Jul 21 11:39:05 2019 -0700 Merge tag 'mac80211-for-davem-2019-07-20' of git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211 Johannes Berg says: ==================== We have a handful of fixes: * ignore bad CW parameters if we aren't using them, instead of warning * fix operation (and then build) with the new netlink vendor command policy requirement * fix a memory leak in an error path when setting beacons ==================== Signed-off-by: David S. Miller commit c7bf0a0f3703bc145368b9ced02749bf75fc718d Merge: d6788eb7d0dc e2297f7c3ab3 Author: Linus Torvalds Date: Sun Jul 21 10:28:39 2019 -0700 Merge tag 'devicetree-fixes-for-5.3' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux Pull Devicetree fixes from Rob Herring: "Fix several warnings/errors in validation of binding schemas" * tag 'devicetree-fixes-for-5.3' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux: dt-bindings: pinctrl: stm32: Fix missing 'clocks' property in examples dt-bindings: iio: ad7124: Fix dtc warnings in example dt-bindings: iio: avia-hx711: Fix avdd-supply typo in example dt-bindings: pinctrl: aspeed: Fix AST2500 example errors dt-bindings: pinctrl: aspeed: Fix 'compatible' schema errors dt-bindings: riscv: Limit cpus schema to only check RiscV 'cpu' nodes dt-bindings: Ensure child nodes are of type 'object' commit d6788eb7d0dcac9ce4084f7b87884812ebf5d941 Merge: 91962d0f79cb 1b03bc5c1163 Author: Linus Torvalds Date: Sun Jul 21 10:09:43 2019 -0700 Merge branch 'work.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs Pull vfs documentation typo fix from Al Viro. * 'work.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: typo fix: it's d_make_root, not d_make_inode... commit 91962d0f79cb61776bfb97eb5ea912e49e809d6c Merge: 8cf66504210d 2a957ace44d4 Author: Linus Torvalds Date: Sun Jul 21 10:01:17 2019 -0700 Merge tag '5.3-smb3-fixes' of git://git.samba.org/sfrench/cifs-2.6 Pull cifs fixes from Steve French: "Two fixes for stable, one that had dependency on earlier patch in this merge window and can now go in, and a perf improvement in SMB3 open" * tag '5.3-smb3-fixes' of git://git.samba.org/sfrench/cifs-2.6: cifs: update internal module number cifs: flush before set-info if we have writeable handles smb3: optimize open to not send query file internal info cifs: copy_file_range needs to strip setuid bits and update timestamps CIFS: fix deadlock in cached root handling commit 8cf66504210d308a35cca35fe9c310b1241f9fa7 Author: Qian Cai Date: Thu Jul 11 12:17:45 2019 -0400 iommu/amd: fix a crash in iova_magazine_free_pfns The commit b3aa14f02254 ("iommu: remove the mapping_error dma_map_ops method") incorrectly changed the checking from dma_ops_alloc_iova() in map_sg() causes a crash under memory pressure as dma_ops_alloc_iova() never return DMA_MAPPING_ERROR on failure but 0, so the error handling is all wrong. kernel BUG at drivers/iommu/iova.c:801! Workqueue: kblockd blk_mq_run_work_fn RIP: 0010:iova_magazine_free_pfns+0x7d/0xc0 Call Trace: free_cpu_cached_iovas+0xbd/0x150 alloc_iova_fast+0x8c/0xba dma_ops_alloc_iova.isra.6+0x65/0xa0 map_sg+0x8c/0x2a0 scsi_dma_map+0xc6/0x160 pqi_aio_submit_io+0x1f6/0x440 [smartpqi] pqi_scsi_queue_command+0x90c/0xdd0 [smartpqi] scsi_queue_rq+0x79c/0x1200 blk_mq_dispatch_rq_list+0x4dc/0xb70 blk_mq_sched_dispatch_requests+0x249/0x310 __blk_mq_run_hw_queue+0x128/0x200 blk_mq_run_work_fn+0x27/0x30 process_one_work+0x522/0xa10 worker_thread+0x63/0x5b0 kthread+0x1d2/0x1f0 ret_from_fork+0x22/0x40 Fixes: b3aa14f02254 ("iommu: remove the mapping_error dma_map_ops method") Signed-off-by: Qian Cai Reviewed-by: Christoph Hellwig Signed-off-by: Linus Torvalds commit 618381f09cc15592bf3afe846c6a94e9bfcd9ce4 Author: Mike Rapoport Date: Tue Apr 30 17:27:50 2019 +0300 hexagon: switch to generic version of pte allocation The hexagon implementation pte_alloc_one(), pte_alloc_one_kernel(), pte_free_kernel() and pte_free() is identical to the generic except of lack of __GFP_ACCOUNT for the user PTEs allocation. Switch hexagon to use generic version of these functions. Signed-off-by: Mike Rapoport Signed-off-by: Linus Torvalds commit bec5545edef658f81cd9721dbe8fbebeb3c7534d Merge: f1a3b43cc1f5 d9c53aa440b3 Author: Linus Torvalds Date: Sun Jul 21 09:46:59 2019 -0700 Merge tag 'ntb-5.3' of git://github.com/jonmason/ntb Pull NTB updates from Jon Mason: "New feature to add support for NTB virtual MSI interrupts, the ability to test and use this feature in the NTB transport layer. Also, bug fixes for the AMD and Switchtec drivers, as well as some general patches" * tag 'ntb-5.3' of git://github.com/jonmason/ntb: (22 commits) NTB: Describe the ntb_msi_test client in the documentation. NTB: Add MSI interrupt support to ntb_transport NTB: Add ntb_msi_test support to ntb_test NTB: Introduce NTB MSI Test Client NTB: Introduce MSI library NTB: Rename ntb.c to support multiple source files in the module NTB: Introduce functions to calculate multi-port resource index NTB: Introduce helper functions to calculate logical port number PCI/switchtec: Add module parameter to request more interrupts PCI/MSI: Support allocating virtual MSI interrupts ntb_hw_switchtec: Fix setup MW with failure bug ntb_hw_switchtec: Skip unnecessary re-setup of shared memory window for crosslink case ntb_hw_switchtec: Remove redundant steps of switchtec_ntb_reinit_peer() function NTB: correct ntb_dev_ops and ntb_dev comment typos NTB: amd: Silence shift wrapping warning in amd_ntb_db_vector_mask() ntb_hw_switchtec: potential shift wrapping bug in switchtec_ntb_init_sndev() NTB: ntb_transport: Ensure qp->tx_mw_dma_addr is initaliazed NTB: ntb_hw_amd: set peer limit register NTB: ntb_perf: Clear stale values in doorbell and command SPAD register NTB: ntb_perf: Disable NTB link after clearing peer XLAT registers ... commit a7cd67e2b76edd46fbd2517078eeba369f933575 Author: Ronald Tschalär Date: Sun Jul 21 15:15:12 2019 +0300 Input: applespi - fix warnings detected by sparse This makes sure that we convert from on-wire to CPU endianness in applespi_debug_update_dimensions() and also marks as "static" as it is not needed to be visible outside of the driver. Reported-by: kbuild test robot Signed-off-by: Ronald Tschalär Signed-off-by: Dmitry Torokhov commit 69245c97560b40f88c609b078f4b51c5be81d88b Author: Helge Deller Date: Sun Jul 21 00:55:48 2019 +0200 parisc: Flush ITLB in flush_tlb_all_local() only on split TLB machines flush_tlb_all_local() flushes the ITLB and DTLB of the CPU. In case the machine does not have separate ITLBs and DTLBs, use the alternative functionality to replace the code which flushes the ITLB with nops while keeping the code which flushes the DTLB. Signed-off-by: Helge Deller commit f5e03d3a04978d2866f82cb11cc7a6b808c8ce07 Author: Sven Schnelle Date: Sun Jul 21 11:00:39 2019 +0200 parisc: add kprobe_fault_handler() Add kprobe_fault_handler() to fix compilation for PA-RISC. On PA-RISC we actually don't need that function as the recovery counter is restored after interrupt. See the PA-RISC 2.0 Architecture Manual, pg. 4-8, Figure 4-4: "Interruption Processing". Fixes: b98cca444d28 ("mm, kprobes: generalize and rename notify_page_fault() as kprobe_page_fault()") Signed-off-by: Sven Schnelle Signed-off-by: Helge Deller commit 1b03bc5c116383b8bc099e8d60978c379196a687 Author: Al Viro Date: Sat Jul 20 23:17:30 2019 -0400 typo fix: it's d_make_root, not d_make_inode... Signed-off-by: Al Viro commit e2297f7c3ab3b68dda2ac732b1767212019d3bdf Author: Rob Herring Date: Tue Jul 16 15:34:40 2019 -0600 dt-bindings: pinctrl: stm32: Fix missing 'clocks' property in examples Now that examples are validated against the DT schema, an error with required 'clocks' property missing is exposed: Documentation/devicetree/bindings/pinctrl/st,stm32-pinctrl.example.dt.yaml: \ pinctrl@40020000: gpio@0: 'clocks' is a required property Documentation/devicetree/bindings/pinctrl/st,stm32-pinctrl.example.dt.yaml: \ pinctrl@50020000: gpio@1000: 'clocks' is a required property Documentation/devicetree/bindings/pinctrl/st,stm32-pinctrl.example.dt.yaml: \ pinctrl@50020000: gpio@2000: 'clocks' is a required property Add the missing 'clocks' properties to the examples to fix the errors. Fixes: 2c9239c125f0 ("dt-bindings: pinctrl: Convert stm32 pinctrl bindings to json-schema") Cc: Linus Walleij Cc: Maxime Coquelin Cc: linux-gpio@vger.kernel.org Cc: linux-stm32@st-md-mailman.stormreply.com Acked-by: Alexandre TORGUE Signed-off-by: Rob Herring commit 20051f5fdf6770f05d677e2f03b0a2bab6b0fc64 Author: Rob Herring Date: Tue Jul 16 14:21:56 2019 -0600 dt-bindings: iio: ad7124: Fix dtc warnings in example With the conversion to DT schema, the examples are now compiled with dtc. The ad7124 binding example has the following warning: Documentation/devicetree/bindings/iio/adc/adi,ad7124.example.dts:19.11-21: \ Warning (reg_format): /example-0/adc@0:reg: property has invalid length (4 bytes) (#address-cells == 1, #size-cells == 1) There's a default #size-cells and #address-cells values of 1 for examples. For examples needing different values such as this one on a SPI bus, they need to provide a SPI bus parent node. Fixes: 26ae15e62d3c ("Convert AD7124 bindings documentation to YAML format.") Cc: Jonathan Cameron Cc: linux-iio@vger.kernel.org Signed-off-by: Rob Herring commit fbbf2b6e9b74ffa79bef5e3da91200195045379e Author: Rob Herring Date: Tue Jul 16 14:13:29 2019 -0600 dt-bindings: iio: avia-hx711: Fix avdd-supply typo in example Now that examples are validated against the DT schema, a typo in avia-hx711 example generates a warning: Documentation/devicetree/bindings/iio/adc/avia-hx711.example.dt.yaml: weight: 'avdd-supply' is a required property Fix the typo. Fixes: 5150ec3fe125 ("avia-hx711.yaml: transform DT binding to YAML") Cc: Andreas Klinger Cc: Jonathan Cameron Cc: linux-iio@vger.kernel.org Signed-off-by: Rob Herring commit fcbe7e3cf86d665bf4924eecb13a5af10bcfa372 Author: Rob Herring Date: Mon Jul 15 16:48:41 2019 -0600 dt-bindings: pinctrl: aspeed: Fix AST2500 example errors The schema examples are now validated against the schema itself. The AST2500 pinctrl schema has a couple of errors: Documentation/devicetree/bindings/pinctrl/aspeed,ast2500-pinctrl.example.dt.yaml: \ example-0: $nodename:0: 'example-0' does not match '^(bus|soc|axi|ahb|apb)(@[0-9a-f]+)?$' Documentation/devicetree/bindings/pinctrl/aspeed,ast2500-pinctrl.example.dt.yaml: \ pinctrl: aspeed,external-nodes: [[1, 2]] is too short Fixes: 0a617de16730 ("dt-bindings: pinctrl: aspeed: Convert AST2500 bindings to json-schema") Cc: Andrew Jeffery Cc: Linus Walleij Cc: Joel Stanley Cc: linux-aspeed@lists.ozlabs.org Cc: linux-gpio@vger.kernel.org Cc: linux-arm-kernel@lists.infradead.org Acked-by: Andrew Jeffery Signed-off-by: Rob Herring commit ad21a4ce040cc41b4a085417169b558e86af56b7 Author: Rob Herring Date: Mon Jul 15 16:37:25 2019 -0600 dt-bindings: pinctrl: aspeed: Fix 'compatible' schema errors The Aspeed pinctl schema have errors in the 'compatible' schema: Documentation/devicetree/bindings/pinctrl/aspeed,ast2400-pinctrl.yaml: \ properties:compatible:enum: ['aspeed', 'ast2400-pinctrl', 'aspeed', 'g4-pinctrl'] has non-unique elements Documentation/devicetree/bindings/pinctrl/aspeed,ast2500-pinctrl.yaml: \ properties:compatible:enum: ['aspeed', 'ast2500-pinctrl', 'aspeed', 'g5-pinctrl'] has non-unique elements Flow style sequences have to be quoted if the vales contain ','. Fix this by using the more common one line per entry formatting. Fixes: 0a617de16730 ("dt-bindings: pinctrl: aspeed: Convert AST2500 bindings to json-schema") Fixes: 07457937bb5c ("dt-bindings: pinctrl: aspeed: Convert AST2400 bindings to json-schema") Cc: Andrew Jeffery Cc: Linus Walleij Cc: Joel Stanley Cc: linux-aspeed@lists.ozlabs.org Cc: linux-gpio@vger.kernel.org Cc: linux-arm-kernel@lists.infradead.org Acked-by: Andrew Jeffery Signed-off-by: Rob Herring commit 7d9ef7f37d1f37981344d1a8c8578b67bdf4736a Author: Rob Herring Date: Wed Jun 26 17:57:59 2019 -0600 dt-bindings: riscv: Limit cpus schema to only check RiscV 'cpu' nodes Matching on the 'cpus' node was a bad choice because the schema is incorrectly applied to non-RiscV cpus nodes. As we now have a common cpus schema which checks the general structure, it is also redundant to do so in the Risc-V CPU schema. The downside is one could conceivably mix different architecture's cpu nodes or have typos in the compatible string. The latter problem pretty much exists for every schema. Acked-by: Paul Walmsley Signed-off-by: Rob Herring commit 15ffef1ae69e99ebb54326f0220916b1fe619b24 Author: Rob Herring Date: Wed Jul 3 14:17:06 2019 -0600 dt-bindings: Ensure child nodes are of type 'object' Properties which are child node definitions need to have an explict type. Otherwise, a matching (DT) property can silently match when an error is desired. Fix this up tree-wide. Once this is fixed, the meta-schema will enforce this on any child node definitions. Cc: Chen-Yu Tsai Cc: David Woodhouse Cc: Brian Norris Cc: Marek Vasut Cc: Richard Weinberger Cc: Vignesh Raghavendra Cc: Linus Walleij Cc: Maxime Coquelin Cc: linux-mtd@lists.infradead.org Cc: linux-gpio@vger.kernel.org Cc: linux-stm32@st-md-mailman.stormreply.com Cc: linux-spi@vger.kernel.org Acked-by: Miquel Raynal Acked-by: Maxime Ripard Acked-by: Mark Brown Acked-by: Alexandre TORGUE Signed-off-by: Rob Herring commit d2b3fe42bc629c2d4002f652b3abdfb2e72991c7 Author: Brian Norris Date: Wed Jul 17 18:57:12 2019 -0700 mac80211: don't warn about CW params when not using them ieee80211_set_wmm_default() normally sets up the initial CW min/max for each queue, except that it skips doing this if the driver doesn't support ->conf_tx. We still end up calling drv_conf_tx() in some cases (e.g., ieee80211_reconfig()), which also still won't do anything useful...except it complains here about the invalid CW parameters. Let's just skip the WARN if we weren't going to do anything useful with the parameters. Signed-off-by: Brian Norris Link: https://lore.kernel.org/r/20190718015712.197499-1-briannorris@chromium.org Signed-off-by: Johannes Berg commit bcc27fab8cc673ddc95452674373cce618ccb3a3 Author: Lorenzo Bianconi Date: Wed Jul 3 00:29:47 2019 +0200 mac80211: fix possible memory leak in ieee80211_assign_beacon Free new beacon_data in ieee80211_assign_beacon whenever ieee80211_assign_beacon fails Fixes: 8860020e0be1 ("cfg80211: restructure AP/GO mode API") Fixes: bc847970f432 ("mac80211: support FTM responder configuration/statistic") Signed-off-by: Lorenzo Bianconi Link: https://lore.kernel.org/r/770285772543c9fca33777bb4ad4760239e56256.1562105631.git.lorenzo@kernel.org Signed-off-by: Johannes Berg commit 5edaac063bbf1267260ad2a5b9bb803399343e58 Author: John Crispin Date: Thu Jun 27 11:58:32 2019 +0200 nl80211: fix NL80211_HE_MAX_CAPABILITY_LEN NL80211_HE_MAX_CAPABILITY_LEN has changed between D2.0 and D4.0. It is now MAC (6) + PHY (11) + MCS (12) + PPE (25) = 54. Signed-off-by: John Crispin Link: https://lore.kernel.org/r/20190627095832.19445-1-john@phrozen.org Signed-off-by: Johannes Berg commit 91046d6364afde646734c7ead1f649d253c386e9 Author: Johannes Berg Date: Tue Jun 25 10:04:51 2019 +0200 nl80211: fix VENDOR_CMD_RAW_DATA Since ERR_PTR() is an inline, not a macro, just open-code it here so it's usable as an initializer, fixing the build in brcmfmac. Reported-by: Arend Van Spriel Fixes: 901bb9891855 ("nl80211: require and validate vendor command policy") Signed-off-by: Johannes Berg commit 1667e4f9bcfb6785362a300ac4486df0854a72aa Author: Johannes Berg Date: Tue Jun 25 10:04:51 2019 +0200 wireless: fix nl80211 vendor commands In my previous commit to validate a policy I neglected to actually add one to the few drivers using vendor commands, fix that now. Reported-by: Tony Lindgren Tested-by: Tony Lindgren Fixes: 901bb9891855 ("nl80211: require and validate vendor command policy") Signed-off-by: Johannes Berg commit f1a3b43cc1f50c6ee5ba582f2025db3dea891208 Merge: ac60602a6d8f c39f2d9db0fd Author: Linus Torvalds Date: Sat Jul 20 12:22:30 2019 -0700 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input Pull more input updates from Dmitry Torokhov: - Apple SPI keyboard and trackpad driver for newer Macs - ALPS driver will ignore trackpoint-only devices to give the trackpoint driver a chance to handle them properly - another Lenovo is switched over to SMbus from PS/2 - assorted driver fixups. * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: Input: alps - fix a mismatch between a condition check and its comment Input: psmouse - fix build error of multiple definition Input: applespi - remove set but not used variables 'sts' Input: add Apple SPI keyboard and trackpad driver Input: alps - don't handle ALPS cs19 trackpoint-only device Input: hyperv-keyboard - remove dependencies on PAGE_SIZE for ring buffer Input: adp5589 - initialize GPIO controller parent device Input: iforce - remove empty multiline comments Input: synaptics - fix misuse of strlcpy Input: auo-pixcir-ts - switch to using devm_add_action_or_reset() Input: gtco - bounds check collection indent level Input: mtk-pmic-keys - add of_node_put() before return Input: sun4i-lradc-keys - add of_node_put() before return Input: synaptics - whitelist Lenovo T580 SMBus intertouch commit 1a03bb532934e90c7d662f7c59f4f66ea8451fa4 Author: Thomas Voegtle Date: Sat Jul 20 19:01:22 2019 +0200 r8169: fix RTL8168g PHY init This fixes a copy&paste error in the original patch. Setting the wrong register resulted in massive packet loss on some systems. Fixes: a2928d28643e ("r8169: use paged versions of phylib MDIO access functions") Tested-by: Thomas Voegtle Signed-off-by: Thomas Voegtle Signed-off-by: Heiner Kallweit Signed-off-by: David S. Miller commit ac60602a6d8f6830dee89f4b87ee005f62eb7171 Merge: c6dd78fcb8ee 449fa54d6815 Author: Linus Torvalds Date: Sat Jul 20 12:09:52 2019 -0700 Merge tag 'dma-mapping-5.3-1' of git://git.infradead.org/users/hch/dma-mapping Pull dma-mapping fixes from Christoph Hellwig: "Fix various regressions: - force unencrypted dma-coherent buffers if encryption bit can't fit into the dma coherent mask (Tom Lendacky) - avoid limiting request size if swiotlb is not used (me) - fix swiotlb handling in dma_direct_sync_sg_for_cpu/device (Fugang Duan)" * tag 'dma-mapping-5.3-1' of git://git.infradead.org/users/hch/dma-mapping: dma-direct: correct the physical addr in dma_direct_sync_sg_for_cpu/device dma-direct: only limit the mapping size if swiotlb could be used dma-mapping: add a dma_addressing_limited helper dma-direct: Force unencrypted DMA under SME for certain DMA masks commit c6dd78fcb8eefa15dd861889e0f59d301cb5230c Merge: 46f5c0cc3af0 6879298bd067 Author: Linus Torvalds Date: Sat Jul 20 11:24:49 2019 -0700 Merge branch 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 fixes from Thomas Gleixner: "A set of x86 specific fixes and updates: - The CR2 corruption fixes which store CR2 early in the entry code and hand the stored address to the fault handlers. - Revert a forgotten leftover of the dropped FSGSBASE series. - Plug a memory leak in the boot code. - Make the Hyper-V assist functionality robust by zeroing the shadow page. - Remove a useless check for dead processes with LDT - Update paravirt and VMware maintainers entries. - A few cleanup patches addressing various compiler warnings" * 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/entry/64: Prevent clobbering of saved CR2 value x86/hyper-v: Zero out the VP ASSIST PAGE on allocation x86, boot: Remove multiple copy of static function sanitize_boot_params() x86/boot/compressed/64: Remove unused variable x86/boot/efi: Remove unused variables x86/mm, tracing: Fix CR2 corruption x86/entry/64: Update comments and sanity tests for create_gap x86/entry/64: Simplify idtentry a little x86/entry/32: Simplify common_exception x86/paravirt: Make read_cr2() CALLEE_SAVE MAINTAINERS: Update PARAVIRT_OPS_INTERFACE and VMWARE_HYPERVISOR_INTERFACE x86/process: Delete useless check for dead process with LDT x86: math-emu: Hide clang warnings for 16-bit overflow x86/e820: Use proper booleans instead of 0/1 x86/apic: Silence -Wtype-limits compiler warnings x86/mm: Free sme_early_buffer after init x86/boot: Fix memory leak in default_get_smp_config() Revert "x86/ptrace: Prevent ptrace from clearing the FS/GS selector" and fix the test commit 46f5c0cc3af0ecb76224a91d2997d74e35ff7821 Merge: e6023adc5c6a e0c5c5e308ee Author: Linus Torvalds Date: Sat Jul 20 11:06:12 2019 -0700 Merge branch 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull perf tooling updates from Thomas Gleixner: "A set of perf improvements and fixes: perf db-export: - Improvements in how COMM details are exported to databases for post processing and use in the sql-viewer.py UI. - Export switch events to the database. BPF: - Bump rlimit(MEMLOCK) for 'perf test bpf' and 'perf trace', just like selftests/bpf/bpf_rlimit.h do, which makes errors due to exhaustion of this limit, which are kinda cryptic (EPERM sometimes) less frequent. perf version: - Fix segfault due to missing OPT_END(), noticed on PowerPC. perf vendor events: - Add JSON files for IBM s/390 machine type 8561. perf cs-etm (ARM): - Fix two cases of error returns not bing done properly: Invalid ERR_PTR() use and loss of propagation error codes" * 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (28 commits) perf version: Fix segfault due to missing OPT_END() perf vendor events s390: Add JSON files for machine type 8561 perf cs-etm: Return errcode in cs_etm__process_auxtrace_info() perf cs-etm: Remove errnoeous ERR_PTR() usage in cs_etm__process_auxtrace_info perf scripts python: export-to-postgresql.py: Export switch events perf scripts python: export-to-sqlite.py: Export switch events perf db-export: Export switch events perf db-export: Factor out db_export__threads() perf script: Add scripting operation process_switch() perf scripts python: exported-sql-viewer.py: Use new 'has_calls' column perf scripts python: exported-sql-viewer.py: Remove redundant semi-colons perf scripts python: export-to-postgresql.py: Add has_calls column to comms table perf scripts python: export-to-sqlite.py: Add has_calls column to comms table perf db-export: Also export thread's current comm perf db-export: Factor out db_export__comm() perf scripts python: export-to-postgresql.py: Export comm details perf scripts python: export-to-sqlite.py: Export comm details perf db-export: Export comm details perf db-export: Fix a white space issue in db_export__sample() perf db-export: Move export__comm_thread into db_export__sample() ... commit e6023adc5c6af79ac8ac5b17939f58091fa0d870 Merge: 4b01f5a4c9c4 b68b9907069a Author: Linus Torvalds Date: Sat Jul 20 10:45:15 2019 -0700 Merge branch 'core-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull core fixes from Thomas Gleixner: - A collection of objtool fixes which address recent fallout partially exposed by newer toolchains, clang, BPF and general code changes. - Force USER_DS for user stack traces [ Note: the "objtool fixes" are not all to objtool itself, but for kernel code that triggers objtool warnings. Things like missing function size annotations, or code that confuses the unwinder etc. - Linus] * 'core-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (27 commits) objtool: Support conditional retpolines objtool: Convert insn type to enum objtool: Fix seg fault on bad switch table entry objtool: Support repeated uses of the same C jump table objtool: Refactor jump table code objtool: Refactor sibling call detection logic objtool: Do frame pointer check before dead end check objtool: Change dead_end_function() to return boolean objtool: Warn on zero-length functions objtool: Refactor function alias logic objtool: Track original function across branches objtool: Add mcsafe_handle_tail() to the uaccess safe list bpf: Disable GCC -fgcse optimization for ___bpf_prog_run() x86/uaccess: Remove redundant CLACs in getuser/putuser error paths x86/uaccess: Don't leak AC flag into fentry from mcsafe_handle_tail() x86/uaccess: Remove ELF function annotation from copy_user_handle_tail() x86/head/64: Annotate start_cpu0() as non-callable x86/entry: Fix thunk function ELF sizes x86/kvm: Don't call kvm_spurious_fault() from .fixup x86/kvm: Replace vmx_vmenter()'s call to kvm_spurious_fault() with UD2 ... commit 4b01f5a4c9c4f0c502875c1fb31dcd5d0df86475 Merge: 70e6e1b971e4 19dbdcb8039c Author: Linus Torvalds Date: Sat Jul 20 10:43:03 2019 -0700 Merge branch 'smp-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull smp fix from Thomas Gleixner: "Add warnings to the smp function calls so callers from wrong contexts get detected" * 'smp-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: smp: Warn on function calls from softirq context commit 70e6e1b971e46f5c1c2d72217ba62401a2edc22b Merge: 07ab9d5bc53d a50a3f4b6a31 Author: Linus Torvalds Date: Sat Jul 20 10:33:44 2019 -0700 Merge branch 'sched-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull CONFIG_PREEMPT_RT stub config from Thomas Gleixner: "The real-time preemption patch set exists for almost 15 years now and while the vast majority of infrastructure and enhancements have found their way into the mainline kernel, the final integration of RT is still missing. Over the course of the last few years, we have worked on reducing the intrusivenness of the RT patches by refactoring kernel infrastructure to be more real-time friendly. Almost all of these changes were benefitial to the mainline kernel on their own, so there was no objection to integrate them. Though except for the still ongoing printk refactoring, the remaining changes which are required to make RT a first class mainline citizen are not longer arguable as immediately beneficial for the mainline kernel. Most of them are either reordering code flows or adding RT specific functionality. But this now has hit a wall and turned into a classic hen and egg problem: Maintainers are rightfully wary vs. these changes as they make only sense if the final integration of RT into the mainline kernel takes place. Adding CONFIG_PREEMPT_RT aims to solve this as a clear sign that RT will be fully integrated into the mainline kernel. The final integration of the missing bits and pieces will be of course done with the same careful approach as we have used in the past. While I'm aware that you are not entirely enthusiastic about that, I think that RT should receive the same treatment as any other widely used out of tree functionality, which we have accepted into mainline over the years. RT has become the de-facto standard real-time enhancement and is shipped by enterprise, embedded and community distros. It's in use throughout a wide range of industries: telecommunications, industrial automation, professional audio, medical devices, data acquisition, automotive - just to name a few major use cases. RT development is backed by a Linuxfoundation project which is supported by major stakeholders of this technology. The funding will continue over the actual inclusion into mainline to make sure that the functionality is neither introducing regressions, regressing itself, nor becomes subject to bitrot. There is also a lifely user community around RT as well, so contrary to the grim situation 5 years ago, it's a healthy project. As RT is still a good vehicle to exercise rarely used code paths and to detect hard to trigger issues, you could at least view it as a QA tool if nothing else" * 'sched-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: sched/rt, Kconfig: Introduce CONFIG_PREEMPT_RT commit 07ab9d5bc53d7fe84047be1d403566123ab9cfaa Merge: f65420df914a 30cd8604323d Author: Linus Torvalds Date: Sat Jul 20 10:20:27 2019 -0700 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm Pull more KVM updates from Paolo Bonzini: "Mostly bugfixes, but also: - s390 support for KVM selftests - LAPIC timer offloading to housekeeping CPUs - Extend an s390 optimization for overcommitted hosts to all architectures - Debugging cleanups and improvements" * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: (25 commits) KVM: x86: Add fixed counters to PMU filter KVM: nVMX: do not use dangling shadow VMCS after guest reset KVM: VMX: dump VMCS on failed entry KVM: x86/vPMU: refine kvm_pmu err msg when event creation failed KVM: s390: Use kvm_vcpu_wake_up in kvm_s390_vcpu_wakeup KVM: Boost vCPUs that are delivering interrupts KVM: selftests: Remove superfluous define from vmx.c KVM: SVM: Fix detection of AMD Errata 1096 KVM: LAPIC: Inject timer interrupt via posted interrupt KVM: LAPIC: Make lapic timer unpinned KVM: x86/vPMU: reset pmc->counter to 0 for pmu fixed_counters KVM: nVMX: Ignore segment base for VMX memory operand when segment not FS or GS kvm: x86: ioapic and apic debug macros cleanup kvm: x86: some tsc debug cleanup kvm: vmx: fix coccinelle warnings x86: kvm: avoid constant-conversion warning x86: kvm: avoid -Wsometimes-uninitized warning KVM: x86: expose AVX512_BF16 feature to guest KVM: selftests: enable pgste option for the linker on s390 KVM: selftests: Move kvm_create_max_vcpus test to generic code ... commit f65420df914a85e33b2c8b1cab310858b2abb7c0 Merge: 168c79971b4a 07d9aa143464 Author: Linus Torvalds Date: Sat Jul 20 10:04:58 2019 -0700 Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull SCSI fixes from James Bottomley: "This is the final round of mostly small fixes in our initial submit. It's mostly minor fixes and driver updates. The only change of note is adding a virt_boundary_mask to the SCSI host and host template to parametrise this for NVMe devices instead of having them do a call in slave_alloc. It's a fairly straightforward conversion except in the two NVMe handling drivers that didn't set it who now have a virtual infinity parameter added" * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: (24 commits) scsi: megaraid_sas: set an unlimited max_segment_size scsi: mpt3sas: set an unlimited max_segment_size for SAS 3.0 HBAs scsi: IB/srp: set virt_boundary_mask in the scsi host scsi: IB/iser: set virt_boundary_mask in the scsi host scsi: storvsc: set virt_boundary_mask in the scsi host template scsi: ufshcd: set max_segment_size in the scsi host template scsi: core: take the DMA max mapping size into account scsi: core: add a host / host template field for the virt boundary scsi: core: Fix race on creating sense cache scsi: sd_zbc: Fix compilation warning scsi: libfc: fix null pointer dereference on a null lport scsi: zfcp: fix GCC compiler warning emitted with -Wmaybe-uninitialized scsi: zfcp: fix request object use-after-free in send path causing wrong traces scsi: zfcp: fix request object use-after-free in send path causing seqno errors scsi: megaraid_sas: Update driver version to 07.710.50.00 scsi: megaraid_sas: Add module parameter for FW Async event logging scsi: megaraid_sas: Enable msix_load_balance for Invader and later controllers scsi: megaraid_sas: Fix calculation of target ID scsi: lpfc: reduce stack size with CONFIG_GCC_PLUGIN_STRUCTLEAK_VERBOSE scsi: devinfo: BLIST_TRY_VPD_PAGES for SanDisk Cruzer Blade ... commit 168c79971b4a7be7011e73bf488b740a8e1135c8 Merge: 18253e034d2a 29be86d7f9cb Author: Linus Torvalds Date: Sat Jul 20 09:34:55 2019 -0700 Merge tag 'kbuild-v5.3-2' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild Pull more Kbuild updates from Masahiro Yamada: - match the directory structure of the linux-libc-dev package to that of Debian-based distributions - fix incorrect include/config/auto.conf generation when Kconfig creates it along with the .config file - remove misleading $(AS) from documents - clean up precious tag files by distclean instead of mrproper - add a new coccinelle patch for devm_platform_ioremap_resource migration - refactor module-related scripts to read modules.order instead of $(MODVERDIR)/*.mod files to get the list of created modules - remove MODVERDIR - update list of header compile-test - add -fcf-protection=none flag to avoid conflict with the retpoline flags when CONFIG_RETPOLINE=y - misc cleanups * tag 'kbuild-v5.3-2' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild: (25 commits) kbuild: add -fcf-protection=none when using retpoline flags kbuild: update compile-test header list for v5.3-rc1 kbuild: split out *.mod out of {single,multi}-used-m rules kbuild: remove 'prepare1' target kbuild: remove the first line of *.mod files kbuild: create *.mod with full directory path and remove MODVERDIR kbuild: export_report: read modules.order instead of .tmp_versions/*.mod kbuild: modpost: read modules.order instead of $(MODVERDIR)/*.mod kbuild: modsign: read modules.order instead of $(MODVERDIR)/*.mod kbuild: modinst: read modules.order instead of $(MODVERDIR)/*.mod scsi: remove pointless $(MODVERDIR)/$(obj)/53c700.ver kbuild: remove duplication from modules.order in sub-directories kbuild: get rid of kernel/ prefix from in-tree modules.{order,builtin} kbuild: do not create empty modules.order in the prepare stage coccinelle: api: add devm_platform_ioremap_resource script kbuild: compile-test headers listed in header-test-m as well kbuild: remove unused hostcc-option kbuild: remove tag files by distclean instead of mrproper kbuild: add --hash-style= and --build-id unconditionally kbuild: get rid of misleading $(AS) from documents ... commit 18253e034d2aeee140f82fc9fe89c4bce5c81799 Merge: abdfd52a295f 56cbb429d911 Author: Linus Torvalds Date: Sat Jul 20 09:15:51 2019 -0700 Merge branch 'work.dcache2' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs Pull dcache and mountpoint updates from Al Viro: "Saner handling of refcounts to mountpoints. Transfer the counting reference from struct mount ->mnt_mountpoint over to struct mountpoint ->m_dentry. That allows us to get rid of the convoluted games with ordering of mount shutdowns. The cost is in teaching shrink_dcache_{parent,for_umount} to cope with mixed-filesystem shrink lists, which we'll also need for the Slab Movable Objects patchset" * 'work.dcache2' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: switch the remnants of releasing the mountpoint away from fs_pin get rid of detach_mnt() make struct mountpoint bear the dentry reference to mountpoint, not struct mount Teach shrink_dcache_parent() to cope with mixed-filesystem shrink lists fs/namespace.c: shift put_mountpoint() to callers of unhash_mnt() __detach_mounts(): lookup_mountpoint() can't return ERR_PTR() anymore nfs: dget_parent() never returns NULL ceph: don't open-code the check for dead lockref commit 6879298bd0673840cadd1fb36d7225485504ceb4 Author: Thomas Gleixner Date: Sat Jul 20 10:56:41 2019 +0200 x86/entry/64: Prevent clobbering of saved CR2 value The recent fix for CR2 corruption introduced a new way to reliably corrupt the saved CR2 value. CR2 is saved early in the entry code in RDX, which is the third argument to the fault handling functions. But it missed that between saving and invoking the fault handler enter_from_user_mode() can be called. RDX is a caller saved register so the invoked function can freely clobber it with the obvious consequences. The TRACE_IRQS_OFF call is safe as it calls through the thunk which preserves RDX, but TRACE_IRQS_OFF_DEBUG is not because it also calls into C-code outside of the thunk. Store CR2 in R12 instead which is a callee saved register and move R12 to RDX just before calling the fault handler. Fixes: a0d14b8909de ("x86/mm, tracing: Fix CR2 corruption") Reported-by: Sean Christopherson Signed-off-by: Thomas Gleixner Acked-by: Peter Zijlstra (Intel) Link: https://lkml.kernel.org/r/alpine.DEB.2.21.1907201020540.1782@nanos.tec.linutronix.de commit 19dbdcb8039cff16669a05136a29180778d16d0a Author: Peter Zijlstra Date: Thu Jul 18 11:20:09 2019 +0200 smp: Warn on function calls from softirq context It's clearly documented that smp function calls cannot be invoked from softirq handling context. Unfortunately nothing enforces that or emits a warning. A single function call can be invoked from softirq context only via smp_call_function_single_async(). The only legit context is task context, so add a warning to that effect. Reported-by: luferry Signed-off-by: Peter Zijlstra Signed-off-by: Thomas Gleixner Link: https://lkml.kernel.org/r/20190718160601.GP3402@hirez.programming.kicks-ass.net commit 30cd8604323dbaf20a80e797fe7057f5b02e394d Author: Eric Hankland Date: Thu Jul 18 11:38:18 2019 -0700 KVM: x86: Add fixed counters to PMU filter Updates KVM_CAP_PMU_EVENT_FILTER so it can also whitelist or blacklist fixed counters. Signed-off-by: Eric Hankland [No need to check padding fields for zero. - Paolo] Signed-off-by: Paolo Bonzini commit 88dddc11a8d6b09201b4db9d255b3394d9bc9e57 Author: Paolo Bonzini Date: Fri Jul 19 18:41:10 2019 +0200 KVM: nVMX: do not use dangling shadow VMCS after guest reset If a KVM guest is reset while running a nested guest, free_nested will disable the shadow VMCS execution control in the vmcs01. However, on the next KVM_RUN vmx_vcpu_run would nevertheless try to sync the VMCS12 to the shadow VMCS which has since been freed. This causes a vmptrld of a NULL pointer on my machime, but Jan reports the host to hang altogether. Let's see how much this trivial patch fixes. Reported-by: Jan Kiszka Cc: Liran Alon Cc: stable@vger.kernel.org Signed-off-by: Paolo Bonzini commit 3b20e03a1066ab2056711166c1b41d421d1ff7b7 Author: Paolo Bonzini Date: Fri Jul 19 18:15:08 2019 +0200 KVM: VMX: dump VMCS on failed entry This is useful for debugging, and is ratelimited nowadays. Signed-off-by: Paolo Bonzini commit 6fc3977ccc5d3c22e851f2dce2d3ce2a0a843842 Author: Like Xu Date: Thu Jul 18 13:35:14 2019 +0800 KVM: x86/vPMU: refine kvm_pmu err msg when event creation failed If a perf_event creation fails due to any reason of the host perf subsystem, it has no chance to log the corresponding event for guest which may cause abnormal sampling data in guest result. In debug mode, this message helps to understand the state of vPMC and we may not limit the number of occurrences but not in a spamming style. Suggested-by: Joe Perches Signed-off-by: Like Xu Cc: stable@vger.kernel.org Signed-off-by: Paolo Bonzini commit d984740944308a310f9d33df774e2304fc1e6959 Author: Wanpeng Li Date: Thu Jul 18 19:39:07 2019 +0800 KVM: s390: Use kvm_vcpu_wake_up in kvm_s390_vcpu_wakeup Use kvm_vcpu_wake_up() in kvm_s390_vcpu_wakeup(). Suggested-by: Paolo Bonzini Cc: Paolo Bonzini Cc: Radim Krčmář Cc: Christian Borntraeger Signed-off-by: Wanpeng Li Signed-off-by: Paolo Bonzini commit d73eb57b80b98ae147e4e6a7d9877c2ba175f972 Author: Wanpeng Li Date: Thu Jul 18 19:39:06 2019 +0800 KVM: Boost vCPUs that are delivering interrupts Inspired by commit 9cac38dd5d (KVM/s390: Set preempted flag during vcpu wakeup and interrupt delivery), we want to also boost not just lock holders but also vCPUs that are delivering interrupts. Most smp_call_function_many calls are synchronous, so the IPI target vCPUs are also good yield candidates. This patch introduces vcpu->ready to boost vCPUs during wakeup and interrupt delivery time; unlike s390 we do not reuse vcpu->preempted so that voluntarily preempted vCPUs are taken into account by kvm_vcpu_on_spin, but vmx_vcpu_pi_put is not affected (VT-d PI handles voluntary preemption separately, in pi_pre_block). Testing on 80 HT 2 socket Xeon Skylake server, with 80 vCPUs VM 80GB RAM: ebizzy -M vanilla boosting improved 1VM 21443 23520 9% 2VM 2800 8000 180% 3VM 1800 3100 72% Testing on my Haswell desktop 8 HT, with 8 vCPUs VM 8GB RAM, two VMs, one running ebizzy -M, the other running 'stress --cpu 2': w/ boosting + w/o pv sched yield(vanilla) vanilla boosting improved 1570 4000 155% w/ boosting + w/ pv sched yield(vanilla) vanilla boosting improved 1844 5157 179% w/o boosting, perf top in VM: 72.33% [kernel] [k] smp_call_function_many 4.22% [kernel] [k] call_function_i 3.71% [kernel] [k] async_page_fault w/ boosting, perf top in VM: 38.43% [kernel] [k] smp_call_function_many 6.31% [kernel] [k] async_page_fault 6.13% libc-2.23.so [.] __memcpy_avx_unaligned 4.88% [kernel] [k] call_function_interrupt Cc: Paolo Bonzini Cc: Radim Krčmář Cc: Christian Borntraeger Cc: Paul Mackerras Cc: Marc Zyngier Signed-off-by: Wanpeng Li Signed-off-by: Paolo Bonzini commit 2417c87059b0f29535bcedf9360b94a0110bc3da Author: Thomas Huth Date: Thu Jul 18 13:55:27 2019 +0200 KVM: selftests: Remove superfluous define from vmx.c The code in vmx.c does not use "program_invocation_name", so there is no need to "#define _GNU_SOURCE" here. Signed-off-by: Thomas Huth Signed-off-by: Paolo Bonzini commit 118154bdf54ca79e4b5f3ce6d4a8a7c6b7c2c76f Author: Liran Alon Date: Wed Jul 17 02:56:58 2019 +0300 KVM: SVM: Fix detection of AMD Errata 1096 When CPU raise #NPF on guest data access and guest CR4.SMAP=1, it is possible that CPU microcode implementing DecodeAssist will fail to read bytes of instruction which caused #NPF. This is AMD errata 1096 and it happens because CPU microcode reading instruction bytes incorrectly attempts to read code as implicit supervisor-mode data accesses (that is, just like it would read e.g. a TSS), which are susceptible to SMAP faults. The microcode reads CS:RIP and if it is a user-mode address according to the page tables, the processor gives up and returns no instruction bytes. In this case, GuestIntrBytes field of the VMCB on a VMEXIT will incorrectly return 0 instead of the correct guest instruction bytes. Current KVM code attemps to detect and workaround this errata, but it has multiple issues: 1) It mistakenly checks if guest CR4.SMAP=0 instead of guest CR4.SMAP=1, which is required for encountering a SMAP fault. 2) It assumes SMAP faults can only occur when guest CPL==3. However, in case guest CR4.SMEP=0, the guest can execute an instruction which reside in a user-accessible page with CPL<3 priviledge. If this instruction raise a #NPF on it's data access, then CPU DecodeAssist microcode will still encounter a SMAP violation. Even though no sane OS will do so (as it's an obvious priviledge escalation vulnerability), we still need to handle this semanticly correct in KVM side. Note that (2) *is* a useful optimization, because CR4.SMAP=1 is an easy triggerable condition and guests usually enable SMAP together with SMEP. If the vCPU has CR4.SMEP=1, the errata could indeed be encountered onlt at guest CPL==3; otherwise, the CPU would raise a SMEP fault to guest instead of #NPF. We keep this condition to avoid false positives in the detection of the errata. In addition, to avoid future confusion and improve code readbility, include details of the errata in code and not just in commit message. Fixes: 05d5a4863525 ("KVM: SVM: Workaround errata#1096 (insn_len maybe zero on SMAP violation)") Cc: Singh Brijesh Cc: Sean Christopherson Cc: Paolo Bonzini Reviewed-by: Boris Ostrovsky Signed-off-by: Liran Alon Reviewed-by: Brijesh Singh Signed-off-by: Paolo Bonzini commit 0c5f81dad46c90792e6c3c4797131323c9e96dcd Author: Wanpeng Li Date: Sat Jul 6 09:26:51 2019 +0800 KVM: LAPIC: Inject timer interrupt via posted interrupt Dedicated instances are currently disturbed by unnecessary jitter due to the emulated lapic timers firing on the same pCPUs where the vCPUs reside. There is no hardware virtual timer on Intel for guest like ARM, so both programming timer in guest and the emulated timer fires incur vmexits. This patch tries to avoid vmexit when the emulated timer fires, at least in dedicated instance scenario when nohz_full is enabled. In that case, the emulated timers can be offload to the nearest busy housekeeping cpus since APICv has been found for several years in server processors. The guest timer interrupt can then be injected via posted interrupts, which are delivered by the housekeeping cpu once the emulated timer fires. The host should tuned so that vCPUs are placed on isolated physical processors, and with several pCPUs surplus for busy housekeeping. If disabled mwait/hlt/pause vmexits keep the vCPUs in non-root mode, ~3% redis performance benefit can be observed on Skylake server, and the number of external interrupt vmexits drops substantially. Without patch VM-EXIT Samples Samples% Time% Min Time Max Time Avg time EXTERNAL_INTERRUPT 42916 49.43% 39.30% 0.47us 106.09us 0.71us ( +- 1.09% ) While with patch: VM-EXIT Samples Samples% Time% Min Time Max Time Avg time EXTERNAL_INTERRUPT 6871 9.29% 2.96% 0.44us 57.88us 0.72us ( +- 4.02% ) Cc: Paolo Bonzini Cc: Radim Krčmář Cc: Marcelo Tosatti Signed-off-by: Wanpeng Li Signed-off-by: Paolo Bonzini commit 89099d855bf084c3e428ca257b50d77d1a468437 Merge: 9a2f97bb8ddd 14bfb13f0ed5 Author: David S. Miller Date: Fri Jul 19 21:27:45 2019 -0700 Merge branch 'flow_offload-fixes' Pablo Neira Ayuso says: ==================== flow_offload fixes The following patchset contains fixes for the flow_offload infrastructure: 1) Fix possible build breakage before patch 3/4. Both the flow_offload infrastructure and OVS define the flow_stats structure. Patch 3/4 in this batch indirectly pulls in the flow_stats definition from include/net/flow_offload.h into OVS, leading to structure redefinition compile-time errors. 2) Remove netns parameter from flow_block_cb_alloc(), this is not required as Jiri suggests. The flow_block_cb_is_busy() function uses the per-driver block list to check for used blocks which was the original intention for this parameter. 3) Rename tc_setup_cb_t to flow_setup_cb_t. This callback is not exclusive of tc anymore, this might confuse the reader as Jiri suggests, fix this semantic inconsistency. Add #include to include/net/netfilter/nf_tables_offload.h to avoid a compile break with CONFIG_HEADER_TEST=y. 4) Fix block sharing feature: Add flow_block structure and use it, update flow_block_cb_lookup() to use this flow_block object. ==================== Signed-off-by: David S. Miller commit 14bfb13f0ed525ed117b5d1f3e77e7c0a6be15de Author: Pablo Neira Ayuso Date: Fri Jul 19 18:20:16 2019 +0200 net: flow_offload: add flow_block structure and use it This object stores the flow block callbacks that are attached to this block. Update flow_block_cb_lookup() to take this new object. This patch restores the block sharing feature. Fixes: da3eeb904ff4 ("net: flow_offload: add list handling functions") Signed-off-by: Pablo Neira Ayuso Acked-by: Jiri Pirko Signed-off-by: David S. Miller commit a7323311515d488b7714bb7504a1d50fabb0bfcf Author: Pablo Neira Ayuso Date: Fri Jul 19 18:20:15 2019 +0200 net: flow_offload: rename tc_setup_cb_t to flow_setup_cb_t Rename this type definition and adapt users. Signed-off-by: Pablo Neira Ayuso Acked-by: Jiri Pirko Signed-off-by: David S. Miller commit 0c7294ddae73ad8d7532f95a86259e311e991a55 Author: Pablo Neira Ayuso Date: Fri Jul 19 18:20:14 2019 +0200 net: flow_offload: remove netns parameter from flow_block_cb_alloc() No need to annotate the netns on the flow block callback object, flow_block_cb_is_busy() already checks for used blocks. Fixes: d63db30c8537 ("net: flow_offload: add flow_block_cb_alloc() and flow_block_cb_free()") Signed-off-by: Pablo Neira Ayuso Acked-by: Jiri Pirko Signed-off-by: David S. Miller commit aef833c58d321f09ae4ce4467723542842ba9faf Author: Pablo Neira Ayuso Date: Fri Jul 19 18:20:13 2019 +0200 net: openvswitch: rename flow_stats to sw_flow_stats There is a flow_stats structure defined in include/net/flow_offload.h and a follow up patch adds #include to net/sch_generic.h. This breaks compilation since OVS codebase includes net/sock.h which pulls in linux/filter.h which includes net/sch_generic.h. In file included from ./include/net/sch_generic.h:18:0, from ./include/linux/filter.h:25, from ./include/net/sock.h:59, from ./include/linux/tcp.h:19, from net/openvswitch/datapath.c:24 This definition takes precedence on OVS since it is placed in the networking core, so rename flow_stats in OVS to sw_flow_stats since this structure is contained in sw_flow. Signed-off-by: Pablo Neira Ayuso Acked-by: Jiri Pirko Signed-off-by: David S. Miller commit 9a2f97bb8ddddbf655ce1fcdf688dcec19deb59f Merge: 31cc088a4f5d dfee0e99bcff Author: David S. Miller Date: Fri Jul 19 21:25:10 2019 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf Pablo Neira Ayuso says: ==================== Netfilter fixes for net The following patchset contains Netfilter fixes for net: 1) Fix a deadlock when module is requested via netlink_bind() in nfnetlink, from Florian Westphal. 2) Fix ipt_rpfilter and ip6t_rpfilter with VRF, from Miaohe Lin. 3) Skip master comparison in SIP helper to fix expectation clash under two valid scenarios, from xiao ruizhu. 4) Remove obsolete comments in nf_conntrack codebase, from Yonatan Goldschmidt. 5) Fix redirect extension module autoload, from Christian Hesse. 6) Fix incorrect mssg option sent to client in synproxy, from Fernando Fernandez. 7) Fix incorrect window calculations in TCP conntrack, from Florian Westphal. 8) Don't bail out when updating basechain policy due to recent offload works, also from Florian. 9) Allow symhash to use modulus 1 as other hash extensions do, from Laura.Garcia. 10) Missing NAT chain module autoload for the inet family, from Phil Sutter. 11) Fix missing adjustment of TCP RST packet in synproxy, from Fernando Fernandez. 12) Skip EAGAIN path when nft_meta_bridge is built-in or not selected. 13) Conntrack bridge does not depend on nf_tables_bridge. 14) Turn NF_TABLES_BRIDGE into tristate to fix possible link break of nft_meta_bridge, from Arnd Bergmann. ==================== Signed-off-by: David S. Miller commit c39f2d9db0fd81ea20bb5cce9b3f082ca63753e2 Merge: 597473720f4d 771a081e44a9 Author: Dmitry Torokhov Date: Sat Jul 20 07:07:56 2019 +0300 Merge branch 'next' into for-linus Prepare second round of input updates for 5.3 merge window. commit 29be86d7f9cb18df4123f309ac7857570513e8bc Author: Seth Forshee Date: Wed Jul 17 11:06:26 2019 -0500 kbuild: add -fcf-protection=none when using retpoline flags The gcc -fcf-protection=branch option is not compatible with -mindirect-branch=thunk-extern. The latter is used when CONFIG_RETPOLINE is selected, and this will fail to build with a gcc which has -fcf-protection=branch enabled by default. Adding -fcf-protection=none when building with retpoline enabled prevents such build failures. Signed-off-by: Seth Forshee Signed-off-by: Masahiro Yamada commit 67bf47452ea00edd90e796054229b651e64b82c1 Author: Masahiro Yamada Date: Wed Jul 17 15:29:13 2019 +0900 kbuild: update compile-test header list for v5.3-rc1 - Some headers graduated from the blacklist - hyperv_timer.h joined the header-test when CONFIG_X86=y - nf_tables*.h joined the header-test when CONFIG_NF_TABLES is enabled. - The entry for nf_tables_offload.h was added to fix build error for the combination of CONFIG_NF_TABLES=n and CONFIG_KERNEL_HEADER_TEST=y. - The entry for iomap.h was added because this header is supposed to be included only when CONFIG_BLOCK=y Signed-off-by: Masahiro Yamada commit abdfd52a295fb5731ab07b5c9013e2e39f4d1cbe Merge: af6af87d7e4f a151f2753725 Author: Linus Torvalds Date: Fri Jul 19 17:27:27 2019 -0700 Merge tag 'armsoc-defconfig' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc Pull ARM SoC defconfig updates from Olof Johansson: "We keep this in a separate branch to avoid cross-branch conflicts, but most of the material here is fairly boring -- some new drivers turned on for hardware since they were merged, and some refreshed files due to time having moved a lot of entries around" * tag 'armsoc-defconfig' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (47 commits) ARM: configs: multi_v5: Remove duplicate ASPEED options arm64: defconfig: Enable CONFIG_KEYBOARD_SNVS_PWRKEY as module ARM: imx_v6_v7_defconfig: Enable CONFIG_ARM_IMX_CPUFREQ_DT defconfig: arm64: enable i.MX8 SCU octop driver arm64: defconfig: Add i.MX SCU SoC info driver arm64: defconfig: Enable CONFIG_QORIQ_THERMAL ARM: imx_v6_v7_defconfig: Select CONFIG_NVMEM_SNVS_LPGPR arm64: defconfig: ARM_IMX_CPUFREQ_DT=m ARM: imx_v6_v7_defconfig: Add TPM PWM support by default ARM: imx_v6_v7_defconfig: Enable the OV2680 camera driver ARM: imx_v6_v7_defconfig: Enable CONFIG_THERMAL_STATISTICS arm64: defconfig: NVMEM_IMX_OCOTP=y for imx8m ARM: multi_v7_defconfig: enable STMFX pinctrl support arm64 defconfig: enable LVM support ARM: configs: multi_v5: Add more ASPEED devices arm64: defconfig: Add Tegra194 PCIe driver ARM: configs: aspeed: Add new drivers ARM: exynos_defconfig: Enable Panfrost and Lima drivers ARM: multi_v7_defconfig: Enable Panfrost and Lima drivers arm64 defconfig: enable Mellanox cards ... commit af6af87d7e4ff67324425daa699b9cda32e3161d Merge: 8362fd64f07e f90b8fda3a9d Author: Linus Torvalds Date: Fri Jul 19 17:19:24 2019 -0700 Merge tag 'armsoc-dt' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc Pull ARM Devicetree updates from Olof Johansson: "We continue to see a lot of new material. I've highlighted some of it below, but there's been more beyond that as well. One of the sweeping changes is that many boards have seen their ARM Mali GPU devices added to device trees, since the DRM drivers have now been merged. So, with the caveat that I have surely missed several great contributions, here's a collection of the material this time around: New SoCs: - Mediatek mt8183 (4x Cortex-A73 + 4x Cortex-A53) - TI J721E (2x Cortex-A72 + 3x Cortex-R5F + 3 DSPs + MMA) - Amlogic G12B (4x Cortex-A73 + 2x Cortex-A53) New Boards / platforms: - Aspeed BMC support for a number of new server platforms - Kontron SMARC SoM (several i.MX6 versions) - Novtech's Meerkat96 (i.MX7) - ST Micro Avenger96 board - Hardkernel ODROID-N2 (Amlogic G12B) - Purism Librem5 devkit (i.MX8MQ) - Google Cheza (Qualcomm SDM845) - Qualcomm Dragonboard 845c (Qualcomm SDM845) - Hugsun X99 TV Box (Rockchip RK3399) - Khadas Edge/Edge-V/Captain (Rockchip RK3399) Updated / expanded boards and platforms: - Renesas r7s9210 has a lot of new peripherals added - Fixes and polish for Rockchip-based Chromebooks - Amlogic G12A has a lot of peripherals added - Nvidia Jetson Nano sees various fixes and improvements, and is now at feature parity with TX1" * tag 'armsoc-dt' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (586 commits) ARM: dts: gemini: Set DIR-685 SPI CS as active low ARM: dts: exynos: Adjust buck[78] regulators to supported values on Arndale Octa ARM: dts: exynos: Adjust buck[78] regulators to supported values on Odroid XU3 family ARM: dts: exynos: Move Mali400 GPU node to "/soc" ARM: dts: exynos: Fix imprecise abort on Mali GPU probe on Exynos4210 arm64: dts: qcom: qcs404: Add missing space for cooling-cells property arm64: dts: rockchip: Fix USB3 Type-C on rk3399-sapphire arm64: dts: rockchip: Update DWC3 modules on RK3399 SoCs arm64: dts: rockchip: enable rk3328 watchdog clock ARM: dts: rockchip: add display nodes for rk322x ARM: dts: rockchip: fix vop iommu-cells on rk322x arm64: dts: rockchip: Add support for Hugsun X99 TV Box arm64: dts: rockchip: Define values for the IPA governor for rock960 arm64: dts: rockchip: Fix multiple thermal zones conflict in rk3399.dtsi arm64: dts: rockchip: add core dtsi file for RK3399Pro SoCs arm64: dts: rockchip: improve rk3328-roc-cc rgmii performance. Revert "ARM: dts: rockchip: set PWM delay backlight settings for Minnie" ARM: dts: rockchip: Configure BT_DEV_WAKE in on rk3288-veyron arm64: dts: qcom: sdm845-cheza: add initial cheza dt ARM: dts: msm8974-FP2: Add vibration motor ... commit 8362fd64f07eaef7155c94fca8dee91c4f99a666 Merge: 24e44913aa74 8c0993621c3e Author: Linus Torvalds Date: Fri Jul 19 17:13:56 2019 -0700 Merge tag 'armsoc-drivers' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc Pull ARM SoC-related driver updates from Olof Johansson: "Various driver updates for platforms and a couple of the small driver subsystems we merge through our tree: - A driver for SCU (system control) on NXP i.MX8QXP - Qualcomm Always-on Subsystem messaging driver (AOSS QMP) - Qualcomm PM support for MSM8998 - Support for a newer version of DRAM PHY driver for Broadcom (DPFE) - Reset controller support for Bitmain BM1880 - TI SCI (System Control Interface) support for CPU control on AM654 processors - More TI sysc refactoring and rework" * tag 'armsoc-drivers' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (84 commits) reset: remove redundant null check on pointer dev soc: rockchip: work around clang warning dt-bindings: reset: imx7: Fix the spelling of 'indices' soc: imx: Add i.MX8MN SoC driver support soc: aspeed: lpc-ctrl: Fix probe error handling soc: qcom: geni: Add support for ACPI firmware: ti_sci: Fix gcc unused-but-set-variable warning firmware: ti_sci: Use the correct style for SPDX License Identifier soc: imx8: Use existing of_root directly soc: imx8: Fix potential kernel dump in error path firmware/psci: psci_checker: Park kthreads before stopping them memory: move jedec_ddr.h from include/memory to drivers/memory/ memory: move jedec_ddr_data.c from lib/ to drivers/memory/ MAINTAINERS: Remove myself as qcom maintainer soc: aspeed: lpc-ctrl: make parameter optional soc: qcom: apr: Don't use reg for domain id soc: qcom: fix QCOM_AOSS_QMP dependency and build errors memory: tegra: Fix -Wunused-const-variable firmware: tegra: Early resume BPMP soc/tegra: Select pinctrl for Tegra194 ... commit 24e44913aa746098349370a0f279733c0cadcba7 Merge: 31cc088a4f5d 7e8a0f108990 Author: Linus Torvalds Date: Fri Jul 19 17:05:08 2019 -0700 Merge tag 'armsoc-soc' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc Pull ARM SoC platform updates from Olof Johansson: "SoC platform changes. Main theme this merge window: - The Netx platform (Netx 100/500) platform is removed by Linus Walleij-- the SoC doesn't have active maintainers with hardware, and in discussions with the vendor the agreement was that it's OK to remove. - Russell King has a series of patches that cleans up and refactors SA1101 and RiscPC support" * tag 'armsoc-soc' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (47 commits) ARM: stm32: use "depends on" instead of "if" after prompt ARM: sa1100: convert to common clock framework ARM: exynos: Cleanup cppcheck shifting warning ARM: pxa/lubbock: remove lubbock_set_misc_wr() from global view ARM: exynos: Only build MCPM support if used arm: add missing include platform-data/atmel.h ARM: davinci: Use GPIO lookup table for DA850 LEDs ARM: OMAP2: drop explicit assembler architecture ARM: use arch_extension directive instead of arch argument ARM: imx: Switch imx7d to imx-cpufreq-dt for speed-grading ARM: bcm: Enable PINCTRL for ARCH_BRCMSTB ARM: bcm: Enable ARCH_HAS_RESET_CONTROLLER for ARCH_BRCMSTB ARM: riscpc: enable chained scatterlist support ARM: riscpc: reduce IRQ handling code ARM: riscpc: move RiscPC assembly files from arch/arm/lib to mach-rpc ARM: riscpc: parse video information from tagged list ARM: riscpc: add ecard quirk for Atomwide 3port serial card MAINTAINERS: mvebu: Add git entry soc: ti: pm33xx: Add a print while entering RTC only mode with DDR in self-refresh ARM: OMAP2+: Make some variables static ... commit 94bccc34071094c165c79b515d21b63c78f7e968 Author: Thomas Tai Date: Thu Jul 18 18:37:34 2019 +0000 iscsi_ibft: make ISCSI_IBFT dependson ACPI instead of ISCSI_IBFT_FIND iscsi_ibft can use ACPI to find the iBFT entry during bootup, currently, ISCSI_IBFT depends on ISCSI_IBFT_FIND which is a X86 legacy way to find the iBFT by searching through the low memory. This patch changes the dependency so that other arch like ARM64 can use ISCSI_IBFT as long as the arch supports ACPI. ibft_init() needs to use the global variable ibft_addr declared in iscsi_ibft_find.c. A #ifndef CONFIG_ISCSI_IBFT_FIND is needed to declare the variable if CONFIG_ISCSI_IBFT_FIND is not selected. Moving ibft_addr into the iscsi_ibft.c does not work because if ISCSI_IBFT is selected as a module, the arch/x86/kernel/setup.c won't be able to find the variable at compile time. Signed-off-by: Thomas Tai Signed-off-by: Konrad Rzeszutek Wilk commit 1d4126c4e1190d2f7d3f388552f9bd17ae0c64fc Author: Andrii Nakryiko Date: Fri Jul 19 12:46:03 2019 -0700 libbpf: sanitize VAR to conservative 1-byte INT If VAR in non-sanitized BTF was size less than 4, converting such VAR into an INT with size=4 will cause BTF validation failure due to violationg of STRUCT (into which DATASEC was converted) member size. Fix by conservatively using size=1. Signed-off-by: Andrii Nakryiko Signed-off-by: Alexei Starovoitov commit 04efe5911fb30664a56ec63d272a0f39a71545db Author: Andrii Nakryiko Date: Fri Jul 19 12:32:42 2019 -0700 libbpf: fix SIGSEGV when BTF loading fails, but .BTF.ext exists In case when BTF loading fails despite sanitization, but BPF object has .BTF.ext loaded as well, we free and null obj->btf, but not obj->btf_ext. This leads to an attempt to relocate .BTF.ext later on during bpf_object__load(), which assumes obj->btf is present. This leads to SIGSEGV on null pointer access. Fix bug by freeing and nulling obj->btf_ext as well. Signed-off-by: Andrii Nakryiko Signed-off-by: Alexei Starovoitov commit 31cc088a4f5d83481c6f5041bd6eb06115b974af Merge: dd4542d2823a 8ee795625665 Author: Linus Torvalds Date: Fri Jul 19 12:29:43 2019 -0700 Merge tag 'drm-next-2019-07-19' of git://anongit.freedesktop.org/drm/drm Pull drm fixes from Daniel Vetter: "Dave is back in shape, but now family got it so I'm doing the pull. Two things worthy of note: - nouveau feature pull was way too late, Dave&me decided to not take that, so Ben spun up a pull with just the fixes. - after some chatting with the arm display maintainers we decided to change a bit how that's maintained, for more oversight/review and cross vendor collab. More details below: nouveau: - bugfixes - TU116 enabling (minor iteration) :w amdgpu: - large pile of fixes for new hw support this release (navi, vega20) - audio hotplug fix - bunch of corner cases and small fixes all over for amdgpu/kfd komeda: - back out some new properties (from this merge window) that needs more pondering. bochs: - fb pitch setup core: - a new panel quirk - misc fixes" * tag 'drm-next-2019-07-19' of git://anongit.freedesktop.org/drm/drm: (73 commits) drm/nouveau/secboot/gp102-: remove WAR for SEC2 RTOS start bug drm/nouveau/flcn/gp102-: improve implementation of bind_context() on SEC2/GSP drm/nouveau: fix memory leak in nouveau_conn_reset() drm/nouveau/dmem: missing mutex_lock in error path drm/nouveau/hwmon: return EINVAL if the GPU is powered down for sensors reads drm/nouveau: fix bogus GPL-2 license header drm/nouveau: fix bogus GPL-2 license header drm/nouveau/i2c: Enable i2c pads & busses during preinit drm/nouveau/disp/tu102-: wire up scdc parameter setter drm/nouveau/core: recognise TU116 chipset drm/nouveau/kms: disallow dual-link harder if hdmi connection detected drm/nouveau/disp/nv50-: fix center/aspect-corrected scaling drm/nouveau/disp/nv50-: force scaler for any non-default LVDS/eDP modes drm/nouveau/mcp89/mmu: Use mcp77_mmu_new instead of g84_mmu_new on MCP89. drm/amd/display: init res_pool dccg_ref, dchub_ref with xtalin_freq drm/amdgpu/pm: remove check for pp funcs in freq sysfs handlers drm/amd/display: Force uclk to max for every state drm/amdkfd: Remove GWS from process during uninit drm/amd/amdgpu: Fix offset for vmid selection in debugfs interface drm/amd/powerplay: update vega20 driver if to fit latest SMU firmware ... commit dd4542d2823ac55cb86450960423f55e818aa182 Merge: 40ef768ab6ee cf144f81a99d Author: Linus Torvalds Date: Fri Jul 19 12:23:37 2019 -0700 Merge branch 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 Pull crypto fixes from Herbert Xu: - Fix missed wake-up race in padata - Use crypto_memneq in ccp - Fix version check in ccp - Fix fuzz test failure in ccp - Fix potential double free in crypto4xx - Fix compile warning in stm32 * 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6: padata: use smp_mb in padata_reorder to avoid orphaned padata jobs crypto: ccp - Fix SEV_VERSION_GREATER_OR_EQUAL crypto: ccp/gcm - use const time tag comparison. crypto: ccp - memset structure fields to zero before reuse crypto: crypto4xx - fix a potential double free in ppc4xx_trng_probe crypto: stm32/hash - Fix incorrect printk modifier for size_t commit 40ef768ab6eecc1b51461a034274350b31fc29d1 Author: Dave Jones Date: Thu Jul 18 23:51:56 2019 -0400 Remove references to dead website. This fell into disrepair a while ago, and the majority of hits to the snapshots were from bots, so it's more trouble to keep running than it's worth. Signed-off-by: Dave Jones Signed-off-by: Linus Torvalds commit 41ba485ef1d0dca98c5b194b8fb19201e123a08d Merge: a84d2d2906f9 6d54ceb539aa Author: Linus Torvalds Date: Fri Jul 19 12:18:46 2019 -0700 Merge tag 'trace-v5.3-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace Pull tracing fix from Steven Rostedt: "Eiichi Tsukata found a small bug from the fixup of the stack code Removing ULONG_MAX as the marker for the user stack trace end, made the tracing code not know where the end is. The end is now marked with a zero (NULL) pointer. Eiichi fixed this in the tracing code" * tag 'trace-v5.3-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace: tracing: Fix user stack trace "??" output commit a84d2d2906f983fb80f5dcc3e8e7c3ad70aa9f0d Merge: b5d72dda8976 bdfeb0ccea1a Author: Linus Torvalds Date: Fri Jul 19 12:15:33 2019 -0700 Merge tag 'csky-for-linus-5.3-rc1' of git://github.com/c-sky/csky-linux Pull arch/csky pupdates from Guo Ren: "This round of csky subsystem gives two features (ASID algorithm update, Perf pmu record support) and some fixups. ASID updates: - Revert mmu ASID mechanism - Add new asid lib code from arm - Use generic asid algorithm to implement switch_mm - Improve tlb operation with help of asid Perf pmu record support: - Init pmu as a device - Add count-width property for csky pmu - Add pmu interrupt support - Fix perf record in kernel/user space - dt-bindings: Add csky PMU bindings Fixes: - Fixup no panic in kernel for some traps - Fixup some error count in 810 & 860. - Fixup abiv1 memset error" * tag 'csky-for-linus-5.3-rc1' of git://github.com/c-sky/csky-linux: csky: Fixup abiv1 memset error csky: Improve tlb operation with help of asid csky: Use generic asid algorithm to implement switch_mm csky: Add new asid lib code from arm csky: Revert mmu ASID mechanism dt-bindings: csky: Add csky PMU bindings dt-bindings: interrupt-controller: Update csky mpintc csky: Fixup some error count in 810 & 860. csky: Fix perf record in kernel/user space csky: Add pmu interrupt support csky: Add count-width property for csky pmu csky: Init pmu as a device csky: Fixup no panic in kernel for some traps csky: Select intc & timer drivers commit b5d72dda8976e878be47415b94bca8465d1fa22d Merge: 26473f83703e a1078e821b60 Author: Linus Torvalds Date: Fri Jul 19 11:41:26 2019 -0700 Merge tag 'for-linus-5.3a-rc1-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip Pull xen updates from Juergen Gross: "Fixes and features: - A series to introduce a common command line parameter for disabling paravirtual extensions when running as a guest in virtualized environment - A fix for int3 handling in Xen pv guests - Removal of the Xen-specific tmem driver as support of tmem in Xen has been dropped (and it was experimental only) - A security fix for running as Xen dom0 (XSA-300) - A fix for IRQ handling when offlining cpus in Xen guests - Some small cleanups" * tag 'for-linus-5.3a-rc1-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip: xen: let alloc_xenballooned_pages() fail if not enough memory free xen/pv: Fix a boot up hang revealed by int3 self test x86/xen: Add "nopv" support for HVM guest x86/paravirt: Remove const mark from x86_hyper_xen_hvm variable xen: Map "xen_nopv" parameter to "nopv" and mark it obsolete x86: Add "nopv" parameter to disable PV extensions x86/xen: Mark xen_hvm_need_lapic() and xen_x2apic_para_available() as __init xen: remove tmem driver Revert "x86/paravirt: Set up the virt_spin_lock_key after static keys get initialized" xen/events: fix binding user event channels to cpus commit 26473f83703e6bc56114ce4b045000de6efcfff7 Merge: 4f5ed1318c01 5d907307adc1 Author: Linus Torvalds Date: Fri Jul 19 11:38:12 2019 -0700 Merge tag 'iomap-5.3-merge-4' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux Pull iomap split/cleanup from Darrick Wong: "As promised, here's the second part of the iomap merge for 5.3, in which we break up iomap.c into smaller files grouped by functional area so that it'll be easier in the long run to maintain cohesiveness of code units and to review incoming patches. There are no functional changes and fs/iomap.c split cleanly. Summary: - Regroup the fs/iomap.c code by major functional area so that we can start development for 5.4 from a more stable base" * tag 'iomap-5.3-merge-4' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux: iomap: move internal declarations into fs/iomap/ iomap: move the main iteration code into a separate file iomap: move the buffered IO code into a separate file iomap: move the direct IO code into a separate file iomap: move the SEEK_HOLE code into a separate file iomap: move the file mapping reporting code into a separate file iomap: move the swapfile code into a separate file iomap: start moving code to fs/iomap/ commit 4f5ed1318c0108369a76f4a56242fbeea537abe9 Merge: d2fbf4b6d585 02e5ad973883 Author: Linus Torvalds Date: Fri Jul 19 11:35:08 2019 -0700 Merge branch 'work.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs Pull misc vfs updates from Al Viro: "Assorted stuff" * 'work.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: perf_event_get(): don't bother with fget_raw() vfs: update d_make_root() description commit d2fbf4b6d585e40f2369675148777abce3abd0e7 Merge: 933a90bf4f35 b4ed8f75c828 Author: Linus Torvalds Date: Fri Jul 19 11:33:22 2019 -0700 Merge branch 'work.adfs' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs Pull adfs updates from Al Viro: "More ADFS patches from Russell King" * 'work.adfs' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: fs/adfs: add time stamp and file type helpers fs/adfs: super: limit idlen according to directory type fs/adfs: super: fix use-after-free bug fs/adfs: super: safely update options on remount fs/adfs: super: correct superblock flags fs/adfs: clean up indirect disc addresses and fragment IDs fs/adfs: clean up error message printing fs/adfs: use %pV for error messages fs/adfs: use format_version from disc_record fs/adfs: add helper to get filesystem size fs/adfs: add helper to get discrecord from map fs/adfs: correct disc record structure commit 933a90bf4f3505f8ec83bda21a3c7d70d7c2b426 Merge: 5f4fc6d440d7 037f11b4752f Author: Linus Torvalds Date: Fri Jul 19 10:42:02 2019 -0700 Merge branch 'work.mount0' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs Pull vfs mount updates from Al Viro: "The first part of mount updates. Convert filesystems to use the new mount API" * 'work.mount0' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: (63 commits) mnt_init(): call shmem_init() unconditionally constify ksys_mount() string arguments don't bother with registering rootfs init_rootfs(): don't bother with init_ramfs_fs() vfs: Convert smackfs to use the new mount API vfs: Convert selinuxfs to use the new mount API vfs: Convert securityfs to use the new mount API vfs: Convert apparmorfs to use the new mount API vfs: Convert openpromfs to use the new mount API vfs: Convert xenfs to use the new mount API vfs: Convert gadgetfs to use the new mount API vfs: Convert oprofilefs to use the new mount API vfs: Convert ibmasmfs to use the new mount API vfs: Convert qib_fs/ipathfs to use the new mount API vfs: Convert efivarfs to use the new mount API vfs: Convert configfs to use the new mount API vfs: Convert binfmt_misc to use the new mount API convenience helper: get_tree_single() convenience helper get_tree_nodev() vfs: Kill sget_userns() ... commit 5f4fc6d440d77a2cf74fe4ea56955674ac7e35e7 Merge: 249be8511b26 8d650cdedaab Author: Linus Torvalds Date: Fri Jul 19 10:06:06 2019 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net Pull networking fixes from David Miller: 1) Fix AF_XDP cq entry leak, from Ilya Maximets. 2) Fix handling of PHY power-down on RTL8411B, from Heiner Kallweit. 3) Add some new PCI IDs to iwlwifi, from Ihab Zhaika. 4) Fix handling of neigh timers wrt. entries added by userspace, from Lorenzo Bianconi. 5) Various cases of missing of_node_put(), from Nishka Dasgupta. 6) The new NET_ACT_CT needs to depend upon NF_NAT, from Yue Haibing. 7) Various RDS layer fixes, from Gerd Rausch. 8) Fix some more fallout from TCQ_F_CAN_BYPASS generalization, from Cong Wang. 9) Fix FIB source validation checks over loopback, also from Cong Wang. 10) Use promisc for unsupported number of filters, from Justin Chen. 11) Missing sibling route unlink on failure in ipv6, from Ido Schimmel. * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (90 commits) tcp: fix tcp_set_congestion_control() use from bpf hook ag71xx: fix return value check in ag71xx_probe() ag71xx: fix error return code in ag71xx_probe() usb: qmi_wwan: add D-Link DWM-222 A2 device ID bnxt_en: Fix VNIC accounting when enabling aRFS on 57500 chips. net: dsa: sja1105: Fix missing unlock on error in sk_buff() gve: replace kfree with kvfree selftests/bpf: fix test_xdp_noinline on s390 selftests/bpf: fix "valid read map access into a read-only array 1" on s390 net/mlx5: Replace kfree with kvfree MAINTAINERS: update netsec driver ipv6: Unlink sibling route in case of failure liquidio: Replace vmalloc + memset with vzalloc udp: Fix typo in net/ipv4/udp.c net: bcmgenet: use promisc for unsupported filters ipv6: rt6_check should return NULL if 'from' is NULL tipc: initialize 'validated' field of received packets selftests: add a test case for rp_filter fib: relax source validation check for loopback packets mlxsw: spectrum: Do not process learned records with a dummy FID ... commit 249be8511b269495bc95cb8bdfdd5840b2ba73c0 Merge: 3bfe1fc46794 eec4844fae7c Author: Linus Torvalds Date: Fri Jul 19 09:45:58 2019 -0700 Merge branch 'akpm' (patches from Andrew) Merge yet more updates from Andrew Morton: "The rest of MM and a kernel-wide procfs cleanup. Summary of the more significant patches: - Patch series "mm/memory_hotplug: Factor out memory block devicehandling", v3. David Hildenbrand. Some spring-cleaning of the memory hotplug code, notably in drivers/base/memory.c - "mm: thp: fix false negative of shmem vma's THP eligibility". Yang Shi. Fix /proc/pid/smaps output for THP pages used in shmem. - "resource: fix locking in find_next_iomem_res()" + 1. Nadav Amit. Bugfix and speedup for kernel/resource.c - Patch series "mm: Further memory block device cleanups", David Hildenbrand. More spring-cleaning of the memory hotplug code. - Patch series "mm: Sub-section memory hotplug support". Dan Williams. Generalise the memory hotplug code so that pmem can use it more completely. Then remove the hacks from the libnvdimm code which were there to work around the memory-hotplug code's constraints. - "proc/sysctl: add shared variables for range check", Matteo Croce. We have about 250 instances of int zero; ... .extra1 = &zero, in the tree. This is a tree-wide sweep to make all those private "zero"s and "one"s use global variables. Alas, it isn't practical to make those two global integers const" * emailed patches from Andrew Morton : (38 commits) proc/sysctl: add shared variables for range check mm: migrate: remove unused mode argument mm/sparsemem: cleanup 'section number' data types libnvdimm/pfn: stop padding pmem namespaces to section alignment libnvdimm/pfn: fix fsdax-mode namespace info-block zero-fields mm/devm_memremap_pages: enable sub-section remap mm: document ZONE_DEVICE memory-model implications mm/sparsemem: support sub-section hotplug mm/sparsemem: prepare for sub-section ranges mm: kill is_dev_zone() helper mm/hotplug: kill is_dev_zone() usage in __remove_pages() mm/sparsemem: convert kmalloc_section_memmap() to populate_section_memmap() mm/hotplug: prepare shrink_{zone, pgdat}_span for sub-section removal mm/sparsemem: add helpers track active portions of a section at boot mm/sparsemem: introduce a SECTION_IS_EARLY flag mm/sparsemem: introduce struct mem_section_usage drivers/base/memory.c: get rid of find_memory_block_hinted() mm/memory_hotplug: move and simplify walk_memory_blocks() mm/memory_hotplug: rename walk_memory_range() and pass start+size instead of pfns mm: make register_mem_sect_under_node() static ... commit 6d54ceb539aacc3df65c89500e8b045924f3ef81 Author: Eiichi Tsukata Date: Sun Jun 30 17:54:38 2019 +0900 tracing: Fix user stack trace "??" output Commit c5c27a0a5838 ("x86/stacktrace: Remove the pointless ULONG_MAX marker") removes ULONG_MAX marker from user stack trace entries but trace_user_stack_print() still uses the marker and it outputs unnecessary "??". For example: less-1911 [001] d..2 34.758944: => <00007f16f2295910> => ?? => ?? => ?? => ?? => ?? => ?? => ?? The user stack trace code zeroes the storage before saving the stack, so if the trace is shorter than the maximum number of entries it can terminate the print loop if a zero entry is detected. Link: http://lkml.kernel.org/r/20190630085438.25545-1-devel@etsukata.com Cc: stable@vger.kernel.org Fixes: 4285f2fcef80 ("tracing: Remove the ULONG_MAX stack trace hackery") Signed-off-by: Eiichi Tsukata Signed-off-by: Steven Rostedt (VMware) commit dfee0e99bcff718fa14d973c41f161220fdcb7d5 Author: Arnd Bergmann Date: Wed Jul 10 10:08:20 2019 +0200 netfilter: bridge: make NF_TABLES_BRIDGE tristate The new nft_meta_bridge code fails to link as built-in when NF_TABLES is a loadable module. net/bridge/netfilter/nft_meta_bridge.o: In function `nft_meta_bridge_get_eval': nft_meta_bridge.c:(.text+0x1e8): undefined reference to `nft_meta_get_eval' net/bridge/netfilter/nft_meta_bridge.o: In function `nft_meta_bridge_get_init': nft_meta_bridge.c:(.text+0x468): undefined reference to `nft_meta_get_init' nft_meta_bridge.c:(.text+0x49c): undefined reference to `nft_parse_register' nft_meta_bridge.c:(.text+0x4cc): undefined reference to `nft_validate_register_store' net/bridge/netfilter/nft_meta_bridge.o: In function `nft_meta_bridge_module_exit': nft_meta_bridge.c:(.exit.text+0x14): undefined reference to `nft_unregister_expr' net/bridge/netfilter/nft_meta_bridge.o: In function `nft_meta_bridge_module_init': nft_meta_bridge.c:(.init.text+0x14): undefined reference to `nft_register_expr' net/bridge/netfilter/nft_meta_bridge.o:(.rodata+0x60): undefined reference to `nft_meta_get_dump' net/bridge/netfilter/nft_meta_bridge.o:(.rodata+0x88): undefined reference to `nft_meta_set_eval' This can happen because the NF_TABLES_BRIDGE dependency itself is just a 'bool'. Make the symbol a 'tristate' instead so Kconfig can propagate the dependencies correctly. Fixes: 30e103fe24de ("netfilter: nft_meta: move bridge meta keys into nft_meta_bridge") Signed-off-by: Arnd Bergmann Signed-off-by: Pablo Neira Ayuso commit 0e279dcea0ec897af1c979ebee4ec92b461793f5 Author: Takashi Iwai Date: Fri Jul 19 10:55:05 2019 +0200 ALSA: pcm: Fix refcount_inc() on zero usage The recent rewrite of PCM link lock management introduced the refcount in snd_pcm_group object, managed by the kernel refcount_t API. This caused unexpected kernel warnings when the kernel is built with CONFIG_REFCOUNT_FULL=y. As the warning line indicates, the problem is obviously that we start with refcount=0 and do refcount_inc() for adding each PCM link, while refcount_t API doesn't like refcount_inc() performed on zero. For adapting the proper refcount_t usage, this patch changes the logic slightly: - The initial refcount is 1, assuming the single list entry - The refcount is incremented / decremented at each PCM link addition and deletion - ... which allows us concentrating only on the refcount as a release condition Fixes: f57f3df03a8e ("ALSA: pcm: More fine-grained PCM link locking") BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=204221 Reported-and-tested-by: Duncan Overbruck Cc: Signed-off-by: Takashi Iwai commit 449fa54d6815be8c2c1f68fa9dbbae9384a7c03e Author: Fugang Duan Date: Fri Jul 19 17:26:48 2019 +0800 dma-direct: correct the physical addr in dma_direct_sync_sg_for_cpu/device dma_map_sg() may use swiotlb buffer when the kernel command line includes "swiotlb=force" or the dma_addr is out of dev->dma_mask range. After DMA complete the memory moving from device to memory, then user call dma_sync_sg_for_cpu() to sync with DMA buffer, and copy the original virtual buffer to other space. So dma_direct_sync_sg_for_cpu() should use swiotlb physical addr, not the original physical addr from sg_phys(sg). dma_direct_sync_sg_for_device() also has the same issue, correct it as well. Fixes: 55897af63091("dma-direct: merge swiotlb_dma_ops into the dma_direct code") Signed-off-by: Fugang Duan Reviewed-by: Robin Murphy Signed-off-by: Christoph Hellwig commit d6f0f2f19a9e41bd0bcd5757f68500ed29352509 Author: Mauro Carvalho Chehab Date: Thu Jul 18 16:13:48 2019 -0300 docs: load_config.py: ensure subdirs end with "/" The logic with seeks for a subdir passed via SPHINXDIRS is incomplete: if one uses something like: make SPHINXDIRS=arm pdfdocs It will find both "arm" and "arm64" directories. Worse than that, it will convert "arm64/index" to "4/index". Signed-off-by: Mauro Carvalho Chehab commit b4fc36e60f25cf22bf8b7b015a701015740c3743 Author: Shawn Anastasio Date: Wed Jul 17 18:54:37 2019 -0500 powerpc/dma: Fix invalid DMA mmap behavior The refactor of powerpc DMA functions in commit 6666cc17d780 ("powerpc/dma: remove dma_nommu_mmap_coherent") incorrectly changes the way DMA mappings are handled on powerpc. Since this change, all mapped pages are marked as cache-inhibited through the default implementation of arch_dma_mmap_pgprot. This differs from the previous behavior of only marking pages in noncoherent mappings as cache-inhibited and has resulted in sporadic system crashes in certain hardware configurations and workloads (see Bugzilla). This commit restores the previous correct behavior by providing an implementation of arch_dma_mmap_pgprot that only marks pages in noncoherent mappings as cache-inhibited. As this behavior should be universal for all powerpc platforms a new file, dma-generic.c, was created to store it. Fixes: 6666cc17d780 ("powerpc/dma: remove dma_nommu_mmap_coherent") # NOTE: fixes commit 6666cc17d780 released in v5.1. # Consider a stable tag: # Cc: stable@vger.kernel.org # v5.1+ # NOTE: fixes commit 6666cc17d780 released in v5.1. # Consider a stable tag: # Cc: stable@vger.kernel.org # v5.1+ Cc: stable@vger.kernel.org # v5.1+ Signed-off-by: Shawn Anastasio Reviewed-by: Alexey Kardashevskiy Reviewed-by: Christoph Hellwig Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20190717235437.12908-1-shawn@anastas.io commit 771a081e44a9baa1991ef011cc453ef425591740 Author: Hui Wang Date: Fri Jul 19 12:38:58 2019 +0300 Input: alps - fix a mismatch between a condition check and its comment In the function alps_is_cs19_trackpoint(), we check if the param[1] is in the 0x20~0x2f range, but the code we wrote for this checking is not correct: (param[1] & 0x20) does not mean param[1] is in the range of 0x20~0x2f, it also means the param[1] is in the range of 0x30~0x3f, 0x60~0x6f... Now fix it with a new condition checking ((param[1] & 0xf0) == 0x20). Fixes: 7e4935ccc323 ("Input: alps - don't handle ALPS cs19 trackpoint-only device") Cc: stable@vger.kernel.org Signed-off-by: Hui Wang Signed-off-by: Dmitry Torokhov commit 49e6979e7e92cf496105b5636f1df0ac17c159c0 Author: YueHaibing Date: Tue Jul 16 20:17:20 2019 +0200 Input: psmouse - fix build error of multiple definition trackpoint_detect() should be static inline while CONFIG_MOUSE_PS2_TRACKPOINT is not set, otherwise, we build fails: drivers/input/mouse/alps.o: In function `trackpoint_detect': alps.c:(.text+0x8e00): multiple definition of `trackpoint_detect' drivers/input/mouse/psmouse-base.o:psmouse-base.c:(.text+0x1b50): first defined here Reported-by: Hulk Robot Fixes: 55e3d9224b60 ("Input: psmouse - allow disabing certain protocol extensions") Signed-off-by: YueHaibing Signed-off-by: Dmitry Torokhov commit d56fef0ec85b8a8bae5d7d003b93f0a0aaf82ed9 Author: Mao Wenan Date: Tue Jul 16 20:16:28 2019 +0200 Input: applespi - remove set but not used variables 'sts' Fixes gcc '-Wunused-but-set-variable' warning: drivers/input/keyboard/applespi.c: In function applespi_set_bl_level: drivers/input/keyboard/applespi.c:902:6: warning: variable sts set but not used [-Wunused-but-set-variable] Fixes: b426ac0452093d ("Input: add Apple SPI keyboard and trackpad driver") Signed-off-by: Mao Wenan Signed-off-by: Dmitry Torokhov commit 038b1a05eae6666b731920e46f47d8e2332e07ff Author: Ronald Tschalär Date: Mon Jul 15 10:30:11 2019 -0700 Input: add Apple SPI keyboard and trackpad driver The keyboard and trackpad on recent MacBook's (since 8,1) and MacBookPro's (13,* and 14,*) are attached to an SPI controller instead of USB, as previously. The higher level protocol is not publicly documented and hence has been reverse engineered. As a consequence there are still a number of unknown fields and commands. However, the known parts have been working well and received extensive testing and use. In order for this driver to work, the proper SPI drivers need to be loaded too; for MB8,1 these are spi_pxa2xx_platform and spi_pxa2xx_pci; for all others they are spi_pxa2xx_platform and intel_lpss_pci. Link: https://bugzilla.kernel.org/show_bug.cgi?id=99891 Link: https://bugzilla.kernel.org/show_bug.cgi?id=108331 Signed-off-by: Ronald Tschalär Reviewed-by: Andy Shevchenko Signed-off-by: Dmitry Torokhov commit e320ab3cec7dd8b1606964d81ae1e14391ff8e96 Author: Dexuan Cui Date: Fri Jul 19 03:22:35 2019 +0000 x86/hyper-v: Zero out the VP ASSIST PAGE on allocation The VP ASSIST PAGE is an "overlay" page (see Hyper-V TLFS's Section 5.2.1 "GPA Overlay Pages" for the details) and here is an excerpt: "The hypervisor defines several special pages that "overlay" the guest's Guest Physical Addresses (GPA) space. Overlays are addressed GPA but are not included in the normal GPA map maintained internally by the hypervisor. Conceptually, they exist in a separate map that overlays the GPA map. If a page within the GPA space is overlaid, any SPA page mapped to the GPA page is effectively "obscured" and generally unreachable by the virtual processor through processor memory accesses. If an overlay page is disabled, the underlying GPA page is "uncovered", and an existing mapping becomes accessible to the guest." SPA = System Physical Address = the final real physical address. When a CPU (e.g. CPU1) is onlined, hv_cpu_init() allocates the VP ASSIST PAGE and enables the EOI optimization for this CPU by writing the MSR HV_X64_MSR_VP_ASSIST_PAGE. From now on, hvp->apic_assist belongs to the special SPA page, and this CPU *always* uses hvp->apic_assist (which is shared with the hypervisor) to decide if it needs to write the EOI MSR. When a CPU is offlined then on the outgoing CPU: 1. hv_cpu_die() disables the EOI optimizaton for this CPU, and from now on hvp->apic_assist belongs to the original "normal" SPA page; 2. the remaining work of stopping this CPU is done 3. this CPU is completely stopped. Between 1 and 3, this CPU can still receive interrupts (e.g. reschedule IPIs from CPU0, and Local APIC timer interrupts), and this CPU *must* write the EOI MSR for every interrupt received, otherwise the hypervisor may not deliver further interrupts, which may be needed to completely stop the CPU. So, after the EOI optimization is disabled in hv_cpu_die(), it's required that the hvp->apic_assist's bit0 is zero, which is not guaranteed by the current allocation mode because it lacks __GFP_ZERO. As a consequence the bit might be set and interrupt handling would not write the EOI MSR causing interrupt delivery to become stuck. Add the missing __GFP_ZERO to the allocation. Note 1: after the "normal" SPA page is allocted and zeroed out, neither the hypervisor nor the guest writes into the page, so the page remains with zeros. Note 2: see Section 10.3.5 "EOI Assist" for the details of the EOI optimization. When the optimization is enabled, the guest can still write the EOI MSR register irrespective of the "No EOI required" value, but that's slower than the optimized assist based variant. Fixes: ba696429d290 ("x86/hyper-v: Implement EOI assist") Signed-off-by: Dexuan Cui Signed-off-by: Thomas Gleixner Cc: stable@vger.kernel.org Link: https://lkml.kernel.org/r/ Date: Fri Jul 19 17:28:10 2019 +1000 Merge branch 'linux-5.3' of git://github.com/skeggsb/linux into drm-next nouveau fixes and TU116 enablement. Signed-off-by: Dave Airlie From: Ben Skeggs Link: https://patchwork.freedesktop.org/patch/msgid/CACAvsv5hZ3B4S9cVTPd2-Ug7dMSasLPJrWMyoDo4MOg8cbXWkA@mail.gmail.com commit 9fb7dc73b923ef5e9251ee7c58239a790720904c Merge: b3c8a40cfc4a 41a5a2a8531f Author: Dave Airlie Date: Fri Jul 19 17:21:48 2019 +1000 Merge tag 'drm-next-5.3-2019-07-18' of git://people.freedesktop.org/~agd5f/linux into drm-next drm-next-5.3-2019-07-18: amdgpu: - Navi DC fix for secondary adapters - Fix Navi flickering with high res panels - Navi SMU fixes - Vega20 SMU fixes - Fixes for audio hotplug on HG systems - Fix for potential integer overflows on large buffer migrations - debugfs fixes for umr - Various other small fixes amdkfd: - Apply noretry setting consistently - Fix hang in eviction - Properly clean up GWS on uninit UAPI: - clarify a comment on ctx priority Signed-off-by: Dave Airlie From: Alex Deucher Link: https://patchwork.freedesktop.org/patch/msgid/20190718211525.3374-1-alexander.deucher@amd.com commit 4d352dbd5850bfc752609d46b5c8403ae0bd5163 Author: Ben Skeggs Date: Tue Jul 2 16:29:40 2019 +1000 drm/nouveau/secboot/gp102-: remove WAR for SEC2 RTOS start bug Appears to be fixed by "flcn/gp102-: improve implementation of bind_context() on SEC2/GSP". Tested on GP10[24678] and GV100. Signed-off-by: Ben Skeggs commit 5210e967d3c9d32b5394c1f86edebb03e3202954 Author: Ben Skeggs Date: Tue Jul 2 07:52:15 2019 +1000 drm/nouveau/flcn/gp102-: improve implementation of bind_context() on SEC2/GSP Fixes various issues encountered while attempting to initialise ACR. Signed-off-by: Ben Skeggs commit 09b90e2fe35faeace2488234e2a7728f2ea8ba26 Author: Yongxin Liu Date: Mon Jul 1 09:46:22 2019 +0800 drm/nouveau: fix memory leak in nouveau_conn_reset() In nouveau_conn_reset(), if connector->state is true, __drm_atomic_helper_connector_destroy_state() will be called, but the memory pointed by asyc isn't freed. Memory leak happens in the following function __drm_atomic_helper_connector_reset(), where newly allocated asyc->state will be assigned to connector->state. So using nouveau_conn_atomic_destroy_state() instead of __drm_atomic_helper_connector_destroy_state to free the "old" asyc. Here the is the log showing memory leak. unreferenced object 0xffff8c5480483c80 (size 192): comm "kworker/0:2", pid 188, jiffies 4294695279 (age 53.179s) hex dump (first 32 bytes): 00 f0 ba 7b 54 8c ff ff 00 00 00 00 00 00 00 00 ...{T........... 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<000000005005c0d0>] kmem_cache_alloc_trace+0x195/0x2c0 [<00000000a122baed>] nouveau_conn_reset+0x25/0xc0 [nouveau] [<000000004fd189a2>] nouveau_connector_create+0x3a7/0x610 [nouveau] [<00000000c73343a8>] nv50_display_create+0x343/0x980 [nouveau] [<000000002e2b03c3>] nouveau_display_create+0x51f/0x660 [nouveau] [<00000000c924699b>] nouveau_drm_device_init+0x182/0x7f0 [nouveau] [<00000000cc029436>] nouveau_drm_probe+0x20c/0x2c0 [nouveau] [<000000007e961c3e>] local_pci_probe+0x47/0xa0 [<00000000da14d569>] work_for_cpu_fn+0x1a/0x30 [<0000000028da4805>] process_one_work+0x27c/0x660 [<000000001d415b04>] worker_thread+0x22b/0x3f0 [<0000000003b69f1f>] kthread+0x12f/0x150 [<00000000c94c29b7>] ret_from_fork+0x3a/0x50 Signed-off-by: Yongxin Liu Signed-off-by: Ben Skeggs commit d304654bd79332ace9ac46b9a3d8de60acb15da3 Author: Ralph Campbell Date: Fri Jun 14 13:20:03 2019 -0700 drm/nouveau/dmem: missing mutex_lock in error path In nouveau_dmem_pages_alloc(), the drm->dmem->mutex is unlocked before calling nouveau_dmem_chunk_alloc() as shown when CONFIG_PROVE_LOCKING is enabled: [ 1294.871933] ===================================== [ 1294.876656] WARNING: bad unlock balance detected! [ 1294.881375] 5.2.0-rc3+ #5 Not tainted [ 1294.885048] ------------------------------------- [ 1294.889773] test-malloc-vra/6299 is trying to release lock (&drm->dmem->mutex) at: [ 1294.897482] [] nouveau_dmem_migrate_alloc_and_copy+0x79f/0xbf0 [nouveau] [ 1294.905782] but there are no more locks to release! [ 1294.910690] [ 1294.910690] other info that might help us debug this: [ 1294.917249] 1 lock held by test-malloc-vra/6299: [ 1294.921881] #0: 0000000016e10454 (&mm->mmap_sem#2){++++}, at: nouveau_svmm_bind+0x142/0x210 [nouveau] [ 1294.931313] [ 1294.931313] stack backtrace: [ 1294.935702] CPU: 4 PID: 6299 Comm: test-malloc-vra Not tainted 5.2.0-rc3+ #5 [ 1294.942786] Hardware name: ASUS X299-A/PRIME X299-A, BIOS 1401 05/21/2018 [ 1294.949590] Call Trace: [ 1294.952059] dump_stack+0x7c/0xc0 [ 1294.955469] ? nouveau_dmem_migrate_alloc_and_copy+0x79f/0xbf0 [nouveau] [ 1294.962213] print_unlock_imbalance_bug.cold.52+0xca/0xcf [ 1294.967641] lock_release+0x306/0x380 [ 1294.971383] ? nouveau_dmem_migrate_alloc_and_copy+0x79f/0xbf0 [nouveau] [ 1294.978089] ? lock_downgrade+0x2d0/0x2d0 [ 1294.982121] ? find_held_lock+0xac/0xd0 [ 1294.985979] __mutex_unlock_slowpath+0x8f/0x3f0 [ 1294.990540] ? wait_for_completion+0x230/0x230 [ 1294.995002] ? rwlock_bug.part.2+0x60/0x60 [ 1294.999197] nouveau_dmem_migrate_alloc_and_copy+0x79f/0xbf0 [nouveau] [ 1295.005751] ? page_mapping+0x98/0x110 [ 1295.009511] migrate_vma+0xa74/0x1090 [ 1295.013186] ? move_to_new_page+0x480/0x480 [ 1295.017400] ? __kmalloc+0x153/0x300 [ 1295.021052] ? nouveau_dmem_migrate_vma+0xd8/0x1e0 [nouveau] [ 1295.026796] nouveau_dmem_migrate_vma+0x157/0x1e0 [nouveau] [ 1295.032466] ? nouveau_dmem_init+0x490/0x490 [nouveau] [ 1295.037612] ? vmacache_find+0xc2/0x110 [ 1295.041537] nouveau_svmm_bind+0x1b4/0x210 [nouveau] [ 1295.046583] ? nouveau_svm_fault+0x13e0/0x13e0 [nouveau] [ 1295.051912] drm_ioctl_kernel+0x14d/0x1a0 [ 1295.055930] ? drm_setversion+0x330/0x330 [ 1295.059971] drm_ioctl+0x308/0x530 [ 1295.063384] ? drm_version+0x150/0x150 [ 1295.067153] ? find_held_lock+0xac/0xd0 [ 1295.070996] ? __pm_runtime_resume+0x3f/0xa0 [ 1295.075285] ? mark_held_locks+0x29/0xa0 [ 1295.079230] ? _raw_spin_unlock_irqrestore+0x3c/0x50 [ 1295.084232] ? lockdep_hardirqs_on+0x17d/0x250 [ 1295.088768] nouveau_drm_ioctl+0x9a/0x100 [nouveau] [ 1295.093661] do_vfs_ioctl+0x137/0x9a0 [ 1295.097341] ? ioctl_preallocate+0x140/0x140 [ 1295.101623] ? match_held_lock+0x1b/0x230 [ 1295.105646] ? match_held_lock+0x1b/0x230 [ 1295.109660] ? find_held_lock+0xac/0xd0 [ 1295.113512] ? __do_page_fault+0x324/0x630 [ 1295.117617] ? lock_downgrade+0x2d0/0x2d0 [ 1295.121648] ? mark_held_locks+0x79/0xa0 [ 1295.125583] ? handle_mm_fault+0x352/0x430 [ 1295.129687] ksys_ioctl+0x60/0x90 [ 1295.133020] ? mark_held_locks+0x29/0xa0 [ 1295.136964] __x64_sys_ioctl+0x3d/0x50 [ 1295.140726] do_syscall_64+0x68/0x250 [ 1295.144400] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 1295.149465] RIP: 0033:0x7f1a3495809b [ 1295.153053] Code: 0f 1e fa 48 8b 05 ed bd 0c 00 64 c7 00 26 00 00 00 48 c7 c0 ff ff ff ff c3 66 0f 1f 44 00 00 f3 0f 1e fa b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d bd bd 0c 00 f7 d8 64 89 01 48 [ 1295.171850] RSP: 002b:00007ffef7ed1358 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1295.179451] RAX: ffffffffffffffda RBX: 00007ffef7ed1628 RCX: 00007f1a3495809b [ 1295.186601] RDX: 00007ffef7ed13b0 RSI: 0000000040406449 RDI: 0000000000000004 [ 1295.193759] RBP: 00007ffef7ed13b0 R08: 0000000000000000 R09: 000000000157e770 [ 1295.200917] R10: 000000000151c010 R11: 0000000000000246 R12: 0000000040406449 [ 1295.208083] R13: 0000000000000004 R14: 0000000000000000 R15: 0000000000000000 Reacquire the lock before continuing to the next page. Signed-off-by: Ralph Campbell Signed-off-by: Ben Skeggs commit 68bf8b577977a2804af82ffe03ce25d952f82fd2 Author: Karol Herbst Date: Tue Jun 18 13:01:33 2019 +0200 drm/nouveau/hwmon: return EINVAL if the GPU is powered down for sensors reads fixes bogus values userspace gets from hwmon while the GPU is powered down Signed-off-by: Karol Herbst Reviewed-by: Rhys Kidd Signed-off-by: Ben Skeggs commit b0f84a84fff180718995b1269da2988e5b28be42 Author: Ben Skeggs Date: Fri Jul 5 15:11:42 2019 +1000 drm/nouveau: fix bogus GPL-2 license header The bulk SPDX addition made all these files into GPL-2.0 licensed files. However the remainder of the project is MIT-licensed, these files were simply missing the boiler plate and got caught up in the global update. Fixes: 96ac6d4351004 (treewide: Add SPDX license identifier - Kbuild) Signed-off-by: Ben Skeggs commit b7019ac550eb3916f34d79db583e9b7ea2524afa Author: Ilia Mirkin Date: Wed Jun 19 20:13:43 2019 -0400 drm/nouveau: fix bogus GPL-2 license header The bulk SPDX addition made all these files into GPL-2.0 licensed files. However the remainder of the project is MIT-licensed, these files (primarily header files) were simply missing the boiler plate and got caught up in the global update. Fixes: b24413180f5 (License cleanup: add SPDX GPL-2.0 license identifier to files with no license) Signed-off-by: Ilia Mirkin Acked-by: Emil Velikov Acked-by: Karol Herbst Signed-off-by: Ben Skeggs commit 7cb95eeea6706c790571042a06782e378b2561ea Author: Lyude Paul Date: Wed Jun 26 14:10:27 2019 -0400 drm/nouveau/i2c: Enable i2c pads & busses during preinit It turns out that while disabling i2c bus access from software when the GPU is suspended was a step in the right direction with: commit 342406e4fbba ("drm/nouveau/i2c: Disable i2c bus access after ->fini()") We also ended up accidentally breaking the vbios init scripts on some older Tesla GPUs, as apparently said scripts can actually use the i2c bus. Since these scripts are executed before initializing any subdevices, we end up failing to acquire access to the i2c bus which has left a number of cards with their fan controllers uninitialized. Luckily this doesn't break hardware - it just means the fan gets stuck at 100%. This also means that we've always been using our i2c busses before initializing them during the init scripts for older GPUs, we just didn't notice it until we started preventing them from being used until init. It's pretty impressive this never caused us any issues before! So, fix this by initializing our i2c pad and busses during subdev pre-init. We skip initializing aux busses during pre-init, as those are guaranteed to only ever be used by nouveau for DP aux transactions. Signed-off-by: Lyude Paul Tested-by: Marc Meledandri Fixes: 342406e4fbba ("drm/nouveau/i2c: Disable i2c bus access after ->fini()") Cc: stable@vger.kernel.org Signed-off-by: Ben Skeggs commit 3485b7b50b53953d6e9e7cb997949f42bc624853 Author: Ben Skeggs Date: Tue Jun 18 18:40:16 2019 +1000 drm/nouveau/disp/tu102-: wire up scdc parameter setter Regs seem valid here still, and tested on TU116. Signed-off-by: Ben Skeggs commit 75dec321cd2dceb439686b771c67e677c47618c5 Author: Ben Skeggs Date: Mon Jun 17 12:52:48 2019 +1000 drm/nouveau/core: recognise TU116 chipset Modesetting only, still waiting on ACR/GR firmware from NVIDIA for Turing graphics/compute bring-up. Each subsystem was compared with traces, along with various tests to check that things generally work as they should, and appears compatible enough with the current TU117 code to enable support. Signed-off-by: Ben Skeggs commit d1084184789d677df4e9c110f38cb3f3d709195d Author: Ben Skeggs Date: Wed May 29 09:58:18 2019 +1000 drm/nouveau/kms: disallow dual-link harder if hdmi connection detected The fallthrough cases (pre-Fermi) would accidentally allow dual-link pixel clocks even where they shouldn't be. This leads to a high resolution HDMI displays, connected via a DVI->HDMI adapter, to fail on the original NV50. Signed-off-by: Ben Skeggs commit 533f4752407543f488a9118d817b8c504352b6fb Author: Ilia Mirkin Date: Sat May 25 18:41:49 2019 -0400 drm/nouveau/disp/nv50-: fix center/aspect-corrected scaling Previously center scaling would get scaling applied to it (when it was only supposed to center the image), and aspect-corrected scaling did not always correctly pick whether to reduce width or height for a particular combination of inputs/outputs. Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=110660 Signed-off-by: Ilia Mirkin Signed-off-by: Ben Skeggs commit f8d6211ac77f0d1f7aebc64e961dc28771ba0052 Author: Ilia Mirkin Date: Sat May 25 18:41:48 2019 -0400 drm/nouveau/disp/nv50-: force scaler for any non-default LVDS/eDP modes Higher layers tend to add a lot of modes not actually in the EDID, such as the standard DMT modes. Changing this would be extremely intrusive to everyone, so just force the scaler more often. There are no practical cases we're aware of where a LVDS/eDP panel has multiple resolutions exposed, and i915 already does it this way. Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=110660 Signed-off-by: Ilia Mirkin Signed-off-by: Ben Skeggs commit bb2b4074f8d99214718f45c379ceb74564aad3bc Author: Timo Wiren Date: Wed May 22 20:01:06 2019 +0300 drm/nouveau/mcp89/mmu: Use mcp77_mmu_new instead of g84_mmu_new on MCP89. Fix a crash or broken depth testing in all OpenGL applications that use the depth buffer on MCP89 (GeForce 320M) seen on a MacBook Pro Late 2010. The bug is tracked in https://bugs.freedesktop.org/show_bug.cgi?id=108500 Signed-off-by: Timo Wiren Signed-off-by: Ben Skeggs commit bdfeb0ccea1a12b58299b95eb0f28e2aa26de4c2 Author: Guo Ren Date: Fri Jun 28 20:39:46 2019 +0800 csky: Fixup abiv1 memset error Current memset implementation in abiv1 is wrong and it'll cause unalign access. Just remove it and use the generic one. This patch will cause performance degradation and we will improve it with a new design in next patchset. Signed-off-by: Guo Ren Cc: Arnd Bergmann commit 4e562c11664c0e0e84bb8495894b8637acc1c095 Author: Guo Ren Date: Tue Jun 18 20:34:35 2019 +0800 csky: Improve tlb operation with help of asid There are two generations of tlb operation instruction for C-SKY. First generation is use mcr register and it need software do more things, second generation is use specific instructions, eg: tlbi.va, tlbi.vas, tlbi.alls We implemented the following functions: - flush_tlb_range (a range of entries) - flush_tlb_page (one entry) Above functions use asid from vma->mm to invalid tlb entries and we could use tlbi.vas instruction for newest generation csky cpu. - flush_tlb_kernel_range - flush_tlb_one Above functions don't care asid and it invalid the tlb entries only with vpn and we could use tlbi.vaas instruction for newest generat- ion csky cpu. Signed-off-by: Guo Ren Cc: Arnd Bergmann commit 22d55f02b8922a097cd4be1e2f131dfa7ef65901 Author: Guo Ren Date: Tue Jun 18 20:33:32 2019 +0800 csky: Use generic asid algorithm to implement switch_mm Use linux generic asid/vmid algorithm to implement csky switch_mm function. The algorithm is from arm and it could work with SMP system. It'll help reduce tlb flush for switch_mm in task/vm switch. Signed-off-by: Guo Ren Cc: Arnd Bergmann commit a231b8839cd4259de1d37a78165739a4d5d08e72 Author: Guo Ren Date: Tue Jun 18 20:06:52 2019 +0800 csky: Add new asid lib code from arm This patch only contains asid help code from arm for next patch to use. The asid allocator use five level check to reduce the cost of switch_mm. 1. Check if the asid version is the same (it's general) 2. Check reserved_asid which is set in rollover flush_context() and key point is to keep the same bit position with the current asid version instead of input version. 3. Check if the position of bitmap is free then it could be set & used directly. 4. find_next_zero_bit() (a little performance cost) 5. flush_context (this is the worst cost with increase current asid version) Check is level by level and cost is also higher with the next level. The reserved_asid and bitmap mechanism prevent unnecessary find_next_zero_bit(). The atomic 64 bit asid is also suitable for 32-bit system and it won't cost a lot in 1th 2th 3th level check. The operation of set/clear mm_cpumask was removed in arm64 compared to arm32. It seems no side effect on current arm64 system, but from software meaning it's wrong. Although csky also needn't it, we add it back for csky. The asid_per_ctxt is no use for csky and it reserves the lowest bits for other use, maybe: trust zone ? Ok, just keep it in csky copy. Seems it also could be used by other archs and it's worth to move asid code to generic in future. Signed-off-by: Guo Ren Cc: Arnd Bergmann Cc: Julien Grall commit 9d35dc3006a9865eb5b55cc79df49933601131f8 Author: Guo Ren Date: Tue Jun 18 17:20:10 2019 +0800 csky: Revert mmu ASID mechanism Current C-SKY ASID mechanism is from mips and it doesn't work well with multi-cores. ASID per core mechanism is not suitable for C-SKY SMP tlb maintain operations, eg: tlbi.vas need share the same asid in all processors and it'll invalid the tlb entry in all cores with the same asid. This patch is prepare for new ASID mechanism. Signed-off-by: Guo Ren Cc: Arnd Bergmann commit 4d581034f9086f784a3408575bdb3c201740c6cb Author: Mao Han Date: Tue Jun 4 18:54:47 2019 +0800 dt-bindings: csky: Add csky PMU bindings This patch adds the documentation to describe that how to add pmu node in dts. Signed-off-by: Mao Han Signed-off-by: Guo Ren Cc: Rob Herring commit 69d812f5eb249bf30069f81dd508aa4548ec6eb1 Author: Guo Ren Date: Thu Jun 6 15:37:32 2019 +0800 dt-bindings: interrupt-controller: Update csky mpintc Add trigger type setting for csky,mpintc. The driver also could support #interrupt-cells <1> and it wouldn't invalidate existing DTs. Here we only show the complete format. Signed-off-by: Guo Ren Reviewed-by: Rob Herring Cc: Marc Zyngier commit e7534198abd6af7091a40d79cbb365a80ba9f82d Author: Guo Ren Date: Tue Jun 4 18:54:48 2019 +0800 csky: Fixup some error count in 810 & 860. CK810 pmu only support event with index 0-8 and 0xd; CK860 only support event 1~4, 0xa~0x1b. So do not register unsupport event to hardware cache event, which may leader to unknown behavior. Signed-off-by: Mao Han Signed-off-by: Guo Ren commit d41435d9b2b3f8fb58dc1258220401ad16aa8a19 Author: Mao Han Date: Tue Jun 4 18:54:49 2019 +0800 csky: Fix perf record in kernel/user space csky_pmu_event_init is called several times during the perf record initialzation. After configure the event counter in either kernel space or user space, csky_pmu_event_init is called twice with no attr specified. Configuration will be overwritten with sampling in both kernel space and user space. --all-kernel/--all-user is useless without this patch applied. Signed-off-by: Mao Han Signed-off-by: Guo Ren commit f622fbf205966a8e911f81a00db17997dd171404 Author: Mao Han Date: Tue Jun 4 18:54:46 2019 +0800 csky: Add pmu interrupt support This patch add interrupt request and handler for csky pmu. perf can record on hardware event with this patch applied. Signed-off-by: Mao Han Signed-off-by: Guo Ren commit ccffa1ad15be95b11dab128e1a59270057322934 Author: Mao Han Date: Tue Jun 4 18:54:45 2019 +0800 csky: Add count-width property for csky pmu The csky pmu counter may have different io width. When the counter is smaller then 64 bits and counter value is smaller than the old value, it will result to a extremely large delta value. So the sampled value should be extend to 64 bits to avoid this, the extension bits base on the count-width property from dts. Signed-off-by: Mao Han Signed-off-by: Guo Ren commit f132076c8ff9ec1603c7079c3ce3b2cce8b72a89 Author: Mao Han Date: Tue Jun 4 18:54:44 2019 +0800 csky: Init pmu as a device This patch change the csky pmu initialization from arch init to device init. The pmu can be configued with information from device tree(pmu device name, irq number and etc.). Signed-off-by: Mao Han Signed-off-by: Guo Ren commit 3158d28953fcd85492b28b1d2d5a5e20bb62a626 Author: Guo Ren Date: Fri May 10 17:07:01 2019 +0800 csky: Fixup no panic in kernel for some traps These traps couldn't be hanppen in kernel and we must panic there not send a signal to userspace. Signed-off-by: Guo Ren Cc: Arnd Bergmann commit 1994cc49f18b47a18dfb0371063fc9d80c464b33 Author: Guo Ren Date: Fri May 10 12:57:27 2019 +0800 csky: Select intc & timer drivers Let arch help to select interrupt controller's and timer's drivers instead of people using menuconfig to select. This help the mini system boot up. Signed-off-by: Guo Ren Cc: Arnd Bergmann commit 56ac5e2139331898f29e6990f67ae8d2f080686b Author: Paul Walmsley Date: Thu Jul 18 17:15:06 2019 -0700 riscv: enable sys_clone3 syscall for rv64 Enable the sys_clone3 syscall for RV64. We simply include the generic version. Tested by running the program from https://lore.kernel.org/lkml/20190716130631.tohj4ub54md25dys@brauner.io/ and verifying that it completes successfully. Signed-off-by: Paul Walmsley Acked-by: Christian Brauner Cc: Christian Brauner commit 9798f4ea71eaf8eaad7e688c5b298528089c7bf8 Author: Cédric Le Goater Date: Thu Jul 18 23:51:54 2019 +0200 KVM: PPC: Book3S HV: XIVE: fix rollback when kvmppc_xive_create fails The XIVE device structure is now allocated in kvmppc_xive_get_device() and kfree'd in kvmppc_core_destroy_vm(). In case of an OPAL error when allocating the XIVE VPs, the kfree() call in kvmppc_xive_*create() will result in a double free and corrupt the host memory. Fixes: 5422e95103cf ("KVM: PPC: Book3S HV: XIVE: Replace the 'destroy' method by a 'release' method") Cc: stable@vger.kernel.org # v5.2+ Signed-off-by: Cédric Le Goater Tested-by: Michael Ellerman Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/6ea6998b-a890-2511-01d1-747d7621eb19@kaod.org commit 8d650cdedaabb33e85e9b7c517c0c71fcecc1de9 Author: Eric Dumazet Date: Thu Jul 18 19:28:14 2019 -0700 tcp: fix tcp_set_congestion_control() use from bpf hook Neal reported incorrect use of ns_capable() from bpf hook. bpf_setsockopt(...TCP_CONGESTION...) -> tcp_set_congestion_control() -> ns_capable(sock_net(sk)->user_ns, CAP_NET_ADMIN) -> ns_capable_common() -> current_cred() -> rcu_dereference_protected(current->cred, 1) Accessing 'current' in bpf context makes no sense, since packets are processed from softirq context. As Neal stated : The capability check in tcp_set_congestion_control() was written assuming a system call context, and then was reused from a BPF call site. The fix is to add a new parameter to tcp_set_congestion_control(), so that the ns_capable() call is only performed under the right context. Fixes: 91b5b21c7c16 ("bpf: Add support for changing congestion control") Signed-off-by: Eric Dumazet Cc: Lawrence Brakmo Reported-by: Neal Cardwell Acked-by: Neal Cardwell Acked-by: Lawrence Brakmo Signed-off-by: David S. Miller commit 269b7c5ff78264e3728b95828d219e0e0eeaec94 Author: Wei Yongjun Date: Fri Jul 19 01:22:06 2019 +0000 ag71xx: fix return value check in ag71xx_probe() In case of error, the function of_get_mac_address() returns ERR_PTR() and never returns NULL. The NULL test in the return value check should be replaced with IS_ERR(). Fixes: d51b6ce441d3 ("net: ethernet: add ag71xx driver") Signed-off-by: Wei Yongjun Reviewed-by: Oleksij Rempel Signed-off-by: David S. Miller commit 6f5fa8d2c05f247ab50440df0f07867ae0fc9050 Author: Wei Yongjun Date: Fri Jul 19 01:21:57 2019 +0000 ag71xx: fix error return code in ag71xx_probe() Fix to return error code -ENOMEM from the dmam_alloc_coherent() error handling case instead of 0, as done elsewhere in this function. Fixes: d51b6ce441d3 ("net: ethernet: add ag71xx driver") Signed-off-by: Wei Yongjun Reviewed-by: Oleksij Rempel Signed-off-by: David S. Miller commit eec4844fae7c033a0c1fc1eb3b8517aeb8b6cc49 Author: Matteo Croce Date: Thu Jul 18 15:58:50 2019 -0700 proc/sysctl: add shared variables for range check In the sysctl code the proc_dointvec_minmax() function is often used to validate the user supplied value between an allowed range. This function uses the extra1 and extra2 members from struct ctl_table as minimum and maximum allowed value. On sysctl handler declaration, in every source file there are some readonly variables containing just an integer which address is assigned to the extra1 and extra2 members, so the sysctl range is enforced. The special values 0, 1 and INT_MAX are very often used as range boundary, leading duplication of variables like zero=0, one=1, int_max=INT_MAX in different source files: $ git grep -E '\.extra[12].*&(zero|one|int_max)' |wc -l 248 Add a const int array containing the most commonly used values, some macros to refer more easily to the correct array member, and use them instead of creating a local one for every object file. This is the bloat-o-meter output comparing the old and new binary compiled with the default Fedora config: # scripts/bloat-o-meter -d vmlinux.o.old vmlinux.o add/remove: 2/2 grow/shrink: 0/2 up/down: 24/-188 (-164) Data old new delta sysctl_vals - 12 +12 __kstrtab_sysctl_vals - 12 +12 max 14 10 -4 int_max 16 - -16 one 68 - -68 zero 128 28 -100 Total: Before=20583249, After=20583085, chg -0.00% [mcroce@redhat.com: tipc: remove two unused variables] Link: http://lkml.kernel.org/r/20190530091952.4108-1-mcroce@redhat.com [akpm@linux-foundation.org: fix net/ipv6/sysctl_net_ipv6.c] [arnd@arndb.de: proc/sysctl: make firmware loader table conditional] Link: http://lkml.kernel.org/r/20190617130014.1713870-1-arnd@arndb.de [akpm@linux-foundation.org: fix fs/eventpoll.c] Link: http://lkml.kernel.org/r/20190430180111.10688-1-mcroce@redhat.com Signed-off-by: Matteo Croce Signed-off-by: Arnd Bergmann Acked-by: Kees Cook Reviewed-by: Aaron Tomlin Cc: Matthew Wilcox Cc: Stephen Rothwell Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 371096949f0ad3950b06729989bd27de51b8c5f5 Author: Keith Busch Date: Thu Jul 18 15:58:46 2019 -0700 mm: migrate: remove unused mode argument migrate_page_move_mapping() doesn't use the mode argument. Remove it and update callers accordingly. Link: http://lkml.kernel.org/r/20190508210301.8472-1-keith.busch@intel.com Signed-off-by: Keith Busch Reviewed-by: Zi Yan Cc: Mel Gorman Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 9a845030427c7a2879a7d635cc7c0e5f79ec962d Author: Dan Williams Date: Thu Jul 18 15:58:43 2019 -0700 mm/sparsemem: cleanup 'section number' data types David points out that there is a mixture of 'int' and 'unsigned long' usage for section number data types. Update the memory hotplug path to use 'unsigned long' consistently for section numbers. [akpm@linux-foundation.org: fix printk format] Link: http://lkml.kernel.org/r/156107543656.1329419.11505835211949439815.stgit@dwillia2-desk3.amr.corp.intel.com Signed-off-by: Dan Williams Reported-by: David Hildenbrand Reviewed-by: David Hildenbrand Cc: Michal Hocko Cc: Oscar Salvador Cc: Jason Gunthorpe Cc: Christoph Hellwig Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit a3619190d62ed9d66416891be2416f6bea2b3ca4 Author: Dan Williams Date: Thu Jul 18 15:58:40 2019 -0700 libnvdimm/pfn: stop padding pmem namespaces to section alignment Now that the mm core supports section-unaligned hotplug of ZONE_DEVICE memory, we no longer need to add padding at pfn/dax device creation time. The kernel will still honor padding established by older kernels. Link: http://lkml.kernel.org/r/156092356588.979959.6793371748950931916.stgit@dwillia2-desk3.amr.corp.intel.com Signed-off-by: Dan Williams Reported-by: Jeff Moyer Tested-by: Aneesh Kumar K.V [ppc64] Cc: David Hildenbrand Cc: Jane Chu Cc: Jérôme Glisse Cc: Jonathan Corbet Cc: Logan Gunthorpe Cc: Michal Hocko Cc: Mike Rapoport Cc: Oscar Salvador Cc: Pavel Tatashin Cc: Toshi Kani Cc: Vlastimil Babka Cc: Wei Yang Cc: Jason Gunthorpe Cc: Christoph Hellwig Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 7e3e888dfc138089f4c15a81b418e88f0978f744 Author: Dan Williams Date: Thu Jul 18 15:58:36 2019 -0700 libnvdimm/pfn: fix fsdax-mode namespace info-block zero-fields At namespace creation time there is the potential for the "expected to be zero" fields of a 'pfn' info-block to be filled with indeterminate data. While the kernel buffer is zeroed on allocation it is immediately overwritten by nd_pfn_validate() filling it with the current contents of the on-media info-block location. For fields like, 'flags' and the 'padding' it potentially means that future implementations can not rely on those fields being zero. In preparation to stop using the 'start_pad' and 'end_trunc' fields for section alignment, arrange for fields that are not explicitly initialized to be guaranteed zero. Bump the minor version to indicate it is safe to assume the 'padding' and 'flags' are zero. Otherwise, this corruption is expected to benign since all other critical fields are explicitly initialized. Note The cc: stable is about spreading this new policy to as many kernels as possible not fixing an issue in those kernels. It is not until the change titled "libnvdimm/pfn: Stop padding pmem namespaces to section alignment" where this improper initialization becomes a problem. So if someone decides to backport "libnvdimm/pfn: Stop padding pmem namespaces to section alignment" (which is not tagged for stable), make sure this pre-requisite is flagged. Link: http://lkml.kernel.org/r/156092356065.979959.6681003754765958296.stgit@dwillia2-desk3.amr.corp.intel.com Fixes: 32ab0a3f5170 ("libnvdimm, pmem: 'struct page' for pmem") Signed-off-by: Dan Williams Tested-by: Aneesh Kumar K.V [ppc64] Cc: Cc: David Hildenbrand Cc: Jane Chu Cc: Jeff Moyer Cc: Jérôme Glisse Cc: Jonathan Corbet Cc: Logan Gunthorpe Cc: Michal Hocko Cc: Mike Rapoport Cc: Oscar Salvador Cc: Pavel Tatashin Cc: Toshi Kani Cc: Vlastimil Babka Cc: Wei Yang Cc: Jason Gunthorpe Cc: Christoph Hellwig Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 7cc7867fb06166ac113eda9cf20d3c15d95ff6f5 Author: Dan Williams Date: Thu Jul 18 15:58:33 2019 -0700 mm/devm_memremap_pages: enable sub-section remap Teach devm_memremap_pages() about the new sub-section capabilities of arch_{add,remove}_memory(). Effectively, just replace all usage of align_start, align_end, and align_size with res->start, res->end, and resource_size(res). The existing sanity check will still make sure that the two separate remap attempts do not collide within a sub-section (2MB on x86). Link: http://lkml.kernel.org/r/156092355542.979959.10060071713397030576.stgit@dwillia2-desk3.amr.corp.intel.com Signed-off-by: Dan Williams Tested-by: Aneesh Kumar K.V [ppc64] Cc: Michal Hocko Cc: Toshi Kani Cc: Jérôme Glisse Cc: Logan Gunthorpe Cc: Oscar Salvador Cc: Pavel Tatashin Cc: David Hildenbrand Cc: Jane Chu Cc: Jeff Moyer Cc: Jonathan Corbet Cc: Mike Rapoport Cc: Vlastimil Babka Cc: Wei Yang Cc: Jason Gunthorpe Cc: Christoph Hellwig Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit a0653406a3a671c1609d54835f0443869525ca30 Author: Dan Williams Date: Thu Jul 18 15:58:29 2019 -0700 mm: document ZONE_DEVICE memory-model implications Explain the general mechanisms of 'ZONE_DEVICE' pages and list the users of 'devm_memremap_pages()'. [dan.j.williams@intel.com: update ZONE_DEVICE memory model documentation] Link: http://lkml.kernel.org/r/156109575458.1409767.1885676287099277666.stgit@dwillia2-desk3.amr.corp.intel.com Link: http://lkml.kernel.org/r/156092354985.979959.15763234410543451710.stgit@dwillia2-desk3.amr.corp.intel.com Signed-off-by: Dan Williams Reported-by: Mike Rapoport Reviewed-by: Mike Rapoport Tested-by: Aneesh Kumar K.V [ppc64] Cc: Jonathan Corbet Cc: David Hildenbrand Cc: Jane Chu Cc: Jeff Moyer Cc: Jérôme Glisse Cc: Logan Gunthorpe Cc: Michal Hocko Cc: Oscar Salvador Cc: Pavel Tatashin Cc: Toshi Kani Cc: Vlastimil Babka Cc: Wei Yang Cc: Jason Gunthorpe Cc: Christoph Hellwig Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit ba72b4c8cf60e452cf6f0258ed9ee697957b7dfd Author: Dan Williams Date: Thu Jul 18 15:58:26 2019 -0700 mm/sparsemem: support sub-section hotplug The libnvdimm sub-system has suffered a series of hacks and broken workarounds for the memory-hotplug implementation's awkward section-aligned (128MB) granularity. For example the following backtrace is emitted when attempting arch_add_memory() with physical address ranges that intersect 'System RAM' (RAM) with 'Persistent Memory' (PMEM) within a given section: # cat /proc/iomem | grep -A1 -B1 Persistent\ Memory 100000000-1ffffffff : System RAM 200000000-303ffffff : Persistent Memory (legacy) 304000000-43fffffff : System RAM 440000000-23ffffffff : Persistent Memory 2400000000-43bfffffff : Persistent Memory 2400000000-43bfffffff : namespace2.0 WARNING: CPU: 38 PID: 928 at arch/x86/mm/init_64.c:850 add_pages+0x5c/0x60 [..] RIP: 0010:add_pages+0x5c/0x60 [..] Call Trace: devm_memremap_pages+0x460/0x6e0 pmem_attach_disk+0x29e/0x680 [nd_pmem] ? nd_dax_probe+0xfc/0x120 [libnvdimm] nvdimm_bus_probe+0x66/0x160 [libnvdimm] It was discovered that the problem goes beyond RAM vs PMEM collisions as some platform produce PMEM vs PMEM collisions within a given section. The libnvdimm workaround for that case revealed that the libnvdimm section-alignment-padding implementation has been broken for a long while. A fix for that long-standing breakage introduces as many problems as it solves as it would require a backward-incompatible change to the namespace metadata interpretation. Instead of that dubious route [1], address the root problem in the memory-hotplug implementation. Note that EEXIST is no longer treated as success as that is how sparse_add_section() reports subsection collisions, it was also obviated by recent changes to perform the request_region() for 'System RAM' before arch_add_memory() in the add_memory() sequence. [1] https://lore.kernel.org/r/155000671719.348031.2347363160141119237.stgit@dwillia2-desk3.amr.corp.intel.com [osalvador@suse.de: fix deactivate_section for early sections] Link: http://lkml.kernel.org/r/20190715081549.32577-2-osalvador@suse.de Link: http://lkml.kernel.org/r/156092354368.979959.6232443923440952359.stgit@dwillia2-desk3.amr.corp.intel.com Signed-off-by: Dan Williams Signed-off-by: Oscar Salvador Tested-by: Aneesh Kumar K.V [ppc64] Reviewed-by: Oscar Salvador Cc: Michal Hocko Cc: Vlastimil Babka Cc: Logan Gunthorpe Cc: Pavel Tatashin Cc: David Hildenbrand Cc: Jane Chu Cc: Jeff Moyer Cc: Jérôme Glisse Cc: Jonathan Corbet Cc: Mike Rapoport Cc: Toshi Kani Cc: Wei Yang Cc: Jason Gunthorpe Cc: Christoph Hellwig Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 7ea6216049ff9cf250a6722cd766d99c8d1424e5 Author: Dan Williams Date: Thu Jul 18 15:58:22 2019 -0700 mm/sparsemem: prepare for sub-section ranges Prepare the memory hot-{add,remove} paths for handling sub-section ranges by plumbing the starting page frame and number of pages being handled through arch_{add,remove}_memory() to sparse_{add,remove}_one_section(). This is simply plumbing, small cleanups, and some identifier renames. No intended functional changes. Link: http://lkml.kernel.org/r/156092353780.979959.9713046515562743194.stgit@dwillia2-desk3.amr.corp.intel.com Signed-off-by: Dan Williams Reviewed-by: Pavel Tatashin Tested-by: Aneesh Kumar K.V [ppc64] Reviewed-by: Oscar Salvador Cc: Michal Hocko Cc: Vlastimil Babka Cc: Logan Gunthorpe Cc: David Hildenbrand Cc: Jane Chu Cc: Jeff Moyer Cc: Jérôme Glisse Cc: Jonathan Corbet Cc: Mike Rapoport Cc: Toshi Kani Cc: Wei Yang Cc: Jason Gunthorpe Cc: Christoph Hellwig Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 46d945aeab4d7dd837bd0724662de2caf712f047 Author: Dan Williams Date: Thu Jul 18 15:58:18 2019 -0700 mm: kill is_dev_zone() helper Given there are no more usages of is_dev_zone() outside of 'ifdef CONFIG_ZONE_DEVICE' protection, kill off the compilation helper. Link: http://lkml.kernel.org/r/156092353211.979959.1489004866360828964.stgit@dwillia2-desk3.amr.corp.intel.com Signed-off-by: Dan Williams Reviewed-by: Oscar Salvador Reviewed-by: Pavel Tatashin Reviewed-by: Wei Yang Acked-by: David Hildenbrand Tested-by: Aneesh Kumar K.V [ppc64] Cc: Michal Hocko Cc: Logan Gunthorpe Cc: Jane Chu Cc: Jeff Moyer Cc: Jérôme Glisse Cc: Jonathan Corbet Cc: Mike Rapoport Cc: Toshi Kani Cc: Vlastimil Babka Cc: Jason Gunthorpe Cc: Christoph Hellwig Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 96da4350000973ef9310a10d077d65bbc017f093 Author: Dan Williams Date: Thu Jul 18 15:58:15 2019 -0700 mm/hotplug: kill is_dev_zone() usage in __remove_pages() The zone type check was a leftover from the cleanup that plumbed altmap through the memory hotplug path, i.e. commit da024512a1fa "mm: pass the vmem_altmap to arch_remove_memory and __remove_pages". Link: http://lkml.kernel.org/r/156092352642.979959.6664333788149363039.stgit@dwillia2-desk3.amr.corp.intel.com Signed-off-by: Dan Williams Reviewed-by: David Hildenbrand Reviewed-by: Oscar Salvador Tested-by: Aneesh Kumar K.V [ppc64] Cc: Michal Hocko Cc: Logan Gunthorpe Cc: Pavel Tatashin Cc: Jane Chu Cc: Jeff Moyer Cc: Jérôme Glisse Cc: Jonathan Corbet Cc: Mike Rapoport Cc: Toshi Kani Cc: Vlastimil Babka Cc: Wei Yang Cc: Jason Gunthorpe Cc: Christoph Hellwig Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit e9c0a3f05477e18d2dae816cb61b62be1b7e90d3 Author: Dan Williams Date: Thu Jul 18 15:58:11 2019 -0700 mm/sparsemem: convert kmalloc_section_memmap() to populate_section_memmap() Allow sub-section sized ranges to be added to the memmap. populate_section_memmap() takes an explict pfn range rather than assuming a full section, and those parameters are plumbed all the way through to vmmemap_populate(). There should be no sub-section usage in current deployments. New warnings are added to clarify which memmap allocation paths are sub-section capable. Link: http://lkml.kernel.org/r/156092352058.979959.6551283472062305149.stgit@dwillia2-desk3.amr.corp.intel.com Signed-off-by: Dan Williams Reviewed-by: Pavel Tatashin Tested-by: Aneesh Kumar K.V [ppc64] Reviewed-by: Oscar Salvador Cc: Michal Hocko Cc: David Hildenbrand Cc: Logan Gunthorpe Cc: Jane Chu Cc: Jeff Moyer Cc: Jérôme Glisse Cc: Jonathan Corbet Cc: Mike Rapoport Cc: Toshi Kani Cc: Vlastimil Babka Cc: Wei Yang Cc: Jason Gunthorpe Cc: Christoph Hellwig Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 49ba3c6b37b38b58251c27864f551908c583e99d Author: Dan Williams Date: Thu Jul 18 15:58:07 2019 -0700 mm/hotplug: prepare shrink_{zone, pgdat}_span for sub-section removal Sub-section hotplug support reduces the unit of operation of hotplug from section-sized-units (PAGES_PER_SECTION) to sub-section-sized units (PAGES_PER_SUBSECTION). Teach shrink_{zone,pgdat}_span() to consider PAGES_PER_SUBSECTION boundaries as the points where pfn_valid(), not valid_section(), can toggle. [osalvador@suse.de: fix shrink_{zone,node}_span] Link: http://lkml.kernel.org/r/20190717090725.23618-3-osalvador@suse.de Link: http://lkml.kernel.org/r/156092351496.979959.12703722803097017492.stgit@dwillia2-desk3.amr.corp.intel.com Signed-off-by: Dan Williams Signed-off-by: Oscar Salvador Reviewed-by: Pavel Tatashin Reviewed-by: Oscar Salvador Tested-by: Aneesh Kumar K.V [ppc64] Cc: Michal Hocko Cc: Vlastimil Babka Cc: Logan Gunthorpe Cc: David Hildenbrand Cc: Jane Chu Cc: Jeff Moyer Cc: Jérôme Glisse Cc: Jonathan Corbet Cc: Mike Rapoport Cc: Toshi Kani Cc: Wei Yang Cc: Jason Gunthorpe Cc: Christoph Hellwig Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit f46edbd1b1516da1fb34c917775168d5df576f78 Author: Dan Williams Date: Thu Jul 18 15:58:04 2019 -0700 mm/sparsemem: add helpers track active portions of a section at boot Prepare for hot{plug,remove} of sub-ranges of a section by tracking a sub-section active bitmask, each bit representing a PMD_SIZE span of the architecture's memory hotplug section size. The implications of a partially populated section is that pfn_valid() needs to go beyond a valid_section() check and either determine that the section is an "early section", or read the sub-section active ranges from the bitmask. The expectation is that the bitmask (subsection_map) fits in the same cacheline as the valid_section() / early_section() data, so the incremental performance overhead to pfn_valid() should be negligible. The rationale for using early_section() to short-ciruit the subsection_map check is that there are legacy code paths that use pfn_valid() at section granularity before validating the pfn against pgdat data. So, the early_section() check allows those traditional assumptions to persist while also permitting subsection_map to tell the truth for purposes of populating the unused portions of early sections with PMEM and other ZONE_DEVICE mappings. Link: http://lkml.kernel.org/r/156092350874.979959.18185938451405518285.stgit@dwillia2-desk3.amr.corp.intel.com Signed-off-by: Dan Williams Reported-by: Qian Cai Tested-by: Jane Chu Tested-by: Aneesh Kumar K.V [ppc64] Reviewed-by: Oscar Salvador Cc: Michal Hocko Cc: Vlastimil Babka Cc: Logan Gunthorpe Cc: Pavel Tatashin Cc: David Hildenbrand Cc: Jeff Moyer Cc: Jérôme Glisse Cc: Jonathan Corbet Cc: Mike Rapoport Cc: Toshi Kani Cc: Wei Yang Cc: Jason Gunthorpe Cc: Christoph Hellwig Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 326e1b8f83a4318b09033ef754f40c785aed5e68 Author: Dan Williams Date: Thu Jul 18 15:58:00 2019 -0700 mm/sparsemem: introduce a SECTION_IS_EARLY flag In preparation for sub-section hotplug, track whether a given section was created during early memory initialization, or later via memory hotplug. This distinction is needed to maintain the coarse expectation that pfn_valid() returns true for any pfn within a given section even if that section has pages that are reserved from the page allocator. For example one of the of goals of subsection hotplug is to support cases where the system physical memory layout collides System RAM and PMEM within a section. Several pfn_valid() users expect to just check if a section is valid, but they are not careful to check if the given pfn is within a "System RAM" boundary and instead expect pgdat information to further validate the pfn. Rather than unwind those paths to make their pfn_valid() queries more precise a follow on patch uses the SECTION_IS_EARLY flag to maintain the traditional expectation that pfn_valid() returns true for all early sections. Link: https://lore.kernel.org/lkml/1560366952-10660-1-git-send-email-cai@lca.pw/ Link: http://lkml.kernel.org/r/156092350358.979959.5817209875548072819.stgit@dwillia2-desk3.amr.corp.intel.com Signed-off-by: Dan Williams Reported-by: Qian Cai Tested-by: Aneesh Kumar K.V [ppc64] Reviewed-by: Oscar Salvador Cc: Michal Hocko Cc: Logan Gunthorpe Cc: David Hildenbrand Cc: Pavel Tatashin Cc: Jane Chu Cc: Jeff Moyer Cc: Jérôme Glisse Cc: Jonathan Corbet Cc: Mike Rapoport Cc: Toshi Kani Cc: Vlastimil Babka Cc: Wei Yang Cc: Jason Gunthorpe Cc: Christoph Hellwig Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit f1eca35a0dc7cb3cdb00c88c8c5e5138a65face0 Author: Dan Williams Date: Thu Jul 18 15:57:57 2019 -0700 mm/sparsemem: introduce struct mem_section_usage Patch series "mm: Sub-section memory hotplug support", v10. The memory hotplug section is an arbitrary / convenient unit for memory hotplug. 'Section-size' units have bled into the user interface ('memblock' sysfs) and can not be changed without breaking existing userspace. The section-size constraint, while mostly benign for typical memory hotplug, has and continues to wreak havoc with 'device-memory' use cases, persistent memory (pmem) in particular. Recall that pmem uses devm_memremap_pages(), and subsequently arch_add_memory(), to allocate a 'struct page' memmap for pmem. However, it does not use the 'bottom half' of memory hotplug, i.e. never marks pmem pages online and never exposes the userspace memblock interface for pmem. This leaves an opening to redress the section-size constraint. To date, the libnvdimm subsystem has attempted to inject padding to satisfy the internal constraints of arch_add_memory(). Beyond complicating the code, leading to bugs [2], wasting memory, and limiting configuration flexibility, the padding hack is broken when the platform changes this physical memory alignment of pmem from one boot to the next. Device failure (intermittent or permanent) and physical reconfiguration are events that can cause the platform firmware to change the physical placement of pmem on a subsequent boot, and device failure is an everyday event in a data-center. It turns out that sections are only a hard requirement of the user-facing interface for memory hotplug and with a bit more infrastructure sub-section arch_add_memory() support can be added for kernel internal usages like devm_memremap_pages(). Here is an analysis of the current design assumptions in the current code and how they are addressed in the new implementation: Current design assumptions: - Sections that describe boot memory (early sections) are never unplugged / removed. - pfn_valid(), in the CONFIG_SPARSEMEM_VMEMMAP=y, case devolves to a valid_section() check - __add_pages() and helper routines assume all operations occur in PAGES_PER_SECTION units. - The memblock sysfs interface only comprehends full sections New design assumptions: - Sections are instrumented with a sub-section bitmask to track (on x86) individual 2MB sub-divisions of a 128MB section. - Partially populated early sections can be extended with additional sub-sections, and those sub-sections can be removed with arch_remove_memory(). With this in place we no longer lose usable memory capacity to padding. - pfn_valid() is updated to look deeper than valid_section() to also check the active-sub-section mask. This indication is in the same cacheline as the valid_section() so the performance impact is expected to be negligible. So far the lkp robot has not reported any regressions. - Outside of the core vmemmap population routines which are replaced, other helper routines like shrink_{zone,pgdat}_span() are updated to handle the smaller granularity. Core memory hotplug routines that deal with online memory are not touched. - The existing memblock sysfs user api guarantees / assumptions are not touched since this capability is limited to !online !memblock-sysfs-accessible sections. Meanwhile the issue reports continue to roll in from users that do not understand when and how the 128MB constraint will bite them. The current implementation relied on being able to support at least one misaligned namespace, but that immediately falls over on any moderately complex namespace creation attempt. Beyond the initial problem of 'System RAM' colliding with pmem, and the unsolvable problem of physical alignment changes, Linux is now being exposed to platforms that collide pmem ranges with other pmem ranges by default [3]. In short, devm_memremap_pages() has pushed the venerable section-size constraint past the breaking point, and the simplicity of section-aligned arch_add_memory() is no longer tenable. These patches are exposed to the kbuild robot on a subsection-v10 branch [4], and a preview of the unit test for this functionality is available on the 'subsection-pending' branch of ndctl [5]. [2]: https://lore.kernel.org/r/155000671719.348031.2347363160141119237.stgit@dwillia2-desk3.amr.corp.intel.com [3]: https://github.com/pmem/ndctl/issues/76 [4]: https://git.kernel.org/pub/scm/linux/kernel/git/djbw/nvdimm.git/log/?h=subsection-v10 [5]: https://github.com/pmem/ndctl/commit/7c59b4867e1c This patch (of 13): Towards enabling memory hotplug to track partial population of a section, introduce 'struct mem_section_usage'. A pointer to a 'struct mem_section_usage' instance replaces the existing pointer to a 'pageblock_flags' bitmap. Effectively it adds one more 'unsigned long' beyond the 'pageblock_flags' (usemap) allocation to house a new 'subsection_map' bitmap. The new bitmap enables the memory hot{plug,remove} implementation to act on incremental sub-divisions of a section. SUBSECTION_SHIFT is defined as global constant instead of per-architecture value like SECTION_SIZE_BITS in order to allow cross-arch compatibility of subsection users. Specifically a common subsection size allows for the possibility that persistent memory namespace configurations be made compatible across architectures. The primary motivation for this functionality is to support platforms that mix "System RAM" and "Persistent Memory" within a single section, or multiple PMEM ranges with different mapping lifetimes within a single section. The section restriction for hotplug has caused an ongoing saga of hacks and bugs for devm_memremap_pages() users. Beyond the fixups to teach existing paths how to retrieve the 'usemap' from a section, and updates to usemap allocation path, there are no expected behavior changes. Link: http://lkml.kernel.org/r/156092349845.979959.73333291612799019.stgit@dwillia2-desk3.amr.corp.intel.com Signed-off-by: Dan Williams Reviewed-by: Oscar Salvador Reviewed-by: Wei Yang Tested-by: Aneesh Kumar K.V [ppc64] Cc: Michal Hocko Cc: Vlastimil Babka Cc: Logan Gunthorpe Cc: Pavel Tatashin Cc: David Hildenbrand Cc: Jérôme Glisse Cc: Mike Rapoport Cc: Jane Chu Cc: Pavel Tatashin Cc: Jonathan Corbet Cc: Qian Cai Cc: Logan Gunthorpe Cc: Toshi Kani Cc: Jeff Moyer Cc: Michal Hocko Cc: Vlastimil Babka Cc: Jason Gunthorpe Cc: Christoph Hellwig Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit dd625285910d3cff535fa76355e49949513918a4 Author: David Hildenbrand Date: Thu Jul 18 15:57:53 2019 -0700 drivers/base/memory.c: get rid of find_memory_block_hinted() No longer needed, let's remove it. Also, drop the "hint" parameter completely from "find_memory_block_by_id", as nobody needs it anymore. [david@redhat.com: v3] Link: http://lkml.kernel.org/r/20190620183139.4352-7-david@redhat.com [david@redhat.com: handle zero-length walks] Link: http://lkml.kernel.org/r/1c2edc22-afd7-2211-c4c7-40e54e5007e8@redhat.com Link: http://lkml.kernel.org/r/20190614100114.311-7-david@redhat.com Signed-off-by: David Hildenbrand Reviewed-by: Andrew Morton Tested-by: Qian Cai Cc: Greg Kroah-Hartman Cc: "Rafael J. Wysocki" Cc: David Hildenbrand Cc: Stephen Rothwell Cc: Pavel Tatashin Cc: Andrew Banman Cc: Mike Travis Cc: Oscar Salvador Cc: Michal Hocko Cc: Wei Yang Cc: Arun KS Cc: Stephen Rothwell Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit ea8846411ad686ff626e00bb2c3821b3db2ab56a Author: David Hildenbrand Date: Thu Jul 18 15:57:50 2019 -0700 mm/memory_hotplug: move and simplify walk_memory_blocks() Let's move walk_memory_blocks() to the place where memory block logic resides and simplify it. While at it, add a type for the callback function. Link: http://lkml.kernel.org/r/20190614100114.311-6-david@redhat.com Signed-off-by: David Hildenbrand Reviewed-by: Andrew Morton Cc: Greg Kroah-Hartman Cc: "Rafael J. Wysocki" Cc: David Hildenbrand Cc: Stephen Rothwell Cc: Pavel Tatashin Cc: Andrew Banman Cc: Mike Travis Cc: Oscar Salvador Cc: Michal Hocko Cc: Wei Yang Cc: Arun KS Cc: Qian Cai Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit fbcf73ce65827c3d8935f38b832a43153a0c78d1 Author: David Hildenbrand Date: Thu Jul 18 15:57:46 2019 -0700 mm/memory_hotplug: rename walk_memory_range() and pass start+size instead of pfns walk_memory_range() was once used to iterate over sections. Now, it iterates over memory blocks. Rename the function, fixup the documentation. Also, pass start+size instead of PFNs, which is what most callers already have at hand. (we'll rework link_mem_sections() most probably soon) Follow-up patches will rework, simplify, and move walk_memory_blocks() to drivers/base/memory.c. Note: walk_memory_blocks() only works correctly right now if the start_pfn is aligned to a section start. This is the case right now, but we'll generalize the function in a follow up patch so the semantics match the documentation. [akpm@linux-foundation.org: remove unused variable] Link: http://lkml.kernel.org/r/20190614100114.311-5-david@redhat.com Signed-off-by: David Hildenbrand Reviewed-by: Andrew Morton Cc: Benjamin Herrenschmidt Cc: Paul Mackerras Cc: Michael Ellerman Cc: "Rafael J. Wysocki" Cc: Len Brown Cc: Greg Kroah-Hartman Cc: David Hildenbrand Cc: Rashmica Gupta Cc: Pavel Tatashin Cc: Anshuman Khandual Cc: Michael Neuling Cc: Thomas Gleixner Cc: Oscar Salvador Cc: Michal Hocko Cc: Wei Yang Cc: Juergen Gross Cc: Qian Cai Cc: Arun KS Cc: Nick Desaulniers Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 8d595c4c0f768f19db043d378b22e98405f9fd47 Author: David Hildenbrand Date: Thu Jul 18 15:57:43 2019 -0700 mm: make register_mem_sect_under_node() static It is only used internally. Link: http://lkml.kernel.org/r/20190614100114.311-4-david@redhat.com Signed-off-by: David Hildenbrand Reviewed-by: Andrew Morton Cc: Greg Kroah-Hartman Cc: "Rafael J. Wysocki" Cc: Keith Busch Cc: Oscar Salvador Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 90ec010fe0d690665852d6bac21643e9ae7affd8 Author: David Hildenbrand Date: Thu Jul 18 15:57:40 2019 -0700 drivers/base/memory: use "unsigned long" for block ids Block ids are just shifted section numbers, so let's also use "unsigned long" for them, too. Link: http://lkml.kernel.org/r/20190614100114.311-3-david@redhat.com Signed-off-by: David Hildenbrand Reviewed-by: Andrew Morton Cc: Greg Kroah-Hartman Cc: "Rafael J. Wysocki" Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 2491f0a2c0b117b9097e9c9eee0c21f2e5f716d7 Author: David Hildenbrand Date: Thu Jul 18 15:57:37 2019 -0700 mm: section numbers use the type "unsigned long" Patch series "mm: Further memory block device cleanups", v1. Some further cleanups around memory block devices. Especially, clean up and simplify walk_memory_range(). Including some other minor cleanups. This patch (of 6): We are using a mixture of "int" and "unsigned long". Let's make this consistent by using "unsigned long" everywhere. We'll do the same with memory block ids next. While at it, turn the "unsigned long i" in removable_show() into an int - sections_per_block is an int. [akpm@linux-foundation.org: s/unsigned long i/unsigned long nr/] [david@redhat.com: v3] Link: http://lkml.kernel.org/r/20190620183139.4352-2-david@redhat.com Link: http://lkml.kernel.org/r/20190614100114.311-2-david@redhat.com Signed-off-by: David Hildenbrand Reviewed-by: Andrew Morton Cc: Greg Kroah-Hartman Cc: "Rafael J. Wysocki" Cc: Vlastimil Babka Cc: Michal Hocko Cc: Dan Williams Cc: Mel Gorman Cc: Wei Yang Cc: Johannes Weiner Cc: Arun KS Cc: Pavel Tatashin Cc: Oscar Salvador Cc: Stephen Rothwell Cc: Mike Rapoport Cc: Baoquan He Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 756398750e11ade1e617cd2a8f8d66fe7ed637e1 Author: Nadav Amit Date: Thu Jul 18 15:57:34 2019 -0700 resource: avoid unnecessary lookups in find_next_iomem_res() find_next_iomem_res() shows up to be a source for overhead in dax benchmarks. Improve performance by not considering children of the tree if the top level does not match. Since the range of the parents should include the range of the children such check is redundant. Running sysbench on dax (pmem emulation, with write_cache disabled): sysbench fileio --file-total-size=3G --file-test-mode=rndwr \ --file-io-mode=mmap --threads=4 --file-fsync-mode=fdatasync run Provides the following results: events (avg/stddev) ------------------- 5.2-rc3: 1247669.0000/16075.39 w/patch: 1286320.5000/16402.72 (+3%) Link: http://lkml.kernel.org/r/20190613045903.4922-3-namit@vmware.com Signed-off-by: Nadav Amit Cc: Borislav Petkov Cc: Toshi Kani Cc: Peter Zijlstra Cc: Dave Hansen Cc: Dan Williams Cc: Bjorn Helgaas Cc: Ingo Molnar Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 49f17c26c123b60fd1c74629eef077740d16ffc2 Author: Nadav Amit Date: Thu Jul 18 15:57:31 2019 -0700 resource: fix locking in find_next_iomem_res() Since resources can be removed, locking should ensure that the resource is not removed while accessing it. However, find_next_iomem_res() does not hold the lock while copying the data of the resource. Keep holding the lock while the data is copied. While at it, change the return value to a more informative value. It is disregarded by the callers. [akpm@linux-foundation.org: fix find_next_iomem_res() documentation] Link: http://lkml.kernel.org/r/20190613045903.4922-2-namit@vmware.com Fixes: ff3cc952d3f00 ("resource: Add remove_resource interface") Signed-off-by: Nadav Amit Reviewed-by: Andrew Morton Reviewed-by: Dan Williams Cc: Borislav Petkov Cc: Toshi Kani Cc: Peter Zijlstra Cc: Dave Hansen Cc: Bjorn Helgaas Cc: Ingo Molnar Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit c06306696f8368b08774e2a743dbc52d92a61693 Author: Yang Shi Date: Thu Jul 18 15:57:27 2019 -0700 mm: thp: fix false negative of shmem vma's THP eligibility Commit 7635d9cbe832 ("mm, thp, proc: report THP eligibility for each vma") introduced THPeligible bit for processes' smaps. But, when checking the eligibility for shmem vma, __transparent_hugepage_enabled() is called to override the result from shmem_huge_enabled(). It may result in the anonymous vma's THP flag override shmem's. For example, running a simple test which create THP for shmem, but with anonymous THP disabled, when reading the process's smaps, it may show: 7fc92ec00000-7fc92f000000 rw-s 00000000 00:14 27764 /dev/shm/test Size: 4096 kB ... [snip] ... ShmemPmdMapped: 4096 kB ... [snip] ... THPeligible: 0 And, /proc/meminfo does show THP allocated and PMD mapped too: ShmemHugePages: 4096 kB ShmemPmdMapped: 4096 kB This doesn't make too much sense. The shmem objects should be treated separately from anonymous THP. Calling shmem_huge_enabled() with checking MMF_DISABLE_THP sounds good enough. And, we could skip stack and dax vma check since we already checked if the vma is shmem already. Also check if vma is suitable for THP by calling transhuge_vma_suitable(). And minor fix to smaps output format and documentation. Link: http://lkml.kernel.org/r/1560401041-32207-3-git-send-email-yang.shi@linux.alibaba.com Fixes: 7635d9cbe832 ("mm, thp, proc: report THP eligibility for each vma") Signed-off-by: Yang Shi Acked-by: Hugh Dickins Cc: Kirill A. Shutemov Cc: Michal Hocko Cc: Vlastimil Babka Cc: David Rientjes Cc: Andrea Arcangeli Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 43675e6fbbeadca90c6c5031557ff95e217e6d2f Author: Yang Shi Date: Thu Jul 18 15:57:24 2019 -0700 mm: thp: make transhuge_vma_suitable available for anonymous THP transhuge_vma_suitable() was only available for shmem THP, but anonymous THP has the same check except pgoff check. And, it will be used for THP eligible check in the later patch, so make it available for all kind of THPs. This also helps reduce code duplication slightly. Since anonymous THP doesn't have to check pgoff, so make pgoff check shmem vma only. And regroup some functions in include/linux/mm.h to solve compile issue since transhuge_vma_suitable() needs call vma_is_anonymous() which was defined after huge_mm.h is included. [akpm@linux-foundation.org: fix typo] [yang.shi@linux.alibaba.com: v4] Link: http://lkml.kernel.org/r/1563400758-124759-2-git-send-email-yang.shi@linux.alibaba.com Link: http://lkml.kernel.org/r/1560401041-32207-2-git-send-email-yang.shi@linux.alibaba.com Signed-off-by: Yang Shi Acked-by: Hugh Dickins Cc: Kirill A. Shutemov Cc: Michal Hocko Cc: Vlastimil Babka Cc: David Rientjes Cc: Andrea Arcangeli Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 26f26bedab337c9c7e1e55b21949a3e2e0d62840 Author: Wei Yang Date: Thu Jul 18 15:57:21 2019 -0700 mm/sparse.c: set section nid for hot-add memory In case of NODE_NOT_IN_PAGE_FLAGS is set, we store section's node id in section_to_node_table[]. While for hot-add memory, this is missed. Without this information, page_to_nid() may not give the right node id. BTW, current online_pages works because it leverages nid in memory_block. But the granularity of node id should be mem_section wide. Link: http://lkml.kernel.org/r/20190618005537.18878-1-richardw.yang@linux.intel.com Signed-off-by: Wei Yang Reviewed-by: Oscar Salvador Reviewed-by: David Hildenbrand Reviewed-by: Anshuman Khandual Acked-by: Michal Hocko Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit b9bf8d342d9b443c0d19aa57883d8ddb38d965de Author: David Hildenbrand Date: Thu Jul 18 15:57:17 2019 -0700 mm/memory_hotplug: remove "zone" parameter from sparse_remove_one_section The parameter is unused, so let's drop it. Memory removal paths should never care about zones. This is the job of memory offlining and will require more refactorings. Link: http://lkml.kernel.org/r/20190527111152.16324-12-david@redhat.com Signed-off-by: David Hildenbrand Reviewed-by: Dan Williams Reviewed-by: Wei Yang Reviewed-by: Oscar Salvador Acked-by: Michal Hocko Cc: Alex Deucher Cc: Andrew Banman Cc: Andy Lutomirski Cc: Anshuman Khandual Cc: Ard Biesheuvel Cc: Arun KS Cc: Baoquan He Cc: Benjamin Herrenschmidt Cc: Borislav Petkov Cc: Catalin Marinas Cc: Chintan Pandya Cc: Christophe Leroy Cc: Chris Wilson Cc: Dave Hansen Cc: "David S. Miller" Cc: Fenghua Yu Cc: Greg Kroah-Hartman Cc: Heiko Carstens Cc: "H. Peter Anvin" Cc: Ingo Molnar Cc: Jonathan Cameron Cc: Joonsoo Kim Cc: Jun Yao Cc: "Kirill A. Shutemov" Cc: Logan Gunthorpe Cc: Mark Brown Cc: Mark Rutland Cc: Masahiro Yamada Cc: Mathieu Malaterre Cc: Michael Ellerman Cc: Mike Rapoport Cc: "mike.travis@hpe.com" Cc: Nicholas Piggin Cc: Paul Mackerras Cc: Pavel Tatashin Cc: Peter Zijlstra Cc: Qian Cai Cc: "Rafael J. Wysocki" Cc: Rich Felker Cc: Rob Herring Cc: Robin Murphy Cc: Thomas Gleixner Cc: Tony Luck Cc: Vasily Gorbik Cc: Will Deacon Cc: Yoshinori Sato Cc: Yu Zhao Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit a31b264c2b415b29660da0bc2ba291a98629ce51 Author: David Hildenbrand Date: Thu Jul 18 15:57:12 2019 -0700 mm/memory_hotplug: make unregister_memory_block_under_nodes() never fail We really don't want anything during memory hotunplug to fail. We always pass a valid memory block device, that check can go. Avoid allocating memory and eventually failing. As we are always called under lock, we can use a static piece of memory. This avoids having to put the structure onto the stack, having to guess about the stack size of callers. Patch inspired by a patch from Oscar Salvador. In the future, there might be no need to iterate over nodes at all. mem->nid should tell us exactly what to remove. Memory block devices with mixed nodes (added during boot) should properly fenced off and never removed. Link: http://lkml.kernel.org/r/20190527111152.16324-11-david@redhat.com Signed-off-by: David Hildenbrand Reviewed-by: Wei Yang Reviewed-by: Oscar Salvador Acked-by: Michal Hocko Cc: Greg Kroah-Hartman Cc: "Rafael J. Wysocki" Cc: Alex Deucher Cc: "David S. Miller" Cc: Mark Brown Cc: Chris Wilson Cc: David Hildenbrand Cc: Jonathan Cameron Cc: Andrew Banman Cc: Andy Lutomirski Cc: Anshuman Khandual Cc: Ard Biesheuvel Cc: Arun KS Cc: Baoquan He Cc: Benjamin Herrenschmidt Cc: Borislav Petkov Cc: Catalin Marinas Cc: Chintan Pandya Cc: Christophe Leroy Cc: Dan Williams Cc: Dave Hansen Cc: Fenghua Yu Cc: Heiko Carstens Cc: "H. Peter Anvin" Cc: Ingo Molnar Cc: Joonsoo Kim Cc: Jun Yao Cc: "Kirill A. Shutemov" Cc: Logan Gunthorpe Cc: Mark Rutland Cc: Masahiro Yamada Cc: Mathieu Malaterre Cc: Michael Ellerman Cc: Mike Rapoport Cc: "mike.travis@hpe.com" Cc: Nicholas Piggin Cc: Paul Mackerras Cc: Pavel Tatashin Cc: Peter Zijlstra Cc: Qian Cai Cc: Rich Felker Cc: Rob Herring Cc: Robin Murphy Cc: Thomas Gleixner Cc: Tony Luck Cc: Vasily Gorbik Cc: Will Deacon Cc: Yoshinori Sato Cc: Yu Zhao Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 4c4b7f9ba9486c565aead99a198ceeef73ae81f6 Author: David Hildenbrand Date: Thu Jul 18 15:57:06 2019 -0700 mm/memory_hotplug: remove memory block devices before arch_remove_memory() Let's factor out removing of memory block devices, which is only necessary for memory added via add_memory() and friends that created memory block devices. Remove the devices before calling arch_remove_memory(). This finishes factoring out memory block device handling from arch_add_memory() and arch_remove_memory(). Link: http://lkml.kernel.org/r/20190527111152.16324-10-david@redhat.com Signed-off-by: David Hildenbrand Reviewed-by: Dan Williams Acked-by: Michal Hocko Cc: Greg Kroah-Hartman Cc: "Rafael J. Wysocki" Cc: David Hildenbrand Cc: "mike.travis@hpe.com" Cc: Andrew Banman Cc: Ingo Molnar Cc: Alex Deucher Cc: "David S. Miller" Cc: Mark Brown Cc: Chris Wilson Cc: Oscar Salvador Cc: Jonathan Cameron Cc: Arun KS Cc: Mathieu Malaterre Cc: Andy Lutomirski Cc: Anshuman Khandual Cc: Ard Biesheuvel Cc: Baoquan He Cc: Benjamin Herrenschmidt Cc: Borislav Petkov Cc: Catalin Marinas Cc: Chintan Pandya Cc: Christophe Leroy Cc: Dave Hansen Cc: Fenghua Yu Cc: Heiko Carstens Cc: "H. Peter Anvin" Cc: Joonsoo Kim Cc: Jun Yao Cc: "Kirill A. Shutemov" Cc: Logan Gunthorpe Cc: Mark Rutland Cc: Masahiro Yamada Cc: Michael Ellerman Cc: Mike Rapoport Cc: Nicholas Piggin Cc: Oscar Salvador Cc: Paul Mackerras Cc: Pavel Tatashin Cc: Peter Zijlstra Cc: Qian Cai Cc: Rich Felker Cc: Rob Herring Cc: Robin Murphy Cc: Thomas Gleixner Cc: Tony Luck Cc: Vasily Gorbik Cc: Wei Yang Cc: Will Deacon Cc: Yoshinori Sato Cc: Yu Zhao Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 05f800a0bd08e14606ac63e0a5c63ed6880acaab Author: David Hildenbrand Date: Thu Jul 18 15:57:01 2019 -0700 mm/memory_hotplug: drop MHP_MEMBLOCK_API No longer needed, the callers of arch_add_memory() can handle this manually. Link: http://lkml.kernel.org/r/20190527111152.16324-9-david@redhat.com Signed-off-by: David Hildenbrand Reviewed-by: Wei Yang Acked-by: Michal Hocko Cc: David Hildenbrand Cc: Oscar Salvador Cc: Pavel Tatashin Cc: Joonsoo Kim Cc: Qian Cai Cc: Arun KS Cc: Mathieu Malaterre Cc: Mike Rapoport Cc: Alex Deucher Cc: Andrew Banman Cc: Andy Lutomirski Cc: Anshuman Khandual Cc: Ard Biesheuvel Cc: Baoquan He Cc: Benjamin Herrenschmidt Cc: Borislav Petkov Cc: Catalin Marinas Cc: Chintan Pandya Cc: Christophe Leroy Cc: Chris Wilson Cc: Dan Williams Cc: Dave Hansen Cc: "David S. Miller" Cc: Fenghua Yu Cc: Greg Kroah-Hartman Cc: Heiko Carstens Cc: "H. Peter Anvin" Cc: Ingo Molnar Cc: Jonathan Cameron Cc: Jun Yao Cc: "Kirill A. Shutemov" Cc: Logan Gunthorpe Cc: Mark Brown Cc: Mark Rutland Cc: Masahiro Yamada Cc: Michael Ellerman Cc: Mike Rapoport Cc: "mike.travis@hpe.com" Cc: Nicholas Piggin Cc: Oscar Salvador Cc: Paul Mackerras Cc: Peter Zijlstra Cc: "Rafael J. Wysocki" Cc: Rich Felker Cc: Rob Herring Cc: Robin Murphy Cc: Thomas Gleixner Cc: Tony Luck Cc: Vasily Gorbik Cc: Will Deacon Cc: Yoshinori Sato Cc: Yu Zhao Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit db051a0dac13db24d58470d75cee0ce7c6b031a1 Author: David Hildenbrand Date: Thu Jul 18 15:56:56 2019 -0700 mm/memory_hotplug: create memory block devices after arch_add_memory() Only memory to be added to the buddy and to be onlined/offlined by user space using /sys/devices/system/memory/... needs (and should have!) memory block devices. Factor out creation of memory block devices. Create all devices after arch_add_memory() succeeded. We can later drop the want_memblock parameter, because it is now effectively stale. Only after memory block devices have been added, memory can be onlined by user space. This implies, that memory is not visible to user space at all before arch_add_memory() succeeded. While at it - use WARN_ON_ONCE instead of BUG_ON in moved unregister_memory() - introduce find_memory_block_by_id() to search via block id - Use find_memory_block_by_id() in init_memory_block() to catch duplicates Link: http://lkml.kernel.org/r/20190527111152.16324-8-david@redhat.com Signed-off-by: David Hildenbrand Reviewed-by: Pavel Tatashin Acked-by: Michal Hocko Cc: Greg Kroah-Hartman Cc: "Rafael J. Wysocki" Cc: David Hildenbrand Cc: "mike.travis@hpe.com" Cc: Ingo Molnar Cc: Andrew Banman Cc: Oscar Salvador Cc: Qian Cai Cc: Wei Yang Cc: Arun KS Cc: Mathieu Malaterre Cc: Alex Deucher Cc: Andy Lutomirski Cc: Anshuman Khandual Cc: Ard Biesheuvel Cc: Baoquan He Cc: Benjamin Herrenschmidt Cc: Borislav Petkov Cc: Catalin Marinas Cc: Chintan Pandya Cc: Christophe Leroy Cc: Chris Wilson Cc: Dan Williams Cc: Dave Hansen Cc: "David S. Miller" Cc: Fenghua Yu Cc: Heiko Carstens Cc: "H. Peter Anvin" Cc: Jonathan Cameron Cc: Joonsoo Kim Cc: Jun Yao Cc: "Kirill A. Shutemov" Cc: Logan Gunthorpe Cc: Mark Brown Cc: Mark Rutland Cc: Masahiro Yamada Cc: Michael Ellerman Cc: Mike Rapoport Cc: Nicholas Piggin Cc: Oscar Salvador Cc: Paul Mackerras Cc: Peter Zijlstra Cc: Rich Felker Cc: Rob Herring Cc: Robin Murphy Cc: Thomas Gleixner Cc: Tony Luck Cc: Vasily Gorbik Cc: Will Deacon Cc: Yoshinori Sato Cc: Yu Zhao Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 80ec922dbd87fd38d15719c86a94457204648aeb Author: David Hildenbrand Date: Thu Jul 18 15:56:51 2019 -0700 mm/memory_hotplug: allow arch_remove_memory() without CONFIG_MEMORY_HOTREMOVE We want to improve error handling while adding memory by allowing to use arch_remove_memory() and __remove_pages() even if CONFIG_MEMORY_HOTREMOVE is not set to e.g., implement something like: arch_add_memory() rc = do_something(); if (rc) { arch_remove_memory(); } We won't get rid of CONFIG_MEMORY_HOTREMOVE for now, as it will require quite some dependencies for memory offlining. Link: http://lkml.kernel.org/r/20190527111152.16324-7-david@redhat.com Signed-off-by: David Hildenbrand Reviewed-by: Pavel Tatashin Cc: Tony Luck Cc: Fenghua Yu Cc: Benjamin Herrenschmidt Cc: Paul Mackerras Cc: Michael Ellerman Cc: Heiko Carstens Cc: Yoshinori Sato Cc: Rich Felker Cc: Dave Hansen Cc: Andy Lutomirski Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: Borislav Petkov Cc: "H. Peter Anvin" Cc: Greg Kroah-Hartman Cc: "Rafael J. Wysocki" Cc: Michal Hocko Cc: David Hildenbrand Cc: Oscar Salvador Cc: "Kirill A. Shutemov" Cc: Alex Deucher Cc: "David S. Miller" Cc: Mark Brown Cc: Chris Wilson Cc: Christophe Leroy Cc: Nicholas Piggin Cc: Vasily Gorbik Cc: Rob Herring Cc: Masahiro Yamada Cc: "mike.travis@hpe.com" Cc: Andrew Banman Cc: Arun KS Cc: Qian Cai Cc: Mathieu Malaterre Cc: Baoquan He Cc: Logan Gunthorpe Cc: Anshuman Khandual Cc: Ard Biesheuvel Cc: Catalin Marinas Cc: Chintan Pandya Cc: Dan Williams Cc: Ingo Molnar Cc: Jonathan Cameron Cc: Joonsoo Kim Cc: Jun Yao Cc: Mark Rutland Cc: Mike Rapoport Cc: Oscar Salvador Cc: Robin Murphy Cc: Wei Yang Cc: Will Deacon Cc: Yu Zhao Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 1811582587c43bdf13d690d83345610d4df433bb Author: David Hildenbrand Date: Thu Jul 18 15:56:46 2019 -0700 drivers/base/memory: pass a block_id to init_memory_block() We'll rework hotplug_memory_register() shortly, so it no longer consumes pass a section. [cai@lca.pw: fix a compilation warning] Link: http://lkml.kernel.org/r/1559320186-28337-1-git-send-email-cai@lca.pw Link: http://lkml.kernel.org/r/20190527111152.16324-6-david@redhat.com Signed-off-by: David Hildenbrand Signed-off-by: Qian Cai Acked-by: Michal Hocko Cc: Greg Kroah-Hartman Cc: "Rafael J. Wysocki" Cc: Alex Deucher Cc: Andrew Banman Cc: Andy Lutomirski Cc: Anshuman Khandual Cc: Ard Biesheuvel Cc: Arun KS Cc: Baoquan He Cc: Benjamin Herrenschmidt Cc: Borislav Petkov Cc: Catalin Marinas Cc: Chintan Pandya Cc: Christophe Leroy Cc: Chris Wilson Cc: Dan Williams Cc: Dave Hansen Cc: "David S. Miller" Cc: Fenghua Yu Cc: Heiko Carstens Cc: "H. Peter Anvin" Cc: Ingo Molnar Cc: Jonathan Cameron Cc: Joonsoo Kim Cc: Jun Yao Cc: "Kirill A. Shutemov" Cc: Logan Gunthorpe Cc: Mark Brown Cc: Mark Rutland Cc: Masahiro Yamada Cc: Mathieu Malaterre Cc: Michael Ellerman Cc: Mike Rapoport Cc: "mike.travis@hpe.com" Cc: Nicholas Piggin Cc: Oscar Salvador Cc: Oscar Salvador Cc: Paul Mackerras Cc: Pavel Tatashin Cc: Peter Zijlstra Cc: Rich Felker Cc: Rob Herring Cc: Robin Murphy Cc: Thomas Gleixner Cc: Tony Luck Cc: Vasily Gorbik Cc: Wei Yang Cc: Will Deacon Cc: Yoshinori Sato Cc: Yu Zhao Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 22eb634632a2359769f8a2a91a41d3c566a0a450 Author: David Hildenbrand Date: Thu Jul 18 15:56:41 2019 -0700 arm64/mm: add temporary arch_remove_memory() implementation A proper arch_remove_memory() implementation is on its way, which also cleanly removes page tables in arch_add_memory() in case something goes wrong. As we want to use arch_remove_memory() in case something goes wrong during memory hotplug after arch_add_memory() finished, let's add a temporary hack that is sufficient enough until we get a proper implementation that cleans up page table entries. We will remove CONFIG_MEMORY_HOTREMOVE around this code in follow up patches. Link: http://lkml.kernel.org/r/20190527111152.16324-5-david@redhat.com Signed-off-by: David Hildenbrand Cc: Catalin Marinas Cc: Will Deacon Cc: Mark Rutland Cc: Ard Biesheuvel Cc: Chintan Pandya Cc: Mike Rapoport Cc: Jun Yao Cc: Yu Zhao Cc: Robin Murphy Cc: Anshuman Khandual Cc: Alex Deucher Cc: Andrew Banman Cc: Andy Lutomirski Cc: Arun KS Cc: Baoquan He Cc: Benjamin Herrenschmidt Cc: Borislav Petkov Cc: Christophe Leroy Cc: Chris Wilson Cc: Dan Williams Cc: Dave Hansen Cc: "David S. Miller" Cc: Fenghua Yu Cc: Greg Kroah-Hartman Cc: Heiko Carstens Cc: "H. Peter Anvin" Cc: Ingo Molnar Cc: Jonathan Cameron Cc: Joonsoo Kim Cc: "Kirill A. Shutemov" Cc: Logan Gunthorpe Cc: Mark Brown Cc: Masahiro Yamada Cc: Mathieu Malaterre Cc: Michael Ellerman Cc: Michal Hocko Cc: Mike Rapoport Cc: "mike.travis@hpe.com" Cc: Nicholas Piggin Cc: Oscar Salvador Cc: Oscar Salvador Cc: Paul Mackerras Cc: Pavel Tatashin Cc: Peter Zijlstra Cc: Qian Cai Cc: "Rafael J. Wysocki" Cc: Rich Felker Cc: Rob Herring Cc: Thomas Gleixner Cc: Tony Luck Cc: Vasily Gorbik Cc: Wei Yang Cc: Yoshinori Sato Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 18c86506c80f6b6b5e67d95bf0d6f7e665de5239 Author: David Hildenbrand Date: Thu Jul 18 15:56:35 2019 -0700 s390x/mm: implement arch_remove_memory() Will come in handy when wanting to handle errors after arch_add_memory(). Link: http://lkml.kernel.org/r/20190527111152.16324-4-david@redhat.com Signed-off-by: David Hildenbrand Cc: Heiko Carstens Cc: Michal Hocko Cc: Mike Rapoport Cc: David Hildenbrand Cc: Vasily Gorbik Cc: Oscar Salvador Cc: Alex Deucher Cc: Andrew Banman Cc: Andy Lutomirski Cc: Anshuman Khandual Cc: Ard Biesheuvel Cc: Arun KS Cc: Baoquan He Cc: Benjamin Herrenschmidt Cc: Borislav Petkov Cc: Catalin Marinas Cc: Chintan Pandya Cc: Christophe Leroy Cc: Chris Wilson Cc: Dan Williams Cc: Dave Hansen Cc: "David S. Miller" Cc: Fenghua Yu Cc: Greg Kroah-Hartman Cc: "H. Peter Anvin" Cc: Ingo Molnar Cc: Jonathan Cameron Cc: Joonsoo Kim Cc: Jun Yao Cc: "Kirill A. Shutemov" Cc: Logan Gunthorpe Cc: Mark Brown Cc: Mark Rutland Cc: Masahiro Yamada Cc: Mathieu Malaterre Cc: Michael Ellerman Cc: Mike Rapoport Cc: "mike.travis@hpe.com" Cc: Nicholas Piggin Cc: Oscar Salvador Cc: Paul Mackerras Cc: Pavel Tatashin Cc: Peter Zijlstra Cc: Qian Cai Cc: "Rafael J. Wysocki" Cc: Rich Felker Cc: Rob Herring Cc: Robin Murphy Cc: Thomas Gleixner Cc: Tony Luck Cc: Wei Yang Cc: Will Deacon Cc: Yoshinori Sato Cc: Yu Zhao Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 973de24a78493d115ec157c68fd31bc0a114134e Author: David Hildenbrand Date: Thu Jul 18 15:56:30 2019 -0700 s390x/mm: fail when an altmap is used for arch_add_memory() ZONE_DEVICE is not yet supported, fail if an altmap is passed, so we don't forget arch_add_memory()/arch_remove_memory() when unlocking support. Link: http://lkml.kernel.org/r/20190527111152.16324-3-david@redhat.com Signed-off-by: David Hildenbrand Suggested-by: Dan Williams Cc: Heiko Carstens Cc: Michal Hocko Cc: Mike Rapoport Cc: David Hildenbrand Cc: Vasily Gorbik Cc: Oscar Salvador Cc: Alex Deucher Cc: Andrew Banman Cc: Andy Lutomirski Cc: Anshuman Khandual Cc: Ard Biesheuvel Cc: Arun KS Cc: Baoquan He Cc: Benjamin Herrenschmidt Cc: Borislav Petkov Cc: Catalin Marinas Cc: Chintan Pandya Cc: Christophe Leroy Cc: Chris Wilson Cc: Dave Hansen Cc: "David S. Miller" Cc: Fenghua Yu Cc: Greg Kroah-Hartman Cc: "H. Peter Anvin" Cc: Ingo Molnar Cc: Jonathan Cameron Cc: Joonsoo Kim Cc: Jun Yao Cc: "Kirill A. Shutemov" Cc: Logan Gunthorpe Cc: Mark Brown Cc: Mark Rutland Cc: Masahiro Yamada Cc: Mathieu Malaterre Cc: Michael Ellerman Cc: Mike Rapoport Cc: "mike.travis@hpe.com" Cc: Nicholas Piggin Cc: Oscar Salvador Cc: Paul Mackerras Cc: Pavel Tatashin Cc: Peter Zijlstra Cc: Qian Cai Cc: "Rafael J. Wysocki" Cc: Rich Felker Cc: Rob Herring Cc: Robin Murphy Cc: Thomas Gleixner Cc: Tony Luck Cc: Wei Yang Cc: Will Deacon Cc: Yoshinori Sato Cc: Yu Zhao Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit cec3ebd083d4e8d161d0b18894c78e3311bcd026 Author: David Hildenbrand Date: Thu Jul 18 15:56:25 2019 -0700 mm/memory_hotplug: simplify and fix check_hotplug_memory_range() Patch series "mm/memory_hotplug: Factor out memory block devicehandling", v3. We only want memory block devices for memory to be onlined/offlined (add/remove from the buddy). This is required so user space can online/offline memory and kdump gets notified about newly onlined memory. Let's factor out creation/removal of memory block devices. This helps to further cleanup arch_add_memory/arch_remove_memory() and to make implementation of new features easier - especially sub-section memory hot add from Dan. Anshuman Khandual is currently working on arch_remove_memory(). I added a temporary solution via "arm64/mm: Add temporary arch_remove_memory() implementation", that is sufficient as a firsts tep in the context of this series. (we don't cleanup page tables in case anything goes wrong already) Did a quick sanity test with DIMM plug/unplug, making sure all devices and sysfs links properly get added/removed. Compile tested on s390x and x86-64. This patch (of 11): By converting start and size to page granularity, we actually ignore unaligned parts within a page instead of properly bailing out with an error. Link: http://lkml.kernel.org/r/20190527111152.16324-2-david@redhat.com Signed-off-by: David Hildenbrand Reviewed-by: Dan Williams Reviewed-by: Wei Yang Reviewed-by: Pavel Tatashin Reviewed-by: Oscar Salvador Acked-by: Michal Hocko Cc: David Hildenbrand Cc: Qian Cai Cc: Arun KS Cc: Mathieu Malaterre Cc: Alex Deucher Cc: Andrew Banman Cc: Andy Lutomirski Cc: Anshuman Khandual Cc: Ard Biesheuvel Cc: Baoquan He Cc: Benjamin Herrenschmidt Cc: Borislav Petkov Cc: Catalin Marinas Cc: Chintan Pandya Cc: Christophe Leroy Cc: Chris Wilson Cc: Dave Hansen Cc: "David S. Miller" Cc: Fenghua Yu Cc: Greg Kroah-Hartman Cc: Heiko Carstens Cc: "H. Peter Anvin" Cc: Ingo Molnar Cc: Jonathan Cameron Cc: Joonsoo Kim Cc: Jun Yao Cc: "Kirill A. Shutemov" Cc: Logan Gunthorpe Cc: Mark Brown Cc: Mark Rutland Cc: Masahiro Yamada Cc: Michael Ellerman Cc: Mike Rapoport Cc: "mike.travis@hpe.com" Cc: Nicholas Piggin Cc: Paul Mackerras Cc: Peter Zijlstra Cc: "Rafael J. Wysocki" Cc: Rich Felker Cc: Rob Herring Cc: Robin Murphy Cc: Thomas Gleixner Cc: Tony Luck Cc: Vasily Gorbik Cc: Will Deacon Cc: Yoshinori Sato Cc: Yu Zhao Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 7d6053097311643545a8118100175a39bd6fa637 Author: Rogan Dawes Date: Wed Jul 17 11:14:33 2019 +0200 usb: qmi_wwan: add D-Link DWM-222 A2 device ID Signed-off-by: Rogan Dawes Signed-off-by: David S. Miller commit 9b3d15e6b05e0b916be5fbd915f90300a403098b Author: Michael Chan Date: Wed Jul 17 03:07:23 2019 -0400 bnxt_en: Fix VNIC accounting when enabling aRFS on 57500 chips. Unlike legacy chips, 57500 chips don't need additional VNIC resources for aRFS/ntuple. Fix the code accordingly so that we don't reserve and allocate additional VNICs on 57500 chips. Without this patch, the driver is failing to initialize when it tries to allocate extra VNICs. Fixes: ac33906c67e2 ("bnxt_en: Add support for aRFS on 57500 chips.") Signed-off-by: Michael Chan Signed-off-by: David S. Miller commit 008cfbaa3f9f84efead76d2cea12b4dd05cce67d Author: Wei Yongjun Date: Wed Jul 17 06:29:56 2019 +0000 net: dsa: sja1105: Fix missing unlock on error in sk_buff() Add the missing unlock before return from function sk_buff() in the error handling case. Fixes: f3097be21bf1 ("net: dsa: sja1105: Add a state machine for RX timestamping") Signed-off-by: Wei Yongjun Reviewed-by: Vladimir Oltean Reviewed-by: Vivien Didelot Reviewed-by: Florian Fainelli Signed-off-by: David S. Miller commit 8ec1e9006908a606b2a67c905f33ee2d3b6be5c2 Author: Chuhong Yuan Date: Wed Jul 17 10:05:11 2019 +0800 gve: replace kfree with kvfree Variables allocated by kvzalloc should not be freed by kfree. Because they may be allocated by vmalloc. So we replace kfree with kvfree here. Signed-off-by: Chuhong Yuan Signed-off-by: David S. Miller commit 87a30e1f05d73a34e6d1895065541369131aaf1c Author: Dan Williams Date: Wed Jul 17 18:08:26 2019 -0700 driver-core, libnvdimm: Let device subsystems add local lockdep coverage For good reason, the standard device_lock() is marked lockdep_set_novalidate_class() because there is simply no sane way to describe the myriad ways the device_lock() ordered with other locks. However, that leaves subsystems that know their own local device_lock() ordering rules to find lock ordering mistakes manually. Instead, introduce an optional / additional lockdep-enabled lock that a subsystem can acquire in all the same paths that the device_lock() is acquired. A conversion of the NFIT driver and NVDIMM subsystem to a lockdep-validate device_lock() scheme is included. The debug_nvdimm_lock() implementation implements the correct lock-class and stacking order for the libnvdimm device topology hierarchy. Yes, this is a hack, but hopefully it is a useful hack for other subsystems device_lock() debug sessions. Quoting Greg: "Yeah, it feels a bit hacky but it's really up to a subsystem to mess up using it as much as anything else, so user beware :) I don't object to it if it makes things easier for you to debug." Cc: Ingo Molnar Cc: Ira Weiny Cc: Will Deacon Cc: Dave Jiang Cc: Keith Busch Cc: Peter Zijlstra Cc: Vishal Verma Cc: "Rafael J. Wysocki" Cc: Greg Kroah-Hartman Signed-off-by: Dan Williams Acked-by: Greg Kroah-Hartman Reviewed-by: Ira Weiny Link: https://lore.kernel.org/r/156341210661.292348.7014034644265455704.stgit@dwillia2-desk3.amr.corp.intel.com commit ca6bf264f6d856f959c4239cda1047b587745c67 Author: Dan Williams Date: Wed Jul 17 18:08:21 2019 -0700 libnvdimm/bus: Fix wait_nvdimm_bus_probe_idle() ABBA deadlock A multithreaded namespace creation/destruction stress test currently deadlocks with the following lockup signature: INFO: task ndctl:2924 blocked for more than 122 seconds. Tainted: G OE 5.2.0-rc4+ #3382 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. ndctl D 0 2924 1176 0x00000000 Call Trace: ? __schedule+0x27e/0x780 schedule+0x30/0xb0 wait_nvdimm_bus_probe_idle+0x8a/0xd0 [libnvdimm] ? finish_wait+0x80/0x80 uuid_store+0xe6/0x2e0 [libnvdimm] kernfs_fop_write+0xf0/0x1a0 vfs_write+0xb7/0x1b0 ksys_write+0x5c/0xd0 do_syscall_64+0x60/0x240 INFO: task ndctl:2923 blocked for more than 122 seconds. Tainted: G OE 5.2.0-rc4+ #3382 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. ndctl D 0 2923 1175 0x00000000 Call Trace: ? __schedule+0x27e/0x780 ? __mutex_lock+0x489/0x910 schedule+0x30/0xb0 schedule_preempt_disabled+0x11/0x20 __mutex_lock+0x48e/0x910 ? nvdimm_namespace_common_probe+0x95/0x4d0 [libnvdimm] ? __lock_acquire+0x23f/0x1710 ? nvdimm_namespace_common_probe+0x95/0x4d0 [libnvdimm] nvdimm_namespace_common_probe+0x95/0x4d0 [libnvdimm] __dax_pmem_probe+0x5e/0x210 [dax_pmem_core] ? nvdimm_bus_probe+0x1d0/0x2c0 [libnvdimm] dax_pmem_probe+0xc/0x20 [dax_pmem] nvdimm_bus_probe+0x90/0x2c0 [libnvdimm] really_probe+0xef/0x390 driver_probe_device+0xb4/0x100 In this sequence an 'nd_dax' device is being probed and trying to take the lock on its backing namespace to validate that the 'nd_dax' device indeed has exclusive access to the backing namespace. Meanwhile, another thread is trying to update the uuid property of that same backing namespace. So one thread is in the probe path trying to acquire the lock, and the other thread has acquired the lock and tries to flush the probe path. Fix this deadlock by not holding the namespace device_lock over the wait_nvdimm_bus_probe_idle() synchronization step. In turn this requires the device_lock to be held on entry to wait_nvdimm_bus_probe_idle() and subsequently dropped internally to wait_nvdimm_bus_probe_idle(). Cc: Fixes: bf9bccc14c05 ("libnvdimm: pmem label sets and namespace instantiation") Cc: Vishal Verma Tested-by: Jane Chu Link: https://lore.kernel.org/r/156341210094.292348.2384694131126767789.stgit@dwillia2-desk3.amr.corp.intel.com Signed-off-by: Dan Williams commit b70d31d054ee3a6fc1034b9d7fc0ae1e481aa018 Author: Dan Williams Date: Wed Jul 17 18:08:15 2019 -0700 libnvdimm/bus: Stop holding nvdimm_bus_list_mutex over __nd_ioctl() In preparation for fixing a deadlock between wait_for_bus_probe_idle() and the nvdimm_bus_list_mutex arrange for __nd_ioctl() without nvdimm_bus_list_mutex held. This also unifies the 'dimm' and 'bus' level ioctls into a common nd_ioctl() preamble implementation. Marked for -stable as it is a pre-requisite for a follow-on fix. Cc: Fixes: bf9bccc14c05 ("libnvdimm: pmem label sets and namespace instantiation") Cc: Vishal Verma Tested-by: Jane Chu Link: https://lore.kernel.org/r/156341209518.292348.7183897251740665198.stgit@dwillia2-desk3.amr.corp.intel.com Signed-off-by: Dan Williams commit 6de5d06e657acdbcf9637dac37916a4a5309e0f4 Author: Dan Williams Date: Wed Jul 17 18:08:09 2019 -0700 libnvdimm/bus: Prepare the nd_ioctl() path to be re-entrant In preparation for not holding a lock over the execution of nd_ioctl(), update the implementation to allow multiple threads to be attempting ioctls at the same time. The bus lock still prevents multiple in-flight ->ndctl() invocations from corrupting each other's state, but static global staging buffers are moved to the heap. Reported-by: Vishal Verma Reviewed-by: Vishal Verma Tested-by: Vishal Verma Link: https://lore.kernel.org/r/156341208947.292348.10560140326807607481.stgit@dwillia2-desk3.amr.corp.intel.com Signed-off-by: Dan Williams commit 700cd033a82d466ad8f9615f9985525e45f8960a Author: Dan Williams Date: Wed Jul 17 18:08:03 2019 -0700 libnvdimm/region: Register badblocks before namespaces Namespace activation expects to be able to reference region badblocks. The following warning sometimes triggers when asynchronous namespace activation races in front of the completion of namespace probing. Move all possible namespace probing after region badblocks initialization. Otherwise, lockdep sometimes catches the uninitialized state of the badblocks seqlock with stack trace signatures like: INFO: trying to register non-static key. pmem2: detected capacity change from 0 to 136365211648 the code is fine but needs lockdep annotation. turning off the locking correctness validator. CPU: 9 PID: 358 Comm: kworker/u80:5 Tainted: G OE 5.2.0-rc4+ #3382 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 0.0.0 02/06/2015 Workqueue: events_unbound async_run_entry_fn Call Trace: dump_stack+0x85/0xc0 pmem1.12: detected capacity change from 0 to 8589934592 register_lock_class+0x56a/0x570 ? check_object+0x140/0x270 __lock_acquire+0x80/0x1710 ? __mutex_lock+0x39d/0x910 lock_acquire+0x9e/0x180 ? nd_pfn_validate+0x28f/0x440 [libnvdimm] badblocks_check+0x93/0x1f0 ? nd_pfn_validate+0x28f/0x440 [libnvdimm] nd_pfn_validate+0x28f/0x440 [libnvdimm] ? lockdep_hardirqs_on+0xf0/0x180 nd_dax_probe+0x9a/0x120 [libnvdimm] nd_pmem_probe+0x6d/0x180 [nd_pmem] nvdimm_bus_probe+0x90/0x2c0 [libnvdimm] Fixes: 48af2f7e52f4 ("libnvdimm, pfn: during init, clear errors...") Cc: Cc: Vishal Verma Reviewed-by: Vishal Verma Link: https://lore.kernel.org/r/156341208365.292348.1547528796026249120.stgit@dwillia2-desk3.amr.corp.intel.com Signed-off-by: Dan Williams commit 8aac0e2338916e273ccbd438a2b7a1e8c61749f5 Author: Dan Williams Date: Wed Jul 17 18:07:58 2019 -0700 libnvdimm/bus: Prevent duplicate device_unregister() calls A multithreaded namespace creation/destruction stress test currently fails with signatures like the following: sysfs group 'power' not found for kobject 'dax1.1' RIP: 0010:sysfs_remove_group+0x76/0x80 Call Trace: device_del+0x73/0x370 device_unregister+0x16/0x50 nd_async_device_unregister+0x1e/0x30 [libnvdimm] async_run_entry_fn+0x39/0x160 process_one_work+0x23c/0x5e0 worker_thread+0x3c/0x390 BUG: kernel NULL pointer dereference, address: 0000000000000020 RIP: 0010:klist_put+0x1b/0x6c Call Trace: klist_del+0xe/0x10 device_del+0x8a/0x2c9 ? __switch_to_asm+0x34/0x70 ? __switch_to_asm+0x40/0x70 device_unregister+0x44/0x4f nd_async_device_unregister+0x22/0x2d [libnvdimm] async_run_entry_fn+0x47/0x15a process_one_work+0x1a2/0x2eb worker_thread+0x1b8/0x26e Use the kill_device() helper to atomically resolve the race of multiple threads issuing kill, device_unregister(), requests. Reported-by: Jane Chu Reported-by: Erwin Tsaur Fixes: 4d88a97aa9e8 ("libnvdimm, nvdimm: dimm driver and base libnvdimm device-driver...") Cc: Link: https://github.com/pmem/ndctl/issues/96 Tested-by: Tested-by: Jane Chu Link: https://lore.kernel.org/r/156341207846.292348.10435719262819764054.stgit@dwillia2-desk3.amr.corp.intel.com Signed-off-by: Dan Williams commit 00289cd87676e14913d2d8492d1ce05c4baafdae Author: Dan Williams Date: Wed Jul 17 18:07:53 2019 -0700 drivers/base: Introduce kill_device() The libnvdimm subsystem arranges for devices to be destroyed as a result of a sysfs operation. Since device_unregister() cannot be called from an actively running sysfs attribute of the same device libnvdimm arranges for device_unregister() to be performed in an out-of-line async context. The driver core maintains a 'dead' state for coordinating its own racing async registration / de-registration requests. Rather than add local 'dead' state tracking infrastructure to libnvdimm device objects, export the existing state tracking via a new kill_device() helper. The kill_device() helper simply marks the device as dead, i.e. that it is on its way to device_del(), or returns that the device was already dead. This can be used in advance of calling device_unregister() for subsystems like libnvdimm that might need to handle multiple user threads racing to delete a device. This refactoring does not change any behavior, but it is a pre-requisite for follow-on fixes and therefore marked for -stable. Cc: Greg Kroah-Hartman Cc: "Rafael J. Wysocki" Fixes: 4d88a97aa9e8 ("libnvdimm, nvdimm: dimm driver and base libnvdimm device-driver...") Cc: Tested-by: Jane Chu Reviewed-by: Greg Kroah-Hartman Link: https://lore.kernel.org/r/156341207332.292348.14959761496009347574.stgit@dwillia2-desk3.amr.corp.intel.com Signed-off-by: Dan Williams commit 2a957ace44d4cf0f6194a4209d4fa67ee5461d8f Author: Steve French Date: Mon Jul 1 16:25:46 2019 -0500 cifs: update internal module number To 2.21 Signed-off-by: Steve French commit aa081859b10c5d8b19f5c525c78883a59d73c2b8 Author: Ronnie Sahlberg Date: Fri Jul 19 08:12:11 2019 +1000 cifs: flush before set-info if we have writeable handles Servers can defer destaging any data and updating the mtime until close(). This means that if we do a setinfo to modify the mtime while other handles are open for write the server may overwrite our setinfo timestamps when if flushes the file on close() of the writeable handle. To solve this we add an explicit flush when the mtime is about to be updated. This fixes "cp -p" to preserve mtime when copying a file onto an SMB2 share. CC: Stable Signed-off-by: Ronnie Sahlberg Reviewed-by: Pavel Shilovsky Signed-off-by: Steve French commit 89a5bfa350faf87156acda4d7c457808bfecaa0e Author: Steve French Date: Thu Jul 18 17:22:18 2019 -0500 smb3: optimize open to not send query file internal info We can cut one third of the traffic on open by not querying the inode number explicitly via SMB3 query_info since it is now returned on open in the qfid context. This is better in multiple ways, and speeds up file open about 10% (more if network is slow). Reviewed-by: Pavel Shilovsky Signed-off-by: Steve French commit 3bfe1fc46794631366faa3ef075e1b0ff7ba120a Merge: 6860c981b967 733232f8c852 Author: Linus Torvalds Date: Thu Jul 18 14:49:33 2019 -0700 Merge tag 'for-5.3/dm-changes-2' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm Pull more device mapper updates from Mike Snitzer: - Fix zone state management race in DM zoned target by eliminating the unnecessary DMZ_ACTIVE state. - A couple fixes for issues the DM snapshot target's optional discard support added during first week of the 5.3 merge. - Increase default size of outstanding IO that is allowed for a each dm-kcopyd client and introduce tunable to allow user adjust. - Update DM core to use printk ratelimiting functions rather than duplicate them and in doing so fix an issue where DMDEBUG_LIMIT() rate limited KERN_DEBUG messages had excessive "callbacks suppressed" messages. * tag 'for-5.3/dm-changes-2' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm: dm: use printk ratelimiting functions dm kcopyd: Increase default sub-job size to 512KB dm snapshot: fix oversights in optional discard support dm zoned: fix zone state management race commit 2a15d6481741a418837a22df3a440d5bd8b9c412 Author: Paul Burton Date: Wed Jul 17 20:12:23 2019 +0000 MIPS: Annotate fall-through in Cavium Octeon code There's an intentional switch case fall-through in Cavium Octeon USB code, which triggers compile errors with -Wimplicit-fallthrough due to -Werror being enabled for arch/mips. This can be encountered when building cavium_octeon_defconfig. Fix the build issue by annotating the intentional fall-through. Signed-off-by: Paul Burton Cc: linux-mips@vger.kernel.org commit 5bbe54346b539b5938b65d542b6ff5e956c3c08d Author: Paul Burton Date: Wed Jul 17 19:49:10 2019 +0000 MIPS: Annotate fall-through in kvm/emulate.c kvm_compute_return_epc contains a switch statement with an intentional fall-through from a case handling jal (jump and link) instructions to one handling j (jump) instructions. With -Wimplicit-fallthrough this triggers a compile error (due to -Werror being enabled for arch/mips). This can be reproduced using malta_kvm_defconfig. Fix this by annotating the intentional fall-through. Signed-off-by: Paul Burton Cc: linux-mips@vger.kernel.org commit b8bea8a5e5d942e62203416ab41edecaed4fda02 Author: Vladimir Kondratiev Date: Tue Jul 16 10:36:56 2019 +0300 mips: fix cacheinfo Because CONFIG_OF defined for MIPS, cacheinfo attempts to fill information from DT, ignoring data filled by architecture routine. This leads to error reported cacheinfo: Unable to detect cache hierarchy for CPU 0 Way to fix this provided in commit fac51482577d ("drivers: base: cacheinfo: fix x86 with CONFIG_OF enabled") Utilize same mechanism to report that cacheinfo set by architecture specific function Signed-off-by: Vladimir Kondratiev Signed-off-by: Paul Burton Cc: Ralf Baechle Cc: James Hogan Cc: linux-mips@vger.kernel.org Cc: linux-kernel@vger.kernel.org commit a07e3324538a989b7cdbf2c679be6a7f9df2544f Author: Thomas Bogendoerfer Date: Mon May 13 13:47:25 2019 +0200 MIPS: kernel: only use i8253 clocksource with periodic clockevent i8253 clocksource needs a free running timer. This could only be used, if i8253 clockevent is set up as periodic. Signed-off-by: Thomas Bogendoerfer Signed-off-by: Paul Burton Cc: Ralf Baechle Cc: James Hogan Cc: linux-mips@vger.kernel.org Cc: linux-kernel@vger.kernel.org commit 6860c981b9672324cb53b883cfda8d2ea1445ff1 Merge: 0570bc8b7c9b d5b9216fd511 Author: Linus Torvalds Date: Thu Jul 18 14:32:33 2019 -0700 Merge tag 'nfs-for-5.3-1' of git://git.linux-nfs.org/projects/trondmy/linux-nfs Pull NFS client updates from Trond Myklebust: "Highlights include: Stable fixes: - SUNRPC: Ensure bvecs are re-synced when we re-encode the RPC request - Fix an Oops in ff_layout_track_ds_error due to a PTR_ERR() dereference - Revert buggy NFS readdirplus optimisation - NFSv4: Handle the special Linux file open access mode - pnfs: Fix a problem where we gratuitously start doing I/O through the MDS Features: - Allow NFS client to set up multiple TCP connections to the server using a new 'nconnect=X' mount option. Queue length is used to balance load. - Enhance statistics reporting to report on all transports when using multiple connections. - Speed up SUNRPC by removing bh-safe spinlocks - Add a mechanism to allow NFSv4 to request that containers set a unique per-host identifier for when the hostname is not set. - Ensure NFSv4 updates the lease_time after a clientid update Bugfixes and cleanup: - Fix use-after-free in rpcrdma_post_recvs - Fix a memory leak when nfs_match_client() is interrupted - Fix buggy file access checking in NFSv4 open for execute - disable unsupported client side deduplication - Fix spurious client disconnections - Fix occasional RDMA transport deadlock - Various RDMA cleanups - Various tracepoint fixes - Fix the TCP callback channel to guarantee the server can actually send the number of callback requests that was negotiated at mount time" * tag 'nfs-for-5.3-1' of git://git.linux-nfs.org/projects/trondmy/linux-nfs: (68 commits) pnfs/flexfiles: Add tracepoints for detecting pnfs fallback to MDS pnfs: Fix a problem where we gratuitously start doing I/O through the MDS SUNRPC: Optimise transport balancing code SUNRPC: Ensure the bvecs are reset when we re-encode the RPC request pnfs/flexfiles: Fix PTR_ERR() dereferences in ff_layout_track_ds_error NFSv4: Don't use the zero stateid with layoutget SUNRPC: Fix up backchannel slot table accounting SUNRPC: Fix initialisation of struct rpc_xprt_switch SUNRPC: Skip zero-refcount transports SUNRPC: Replace division by multiplication in calculation of queue length NFSv4: Validate the stateid before applying it to state recovery nfs4.0: Refetch lease_time after clientid update nfs4: Rename nfs41_setup_state_renewal nfs4: Make nfs4_proc_get_lease_time available for nfs4.0 nfs: Fix copy-and-paste error in debug message NFS: Replace 16 seq_printf() calls by seq_puts() NFS: Use seq_putc() in nfs_show_stats() Revert "NFS: readdirplus optimization by cache mechanism" (memleak) SUNRPC: Fix transport accounting when caller specifies an rpc_xprt NFS: Record task, client ID, and XID in xdr_status trace points ... commit a50a3f4b6a313dc76912bd4ad3b8b4f4b479c801 Author: Thomas Gleixner Date: Wed Jul 17 22:01:49 2019 +0200 sched/rt, Kconfig: Introduce CONFIG_PREEMPT_RT Add a new entry to the preemption menu which enables the real-time support for the kernel. The choice is only enabled when an architecture supports it. It selects PREEMPT as the RT features depend on it. To achieve that the existing PREEMPT choice is renamed to PREEMPT_LL which select PREEMPT as well. No functional change. Signed-off-by: Thomas Gleixner Acked-by: Paul E. McKenney Acked-by: Steven Rostedt (VMware) Acked-by: Clark Williams Acked-by: Daniel Bristot de Oliveira Acked-by: Frederic Weisbecker Acked-by: Peter Zijlstra (Intel) Acked-by: Marc Zyngier Acked-by: Daniel Wagner Acked-by: Luis Claudio R. Goncalves Acked-by: Julia Cartwright Acked-by: Tom Zanussi Acked-by: Gratian Crisan Acked-by: Sebastian Siewior Cc: Andrew Morton Cc: Christoph Hellwig Cc: Greg Kroah-Hartman Cc: Linus Torvalds Cc: Lukas Bulwahn Cc: Mike Galbraith Cc: Tejun Heo Link: http://lkml.kernel.org/r/alpine.DEB.2.21.1907172200190.1778@nanos.tec.linutronix.de Signed-off-by: Ingo Molnar commit bb745231678cd92ab0c4d37343b06e4879072368 Merge: 7369c10f8117 59fd3486c3dd Author: David S. Miller Date: Thu Jul 18 14:04:45 2019 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf Alexei Starovoitov says: ==================== pull-request: bpf 2019-07-18 The following pull-request contains BPF updates for your *net* tree. The main changes are: 1) verifier precision propagation fix, from Andrii. 2) BTF size fix for typedefs, from Andrii. 3) a bunch of big endian fixes, from Ilya. 4) wide load from bpf_sock_addr fixes, from Stanislav. 5) a bunch of misc fixes from a number of developers. ==================== Signed-off-by: David S. Miller commit 59fd3486c3dd5678bc2fcac75e14466775465c3e Author: Ilya Leoshkevich Date: Wed Jul 17 14:26:20 2019 +0200 selftests/bpf: fix test_xdp_noinline on s390 test_xdp_noinline fails on s390 due to a handful of endianness issues. Use ntohs for parsing eth_proto. Replace bswaps with ntohs/htons. Signed-off-by: Ilya Leoshkevich Acked-by: Vasily Gorbik Signed-off-by: Alexei Starovoitov commit 01a0f9e4496d9f54e06abb71bf9f56c617ef8c24 Author: Ilya Leoshkevich Date: Thu Jul 18 11:13:35 2019 +0200 selftests/bpf: fix "valid read map access into a read-only array 1" on s390 This test looks up a 32-bit map element and then loads it using a 64-bit load. This does not work on s390, which is a big-endian machine. Since the point of this test doesn't seem to be loading a smaller value using a larger load, simply use a 32-bit load. Signed-off-by: Ilya Leoshkevich Signed-off-by: Alexei Starovoitov commit d5b9216fd5114be4ed98ca9c1ecc5f164cd8cf5e Author: Trond Myklebust Date: Thu Jul 18 09:32:17 2019 -0400 pnfs/flexfiles: Add tracepoints for detecting pnfs fallback to MDS Add tracepoints to allow debugging of the event chain leading to a pnfs fallback to doing I/O through the MDS. Signed-off-by: Trond Myklebust commit 8c5477e8046ca139bac250386c08453da37ec1ae Author: Zhenzhong Duan Date: Tue Jul 16 21:18:12 2019 +0800 x86, boot: Remove multiple copy of static function sanitize_boot_params() Kernel build warns: 'sanitize_boot_params' defined but not used [-Wunused-function] at below files: arch/x86/boot/compressed/cmdline.c arch/x86/boot/compressed/error.c arch/x86/boot/compressed/early_serial_console.c arch/x86/boot/compressed/acpi.c That's becausethey each include misc.h which includes a definition of sanitize_boot_params() via bootparam_utils.h. Remove the inclusion from misc.h and have the c file including bootparam_utils.h directly. Signed-off-by: Zhenzhong Duan Signed-off-by: Thomas Gleixner Link: https://lkml.kernel.org/r/1563283092-1189-1-git-send-email-zhenzhong.duan@oracle.com commit 449f328637e3ca62461da04d60ccb35aa5aa21dc Author: Zhenzhong Duan Date: Tue Jul 16 21:17:20 2019 +0800 x86/boot/compressed/64: Remove unused variable Fix gcc warning: arch/x86/boot/compressed/pgtable_64.c: In function 'find_trampoline_placement': arch/x86/boot/compressed/pgtable_64.c:43:16: warning: unused variable 'trampoline_start' [-Wunused-variable] unsigned long trampoline_start; ^ Signed-off-by: Zhenzhong Duan Signed-off-by: Thomas Gleixner Acked-by: Kirill A. Shutemov Link: https://lkml.kernel.org/r/1563283040-31101-1-git-send-email-zhenzhong.duan@oracle.com commit cd6697b8b8751b65abd7859af55cf06f36b8e716 Author: Zhenzhong Duan Date: Tue Jul 16 21:15:57 2019 +0800 x86/boot/efi: Remove unused variables Fix gcc warnings: arch/x86/boot/compressed/eboot.c: In function 'make_boot_params': arch/x86/boot/compressed/eboot.c:394:6: warning: unused variable 'i' [-Wunused-variable] int i; ^ arch/x86/boot/compressed/eboot.c:393:6: warning: unused variable 's1' [-Wunused-variable] u8 *s1; ^ arch/x86/boot/compressed/eboot.c:392:7: warning: unused variable 's2' [-Wunused-variable] u16 *s2; ^ arch/x86/boot/compressed/eboot.c:387:8: warning: unused variable 'options' [-Wunused-variable] void *options, *handle; ^ arch/x86/boot/compressed/eboot.c: In function 'add_e820ext': arch/x86/boot/compressed/eboot.c:498:16: warning: unused variable 'size' [-Wunused-variable] unsigned long size; ^ arch/x86/boot/compressed/eboot.c:497:15: warning: unused variable 'status' [-Wunused-variable] efi_status_t status; ^ arch/x86/boot/compressed/eboot.c: In function 'exit_boot_func': arch/x86/boot/compressed/eboot.c:681:15: warning: unused variable 'status' [-Wunused-variable] efi_status_t status; ^ arch/x86/boot/compressed/eboot.c:680:8: warning: unused variable 'nr_desc' [-Wunused-variable] __u32 nr_desc; ^ arch/x86/boot/compressed/eboot.c: In function 'efi_main': arch/x86/boot/compressed/eboot.c:750:22: warning: unused variable 'image' [-Wunused-variable] efi_loaded_image_t *image; ^ Signed-off-by: Zhenzhong Duan Signed-off-by: Thomas Gleixner Link: https://lkml.kernel.org/r/1563282957-26898-1-git-send-email-zhenzhong.duan@oracle.com commit 58bbeab425c6c5e318f5b6ae31d351331ddfb34b Author: Trond Myklebust Date: Thu Jul 18 15:33:42 2019 -0400 pnfs: Fix a problem where we gratuitously start doing I/O through the MDS If the client has to stop in pnfs_update_layout() to wait for another layoutget to complete, it currently exits and defaults to I/O through the MDS if the layoutget was successful. Fixes: d03360aaf5cc ("pNFS: Ensure we return the error if someone kills...") Signed-off-by: Trond Myklebust Cc: stable@vger.kernel.org # v4.20+ commit 0570bc8b7c9b41deba6f61ac218922e7168ad648 Merge: 0e2a5b5bd9a6 2d69fbf3d01a Author: Linus Torvalds Date: Thu Jul 18 12:26:59 2019 -0700 Merge tag 'riscv/for-v5.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux Pull RISC-V updates from Paul Walmsley: - Hugepage support - "Image" header support for RISC-V kernel binaries, compatible with the current ARM64 "Image" header - Initial page table setup now split into two stages - CONFIG_SOC support (starting with SiFive SoCs) - Avoid reserving memory between RAM start and the kernel in setup_bootmem() - Enable high-res timers and dynamic tick in the RV64 defconfig - Remove long-deprecated gate area stubs - MAINTAINERS updates to switch to the newly-created shared RISC-V git tree, and to fix a get_maintainers.pl issue for patches involving SiFive E-mail addresses Also, one integration fix to resolve a build problem introduced during in the v5.3-rc1 merge window: - Fix build break after macro-to-function conversion in asm-generic/cacheflush.h * tag 'riscv/for-v5.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux: riscv: fix build break after macro-to-function conversion in generic cacheflush.h RISC-V: Add an Image header that boot loader can parse. RISC-V: Setup initial page tables in two stages riscv: remove free_initrd_mem riscv: ccache: Remove unused variable riscv: Introduce huge page support for 32/64bit kernel x86, arm64: Move ARCH_WANT_HUGE_PMD_SHARE config in arch/Kconfig RISC-V: Fix memory reservation in setup_bootmem() riscv: defconfig: enable SOC_SIFIVE riscv: select SiFive platform drivers with SOC_SIFIVE arch: riscv: add config option for building SiFive's SoC resource riscv: Remove gate area stubs MAINTAINERS: change the arch/riscv git tree to the new shared tree MAINTAINERS: don't automatically patches involving SiFive to the linux-riscv list RISC-V: defconfig: Enable NO_HZ_IDLE and HIGH_RES_TIMERS commit 0e2a5b5bd9a6aaec85df347dd71432a1d2d10763 Merge: da0acd7c656c 45800fb45139 Author: Linus Torvalds Date: Thu Jul 18 12:23:45 2019 -0700 Merge branch 'parisc-5.3-2' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux Pull parisc fixes from Helge Deller: - Prevent kernel panics by adding proper checking of register values injected via the ptrace interface - Wire up the new clone3 syscall * 'parisc-5.3-2' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux: parisc: Wire up clone3 syscall parisc: Avoid kernel panic triggered by invalid kprobe parisc: Ensure userspace privilege for ptraced processes in regset functions parisc: Fix kernel panic due invalid values in IAOQ0 or IAOQ1 commit b70666934b41c081489d5ff3c5bf017796545d35 Author: Dale Zhao Date: Wed Jul 10 17:36:53 2019 +0800 drm/amd/display: handle active dongle port type is DP++ or DP case [Why]: Some active dongles have DP++ port and DP port at the same time. Current code doesn't cover DP++ case and processes as default DVI case, in which audio is disabled. Because of dual mode, DP case is also treat as DVI case for the other port. [How]: According DP 1.4 spec, add DP++ procedure similar with HDMI case. Also add None dongle type for DP case. Signed-off-by: Dale Zhao Reviewed-by: Wenjing Liu Acked-by: Leo Li Signed-off-by: Alex Deucher commit b791f9dc2de4f9e66aae28451d1284d054542614 Author: Eric Yang Date: Sat Jun 29 14:38:04 2019 -0400 drm/amd/display: do not read link setting if edp not connected [Why] Previously assume eDP sink present if connector present. Do not need to enforce this restriction. Fix issue where driver attempt to read link setting even though no edp connected. {How] Only read link setting after reading connection status. Signed-off-by: Eric Yang Reviewed-by: Yongqiang Sun Acked-by: Leo Li Signed-off-by: Alex Deucher commit 7352193a33dfc9b69ba3bf6a8caea925b96243b1 Author: Tai Man Date: Fri Jun 28 11:40:38 2019 -0400 drm/amd/display: Increase size of audios array [Why] The audios array defined in "struct resource_pool" is only 6 (MAX_PIPES) but the max number of audio devices (num_audio) is 7. In some projects, it will run out of audios array. [How] Incraese the audios array size to 7. Signed-off-by: Tai Man Reviewed-by: Joshua Aberback Acked-by: Leo Li Signed-off-by: Alex Deucher commit 58caae27df41d2ef3b1ae3bd06284da5b85ac288 Author: Zhan Liu Date: Tue Jul 2 15:17:07 2019 -0400 drm/amd/display: drop ASSERT() if eDP panel is not connected [Why] For boards that support eDP but do not have a physical eDP display connected an ASSERT will be thrown. This is not a critical failure and shouldn't be treated as such. [How] Drop the assertion. Signed-off-by: Zhan Liu Reviewed-by: Nicholas Kazlauskas Acked-by: Leo Li Signed-off-by: Alex Deucher commit 6ac25e6d5b2fbf251e9fa2f4131d42c815b43867 Author: Alvin Lee Date: Thu Jul 4 15:17:42 2019 -0400 drm/amd/display: Only enable audio if speaker allocation exists [Why] In dm_helpers_parse_edid_caps, there is a corner case where no speakers can be allocated even though the audio mode count is greater than 0. Enabling audio when no speaker allocations exists can cause issues in the video stream. [How] Add a check to not enable audio unless one or more speaker allocations exist (since doing this can cause issues in the video stream). Signed-off-by: Alvin Lee Reviewed-by: Jun Lei Acked-by: Leo Li Signed-off-by: Alex Deucher commit 0905f32977268149f06e3ce6ea4bd6d374dd891f Author: Julian Parkin Date: Tue Jun 25 14:55:53 2019 -0400 drm/amd/display: Fix dc_create failure handling and 666 color depths [Why] It is possible (but very unlikely) that constructing dc fails before current_state is created. We support 666 color depth in some scenarios, but this isn't handled in get_norm_pix_clk. It uses exactly the same pixel clock as the 888 case. [How] Check for non null current_state before destructing. Add case for 666 color depth to get_norm_pix_clk to avoid assertion. Signed-off-by: Julian Parkin Reviewed-by: Charlene Liu Acked-by: Leo Li Signed-off-by: Alex Deucher commit 67fd6c0d2de8e51e84ff3fa6e68bbd524f823e49 Author: Derek Lai Date: Tue Jul 2 17:50:41 2019 +0800 drm/amd/display: allocate 4 ddc engines for RV2 [Why] Driver will create 0, 1, and 2 ddc engines for RV2, but some platforms used 0, 1, and 3. [How] Still allocate 4 ddc engines for RV2. Signed-off-by: Derek Lai Reviewed-by: Aric Cyr Acked-by: Leo Li Signed-off-by: Alex Deucher commit feb7eb522e0a7a22c1e60d386bd3c3bfa1d5e4f7 Author: Eric Yang Date: Mon Jun 24 18:18:58 2019 -0400 drm/amd/display: put back front end initialization sequence [Why] Seamless boot optimization removed proper front end power off sequence. In driver disable enable case, this causes driver to power gate hubp and dpp while there is still memory fetching going on, this can cause invalid memory requests to be generated which will hang data fabric. [How] Put back proper front end power off sequence Signed-off-by: Eric Yang Reviewed-by: Anthony Koo Acked-by: Leo Li Acked-by: Tony Cheng Signed-off-by: Alex Deucher commit 39fee5f60ce069cfba55fc3a8ba55faacae330b9 Author: Alvin Lee Date: Mon Jun 24 09:49:44 2019 -0400 drm/amd/display: Wait for flip to complete [why] In pipe split issue occurs when we program immediate flip while vsync flip is pending [how] Don't program immediate flip until flip is no longer pending Signed-off-by: Alvin Lee Reviewed-by: Jaehyun Chung Acked-by: Leo Li Signed-off-by: Alex Deucher commit 09fc26c1718fe7a552866d4eda84e2cc5f9c9c78 Author: Fatemeh Darbehani Date: Fri Jun 21 17:44:50 2019 -0400 drm/amd/display: Change min_h_sync_width from 8 to 4 [Why] Some display's hsync width is lower than the minimum dcn20 is set to support right now. This will cause optc1_validate_timing to fail which eventually will result in wrong set mode. This was set to 8 as per HW team's request for no valid reason. [How] Changing min_h_sync_width to 4 will let us validate timing for preffered mode and light up the headset. This change was made to Vega 10 before for a similar issue. Signed-off-by: Fatemeh Darbehani Reviewed-by: Joshua Aberback Acked-by: Aric Cyr Acked-by: Leo Li Signed-off-by: Alex Deucher commit 74eda776d7a4e69ec7aa1ce30a87636f14220fbb Author: Tai Man Date: Fri Jun 7 17:32:27 2019 -0400 drm/amd/display: use encoder's engine id to find matched free audio device [Why] On some platforms, the encoder id 3 is not populated. So the encoders are not stored in right order as index (id: 0, 1, 2, 4, 5) at pool. This would cause encoders id 4 & id 5 to fail when finding corresponding audio device, defaulting to the first available audio device. As result, we cannot stream audio into two DP ports with encoders id 4 & id 5. [How] It need to create enough audio device objects (0 - 5) to perform matching. Then use encoder engine id to find matched audio device. Signed-off-by: Tai Man Reviewed-by: Charlene Liu Acked-by: Leo Li Signed-off-by: Alex Deucher commit 1ca068ed34d6b39d336c1b0d618ed73ba8f04548 Author: Zi Yu Liao Date: Thu Jun 20 10:55:26 2019 -0400 drm/amd/display: fix DMCU hang when going into Modern Standby [why] When the system is going into suspend, set_backlight gets called after the eDP got blanked. Since smooth brightness is enabled, the driver will make a call into the DMCU to ramp the brightness. The DMCU would try to enable ABM to do so. But since the display is blanked, this ends up causing ABM1_ACE_DBUF_REG_UPDATE_PENDING to get stuck at 1, which results in a dead lock in the DMCU firmware. [how] Disable brightness ramping when the eDP display is blanked. Signed-off-by: Zi Yu Liao Reviewed-by: Eric Yang Acked-by: Anthony Koo Acked-by: Leo Li Signed-off-by: Alex Deucher commit 19f876967a98db63fbfca7e0d9f55099f52189e0 Author: Alvin Lee Date: Thu Jun 20 13:03:25 2019 -0400 drm/amd/display: Disable Audio on reinitialize hardware [Why] When we recover from hang, we do not want to skip the audio enable call. [How] Disable audio in dc_reinitialize_hardware Signed-off-by: Alvin Lee Reviewed-by: Jun Lei Acked-by: Leo Li Signed-off-by: Alex Deucher commit 12d0e503dd9e0576487b2f20577717b2a36fe0c5 Author: Derek Lai Date: Tue Jun 18 14:55:57 2019 +0800 drm/amd/display: Read max down spread [Why] When launch D10.2, driver will write DPCD 0x107 with 0x00 [How] Read MAX_DOWNSPREAD (0x0003h) then keep in current link settings Signed-off-by: Derek Lai Reviewed-by: Tony Cheng Acked-by: Leo Li Signed-off-by: Alex Deucher commit 288af96df16b629552c5bcc9ec0f0191c6198a72 Author: Ilya Bakoulin Date: Wed May 29 18:52:17 2019 -0400 drm/amd/display: Check for valid stream_encode Before accessing it's vtable, check that stream_encoder is non-null. Signed-off-by: Ilya Bakoulin Reviewed-by: Eric Bernstein Acked-by: Leo Li Signed-off-by: Alex Deucher commit c7990daebe71d11a9e360b5c3b0ecd1846a3a4bb Author: SivapiriyanKumarasamy Date: Fri Jun 14 15:04:00 2019 -0400 drm/amd/display: Wait for backlight programming completion in set backlight level [WHY] Currently we don't wait for blacklight programming completion in DMCU when setting backlight level. Some sequences such as PSR static screen event trigger reprogramming requires it to be complete. [How] Add generic wait for dmcu command completion in set backlight level. Signed-off-by: SivapiriyanKumarasamy Reviewed-by: Anthony Koo Acked-by: Leo Li Signed-off-by: Alex Deucher commit ca6f188cdf80de09b92174cf5fb2716021264222 Author: Julian Parkin Date: Thu Jun 13 12:49:37 2019 -0400 drm/amd/display: Poll for GPUVM context ready (v2) [Why] Hardware docs state that we must wait until the GPUVM context is ready after programming it. [How] Poll until the valid bit of PAGE_TABLE_BASE_ADDR_LO32 is set to 1 after programming it. v2: fix include for udelay (Alex) Signed-off-by: Julian Parkin Reviewed-by: Charlene Liu Acked-by: Leo Li Signed-off-by: Alex Deucher commit dd5d9348da02dd83dbb235e55aa0acb3f48ccc95 Author: Wenjing Liu Date: Tue Jun 11 18:18:36 2019 -0400 drm/amd/display: wait for the whole frame after global unlock [why] The current code will not wait for the entire frame after global unlock. This causes dsc dynamic target bpp update corruption when there is a surface update immediately happens after this. [how] Wait for the entire whole frame after unlock before continuing the rest of stream and surface update. Signed-off-by: Wenjing Liu Reviewed-by: Jun Lei Acked-by: Leo Li Signed-off-by: Alex Deucher commit 7f6964c5a05e6593bda3a4bcb5581d0b72fc71cb Author: Nicholas Kazlauskas Date: Wed Jun 5 15:02:04 2019 -0400 drm/amd/display: Copy max_clks_by_state after dce_clk_mgr_construct [Why] For DCE110, DCE112 and DCE120 the max_clks_by_state for the clk_mgr are copied from their respective table before the call to dce_clk_mgr_construct, but then dce_clk_mgr_construct overwrites these with the dce80_max_clks_by_state. [How] Copy these after we call dce_clk_mgr_construct so we're using the right tables. Signed-off-by: Nicholas Kazlauskas Reviewed-by: David Francis Acked-by: Leo Li Signed-off-by: Alex Deucher commit 492d9ec244923420af96db6b69ad7d575859aa92 Author: Murton Liu Date: Mon Jun 10 17:55:28 2019 -0400 drm/amd/display: Clock does not lower in Updateplanes [why] We reset the optimized_required in atomic_plane_disable flag immediately after it is set in atomic_plane_disconnect, causing us to never have flag set during next flip in UpdatePlanes. [how] Optimize directly after each time plane is removed. Signed-off-by: Murton Liu Reviewed-by: Tony Cheng Acked-by: Leo Li Signed-off-by: Alex Deucher commit 4fc1609bcd5475a9cef1caeb10a04106f4f85fac Author: Samson Tam Date: Tue Jun 4 15:52:59 2019 -0400 drm/amd/display: skip retrain in dc_link_set_preferred_link_settings() if using passive dongle [Why] Fixes issue when we have a display connected using a passive dongle and then emulate over it using a DP connection at 1 x 1.62 Ghz. System hangs because register bus returns back 0xFFFFFFFF for all register reads after setting register DIG_BE_CNTL in dcn10_link_encoder_connect_dig_be_to_fe(). Hang occurs later when trying to do a register read. [How] At the start of the emulation, dc_link_set_preferred_link_settings() and dp_retrain_link_dp_test() is called, even though it is connected using a passive dongle. Add an extra condition in dp_retrain_link_dp_test() to check for link->dongle_max_pix_clk > 0. This is the only way we know if the connection is using passive dongle so we don't retrain DP. Signed-off-by: Samson Tam Reviewed-by: Jun Lei Acked-by: Leo Li Signed-off-by: Alex Deucher commit 4a876eecf6a5bfbe05ca6358e1b6a484e27ce32f Author: Jun Lei Date: Wed Jun 5 10:53:40 2019 -0400 drm/amd/display: swap system aperture high/low [why] Currently logical values are swapped in HW, causing system aperture to be undefined, so VA and PA cannot co-exist [how] program values correctly Signed-off-by: Jun Lei Reviewed-by: Yongqiang Sun Acked-by: Leo Li Signed-off-by: Alex Deucher commit 61011e63f87fe5dd0ebff787cd78df4d7d66aec5 Author: Nikola Cornij Date: Wed Jun 5 14:29:47 2019 -0400 drm/amd/display: Set one 4:2:0-related PPS field as recommended by DSC spec [why] 'second_line_offset_adj' was mistakenly left at zero, even though DSC spec v1.2a recommends setting this field to 512 for 4:2:0. [how] Set 'second_line_offset_adj' to 512 for 4:2:0 and leave at zero otherwise Signed-off-by: Nikola Cornij Reviewed-by: Eric Bernstein Acked-by: Leo Li Signed-off-by: Alex Deucher commit 90bbf6374b88bdc1411fd83b24d87513ba23d519 Author: Dmytro Laktyushkin Date: Tue Jun 4 14:48:33 2019 -0400 drm/amd/display: Set default block_size, even in unexpected cases We're not expected to enter the default case, but not returning a default value here is incorrect. Signed-off-by: Dmytro Laktyushkin Reviewed-by: Eric Bernstein Acked-by: Leo Li Signed-off-by: Alex Deucher commit 5b25e5f1a97284020abee7348427f89abdb674e8 Author: Harmanprit Tatla Date: Tue Jun 4 14:12:21 2019 -0400 drm/amd/display: No audio endpoint for Dell MST display [Why] There are certain MST displays (i.e. Dell P2715Q) that although have the MST feature set to off may still report it is a branch device and a non-zero value for downstream port present. This can lead to us incorrectly classifying a dp dongle connection as being active and disabling the audio endpoint for the display. [How] Modified the placement and condition used to assign the is_branch_dev bit. Signed-off-by: Harmanprit Tatla Reviewed-by: Aric Cyr Acked-by: Anthony Koo Acked-by: Leo Li Signed-off-by: Alex Deucher commit db31af12a5169f4ac26acec759c1d872eef26554 Author: Jun Lei Date: Mon Jun 3 11:37:44 2019 -0400 drm/amd/display: cap DCFCLK hardmin to 507 for NV10 [why] Due to limitation in SMU/PPLIB, it is not possible to know Fmax @ Vmin for DCFCLK. This causes issues at high display configurations where extra headroom of DCFCLK can enable P-state switching [how] Use existing override logic. If override not defined, then force min = 507 Signed-off-by: Jun Lei Reviewed-by: Eric Yang Acked-by: Leo Li Signed-off-by: Alex Deucher commit 5d109be38b23c8859ec78a2ed7c254ccd569719d Author: Dmytro Laktyushkin Date: Thu May 30 15:47:51 2019 -0400 drm/amd/display: fix dsc disable A regression caused dsc to never get disabled in certain situations. Signed-off-by: Dmytro Laktyushkin Reviewed-by: Nikola Cornij Acked-by: Leo Li Signed-off-by: Alex Deucher commit 0bd8ac7ed5f9a1a26c722c6cdbc4cb178d36cc03 Author: Jun Lei Date: Mon Jun 3 08:13:12 2019 -0400 drm/amd/display: fix up HUBBUB hw programming for VM [why] Some values were not being converted or bit-shifted properly for HW registers, causing black screen [how] Fix up the values before programming HW Signed-off-by: Jun Lei Reviewed-by: Anthony Koo Acked-by: Leo Li Signed-off-by: Alex Deucher commit 61f33f6aa88388e36ff8ef27a40b4a173c1511d1 Author: Jun Lei Date: Fri May 31 15:14:13 2019 -0400 drm/amd/display: initialize p_state to proper value [why] On some modes SMU will be in infinite loop state at boot, this is because driver assumes p_state_support is false, but this is the opposite of the assumed boot state by SMU. we optimize away notifying SMU about no pstate, and so they will get stuck [how] when we init clk manager, init pstate to true, so it matches driver load assumption Signed-off-by: Jun Lei Reviewed-by: Tony Cheng Acked-by: Leo Li Signed-off-by: Alex Deucher commit c6d5245d41de3a9786707b34189c41d6412fd0ba Author: Leo Liu Date: Thu Jul 18 11:38:46 2019 -0400 drm/amdgpu: use VCN firmware offset for cache window Since we are using the signed FW now, and also using PSP firmware loading, but it's still potential to break driver when loading FW directly instead of PSP, so we should add offset. Signed-off-by: Leo Liu Acked-by: Alex Deucher Signed-off-by: Alex Deucher commit 3457b3055e43fbe457d9779c1362d56f19a888e7 Author: Fuqian Huang Date: Thu Jul 11 11:10:21 2019 +0800 drm/ttm: use the same attributes when freeing d_page->vaddr In function __ttm_dma_alloc_page(), d_page->addr is allocated by dma_alloc_attrs() but freed with use dma_free_coherent() in __ttm_dma_free_page(). Use the correct dma_free_attrs() to free d_page->vaddr. Signed-off-by: Fuqian Huang Reviewed-by: Christian König Signed-off-by: Alex Deucher commit 1a195ed5f197fcfd1d99ceedd469857fcd7d8c4f Author: Kevin Wang Date: Thu Jul 18 15:46:55 2019 +0800 drm/amd/powerplay: change sysfs pp_dpm_xxx format for navi10 v2: set average clock value on level 1 when current clock equal min or max clock (fine grained dpm support). the navi10 gfxclk (sclk) support fine grained DPM, so use level 1 to show current dpm freq in sysfs pp_dpm_xxx Signed-off-by: Kevin Wang Reviewed-by: Kenneth Feng Signed-off-by: Alex Deucher commit 578a4daa1cd61f9783b5d0f566d6ec0a2cb9f6a3 Author: Hawking Zhang Date: Thu Jul 18 16:03:46 2019 +0800 drm/amdgpu: drop ras self test this function is not needed any more. error injection is the only way to validate ras but it can't be executed in amdgpu_ras_init, where gpu is even not initialized Signed-off-by: Hawking Zhang Reviewed-by: Feifei Xu Signed-off-by: Alex Deucher commit 29bd650809225f51ba475c556f43e53e392c44e3 Author: Hawking Zhang Date: Thu Jul 18 13:59:38 2019 +0800 drm/amdgpu: only allow error injection to UMC IP block error injection to other IP blocks (except UMC) will be enabled until RAS feature stablize on those IP blocks Signed-off-by: Hawking Zhang Reviewed-by: Feifei Xu Signed-off-by: Alex Deucher commit 59d9c0ab7169346d53b12db6a5e986a26a28c479 Author: Hawking Zhang Date: Thu Jul 18 12:52:56 2019 +0800 drm/amdgpu: disable GFX RAS by default GFX RAS has not been stablized yet. disable GFX ras until it is fully funcitonal. Signed-off-by: Hawking Zhang Reviewed-by: Feifei Xu Signed-off-by: Alex Deucher commit 5f872b723a451a26ad0f1d29541df9de5d23529d Author: Hawking Zhang Date: Thu Jul 18 12:49:15 2019 +0800 drm/amdgpu: do not create ras debugfs/sysfs node for ASICs that don't have ras ability driver shouldn't init any ras debugfs/sysfs node for ASICs that don't have ras hardware ability Signed-off-by: Hawking Zhang Reviewed-by: Feifei Xu Signed-off-by: Alex Deucher commit 23d66e75d7c75f108754297f6eae77348a7cd544 Author: Evan Quan Date: Wed Jul 17 16:32:27 2019 +0800 drm/amd/powerplay: report bootup clock as max supported on dpm disabled With gfxclk or uclk dpm disabled, it's reasonable to report bootup clock as the max supported. Signed-off-by: Evan Quan Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher commit ad28e02420beae459bf48be14de5de1d76e79704 Author: Joseph Greathouse Date: Wed Jul 17 11:55:22 2019 -0500 drm/amdgpu: Default disable GDS for compute VMIDs The GDS and GWS blocks default to allowing all VMIDs to access all entries. Graphics VMIDs can handle setting these limits when the driver launches work. However, compute workloads under HWS control don't go through the kernel driver. Instead, HWS firmware should set these limits when a process is put into a VMID slot. Disable access to these devices by default by turning off all mask bits (for OA) and setting BASE=SIZE=0 (for GDS and GWS) for all compute VMIDs. If a process wants to use these resources, they can request this from the HWS firmware (when such capabilities are enabled). HWS will then handle setting the base and limit for the process when it is assigned to a VMID. This will also prevent user kernels from getting 'stuck' in GWS by accident if they write GWS-using code but HWS firmware is not set up to handle GWS reset. Until HWS is enabled to handle GWS properly, all GWS accesses will MEM_VIOL fault the kernel. v2: Move initialization outside of SRBM mutex Signed-off-by: Joseph Greathouse Reviewed-by: Felix Kuehling Signed-off-by: Alex Deucher commit 41a5a2a8531f95d18bb4efddea581ccb469e8ee5 Author: hersen wu Date: Wed Jun 26 13:06:07 2019 -0400 drm/amd/display: init res_pool dccg_ref, dchub_ref with xtalin_freq [WHY] dc sw clock implementation of navi10 and raven are not exact the same. dcccg, dchub reference clock initialization is done after dc calls vbios dispcontroller_init table. for raven family, before dispcontroller_init is called by dc, the ref clk values are referred by sw clock implementation and program asic register using wrong values. this causes dchub pstate error. This need provide valid ref clk values. for navi10, since dispcontroller_init is not called, dchubbub_global_timer_enable = 0, hubbub2_get_dchub_ref_freq will hit aeert. this need remove hubbub2_get_dchub_ref_freq from this location and move to dcn20_init_hw. [HOW] for all asic, initialize dccg, dchub ref clk with data from vbios firmware table by default. for raven asic family, use these data from vbios, for asic which support sw dccg component, like navi10, read ref clk by sw dccg functions and update the ref clk. Signed-off-by: hersen wu Reviewed-by: Jun Lei Acked-by: Leo Li Signed-off-by: Alex Deucher commit 8a5b5d425e5454fdef0e5457826f4aa7f96cf463 Author: Alex Deucher Date: Wed Jul 17 13:10:39 2019 -0500 drm/amdgpu/pm: remove check for pp funcs in freq sysfs handlers The dpm sensor function already does this for us. This fixes the freq*_input files with the new SMU implementation. Reviewed-by: Evan Quan Signed-off-by: Alex Deucher commit 02316e963a5a2217aa13f64bb5fc37a3a6d0f5ef Author: Nicholas Kazlauskas Date: Fri Jul 5 16:54:28 2019 -0400 drm/amd/display: Force uclk to max for every state Workaround for now to avoid underflow. The uclk switch time should really be bumped up to 404, but doing so would expose p-state hang issues for higher bandwidth display configurations. Signed-off-by: Nicholas Kazlauskas Signed-off-by: Leo Li Signed-off-by: Alex Deucher commit 7369c10f81172b55b284944caa2f51f595bbdb84 Author: Chuhong Yuan Date: Wed Jul 17 18:14:57 2019 +0800 net/mlx5: Replace kfree with kvfree Variable allocated by kvmalloc should not be freed by kfree. Because it may be allocated by vmalloc. So replace kfree with kvfree here. Fixes: 9b1f298236057 ("net/mlx5: Add support for FW fatal reporter dump") Signed-off-by: Chuhong Yuan Acked-by: Saeed Mahameed Signed-off-by: David S. Miller commit da0acd7c656c09b362b5095dc8595f8655dc1223 Merge: 818e95c768c6 93651f80dcb6 Author: Linus Torvalds Date: Thu Jul 18 12:06:57 2019 -0700 Merge tag 'modules-for-v5.3' of git://git.kernel.org/pub/scm/linux/kernel/git/jeyu/linux Pull module updates from Jessica Yu: "Summary of modules changes for the 5.3 merge window: - Code fixes and cleanups - Fix bug where set_memory_x() wasn't being called when rodata=n - Fix bug where -EEXIST was being returned for going modules - Allow arches to override module_exit_section()" * tag 'modules-for-v5.3' of git://git.kernel.org/pub/scm/linux/kernel/git/jeyu/linux: modules: fix compile error if don't have strict module rwx ARM: module: recognize unwind exit sections module: allow arch overrides for .exit section names modules: fix BUG when load module with rodata=n kernel/module: Fix mem leak in module_add_modinfo_attrs kernel: module: Use struct_size() helper kernel/module.c: Only return -EEXIST for modules that have finished loading commit 184528af92a87e334789f6a22af4e392baf6bf60 Author: Ilias Apalodimas Date: Thu Jul 18 17:38:30 2019 +0300 MAINTAINERS: update netsec driver Add myself to maintainers since i provided the XDP and page_pool implementation Signed-off-by: Ilias Apalodimas Acked-by: Jassi Brar Acked-by: Ard Biesheuvel Signed-off-by: David S. Miller commit bf3c90ee1efe4dd3417d2129f9f6c68a4c76de00 Author: Amir Goldstein Date: Mon Jun 10 20:36:57 2019 +0300 cifs: copy_file_range needs to strip setuid bits and update timestamps cifs has both source and destination inodes locked throughout the copy. Like ->write_iter(), we update mtime and strip setuid bits of destination file before copy and like ->read_iter(), we update atime of source file after copy. Signed-off-by: Amir Goldstein Signed-off-by: Steve French commit 54851aa90cf27041d64b12f65ac72e9f97bd90fd Author: Ido Schimmel Date: Wed Jul 17 23:39:33 2019 +0300 ipv6: Unlink sibling route in case of failure When a route needs to be appended to an existing multipath route, fib6_add_rt2node() first appends it to the siblings list and increments the number of sibling routes on each sibling. Later, the function notifies the route via call_fib6_entry_notifiers(). In case the notification is vetoed, the route is not unlinked from the siblings list, which can result in a use-after-free. Fix this by unlinking the route from the siblings list before returning an error. Audited the rest of the call sites from which the FIB notification chain is called and could not find more problems. Fixes: 2233000cba40 ("net/ipv6: Move call_fib6_entry_notifiers up for route adds") Signed-off-by: Ido Schimmel Reported-by: Alexander Petrovskiy Reviewed-by: David Ahern Signed-off-by: David S. Miller commit b68b9907069a8d3a65bc16a35360bf8f8603c8fa Author: Josh Poimboeuf Date: Wed Jul 17 20:36:57 2019 -0500 objtool: Support conditional retpolines A Clang-built kernel is showing the following warning: arch/x86/kernel/platform-quirks.o: warning: objtool: x86_early_init_platform_quirks()+0x84: unreachable instruction That corresponds to this code: 7e: 0f 85 00 00 00 00 jne 84 80: R_X86_64_PC32 __x86_indirect_thunk_r11-0x4 84: c3 retq This is a conditional retpoline sibling call, which is now possible thanks to retpolines. Objtool hasn't seen that before. It's incorrectly interpreting the conditional jump as an unconditional dynamic jump. Reported-by: Nick Desaulniers Signed-off-by: Josh Poimboeuf Signed-off-by: Thomas Gleixner Tested-by: Nick Desaulniers Acked-by: Peter Zijlstra (Intel) Link: https://lkml.kernel.org/r/30d4c758b267ef487fb97e6ecb2f148ad007b554.1563413318.git.jpoimboe@redhat.com commit 9fe7b7642fe2c5158904d06fe31b740ca0695a01 Author: Josh Poimboeuf Date: Wed Jul 17 20:36:56 2019 -0500 objtool: Convert insn type to enum This makes it easier to add new instruction types. Also it's hopefully more robust since the compiler should warn about out-of-range enums. Signed-off-by: Josh Poimboeuf Signed-off-by: Thomas Gleixner Tested-by: Nick Desaulniers Acked-by: Peter Zijlstra (Intel) Link: https://lkml.kernel.org/r/0740e96af0d40e54cfd6a07bf09db0fbd10793cd.1563413318.git.jpoimboe@redhat.com commit e65050b94d8c518fdbee572ea4ca6d352e1fda37 Author: Josh Poimboeuf Date: Wed Jul 17 20:36:55 2019 -0500 objtool: Fix seg fault on bad switch table entry In one rare case, Clang generated the following code: 5ca: 83 e0 21 and $0x21,%eax 5cd: b9 04 00 00 00 mov $0x4,%ecx 5d2: ff 24 c5 00 00 00 00 jmpq *0x0(,%rax,8) 5d5: R_X86_64_32S .rodata+0x38 which uses the corresponding jump table relocations: 000000000038 000200000001 R_X86_64_64 0000000000000000 .text + 834 000000000040 000200000001 R_X86_64_64 0000000000000000 .text + 5d9 000000000048 000200000001 R_X86_64_64 0000000000000000 .text + b96 000000000050 000200000001 R_X86_64_64 0000000000000000 .text + b96 000000000058 000200000001 R_X86_64_64 0000000000000000 .text + b96 000000000060 000200000001 R_X86_64_64 0000000000000000 .text + b96 000000000068 000200000001 R_X86_64_64 0000000000000000 .text + b96 000000000070 000200000001 R_X86_64_64 0000000000000000 .text + b96 000000000078 000200000001 R_X86_64_64 0000000000000000 .text + b96 000000000080 000200000001 R_X86_64_64 0000000000000000 .text + b96 000000000088 000200000001 R_X86_64_64 0000000000000000 .text + b96 000000000090 000200000001 R_X86_64_64 0000000000000000 .text + b96 000000000098 000200000001 R_X86_64_64 0000000000000000 .text + b96 0000000000a0 000200000001 R_X86_64_64 0000000000000000 .text + b96 0000000000a8 000200000001 R_X86_64_64 0000000000000000 .text + b96 0000000000b0 000200000001 R_X86_64_64 0000000000000000 .text + b96 0000000000b8 000200000001 R_X86_64_64 0000000000000000 .text + b96 0000000000c0 000200000001 R_X86_64_64 0000000000000000 .text + b96 0000000000c8 000200000001 R_X86_64_64 0000000000000000 .text + b96 0000000000d0 000200000001 R_X86_64_64 0000000000000000 .text + b96 0000000000d8 000200000001 R_X86_64_64 0000000000000000 .text + b96 0000000000e0 000200000001 R_X86_64_64 0000000000000000 .text + b96 0000000000e8 000200000001 R_X86_64_64 0000000000000000 .text + b96 0000000000f0 000200000001 R_X86_64_64 0000000000000000 .text + b96 0000000000f8 000200000001 R_X86_64_64 0000000000000000 .text + b96 000000000100 000200000001 R_X86_64_64 0000000000000000 .text + b96 000000000108 000200000001 R_X86_64_64 0000000000000000 .text + b96 000000000110 000200000001 R_X86_64_64 0000000000000000 .text + b96 000000000118 000200000001 R_X86_64_64 0000000000000000 .text + b96 000000000120 000200000001 R_X86_64_64 0000000000000000 .text + b96 000000000128 000200000001 R_X86_64_64 0000000000000000 .text + b96 000000000130 000200000001 R_X86_64_64 0000000000000000 .text + b96 000000000138 000200000001 R_X86_64_64 0000000000000000 .text + 82f 000000000140 000200000001 R_X86_64_64 0000000000000000 .text + 828 Since %eax was masked with 0x21, only the first two and the last two entries are possible. Objtool doesn't actually emulate all the code, so it isn't smart enough to know that all the middle entries aren't reachable. They point to the NOP padding area after the end of the function, so objtool seg faulted when it tried to dereference a NULL insn->func. After this fix, objtool still gives an "unreachable" error because it stops reading the jump table when it encounters the bad addresses: /home/jpoimboe/objtool-tests/adm1275.o: warning: objtool: adm1275_probe()+0x828: unreachable instruction While the above code is technically correct, it's very wasteful of memory -- it uses 34 jump table entries when only 4 are needed. It's also not possible for objtool to validate this type of switch table because the unused entries point outside the function and objtool has no way of determining if that's intentional. Hopefully the Clang folks can fix it. Reported-by: Arnd Bergmann Signed-off-by: Josh Poimboeuf Signed-off-by: Thomas Gleixner Tested-by: Nick Desaulniers Acked-by: Peter Zijlstra (Intel) Link: https://lkml.kernel.org/r/a9db88eec4f1ca089e040989846961748238b6d8.1563413318.git.jpoimboe@redhat.com commit bd98c81346468fc2f86aeeb44d4d0d6f763a62b7 Author: Jann Horn Date: Wed Jul 17 20:36:54 2019 -0500 objtool: Support repeated uses of the same C jump table This fixes objtool for both a GCC issue and a Clang issue: 1) GCC issue: kernel/bpf/core.o: warning: objtool: ___bpf_prog_run()+0x8d5: sibling call from callable instruction with modified stack frame With CONFIG_RETPOLINE=n, GCC is doing the following optimization in ___bpf_prog_run(). Before: select_insn: jmp *jumptable(,%rax,8) ... ALU64_ADD_X: ... jmp select_insn ALU_ADD_X: ... jmp select_insn After: select_insn: jmp *jumptable(, %rax, 8) ... ALU64_ADD_X: ... jmp *jumptable(, %rax, 8) ALU_ADD_X: ... jmp *jumptable(, %rax, 8) This confuses objtool. It has never seen multiple indirect jump sites which use the same jump table. For GCC switch tables, the only way of detecting the size of a table is by continuing to scan for more tables. The size of the previous table can only be determined after another switch table is found, or when the scan reaches the end of the function. That logic was reused for C jump tables, and was based on the assumption that each jump table only has a single jump site. The above optimization breaks that assumption. 2) Clang issue: drivers/usb/misc/sisusbvga/sisusb.o: warning: objtool: sisusb_write_mem_bulk()+0x588: can't find switch jump table With clang 9, code can be generated where a function contains two indirect jump instructions which use the same switch table. The fix is the same for both issues: split the jump table parsing into two passes. In the first pass, locate the heads of all switch tables for the function and mark their locations. In the second pass, parse the switch tables and add them. Fixes: e55a73251da3 ("bpf: Fix ORC unwinding in non-JIT BPF code") Reported-by: Randy Dunlap Reported-by: Arnd Bergmann Signed-off-by: Jann Horn Signed-off-by: Josh Poimboeuf Signed-off-by: Thomas Gleixner Tested-by: Nick Desaulniers Acked-by: Peter Zijlstra (Intel) Link: https://lkml.kernel.org/r/e995befaada9d4d8b2cf788ff3f566ba900d2b4d.1563413318.git.jpoimboe@redhat.com Co-developed-by: Josh Poimboeuf commit e7c2bc37bfae120bce3e7cc8c8abf9d110af0757 Author: Josh Poimboeuf Date: Wed Jul 17 20:36:53 2019 -0500 objtool: Refactor jump table code Now that C jump tables are supported, call them "jump tables" instead of "switch tables". Also rename some other variables, add comments, and simplify the code flow a bit. Signed-off-by: Josh Poimboeuf Signed-off-by: Thomas Gleixner Tested-by: Nick Desaulniers Acked-by: Peter Zijlstra (Intel) Link: https://lkml.kernel.org/r/cf951b0c0641628e0b9b81f7ceccd9bcabcb4bd8.1563413318.git.jpoimboe@redhat.com commit 0c1ddd33177530feb3685a800bba1ac4cc58cc4b Author: Josh Poimboeuf Date: Wed Jul 17 20:36:52 2019 -0500 objtool: Refactor sibling call detection logic Simplify the sibling call detection logic a bit. Signed-off-by: Josh Poimboeuf Signed-off-by: Thomas Gleixner Tested-by: Nick Desaulniers Acked-by: Peter Zijlstra (Intel) Link: https://lkml.kernel.org/r/8357dbef9e7f5512e76bf83a76c81722fc09eb5e.1563413318.git.jpoimboe@redhat.com commit c9bab22bc449ad2496a6bbbf68acc711d9c5301c Author: Josh Poimboeuf Date: Wed Jul 17 20:36:51 2019 -0500 objtool: Do frame pointer check before dead end check Even calls to __noreturn functions need the frame pointer setup first. Such functions often dump the stack. Signed-off-by: Josh Poimboeuf Signed-off-by: Thomas Gleixner Tested-by: Nick Desaulniers Acked-by: Peter Zijlstra (Intel) Link: https://lkml.kernel.org/r/aed62fbd60e239280218be623f751a433658e896.1563413318.git.jpoimboe@redhat.com commit 8e25c9f8b482ea8d8b6fb4f6f5c09bcc5ee18663 Author: Josh Poimboeuf Date: Wed Jul 17 20:36:50 2019 -0500 objtool: Change dead_end_function() to return boolean dead_end_function() can no longer return an error. Simplify its interface by making it return boolean. Signed-off-by: Josh Poimboeuf Signed-off-by: Thomas Gleixner Tested-by: Nick Desaulniers Acked-by: Peter Zijlstra (Intel) Link: https://lkml.kernel.org/r/9e6679610768fb6e6c51dca23f7d4d0c03b0c910.1563413318.git.jpoimboe@redhat.com commit 61e9b75a0ccf1fecacc28a2d77ea4a19aa404e39 Author: Josh Poimboeuf Date: Wed Jul 17 20:36:49 2019 -0500 objtool: Warn on zero-length functions All callable functions should have an ELF size. Signed-off-by: Josh Poimboeuf Signed-off-by: Thomas Gleixner Tested-by: Nick Desaulniers Acked-by: Peter Zijlstra (Intel) Link: https://lkml.kernel.org/r/03d429c4fa87829c61c5dc0e89652f4d9efb62f1.1563413318.git.jpoimboe@redhat.com commit e10cd8fe8ddfd28a172d2be57ae0e90c7f752e6a Author: Josh Poimboeuf Date: Wed Jul 17 20:36:48 2019 -0500 objtool: Refactor function alias logic - Add an alias check in validate_functions(). With this change, aliases no longer need uaccess_safe set. - Add an alias check in decode_instructions(). With this change, the "if (!insn->func)" check is no longer needed. - Don't create aliases for zero-length functions, as it can have unexpected results. The next patch will spit out a warning for zero-length functions anyway. Signed-off-by: Josh Poimboeuf Signed-off-by: Thomas Gleixner Tested-by: Nick Desaulniers Acked-by: Peter Zijlstra (Intel) Link: https://lkml.kernel.org/r/26a99c31426540f19c9a58b9e10727c385a147bc.1563413318.git.jpoimboe@redhat.com commit c705cecc8431951b4f34178e6b1db51b4a504c43 Author: Josh Poimboeuf Date: Wed Jul 17 20:36:47 2019 -0500 objtool: Track original function across branches If 'insn->func' is NULL, objtool skips some important checks, including sibling call validation. So if some .fixup code does an invalid sibling call, objtool ignores it. Treat all code branches (including alts) as part of the original function by keeping track of the original func value from validate_functions(). This improves the usefulness of some clang function fallthrough warnings, and exposes some additional kernel bugs in the process. Signed-off-by: Josh Poimboeuf Signed-off-by: Thomas Gleixner Tested-by: Nick Desaulniers Acked-by: Peter Zijlstra (Intel) Link: https://lkml.kernel.org/r/505df630f33c9717e1ccde6e4b64c5303135c25f.1563413318.git.jpoimboe@redhat.com commit a7e47f26039c26312a4144c3001b4e9fa886bd45 Author: Josh Poimboeuf Date: Wed Jul 17 20:36:46 2019 -0500 objtool: Add mcsafe_handle_tail() to the uaccess safe list After an objtool improvement, it's reporting that __memcpy_mcsafe() is calling mcsafe_handle_tail() with AC=1: arch/x86/lib/memcpy_64.o: warning: objtool: .fixup+0x13: call to mcsafe_handle_tail() with UACCESS enabled arch/x86/lib/memcpy_64.o: warning: objtool: __memcpy_mcsafe()+0x34: (alt) arch/x86/lib/memcpy_64.o: warning: objtool: __memcpy_mcsafe()+0xb: (branch) arch/x86/lib/memcpy_64.o: warning: objtool: __memcpy_mcsafe()+0x0: <=== (func) mcsafe_handle_tail() is basically an extension of __memcpy_mcsafe(), so AC=1 is supposed to be set. Add mcsafe_handle_tail() to the uaccess safe list. Signed-off-by: Josh Poimboeuf Signed-off-by: Thomas Gleixner Tested-by: Nick Desaulniers Acked-by: Peter Zijlstra (Intel) Link: https://lkml.kernel.org/r/035c38f7eac845281d3c3d36749144982e06e58c.1563413318.git.jpoimboe@redhat.com commit 3193c0836f203a91bef96d88c64cccf0be090d9c Author: Josh Poimboeuf Date: Wed Jul 17 20:36:45 2019 -0500 bpf: Disable GCC -fgcse optimization for ___bpf_prog_run() On x86-64, with CONFIG_RETPOLINE=n, GCC's "global common subexpression elimination" optimization results in ___bpf_prog_run()'s jumptable code changing from this: select_insn: jmp *jumptable(, %rax, 8) ... ALU64_ADD_X: ... jmp *jumptable(, %rax, 8) ALU_ADD_X: ... jmp *jumptable(, %rax, 8) to this: select_insn: mov jumptable, %r12 jmp *(%r12, %rax, 8) ... ALU64_ADD_X: ... jmp *(%r12, %rax, 8) ALU_ADD_X: ... jmp *(%r12, %rax, 8) The jumptable address is placed in a register once, at the beginning of the function. The function execution can then go through multiple indirect jumps which rely on that same register value. This has a few issues: 1) Objtool isn't smart enough to be able to track such a register value across multiple recursive indirect jumps through the jump table. 2) With CONFIG_RETPOLINE enabled, this optimization actually results in a small slowdown. I measured a ~4.7% slowdown in the test_bpf "tcpdump port 22" selftest. This slowdown is actually predicted by the GCC manual: Note: When compiling a program using computed gotos, a GCC extension, you may get better run-time performance if you disable the global common subexpression elimination pass by adding -fno-gcse to the command line. So just disable the optimization for this function. Fixes: e55a73251da3 ("bpf: Fix ORC unwinding in non-JIT BPF code") Reported-by: Randy Dunlap Signed-off-by: Josh Poimboeuf Signed-off-by: Thomas Gleixner Acked-by: Alexei Starovoitov Acked-by: Peter Zijlstra (Intel) Link: https://lkml.kernel.org/r/30c3ca29ba037afcbd860a8672eef0021addf9fe.1563413318.git.jpoimboe@redhat.com commit 82e844a6536d1a3c12a73e44712f4021d90a4b53 Author: Josh Poimboeuf Date: Wed Jul 17 20:36:44 2019 -0500 x86/uaccess: Remove redundant CLACs in getuser/putuser error paths The same getuser/putuser error paths are used regardless of whether AC is set. In non-exception failure cases, this results in an unnecessary CLAC. Fixes the following warnings: arch/x86/lib/getuser.o: warning: objtool: .altinstr_replacement+0x18: redundant UACCESS disable arch/x86/lib/putuser.o: warning: objtool: .altinstr_replacement+0x18: redundant UACCESS disable Signed-off-by: Josh Poimboeuf Signed-off-by: Thomas Gleixner Acked-by: Peter Zijlstra (Intel) Link: https://lkml.kernel.org/r/bc14ded2755ae75bd9010c446079e113dbddb74b.1563413318.git.jpoimboe@redhat.com commit 5e307a6bc7b600999742675dd182bcb8a6fe308e Author: Josh Poimboeuf Date: Wed Jul 17 20:36:43 2019 -0500 x86/uaccess: Don't leak AC flag into fentry from mcsafe_handle_tail() After adding mcsafe_handle_tail() to the objtool uaccess safe list, objtool reports: arch/x86/lib/usercopy_64.o: warning: objtool: mcsafe_handle_tail()+0x0: call to __fentry__() with UACCESS enabled With SMAP, this function is called with AC=1, so it needs to be careful about which functions it calls. Disable the ftrace entry hook, which can potentially pull in a lot of extra code. Signed-off-by: Josh Poimboeuf Signed-off-by: Thomas Gleixner Acked-by: Peter Zijlstra (Intel) Link: https://lkml.kernel.org/r/8e13d6f0da1c8a3f7603903da6cbf6d582bbfe10.1563413318.git.jpoimboe@redhat.com commit 3a6ab4bcc52263dd5b1d2fd2e4ce95a38c798b4d Author: Josh Poimboeuf Date: Wed Jul 17 20:36:42 2019 -0500 x86/uaccess: Remove ELF function annotation from copy_user_handle_tail() After an objtool improvement, it's complaining about the CLAC in copy_user_handle_tail(): arch/x86/lib/copy_user_64.o: warning: objtool: .altinstr_replacement+0x12: redundant UACCESS disable arch/x86/lib/copy_user_64.o: warning: objtool: copy_user_handle_tail()+0x6: (alt) arch/x86/lib/copy_user_64.o: warning: objtool: copy_user_handle_tail()+0x2: (alt) arch/x86/lib/copy_user_64.o: warning: objtool: copy_user_handle_tail()+0x0: <=== (func) copy_user_handle_tail() is incorrectly marked as a callable function, so objtool is rightfully concerned about the CLAC with no corresponding STAC. Remove the ELF function annotation. The copy_user_handle_tail() code path is already verified by objtool because it's jumped to by other callable asm code (which does the corresponding STAC). Signed-off-by: Josh Poimboeuf Signed-off-by: Thomas Gleixner Acked-by: Peter Zijlstra (Intel) Link: https://lkml.kernel.org/r/6b6e436774678b4b9873811ff023bd29935bee5b.1563413318.git.jpoimboe@redhat.com commit 61a73f5cd1a5794626d216cc56e20a1b195c5d0c Author: Josh Poimboeuf Date: Wed Jul 17 20:36:41 2019 -0500 x86/head/64: Annotate start_cpu0() as non-callable After an objtool improvement, it complains about the fact that start_cpu0() jumps to code which has an LRET instruction. arch/x86/kernel/head_64.o: warning: objtool: .head.text+0xe4: unsupported instruction in callable function Technically, start_cpu0() is callable, but it acts nothing like a callable function. Prevent objtool from treating it like one by removing its ELF function annotation. Signed-off-by: Josh Poimboeuf Signed-off-by: Thomas Gleixner Acked-by: Peter Zijlstra (Intel) Link: https://lkml.kernel.org/r/6b1b4505fcb90571a55fa1b52d71fb458ca24454.1563413318.git.jpoimboe@redhat.com commit e6dd47394493061c605285a868fc72eae2e9c866 Author: Josh Poimboeuf Date: Wed Jul 17 20:36:40 2019 -0500 x86/entry: Fix thunk function ELF sizes Fix the following warnings: arch/x86/entry/thunk_64.o: warning: objtool: trace_hardirqs_on_thunk() is missing an ELF size annotation arch/x86/entry/thunk_64.o: warning: objtool: trace_hardirqs_off_thunk() is missing an ELF size annotation arch/x86/entry/thunk_64.o: warning: objtool: lockdep_sys_exit_thunk() is missing an ELF size annotation Signed-off-by: Josh Poimboeuf Signed-off-by: Thomas Gleixner Acked-by: Peter Zijlstra (Intel) Link: https://lkml.kernel.org/r/89c97adc9f6cc44a0f5d03cde6d0357662938909.1563413318.git.jpoimboe@redhat.com commit 3901336ed9887b075531bffaeef7742ba614058b Author: Josh Poimboeuf Date: Wed Jul 17 20:36:39 2019 -0500 x86/kvm: Don't call kvm_spurious_fault() from .fixup After making a change to improve objtool's sibling call detection, it started showing the following warning: arch/x86/kvm/vmx/nested.o: warning: objtool: .fixup+0x15: sibling call from callable instruction with modified stack frame The problem is the ____kvm_handle_fault_on_reboot() macro. It does a fake call by pushing a fake RIP and doing a jump. That tricks the unwinder into printing the function which triggered the exception, rather than the .fixup code. Instead of the hack to make it look like the original function made the call, just change the macro so that the original function actually does make the call. This allows removal of the hack, and also makes objtool happy. I triggered a vmx instruction exception and verified that the stack trace is still sane: kernel BUG at arch/x86/kvm/x86.c:358! invalid opcode: 0000 [#1] SMP PTI CPU: 28 PID: 4096 Comm: qemu-kvm Not tainted 5.2.0+ #16 Hardware name: Lenovo THINKSYSTEM SD530 -[7X2106Z000]-/-[7X2106Z000]-, BIOS -[TEE113Z-1.00]- 07/17/2017 RIP: 0010:kvm_spurious_fault+0x5/0x10 Code: 00 00 00 00 00 8b 44 24 10 89 d2 45 89 c9 48 89 44 24 10 8b 44 24 08 48 89 44 24 08 e9 d4 40 22 00 0f 1f 40 00 0f 1f 44 00 00 <0f> 0b 66 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 41 55 49 89 fd 41 RSP: 0018:ffffbf91c683bd00 EFLAGS: 00010246 RAX: 000061f040000000 RBX: ffff9e159c77bba0 RCX: ffff9e15a5c87000 RDX: 0000000665c87000 RSI: ffff9e15a5c87000 RDI: ffff9e159c77bba0 RBP: 0000000000000000 R08: 0000000000000000 R09: ffff9e15a5c87000 R10: 0000000000000000 R11: fffff8f2d99721c0 R12: ffff9e159c77bba0 R13: ffffbf91c671d960 R14: ffff9e159c778000 R15: 0000000000000000 FS: 00007fa341cbe700(0000) GS:ffff9e15b7400000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fdd38356804 CR3: 00000006759de003 CR4: 00000000007606e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: loaded_vmcs_init+0x4f/0xe0 alloc_loaded_vmcs+0x38/0xd0 vmx_create_vcpu+0xf7/0x600 kvm_vm_ioctl+0x5e9/0x980 ? __switch_to_asm+0x40/0x70 ? __switch_to_asm+0x34/0x70 ? __switch_to_asm+0x40/0x70 ? __switch_to_asm+0x34/0x70 ? free_one_page+0x13f/0x4e0 do_vfs_ioctl+0xa4/0x630 ksys_ioctl+0x60/0x90 __x64_sys_ioctl+0x16/0x20 do_syscall_64+0x55/0x1c0 entry_SYSCALL_64_after_hwframe+0x44/0xa9 RIP: 0033:0x7fa349b1ee5b Signed-off-by: Josh Poimboeuf Signed-off-by: Thomas Gleixner Acked-by: Paolo Bonzini Acked-by: Peter Zijlstra (Intel) Link: https://lkml.kernel.org/r/64a9b64d127e87b6920a97afde8e96ea76f6524e.1563413318.git.jpoimboe@redhat.com commit 19f2d8fa98644c7b78845b1d66abeae4e3d9dfa8 Author: Josh Poimboeuf Date: Wed Jul 17 20:36:38 2019 -0500 x86/kvm: Replace vmx_vmenter()'s call to kvm_spurious_fault() with UD2 Objtool reports the following: arch/x86/kvm/vmx/vmenter.o: warning: objtool: vmx_vmenter()+0x14: call without frame pointer save/setup But frame pointers are necessarily broken anyway, because __vmx_vcpu_run() clobbers RBP with the guest's value before calling vmx_vmenter(). So calling without a frame pointer doesn't make things any worse. Make objtool happy by changing the call to a UD2. Suggested-by: Paolo Bonzini Signed-off-by: Josh Poimboeuf Signed-off-by: Thomas Gleixner Acked-by: Peter Zijlstra (Intel) Acked-by: Paolo Bonzini Link: https://lkml.kernel.org/r/9fc2216c9dc972f95bb65ce2966a682c6bda1cb0.1563413318.git.jpoimboe@redhat.com commit d99a6ce70ec6ed990b74bd4e34232fd830d20d27 Author: Josh Poimboeuf Date: Wed Jul 17 20:36:37 2019 -0500 x86/kvm: Fix fastop function ELF metadata Some of the fastop functions, e.g. em_setcc(), are actually just used as global labels which point to blocks of functions. The global labels are incorrectly annotated as functions. Also the functions themselves don't have size annotations. Fixes a bunch of warnings like the following: arch/x86/kvm/emulate.o: warning: objtool: seto() is missing an ELF size annotation arch/x86/kvm/emulate.o: warning: objtool: em_setcc() is missing an ELF size annotation arch/x86/kvm/emulate.o: warning: objtool: setno() is missing an ELF size annotation arch/x86/kvm/emulate.o: warning: objtool: setc() is missing an ELF size annotation Signed-off-by: Josh Poimboeuf Signed-off-by: Thomas Gleixner Acked-by: Paolo Bonzini Acked-by: Peter Zijlstra (Intel) Link: https://lkml.kernel.org/r/c8cc9be60ebbceb3092aa5dd91916039a1f88275.1563413318.git.jpoimboe@redhat.com commit 083db6764821996526970e42d09c1ab2f4155dd4 Author: Josh Poimboeuf Date: Wed Jul 17 20:36:36 2019 -0500 x86/paravirt: Fix callee-saved function ELF sizes The __raw_callee_save_*() functions have an ELF symbol size of zero, which confuses objtool and other tools. Fixes a bunch of warnings like the following: arch/x86/xen/mmu_pv.o: warning: objtool: __raw_callee_save_xen_pte_val() is missing an ELF size annotation arch/x86/xen/mmu_pv.o: warning: objtool: __raw_callee_save_xen_pgd_val() is missing an ELF size annotation arch/x86/xen/mmu_pv.o: warning: objtool: __raw_callee_save_xen_make_pte() is missing an ELF size annotation arch/x86/xen/mmu_pv.o: warning: objtool: __raw_callee_save_xen_make_pgd() is missing an ELF size annotation Signed-off-by: Josh Poimboeuf Signed-off-by: Thomas Gleixner Reviewed-by: Juergen Gross Acked-by: Peter Zijlstra (Intel) Link: https://lkml.kernel.org/r/afa6d49bb07497ca62e4fc3b27a2d0cece545b4e.1563413318.git.jpoimboe@redhat.com commit 9c2a57d16d3c59624281de72233ac81e970f8123 Merge: 5a860f9184eb 41a531ffa4c5 Author: David S. Miller Date: Thu Jul 18 12:00:16 2019 -0700 Merge tag 'wireless-drivers-for-davem-2019-07-18' of git://git.kernel.org/pub/scm/linux/kernel/git/kvalo/wireless-drivers Kalle Valo says: ==================== wireless-drivers fixes for 5.3 First set of fixes for 5.3. iwlwifi * add new cards for 9000 and 20000 series and qu c-step devices ath10k * workaround an uninitialised variable warning rt2x00 * fix rx queue hand on USB ==================== Signed-off-by: David S. Miller commit fc2f14f8f7beac518996f9e8e4ef7c4754c0ab7d Author: Pablo Neira Ayuso Date: Thu Jul 18 20:20:00 2019 +0200 netfilter: bridge: NF_CONNTRACK_BRIDGE does not depend on NF_TABLES_BRIDGE Place NF_CONNTRACK_BRIDGE away from the NF_TABLES_BRIDGE dependency. Fixes: 3c171f496ef5 ("netfilter: bridge: add connection tracking system") Signed-off-by: Pablo Neira Ayuso commit 78e21eb699203f32f8c524b01fb7363125cf9d68 Author: Pablo Neira Ayuso Date: Wed Jul 17 21:48:32 2019 +0200 netfilter: nft_meta: skip EAGAIN if nft_meta_bridge is not a module If it is a module, request this module. Otherwise, if it is compiled built-in or not selected, skip this. Fixes: 0ef1efd1354d ("netfilter: nf_tables: force module load in case select_ops() returns -EAGAIN") Signed-off-by: Pablo Neira Ayuso commit e971ceb803e147e47c15cbb7c5b84327c6453786 Author: Fernando Fernandez Mancera Date: Mon Jul 15 21:31:49 2019 +0200 netfilter: synproxy: fix rst sequence number mismatch 14:51:00.024418 IP 192.168.122.1.41462 > netfilter.90: Flags [S], seq 4023580551, 14:51:00.024454 IP netfilter.90 > 192.168.122.1.41462: Flags [S.], seq 727560212, ack 4023580552, 14:51:00.024524 IP 192.168.122.1.41462 > netfilter.90: Flags [.], ack 1, Note: here, synproxy will send a SYN to the real server, as the 3whs was completed sucessfully. Instead of a syn/ack that we can intercept, we instead received a reset packet from the real backend, that we forward to the original client. However, we don't use the correct sequence number, so the reset is not effective in closing the connection coming from the client. 14:51:00.024550 IP netfilter.90 > 192.168.122.1.41462: Flags [R.], seq 3567407084, 14:51:00.231196 IP 192.168.122.1.41462 > netfilter.90: Flags [.], ack 1, 14:51:00.647911 IP 192.168.122.1.41462 > netfilter.90: Flags [.], ack 1, 14:51:01.474395 IP 192.168.122.1.41462 > netfilter.90: Flags [.], ack 1, Fixes: 48b1de4c110a ("netfilter: add SYNPROXY core/target") Signed-off-by: Fernando Fernandez Mancera Signed-off-by: Pablo Neira Ayuso commit 5a860f9184eb45b2df3fb3364a6b7d076545f83d Author: Chuhong Yuan Date: Thu Jul 18 15:45:42 2019 +0800 liquidio: Replace vmalloc + memset with vzalloc Use vzalloc and vzalloc_node instead of using vmalloc and vmalloc_node and then zeroing the allocated memory by memset 0. This simplifies the code. Signed-off-by: Chuhong Yuan Signed-off-by: David S. Miller commit 7e5a70ad88b1e6f6d9b934b2efb41afff496820f Author: Aurelien Aptel Date: Wed Jul 17 12:46:28 2019 +0200 CIFS: fix deadlock in cached root handling Prevent deadlock between open_shroot() and cifs_mark_open_files_invalid() by releasing the lock before entering SMB2_open, taking it again after and checking if we still need to use the result. Link: https://lore.kernel.org/linux-cifs/684ed01c-cbca-2716-bc28-b0a59a0f8521@prodrive-technologies.com/T/#u Fixes: 3d4ef9a15343 ("smb3: fix redundant opens on root") Signed-off-by: Aurelien Aptel Reviewed-by: Pavel Shilovsky Signed-off-by: Steve French CC: Stable commit 818e95c768c6607a1df4cf022c00c3c58e2f203e Merge: d4df33b0e992 0aeb1def4416 Author: Linus Torvalds Date: Thu Jul 18 11:51:00 2019 -0700 Merge tag 'trace-v5.3' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace Pull tracing updates from Steven Rostedt: "The main changes in this release include: - Add user space specific memory reading for kprobes - Allow kprobes to be executed earlier in boot The rest are mostly just various clean ups and small fixes" * tag 'trace-v5.3' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace: (33 commits) tracing: Make trace_get_fields() global tracing: Let filter_assign_type() detect FILTER_PTR_STRING tracing: Pass type into tracing_generic_entry_update() ftrace/selftest: Test if set_event/ftrace_pid exists before writing ftrace/selftests: Return the skip code when tracing directory not configured in kernel tracing/kprobe: Check registered state using kprobe tracing/probe: Add trace_event_call accesses APIs tracing/probe: Add probe event name and group name accesses APIs tracing/probe: Add trace flag access APIs for trace_probe tracing/probe: Add trace_event_file access APIs for trace_probe tracing/probe: Add trace_event_call register API for trace_probe tracing/probe: Add trace_probe init and free functions tracing/uprobe: Set print format when parsing command tracing/kprobe: Set print format right after parsed command kprobes: Fix to init kprobes in subsys_initcall tracepoint: Use struct_size() in kmalloc() ring-buffer: Remove HAVE_64BIT_ALIGNED_ACCESS ftrace: Enable trampoline when rec count returns back to one tracing/kprobe: Do not run kprobe boot tests if kprobe_event is on cmdline tracing: Make a separate config for trace event self tests ... commit 54f698f31e595f3f0caf28bfe2bde0c3373f9a60 Merge: cac9b9a4b083 e55a73251da3 Author: Thomas Gleixner Date: Thu Jul 18 20:50:48 2019 +0200 Merge branch 'x86/debug' into core/urgent Pick up the two pending objtool patches as the next round of objtool fixes depend on them. commit 666a3d6e1e6b78df34f59e6c0b8907aa3c8dbb2e Author: Su Yanjun Date: Thu Jul 18 10:19:23 2019 +0800 udp: Fix typo in net/ipv4/udp.c Signed-off-by: Su Yanjun Signed-off-by: David S. Miller commit d4df33b0e9925c158b313a586fb1557cf29cfdf4 Merge: 366a4e38b8d0 8492101e15f9 Author: Linus Torvalds Date: Thu Jul 18 11:48:05 2019 -0700 Merge branch 'for-linus-5.2' of git://git.kernel.org/pub/scm/linux/kernel/git/konrad/swiotlb Pull swiotlb updates from Konrad Rzeszutek Wilk: "One compiler fix, and a bug-fix in swiotlb_nr_tbl() and swiotlb_max_segment() to check also for no_iotlb_memory" * 'for-linus-5.2' of git://git.kernel.org/pub/scm/linux/kernel/git/konrad/swiotlb: swiotlb: fix phys_addr_t overflow warning swiotlb: Return consistent SWIOTLB segments/nr_tbl swiotlb: Group identical cleanup in swiotlb_cleanup() commit 35cbef9863640f06107144687bd13151bc2e8ce3 Author: Justin Chen Date: Wed Jul 17 14:58:53 2019 -0700 net: bcmgenet: use promisc for unsupported filters Currently we silently ignore filters if we cannot meet the filter requirements. This will lead to the MAC dropping packets that are expected to pass. A better solution would be to set the NIC to promisc mode when the required filters cannot be met. Also correct the number of MDF filters supported. It should be 17, not 16. Signed-off-by: Justin Chen Reviewed-by: Florian Fainelli Signed-off-by: David S. Miller commit f554af280a80a49412acdd26a6371963f4741e70 Author: Trond Myklebust Date: Tue Jul 16 13:27:23 2019 -0400 SUNRPC: Optimise transport balancing code Moves the balancing code to avoid doing cursor changes on every search iteration. Signed-off-by: Trond Myklebust commit 75369089820473eac45e9ddd970081901a373c08 Author: Trond Myklebust Date: Wed Jul 17 21:22:38 2019 -0400 SUNRPC: Ensure the bvecs are reset when we re-encode the RPC request The bvec tracks the list of pages, so if the number of pages changes due to a re-encode, we need to reset the bvec as well. Fixes: 277e4ab7d530 ("SUNRPC: Simplify TCP receive code by switching...") Signed-off-by: Trond Myklebust Cc: stable@vger.kernel.org # v4.20+ commit 8e04fdfadda75a849c649f7e50fe7d97772e1fcb Author: Trond Myklebust Date: Wed Jul 17 13:57:44 2019 -0400 pnfs/flexfiles: Fix PTR_ERR() dereferences in ff_layout_track_ds_error mirror->mirror_ds can be NULL if uninitialised, but can contain a PTR_ERR() if call to GETDEVICEINFO failed. Fixes: 65990d1afbd2 ("pNFS/flexfiles: Fix a deadlock on LAYOUTGET") Signed-off-by: Trond Myklebust Cc: stable@vger.kernel.org # 4.10+ commit d9aba2b40de6fddd83f2fe3a5ac2bcd2c98fa66b Author: Trond Myklebust Date: Tue Jul 16 15:38:28 2019 -0400 NFSv4: Don't use the zero stateid with layoutget The NFSv4.1 protocol explicitly forbids us from using the zero stateid together with layoutget, so when we see that nfs4_select_rw_stateid() is unable to return a valid delegation, lock or open stateid, then we should initiate recovery and retry. Signed-off-by: Trond Myklebust commit b4f1483cbfa5fafca4874e90063f75603edbc210 Author: Phil Sutter Date: Wed Jul 17 21:38:19 2019 +0200 netfilter: nf_tables: Support auto-loading for inet nat Trying to create an inet family nat chain would not cause nft_chain_nat.ko module to auto-load due to missing module alias. Add a proper one with hard-coded family value 1 for the pseudo-family NFPROTO_INET. Fixes: d164385ec572 ("netfilter: nat: add inet family nat support") Signed-off-by: Phil Sutter Signed-off-by: Pablo Neira Ayuso commit 366a4e38b8d0d3e8c7673ab5c1b5e76bbfbc0085 Merge: ae9b728c8dc0 89b408a68b9d Author: Linus Torvalds Date: Thu Jul 18 11:18:00 2019 -0700 Merge tag 'xfs-5.3-merge-13' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux Pull xfs cleanups from Darrick Wong: "We had a few more lateish cleanup patches come in for 5.3 -- a couple of syncups with the userspace libxfs code and a conversion of the XFS administrator's guide to ReST format. Summary: - Bring fs/xfs/libxfs/xfs_trans_inode.c in sync with userspace libxfs. - Convert the xfs administrator guide to rst and move it into the official admin guide under Documentation" * tag 'xfs-5.3-merge-13' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux: Documentation: filesystem: Convert xfs.txt to ReST xfs: sync up xfs_trans_inode with userspace xfs: move xfs_trans_inode.c to libxfs/ commit ae9b728c8dc0a9939d89f84e8603258ca2a0df22 Merge: d9b9c893048e e9630660bd92 Author: Linus Torvalds Date: Thu Jul 18 11:11:51 2019 -0700 Merge tag '4.3-rc-smb3-fixes' of git://git.samba.org/sfrench/cifs-2.6 Pull cifs updates from Steve French: "Fixes (three for stable) and improvements including much faster encryption (SMB3.1.1 GCM)" * tag '4.3-rc-smb3-fixes' of git://git.samba.org/sfrench/cifs-2.6: (27 commits) smb3: smbdirect no longer experimental cifs: fix crash in smb2_compound_op()/smb2_set_next_command() cifs: fix crash in cifs_dfs_do_automount cifs: fix parsing of symbolic link error response cifs: refactor and clean up arguments in the reparse point parsing SMB3: query inode number on open via create context smb3: Send netname context during negotiate protocol smb3: do not send compression info by default smb3: add new mount option to retrieve mode from special ACE smb3: Allow query of symlinks stored as reparse points cifs: Fix a race condition with cifs_echo_request cifs: always add credits back for unsolicited PDUs fs: cifs: cifsssmb: Change return type of convert_ace_to_cifs_ace add some missing definitions cifs: fix typo in debug message with struct field ia_valid smb3: minor cleanup of compound_send_recv CIFS: Fix module dependency cifs: simplify code by removing CONFIG_CIFS_ACL ifdef cifs: Fix check for matching with existing mount cifs: Properly handle auto disabling of serverino option ... commit d9b9c893048e9d308a833619f0866f1f52778cf5 Merge: 0fe49f70a08d d31d07b97a5e Author: Linus Torvalds Date: Thu Jul 18 11:05:25 2019 -0700 Merge tag 'ceph-for-5.3-rc1' of git://github.com/ceph/ceph-client Pull ceph updates from Ilya Dryomov: "Lots of exciting things this time! - support for rbd object-map and fast-diff features (myself). This will speed up reads, discards and things like snap diffs on sparse images. - ceph.snap.btime vxattr to expose snapshot creation time (David Disseldorp). This will be used to integrate with "Restore Previous Versions" feature added in Windows 7 for folks who reexport ceph through SMB. - security xattrs for ceph (Zheng Yan). Only selinux is supported for now due to the limitations of ->dentry_init_security(). - support for MSG_ADDR2, FS_BTIME and FS_CHANGE_ATTR features (Jeff Layton). This is actually a single feature bit which was missing because of the filesystem pieces. With this in, the kernel client will finally be reported as "luminous" by "ceph features" -- it is still being reported as "jewel" even though all required Luminous features were implemented in 4.13. - stop NULL-terminating ceph vxattrs (Jeff Layton). The convention with xattrs is to not terminate and this was causing inconsistencies with ceph-fuse. - change filesystem time granularity from 1 us to 1 ns, again fixing an inconsistency with ceph-fuse (Luis Henriques). On top of this there are some additional dentry name handling and cap flushing fixes from Zheng. Finally, Jeff is formally taking over for Zheng as the filesystem maintainer" * tag 'ceph-for-5.3-rc1' of git://github.com/ceph/ceph-client: (71 commits) ceph: fix end offset in truncate_inode_pages_range call ceph: use generic_delete_inode() for ->drop_inode ceph: use ceph_evict_inode to cleanup inode's resource ceph: initialize superblock s_time_gran to 1 MAINTAINERS: take over for Zheng as CephFS kernel client maintainer rbd: setallochint only if object doesn't exist rbd: support for object-map and fast-diff rbd: call rbd_dev_mapping_set() from rbd_dev_image_probe() libceph: export osd_req_op_data() macro libceph: change ceph_osdc_call() to take page vector for response libceph: bump CEPH_MSG_MAX_DATA_LEN (again) rbd: new exclusive lock wait/wake code rbd: quiescing lock should wait for image requests rbd: lock should be quiesced on reacquire rbd: introduce copyup state machine rbd: rename rbd_obj_setup_*() to rbd_obj_init_*() rbd: move OSD request allocation into object request state machines rbd: factor out __rbd_osd_setup_discard_ops() rbd: factor out rbd_osd_setup_copyup() rbd: introduce obj_req->osd_reqs list ... commit 0fe49f70a08d7d25acee3b066a88c654fea26121 Merge: f8c3500cd137 23c84eb78375 Author: Linus Torvalds Date: Thu Jul 18 10:58:52 2019 -0700 Merge tag 'dax-for-5.3' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm Pull dax updates from Dan Williams: "The fruits of a bug hunt in the fsdax implementation with Willy and a small feature update for device-dax: - Fix a hang condition that started triggering after the Xarray conversion of fsdax in the v4.20 kernel. - Add a 'resource' (root-only physical base address) sysfs attribute to device-dax instances to correlate memory-blocks onlined via the kmem driver with a given device instance" * tag 'dax-for-5.3' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm: dax: Fix missed wakeup with PMD faults device-dax: Add a 'resource' attribute commit f8c3500cd137867927bc080f4a6e02e0222dd1b8 Merge: d77e9e4e18ce 8c2e408e73f7 Author: Linus Torvalds Date: Thu Jul 18 10:52:08 2019 -0700 Merge tag 'libnvdimm-for-5.3' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm Pull libnvdimm updates from Dan Williams: "Primarily just the virtio_pmem driver: - virtio_pmem The new virtio_pmem facility introduces a paravirtualized persistent memory device that allows a guest VM to use DAX mechanisms to access a host-file with host-page-cache. It arranges for MAP_SYNC to be disabled and instead triggers a host fsync() when a 'write-cache flush' command is sent to the virtual disk device. - Miscellaneous small fixups" * tag 'libnvdimm-for-5.3' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm: virtio_pmem: fix sparse warning xfs: disable map_sync for async flush ext4: disable map_sync for async flush dax: check synchronous mapping is supported dm: enable synchronous dax libnvdimm: add dax_dev sync flag virtio-pmem: Add virtio pmem driver libnvdimm: nd_region flush callback support libnvdimm, namespace: Drop uuid_t implementation detail commit d77e9e4e18ce9da3b4981a5c537979c42b06638c Merge: 2ae048e16636 7fb832ae7294 Author: Linus Torvalds Date: Thu Jul 18 10:47:59 2019 -0700 Merge tag 'linux-watchdog-5.3-rc1' of git://www.linux-watchdog.org/linux-watchdog Pull watchdog updates from Wim Van Sebroeck: - add Allwinner H6 watchdog - drop warning after registering device patches - hpwdt improvements - gpio: add support for nowayout option - introduce CONFIG_WATCHDOG_OPEN_TIMEOUT - convert remaining drivers to use SPDX license identifier - Fixes and improvements on several watchdog device drivers * tag 'linux-watchdog-5.3-rc1' of git://www.linux-watchdog.org/linux-watchdog: (74 commits) watchdog: digicolor_wdt: Remove unused variable in dc_wdt_probe watchdog: ie6xx_wdt: Use spinlock_t instead of struct spinlock watchdog: atmel: atmel-sama5d4-wdt: Disable watchdog on system suspend watchdog: convert remaining drivers to use SPDX license identifier dt-bindings: watchdog: Rename bindings documentation file watchdog: mei_wdt: no need to check return value of debugfs_create functions watchdog: bcm_kona_wdt: no need to check return value of debugfs_create functions docs: watchdog: Fix build error. docs: watchdog: convert docs to ReST and rename to *.rst watchdog: make the device time out at open_deadline when open_timeout is used watchdog: introduce CONFIG_WATCHDOG_OPEN_TIMEOUT watchdog: introduce watchdog.open_timeout commandline parameter dt-bindings: watchdog: move i.MX system controller watchdog binding to SCU watchdog: imx_sc: Add pretimeout support watchdog: renesas_wdt: Add a few cycles delay watchdog: gpio: add support for nowayout option watchdog: renesas_wdt: Use 'dev' instead of dereferencing it repeatedly dt-bindings: watchdog: add Allwinner H6 watchdog watchdog: jz4740: Avoid starting watchdog in set_timeout watchdog: jz4740: Use register names from ... commit c0e48f9dea9129aa11bec3ed13803bcc26e96e49 Author: Zhengyuan Liu Date: Thu Jul 18 20:44:00 2019 +0800 io_uring: add a memory barrier before atomic_read There is a hang issue while using fio to do some basic test. The issue can be easily reproduced using the below script: while true do fio --ioengine=io_uring -rw=write -bs=4k -numjobs=1 \ -size=1G -iodepth=64 -name=uring --filename=/dev/zero done After several minutes (or more), fio would block at io_uring_enter->io_cqring_wait in order to waiting for previously committed sqes to be completed and can't return to user anymore until we send a SIGTERM to fio. After receiving SIGTERM, fio hangs at io_ring_ctx_wait_and_kill with a backtrace like this: [54133.243816] Call Trace: [54133.243842] __schedule+0x3a0/0x790 [54133.243868] schedule+0x38/0xa0 [54133.243880] schedule_timeout+0x218/0x3b0 [54133.243891] ? sched_clock+0x9/0x10 [54133.243903] ? wait_for_completion+0xa3/0x130 [54133.243916] ? _raw_spin_unlock_irq+0x2c/0x40 [54133.243930] ? trace_hardirqs_on+0x3f/0xe0 [54133.243951] wait_for_completion+0xab/0x130 [54133.243962] ? wake_up_q+0x70/0x70 [54133.243984] io_ring_ctx_wait_and_kill+0xa0/0x1d0 [54133.243998] io_uring_release+0x20/0x30 [54133.244008] __fput+0xcf/0x270 [54133.244029] ____fput+0xe/0x10 [54133.244040] task_work_run+0x7f/0xa0 [54133.244056] do_exit+0x305/0xc40 [54133.244067] ? get_signal+0x13b/0xbd0 [54133.244088] do_group_exit+0x50/0xd0 [54133.244103] get_signal+0x18d/0xbd0 [54133.244112] ? _raw_spin_unlock_irqrestore+0x36/0x60 [54133.244142] do_signal+0x34/0x720 [54133.244171] ? exit_to_usermode_loop+0x7e/0x130 [54133.244190] exit_to_usermode_loop+0xc0/0x130 [54133.244209] do_syscall_64+0x16b/0x1d0 [54133.244221] entry_SYSCALL_64_after_hwframe+0x49/0xbe The reason is that we had added a req to ctx->pending_async at the very end, but it didn't get a chance to be processed. How could this happen? fio#cpu0 wq#cpu1 io_add_to_prev_work io_sq_wq_submit_work atomic_read() <<< 1 atomic_dec_return() << 1->0 list_empty(); <<< true; list_add_tail() atomic_read() << 0 or 1? As atomic_ops.rst states, atomic_read does not guarantee that the runtime modification by any other thread is visible yet, so we must take care of that with a proper implicit or explicit memory barrier. This issue was detected with the help of Jackie's Fixes: 31b515106428 ("io_uring: allow workqueue item to handle multiple buffered requests") Signed-off-by: Zhengyuan Liu Signed-off-by: Jens Axboe commit 2ae048e16636afd7521270acacb08d9c42fd23f0 Merge: d0411ec8ca6b 4914da2fb0c8 Author: Linus Torvalds Date: Thu Jul 18 09:36:51 2019 -0700 Merge tag 'sound-fix-5.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "A collection of small fixes. - The optimization of PM resume with HD-audio HDMI codecs, which eventually work around weird issues - A correction of Intel Icelake HDMI audio code - Quirks for Dell machines with Realtek HD-audio codecs - The fix for too long sequencer write stall that was spotted by syzkaller - A few trivial cleanups reported by coccinelle" * tag 'sound-fix-5.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: ALSA: hda - Don't resume forcibly i915 HDMI/DP codec ALSA: hda/hdmi - Fix i915 reverse port/pin mapping ALSA: hda/hdmi - Remove duplicated define ALSA: seq: Break too long mutex context in the write loop ALSA: hda/realtek: apply ALC891 headset fixup to one Dell machine ALSA: rme9652: Unneeded variable: "result". ALSA: emu10k1: Remove unneeded variable "change" ALSA: au88x0: Remove unneeded variable: "changed" ALSA: hda/realtek - Fixed Headphone Mic can't record on Dell platform ALSA: ps3: Remove Unneeded variable: "ret" ALSA: lx6464es: Remove unneeded variable err commit d0411ec8ca6b98061023873e334323ef102100cc Merge: 4b09ddbcd107 918e162e6a71 Author: Linus Torvalds Date: Thu Jul 18 09:32:28 2019 -0700 Merge tag 'pm-5.3-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull more power management updates from Rafael Wysocki: "These modify the Intel RAPL driver to allow it to use an MMIO interface to the hardware, make the int340X thermal driver provide such an interface for it, add Intel Ice Lake CPU IDs to the RAPL driver (these changes depend on the previously merged x86 arch changes), update cpufreq to use the PM QoS framework for managing the min and max frequency limits, and add update the imx-cpufreq-dt cpufreq driver to support i.MX8MN. Specifics: - Add MMIO interface support to the Intel RAPL power capping driver and update the int340X thermal driver to provide a RAPL MMIO interface (Zhang Rui, Stephen Rothwell). - Add Intel Ice Lake CPU IDs to the RAPL driver (Zhang Rui, Rajneesh Bhardwaj). - Make cpufreq use the PM QoS framework (instead of notifiers) for managing the min and max frequency constraints (Viresh Kumar). - Add i.MX8MN support to the imx-cpufreq-dt cpufreq driver (Anson Huang)" * tag 'pm-5.3-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: (27 commits) cpufreq: Make cpufreq_generic_init() return void intel_rapl: need linux/cpuhotplug.h for enum cpuhp_state powercap/rapl: Add Ice Lake NNPI support to RAPL driver powercap/intel_rapl: add support for ICX-D powercap/intel_rapl: add support for ICX powercap/intel_rapl: add support for IceLake desktop intel_rapl: Fix module autoloading issue int340X/processor_thermal_device: add support for MMIO RAPL intel_rapl: support two power limits for every RAPL domain intel_rapl: support 64 bit register intel_rapl: abstract RAPL common code intel_rapl: cleanup hardcoded MSR access intel_rapl: cleanup some functions intel_rapl: abstract register access operations intel_rapl: abstract register address intel_rapl: introduce struct rapl_if_private intel_rapl: introduce intel_rapl.h intel_rapl: remove hardcoded register index intel_rapl: use reg instead of msr cpufreq: imx-cpufreq-dt: Add i.MX8MN support ... commit ac38297f7038cd5b80d66f8809c7bbf5b70031f3 Author: Josef Bacik Date: Tue Jul 16 16:19:29 2019 -0400 rq-qos: use a mb for got_token Oleg noticed that our checking of data.got_token is unsafe in the cleanup case, and should really use a memory barrier. Use a wmb on the write side, and a rmb() on the read side. We don't need one in the main loop since we're saved by set_current_state(). Reviewed-by: Oleg Nesterov Signed-off-by: Josef Bacik Signed-off-by: Jens Axboe commit d14a9b389a86a5154b704bc88ce8dd37c701456a Author: Josef Bacik Date: Tue Jul 16 16:19:28 2019 -0400 rq-qos: set ourself TASK_UNINTERRUPTIBLE after we schedule In case we get a spurious wakeup we need to make sure to re-set ourselves to TASK_UNINTERRUPTIBLE so we don't busy wait. Reviewed-by: Oleg Nesterov Signed-off-by: Josef Bacik Signed-off-by: Jens Axboe commit 64e7ea875ef63b2801be7954cf7257d1bfccc266 Author: Josef Bacik Date: Tue Jul 16 16:19:27 2019 -0400 rq-qos: don't reset has_sleepers on spurious wakeups If we raced with somebody else getting an inflight counter we could fail to get an inflight counter with no sleepers on the list, and thus need to go to sleep. In this case has_sleepers should be true because we are now relying on the waker to get our inflight counter for us. And in the case of spurious wakeups we'd still want this to be the case. So set has_sleepers to true if we went to sleep to make sure we're woken up the proper way. Reviewed-by: Oleg Nesterov Signed-off-by: Josef Bacik Signed-off-by: Jens Axboe commit 545fbd0775bafcefc8f7bc844291bd13c44b7fdc Author: Josef Bacik Date: Tue Jul 16 16:19:26 2019 -0400 rq-qos: fix missed wake-ups in rq_qos_throttle We saw a hang in production with WBT where there was only one waiter in the throttle path and no outstanding IO. This is because of the has_sleepers optimization that is used to make sure we don't steal an inflight counter for new submitters when there are people already on the list. We can race with our check to see if the waitqueue has any waiters (this is done locklessly) and the time we actually add ourselves to the waitqueue. If this happens we'll go to sleep and never be woken up because nobody is doing IO to wake us up. Fix this by checking if the waitqueue has a single sleeper on the list after we add ourselves, that way we have an uptodate view of the list. Reviewed-by: Oleg Nesterov Signed-off-by: Josef Bacik Signed-off-by: Jens Axboe commit a6d81d30d3cd87f85bfd922358eb18b8146c4925 Author: Josef Bacik Date: Tue Jul 16 16:19:25 2019 -0400 wait: add wq_has_single_sleeper helper rq-qos sits in the io path so we want to take locks as sparingly as possible. To accomplish this we try not to take the waitqueue head lock unless we are sure we need to go to sleep, and we have an optimization to make sure that we don't starve out existing waiters. Since we check if there are existing waiters locklessly we need to be able to update our view of the waitqueue list after we've added ourselves to the waitqueue. Accomplish this by adding this helper to see if there is more than just ourselves on the list. Reviewed-by: Oleg Nesterov Signed-off-by: Josef Bacik Signed-off-by: Jens Axboe commit 4b09ddbcd107e280077bd3e918c8089dfa426980 Merge: 47d6a7607443 2c66a5b52e9e Author: Linus Torvalds Date: Thu Jul 18 09:12:34 2019 -0700 Merge tag 'acpi-5.3-rc1-3' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull more ACPI updates from Rafael Wysocki: "These get rid of two clang warnings, add a new quirk mechanism to the ACPI backlight driver (and apply it to one machine) and update the table load object initialization in ACPICA (this is a replacement for a previously reverted ACPICA commit). Specifics: - Make ACPI table loading work more consistently regardless of the exact mechanism used for loading a table (Erik Schmauss). - Get rid of two clang warnings (Arnd Bergmann). - Add new quirk mechanism to the ACPI backlight driver and use it to add a quirk for PB Easynote MZ35 (Hans de Goede)" * tag 'acpi-5.3-rc1-3' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: ACPI: video: Add new hw_changes_brightness quirk, set it on PB Easynote MZ35 ACPI: fix false-positive -Wuninitialized warning ACPI: blacklist: fix clang warning for unused DMI table ACPICA: Update table load object initialization commit 47d6a7607443ea43dbc4d0f371bf773540a8f8f4 Merge: 22051d9c4a57 be2ece49e683 Author: Linus Torvalds Date: Thu Jul 18 08:43:20 2019 -0700 Merge branch 'floppy' Merge floppy ioctl verification fixes from Denis Efremov. This also marks the floppy driver as orphaned - it turns out that Jiri no longer has working hardware. Actual working physical floppy hardware is getting hard to find, and while Willy was able to test this, I think the driver can be considered pretty much dead from an actual hardware standpoint. The hardware that is still sold seems to be mainly USB-based, which doesn't use this legacy driver at all. The old floppy disk controller is still emulated in various VM environments, so the driver isn't going away, but let's see if anybody is interested to step up to maintain it. The lack of hardware also likely means that the ioctl range verification fixes are probably mostly relevant to anybody using floppies in a virtual environment. Which is probably also going away in favor of USB storage emulation, but who knows. Will Decon reviewed the patches but I'm not rebasing them just for that, so I'll add a Reviewed-by: Will Deacon here instead. * floppy: MAINTAINERS: mark floppy.c orphaned floppy: fix out-of-bounds read in copy_buffer floppy: fix invalid pointer dereference in drive_name floppy: fix out-of-bounds read in next_valid_format floppy: fix div-by-zero in setup_format_params commit be2ece49e68361f9b56098e5df3ddbccf87d140a Author: Jiri Kosina Date: Thu Jul 18 00:03:51 2019 +0200 MAINTAINERS: mark floppy.c orphaned I volunteered myself to maintain it quite some time ago back when I fixed the concurrency issues which exhibited itself only with VM-emulated devices, and at the same time I still had the physical 3.5" reader to test all the changes. The reader doesn't work any more though, so I guess it's time to step down from this super-prestigious role :p and mark floppy.c as Orphaned. Signed-off-by: Jiri Kosina Signed-off-by: Linus Torvalds commit 2d69fbf3d01a5b71e98137e2406d4087960c512e Author: Paul Walmsley Date: Wed Jul 17 13:41:51 2019 -0700 riscv: fix build break after macro-to-function conversion in generic cacheflush.h Commit c296d4dc13ae ("asm-generic: fix a compilation warning") converted the various flush_*cache_* macros in asm-generic/cacheflush.h to static inline functions. This breaks RISC-V builds, since RISC-V's cacheflush.h includes the generic cacheflush.h and then undefines the macros to be overridden. Fix by copying the subset of the no-op functions that are reused from the generic cacheflush.h into the RISC-V cacheflush.h, and dropping the include of the generic cacheflush.h. Fixes: c296d4dc13ae ("asm-generic: fix a compilation warning") Signed-off-by: Paul Walmsley Cc: Qian Cai Cc: Arnd Bergmann Cc: Andrew Morton Cc: Linus Torvalds commit cac9b9a4b08304f11daace03b8b48659355e44c1 Author: Peter Zijlstra Date: Thu Jul 18 10:47:47 2019 +0200 stacktrace: Force USER_DS for stack_trace_save_user() When walking userspace stacks, USER_DS needs to be set, otherwise access_ok() will not function as expected. Reported-by: Vegard Nossum Reported-by: Eiichi Tsukata Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Thomas Gleixner Tested-by: Vegard Nossum Reviewed-by: Joel Fernandes (Google) Link: https://lkml.kernel.org/r/20190718085754.GM3402@hirez.programming.kicks-ass.net commit 4d202c8c8ed3822327285747db1765967110b274 Author: Gautham R. Shenoy Date: Wed Jul 17 16:05:24 2019 +0530 powerpc/xive: Fix loop exit-condition in xive_find_target_in_mask() xive_find_target_in_mask() has the following for(;;) loop which has a bug when @first == cpumask_first(@mask) and condition 1 fails to hold for every CPU in @mask. In this case we loop forever in the for-loop. first = cpu; for (;;) { if (cpu_online(cpu) && xive_try_pick_target(cpu)) // condition 1 return cpu; cpu = cpumask_next(cpu, mask); if (cpu == first) // condition 2 break; if (cpu >= nr_cpu_ids) // condition 3 cpu = cpumask_first(mask); } This is because, when @first == cpumask_first(@mask), we never hit the condition 2 (cpu == first) since prior to this check, we would have executed "cpu = cpumask_next(cpu, mask)" which will set the value of @cpu to a value greater than @first or to nr_cpus_ids. When this is coupled with the fact that condition 1 is not met, we will never exit this loop. This was discovered by the hard-lockup detector while running LTP test concurrently with SMT switch tests. watchdog: CPU 12 detected hard LOCKUP on other CPUs 68 watchdog: CPU 12 TB:85587019220796, last SMP heartbeat TB:85578827223399 (15999ms ago) watchdog: CPU 68 Hard LOCKUP watchdog: CPU 68 TB:85587019361273, last heartbeat TB:85576815065016 (19930ms ago) CPU: 68 PID: 45050 Comm: hxediag Kdump: loaded Not tainted 4.18.0-100.el8.ppc64le #1 NIP: c0000000006f5578 LR: c000000000cba9ec CTR: 0000000000000000 REGS: c000201fff3c7d80 TRAP: 0100 Not tainted (4.18.0-100.el8.ppc64le) MSR: 9000000002883033 CR: 24028424 XER: 00000000 CFAR: c0000000006f558c IRQMASK: 1 GPR00: c0000000000afc58 c000201c01c43400 c0000000015ce500 c000201cae26ec18 GPR04: 0000000000000800 0000000000000540 0000000000000800 00000000000000f8 GPR08: 0000000000000020 00000000000000a8 0000000080000000 c00800001a1beed8 GPR12: c0000000000b1410 c000201fff7f4c00 0000000000000000 0000000000000000 GPR16: 0000000000000000 0000000000000000 0000000000000540 0000000000000001 GPR20: 0000000000000048 0000000010110000 c00800001a1e3780 c000201cae26ed18 GPR24: 0000000000000000 c000201cae26ed8c 0000000000000001 c000000001116bc0 GPR28: c000000001601ee8 c000000001602494 c000201cae26ec18 000000000000001f NIP [c0000000006f5578] find_next_bit+0x38/0x90 LR [c000000000cba9ec] cpumask_next+0x2c/0x50 Call Trace: [c000201c01c43400] [c000201cae26ec18] 0xc000201cae26ec18 (unreliable) [c000201c01c43420] [c0000000000afc58] xive_find_target_in_mask+0x1b8/0x240 [c000201c01c43470] [c0000000000b0228] xive_pick_irq_target.isra.3+0x168/0x1f0 [c000201c01c435c0] [c0000000000b1470] xive_irq_startup+0x60/0x260 [c000201c01c43640] [c0000000001d8328] __irq_startup+0x58/0xf0 [c000201c01c43670] [c0000000001d844c] irq_startup+0x8c/0x1a0 [c000201c01c436b0] [c0000000001d57b0] __setup_irq+0x9f0/0xa90 [c000201c01c43760] [c0000000001d5aa0] request_threaded_irq+0x140/0x220 [c000201c01c437d0] [c00800001a17b3d4] bnx2x_nic_load+0x188c/0x3040 [bnx2x] [c000201c01c43950] [c00800001a187c44] bnx2x_self_test+0x1fc/0x1f70 [bnx2x] [c000201c01c43a90] [c000000000adc748] dev_ethtool+0x11d8/0x2cb0 [c000201c01c43b60] [c000000000b0b61c] dev_ioctl+0x5ac/0xa50 [c000201c01c43bf0] [c000000000a8d4ec] sock_do_ioctl+0xbc/0x1b0 [c000201c01c43c60] [c000000000a8dfb8] sock_ioctl+0x258/0x4f0 [c000201c01c43d20] [c0000000004c9704] do_vfs_ioctl+0xd4/0xa70 [c000201c01c43de0] [c0000000004ca274] sys_ioctl+0xc4/0x160 [c000201c01c43e30] [c00000000000b388] system_call+0x5c/0x70 Instruction dump: 78aad182 54a806be 3920ffff 78a50664 794a1f24 7d294036 7d43502a 7d295039 4182001c 48000034 78a9d182 79291f24 <7d23482a> 2fa90000 409e0020 38a50040 To fix this, move the check for condition 2 after the check for condition 3, so that we are able to break out of the loop soon after iterating through all the CPUs in the @mask in the problem case. Use do..while() to achieve this. Fixes: 243e25112d06 ("powerpc/xive: Native exploitation of the XIVE interrupt controller") Cc: stable@vger.kernel.org # v4.12+ Reported-by: Indira P. Joga Signed-off-by: Gautham R. Shenoy Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/1563359724-13931-1-git-send-email-ego@linux.vnet.ibm.com commit b5e02b484d6f12112d49326bff2aecfccd2f518d Author: Paolo Valente Date: Thu Jul 18 09:08:52 2019 +0200 block, bfq: check also in-flight I/O in dispatch plugging Consider a sync bfq_queue Q that remains empty while in service, and suppose that, when this happens, there is a fair amount of already in-flight I/O not belonging to Q. In such a situation, I/O dispatching may need to be plugged (until new I/O arrives for Q), for the following reason. The drive may decide to serve in-flight non-Q's I/O requests before Q's ones, thereby delaying the arrival of new I/O requests for Q (recall that Q is sync). If I/O-dispatching is not plugged, then, while Q remains empty, a basically uncontrolled amount of I/O from other queues may be dispatched too, possibly causing the service of Q's I/O to be delayed even longer in the drive. This problem gets more and more serious as the speed and the queue depth of the drive grow, because, as these two quantities grow, the probability to find no queue busy but many requests in flight grows too. If Q has the same weight and priority as the other queues, then the above delay is unlikely to cause any issue, because all queues tend to undergo the same treatment. So, since not plugging I/O dispatching is convenient for throughput, it is better not to plug. Things change in case Q has a higher weight or priority than some other queue, because Q's service guarantees may simply be violated. For this reason, commit 1de0c4cd9ea6 ("block, bfq: reduce idling only in symmetric scenarios") does plug I/O in such an asymmetric scenario. Plugging minimizes the delay induced by already in-flight I/O, and enables Q to recover the bandwidth it may lose because of this delay. Yet the above commit does not cover the case of weight-raised queues, for efficiency concerns. For weight-raised queues, I/O-dispatch plugging is activated simply if not all bfq_queues are weight-raised. But this check does not handle the case of in-flight requests, because a bfq_queue may become non busy *before* all its in-flight requests are completed. This commit performs I/O-dispatch plugging for weight-raised queues if there are some in-flight requests. As a practical example of the resulting recover of control, under write load on a Samsung SSD 970 PRO, gnome-terminal starts in 1.5 seconds after this fix, against 15 seconds before the fix (as a reference, gnome-terminal takes about 35 seconds to start with any of the other I/O schedulers). Fixes: 1de0c4cd9ea6 ("block, bfq: reduce idling only in symmetric scenarios") Signed-off-by: Paolo Valente Signed-off-by: Jens Axboe commit 70256b42caaf3e13c2932c2be7903a73fbe8bb8b Author: Kai-Heng Feng Date: Thu Jul 18 17:53:13 2019 +0800 ALSA: line6: Fix wrong altsetting for LINE6_PODHD500_1 Commit 7b9584fa1c0b ("staging: line6: Move altsetting to properties") set a wrong altsetting for LINE6_PODHD500_1 during refactoring. Set the correct altsetting number to fix the issue. BugLink: https://bugs.launchpad.net/bugs/1790595 Fixes: 7b9584fa1c0b ("staging: line6: Move altsetting to properties") Signed-off-by: Kai-Heng Feng Cc: Signed-off-by: Takashi Iwai commit 59d81c1e3cade953a0cb3f66ce9a3f2398fdfac3 Author: Takashi Iwai Date: Tue Jul 16 11:52:00 2019 +0200 ALSA: hda - Optimize resume for codecs without jack detection The codecs without jack detection also don't have to be resumed forcibly because, obviously, they have no jack. Skip the forced resume in such a case as optimization as well. Reviewed-by: Kai Vehmanen Signed-off-by: Takashi Iwai commit 2c66a5b52e9e328cd52af0d961f99a0e6717a065 Merge: d1fb5b2f623b dfd6f9ad3636 4f7f96453b46 Author: Rafael J. Wysocki Date: Thu Jul 18 10:22:20 2019 +0200 Merge branches 'acpi-misc' and 'acpi-video' * acpi-misc: ACPI: fix false-positive -Wuninitialized warning ACPI: blacklist: fix clang warning for unused DMI table * acpi-video: ACPI: video: Add new hw_changes_brightness quirk, set it on PB Easynote MZ35 commit 918e162e6a71e924a343b41f71789ad14e1e3229 Merge: 8da04e05cdfc c4dcc8a16278 Author: Rafael J. Wysocki Date: Thu Jul 18 09:49:30 2019 +0200 Merge branch 'pm-cpufreq' * pm-cpufreq: cpufreq: Make cpufreq_generic_init() return void cpufreq: imx-cpufreq-dt: Add i.MX8MN support cpufreq: Add QoS requests for userspace constraints cpufreq: intel_pstate: Reuse refresh_frequency_limits() cpufreq: Register notifiers with the PM QoS framework PM / QoS: Add support for MIN/MAX frequency constraints PM / QOS: Pass request type to dev_pm_qos_read_value() PM / QOS: Rename __dev_pm_qos_read_value() and dev_pm_qos_raw_read_value() PM / QOS: Pass request type to dev_pm_qos_{add|remove}_notifier() commit cf144f81a99d1a3928f90b0936accfd3f45c9a0a Author: Daniel Jordan Date: Tue Jul 16 12:32:53 2019 -0400 padata: use smp_mb in padata_reorder to avoid orphaned padata jobs Testing padata with the tcrypt module on a 5.2 kernel... # modprobe tcrypt alg="pcrypt(rfc4106(gcm(aes)))" type=3 # modprobe tcrypt mode=211 sec=1 ...produces this splat: INFO: task modprobe:10075 blocked for more than 120 seconds. Not tainted 5.2.0-base+ #16 modprobe D 0 10075 10064 0x80004080 Call Trace: ? __schedule+0x4dd/0x610 ? ring_buffer_unlock_commit+0x23/0x100 schedule+0x6c/0x90 schedule_timeout+0x3b/0x320 ? trace_buffer_unlock_commit_regs+0x4f/0x1f0 wait_for_common+0x160/0x1a0 ? wake_up_q+0x80/0x80 { crypto_wait_req } # entries in braces added by hand { do_one_aead_op } { test_aead_jiffies } test_aead_speed.constprop.17+0x681/0xf30 [tcrypt] do_test+0x4053/0x6a2b [tcrypt] ? 0xffffffffa00f4000 tcrypt_mod_init+0x50/0x1000 [tcrypt] ... The second modprobe command never finishes because in padata_reorder, CPU0's load of reorder_objects is executed before the unlocking store in spin_unlock_bh(pd->lock), causing CPU0 to miss CPU1's increment: CPU0 CPU1 padata_reorder padata_do_serial LOAD reorder_objects // 0 INC reorder_objects // 1 padata_reorder TRYLOCK pd->lock // failed UNLOCK pd->lock CPU0 deletes the timer before returning from padata_reorder and since no other job is submitted to padata, modprobe waits indefinitely. Add a pair of full barriers to guarantee proper ordering: CPU0 CPU1 padata_reorder padata_do_serial UNLOCK pd->lock smp_mb() LOAD reorder_objects INC reorder_objects smp_mb__after_atomic() padata_reorder TRYLOCK pd->lock smp_mb__after_atomic is needed so the read part of the trylock operation comes after the INC, as Andrea points out. Thanks also to Andrea for help with writing a litmus test. Fixes: 16295bec6398 ("padata: Generic parallelization/serialization interface") Signed-off-by: Daniel Jordan Cc: Cc: Andrea Parri Cc: Boqun Feng Cc: Herbert Xu Cc: Paul E. McKenney Cc: Peter Zijlstra Cc: Steffen Klassert Cc: linux-arch@vger.kernel.org Cc: linux-crypto@vger.kernel.org Cc: linux-kernel@vger.kernel.org Signed-off-by: Herbert Xu commit 83bf42510d7f7e1daa692c096e8e9919334d7b57 Author: David Rientjes Date: Fri Jul 12 13:41:58 2019 -0700 crypto: ccp - Fix SEV_VERSION_GREATER_OR_EQUAL SEV_VERSION_GREATER_OR_EQUAL() will fail if upgrading from 2.2 to 3.1, for example, because the minor version is not equal to or greater than the major. Fix this and move to a static inline function for appropriate type checking. Fixes: edd303ff0e9e ("crypto: ccp - Add DOWNLOAD_FIRMWARE SEV command") Reported-by: Cfir Cohen Signed-off-by: David Rientjes Acked-by: Tom Lendacky Acked-by: Gary R Hook Signed-off-by: Herbert Xu commit 538a5a072e6ef04377b180ee9b3ce5bae0a85da4 Author: Cfir Cohen Date: Tue Jul 2 10:32:56 2019 -0700 crypto: ccp/gcm - use const time tag comparison. Avoid leaking GCM tag through timing side channel. Fixes: 36cf515b9bbe ("crypto: ccp - Enable support for AES GCM on v5 CCPs") Cc: # v4.12+ Signed-off-by: Cfir Cohen Acked-by: Gary R Hook Signed-off-by: Herbert Xu commit 7402a4fedc2bc448100c2d086406c708451b16dc Author: Trond Myklebust Date: Tue Jul 16 13:51:29 2019 -0400 SUNRPC: Fix up backchannel slot table accounting Add a per-transport maximum limit in the socket case, and add helpers to allow the NFSv4 code to discover that limit. Signed-off-by: Trond Myklebust commit 9f98effc19bd490a375c4e764a56a2c015d27c3c Author: Trond Myklebust Date: Thu Jul 18 01:10:51 2019 -0400 SUNRPC: Fix initialisation of struct rpc_xprt_switch Ensure that we do initialise the fields xps_nactive, xps_queuelen and xps_net. Signed-off-by: Trond Myklebust commit b3c8a40cfc4a7051ac8b7b3fc5fe1ee1467bef25 Merge: 3729fe2bc2a0 7f3bbc0b817b Author: Dave Airlie Date: Thu Jul 18 15:03:13 2019 +1000 Merge tag 'drm-misc-next-fixes-2019-07-11' of git://anongit.freedesktop.org/drm/drm-misc into drm-next Pull request for drm-misc-fixes-next for v5.3: - Revert properties exposed in komeda that need improvement before they become ABI. - Only add modes from the cmdline if they are valid. - Add orientation quirk for GPD MicroPC. - Reduce stack usage in drm selftests. - Fix bochs framebuffer setup. Signed-off-by: Dave Airlie From: Maarten Lankhorst Link: https://patchwork.freedesktop.org/patch/msgid/e6b84ce4-2728-fb02-87c1-6a6b87703c0b@linux.intel.com commit a1078e821b605813b63bf6bca414a85f804d5c66 Author: Juergen Gross Date: Wed Jun 19 11:00:56 2019 +0200 xen: let alloc_xenballooned_pages() fail if not enough memory free Instead of trying to allocate pages with GFP_USER in add_ballooned_pages() check the available free memory via si_mem_available(). GFP_USER is far less limiting memory exhaustion than the test via si_mem_available(). This will avoid dom0 running out of memory due to excessive foreign page mappings especially on ARM and on x86 in PVH mode, as those don't have a pre-ballooned area which can be used for foreign mappings. As the normal ballooning suffers from the same problem don't balloon down more than si_mem_available() pages in one iteration. At the same time limit the default maximum number of retries. This is part of XSA-300. Signed-off-by: Juergen Gross commit 8e144797f1a67c52e386161863da4614a23ad913 Author: Michael Forney Date: Wed Jul 10 16:20:11 2019 -0500 objtool: Rename elf_open() to prevent conflict with libelf from elftoolchain The elftoolchain version of libelf has a function named elf_open(). The function name isn't quite accurate anyway, since it also reads all the ELF data. Rename it to elf_read(), which is more accurate. [ jpoimboe: rename to elf_read(); write commit description ] Signed-off-by: Michael Forney Signed-off-by: Josh Poimboeuf Signed-off-by: Thomas Gleixner Link: https://lkml.kernel.org/r/7ce2d1b35665edf19fd0eb6fbc0b17b81a48e62f.1562793604.git.jpoimboe@redhat.com commit 3c3ea5031761fdd144b461d23a077c3a0cf427fa Author: Michael Forney Date: Wed Jul 10 16:17:35 2019 -0500 objtool: Use Elf_Scn typedef instead of assuming struct name The libelf implementation might use a different struct name, and the Elf_Scn typedef is already used throughout the rest of objtool. Signed-off-by: Michael Forney Signed-off-by: Josh Poimboeuf Signed-off-by: Thomas Gleixner Link: https://lkml.kernel.org/r/d270e1be2835fc2a10acf67535ff2ebd2145bf43.1562793448.git.jpoimboe@redhat.com commit e0c5c5e308ee9b3548844f0d88da937782b895ef Merge: e4557c1a46b0 916c31fff946 Author: Thomas Gleixner Date: Thu Jul 18 00:32:52 2019 +0200 Merge tag 'perf-core-for-mingo-5.3-20190715' of git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux into perf/urgent Pull perf/core improvements and fixes from Arnaldo Carvalho de Melo: perf db-export: Adrian Hunter: - Improvements in how COMM details are exported to databases for post processing and use in the sql-viewer.py UI. - Export switch events to the database. BPF: Arnaldo Carvalho de Melo: - Bump rlimit(MEMLOCK) for 'perf test bpf' and 'perf trace', just like selftests/bpf/bpf_rlimit.h do, which makes errors due to exhaustion of this limit, which are kinda cryptic (EPERM sometimes) less frequent. perf version: Ravi Bangoria: - Fix segfault due to missing OPT_END(), noticed on PowerPC. perf vendor events: Thomas Richter: - Add JSON files for IBM s/390 machine type 8561. perf cs-etm (ARM): YueHaibing: - Fix two cases of error returns not bing done properly: Invalid ERR_PTR() use and loss of propagation error codes. commit 49d05fe2c9d1b4a27761c9807fec39b8155bef9e Author: David Ahern Date: Wed Jul 17 15:08:43 2019 -0700 ipv6: rt6_check should return NULL if 'from' is NULL Paul reported that l2tp sessions were broken after the commit referenced in the Fixes tag. Prior to this commit rt6_check returned NULL if the rt6_info 'from' was NULL - ie., the dst_entry was disconnected from a FIB entry. Restore that behavior. Fixes: 93531c674315 ("net/ipv6: separate handling of FIB entries from dst based routes") Reported-by: Paul Donohue Tested-by: Paul Donohue Signed-off-by: David Ahern Signed-off-by: David S. Miller commit 866e5fd8a7123444d865340ff21c1673f74cdecd Author: Jon Maloy Date: Wed Jul 17 23:43:44 2019 +0200 tipc: initialize 'validated' field of received packets The tipc_msg_validate() function leaves a boolean flag 'validated' in the validated buffer's control block, to avoid performing this action more than once. However, at reception of new packets, the position of this field may already have been set by lower layer protocols, so that the packet is erroneously perceived as already validated by TIPC. We fix this by initializing the said field to 'false' before performing the initial validation. Signed-off-by: Jon Maloy Signed-off-by: David S. Miller commit 7b379472bc530fd9929f8791c4daffc63ca90e0c Merge: f1bf3e2ab42d adb701d6cfa4 Author: David S. Miller Date: Wed Jul 17 15:23:39 2019 -0700 Merge branch 'ipv4-relax-source-validation-check-for-loopback-packets' Cong Wang says: ==================== ipv4: relax source validation check for loopback packets This patchset fixes a corner case when loopback packets get dropped by rp_filter when we route them from veth to lo. Patch 1 is the fix and patch 2 provides a simplified test case for this scenario. ==================== Signed-off-by: David S. Miller commit adb701d6cfa432f5dbdf28839b5e64291a7ed30b Author: Cong Wang Date: Wed Jul 17 14:41:59 2019 -0700 selftests: add a test case for rp_filter Add a test case to simulate the loopback packet case fixed in the previous patch. This test gets passed after the fix: IPv4 rp_filter tests TEST: rp_filter passes local packets [ OK ] TEST: rp_filter passes loopback packets [ OK ] Cc: David Ahern Signed-off-by: Cong Wang Reviewed-by: David Ahern Signed-off-by: David S. Miller commit 66f8209547cc11d8e139d45cb7c937c1bbcce182 Author: Cong Wang Date: Wed Jul 17 14:41:58 2019 -0700 fib: relax source validation check for loopback packets In a rare case where we redirect local packets from veth to lo, these packets fail to pass the source validation when rp_filter is turned on, as the tracing shows: <...>-311708 [040] ..s1 7951180.957825: fib_table_lookup: table 254 oif 0 iif 1 src 10.53.180.130 dst 10.53.180.130 tos 0 scope 0 flags 0 <...>-311708 [040] ..s1 7951180.957826: fib_table_lookup_nh: nexthop dev eth0 oif 4 src 10.53.180.130 So, the fib table lookup returns eth0 as the nexthop even though the packets are local and should be routed to loopback nonetheless, but they can't pass the dev match check in fib_info_nh_uses_dev() without this patch. It should be safe to relax this check for this special case, as normally packets coming out of loopback device still have skb_dst so they won't even hit this slow path. Cc: Julian Anastasov Cc: David Ahern Signed-off-by: Cong Wang Reviewed-by: David Ahern Signed-off-by: David S. Miller commit f1bf3e2ab42d20a7683e1c689f3ce8e942da03d4 Merge: a6574227a81f 577fa14d2100 Author: David S. Miller Date: Wed Jul 17 15:19:46 2019 -0700 Merge branch 'mlxsw-Two-fixes' Ido Schimmel says: ==================== mlxsw: Two fixes This patchset contains two fixes for mlxsw. Patch #1 from Petr fixes an issue in which DSCP rewrite can occur even if the egress port was switched to Trust L2 mode where priority mapping is based on PCP. Patch #2 fixes a problem where packets can be learned on a non-existing FID if a tc filter with a redirect action is configured on a bridged port. The problem and fix are explained in detail in the commit message. Please consider both patches for 5.2.y ==================== Signed-off-by: David S. Miller commit 577fa14d210073ba1ce6237c659a8820312104ad Author: Ido Schimmel Date: Wed Jul 17 23:29:08 2019 +0300 mlxsw: spectrum: Do not process learned records with a dummy FID The switch periodically sends notifications about learned FDB entries. Among other things, the notification includes the FID (Filtering Identifier) and the port on which the MAC was learned. In case the driver does not have the FID defined on the relevant port, the following error will be periodically generated: mlxsw_spectrum2 0000:06:00.0 swp32: Failed to find a matching {Port, VID} following FDB notification This is not supposed to happen under normal conditions, but can happen if an ingress tc filter with a redirect action is installed on a bridged port. The redirect action will cause the packet's FID to be changed to the dummy FID and a learning notification will be emitted with this FID - which is not defined on the bridged port. Fix this by having the driver ignore learning notifications generated with the dummy FID and delete them from the device. Another option is to chain an ignore action after the redirect action which will cause the device to disable learning, but this means that we need to consume another action whenever a redirect action is used. In addition, the scenario described above is merely a corner case. Fixes: cedbb8b25948 ("mlxsw: spectrum_flower: Set dummy FID before forward action") Signed-off-by: Ido Schimmel Reported-by: Alex Kushnarov Acked-by: Jiri Pirko Tested-by: Alex Kushnarov Signed-off-by: David S. Miller commit dedfde2fe1c4ccf27179fcb234e2112d065c39bb Author: Petr Machata Date: Wed Jul 17 23:29:07 2019 +0300 mlxsw: spectrum_dcb: Configure DSCP map as the last rule is removed Spectrum systems use DSCP rewrite map to update DSCP field in egressing packets to correspond to priority that the packet has. Whether rewriting will take place is determined at the point when the packet ingresses the switch: if the port is in Trust L3 mode, packet priority is determined from the DSCP map at the port, and DSCP rewrite will happen. If the port is in Trust L2 mode, 802.1p is used for packet prioritization, and no DSCP rewrite will happen. The driver determines the port trust mode based on whether any DSCP prioritization rules are in effect at given port. If there are any, trust level is L3, otherwise it's L2. When the last DSCP rule is removed, the port is switched to trust L2. Under that scenario, if DSCP of a packet should be rewritten, it should be rewritten to 0. However, when switching to Trust L2, the driver neglects to also update the DSCP rewrite map. The last DSCP rule thus remains in effect, and packets egressing through this port, if they have the right priority, will have their DSCP set according to this rule. Fix by first configuring the rewrite map, and only then switching to trust L2 and bailing out. Fixes: b2b1dab6884e ("mlxsw: spectrum: Support ieee_setapp, ieee_delapp") Signed-off-by: Petr Machata Reported-by: Alex Veber Tested-by: Alex Veber Signed-off-by: Ido Schimmel Signed-off-by: David S. Miller commit a6574227a81ffd443cd715f8946baddccce66ada Author: Rosen Penev Date: Wed Jul 17 12:46:45 2019 -0700 net: ag71xx: Add missing header ag71xx uses devm_ioremap_nocache. This fixes usage of an implicit function Fixes: d51b6ce441d3 ("net: ethernet: add ag71xx driver") Signed-off-by: Rosen Penev Signed-off-by: David S. Miller commit da99466ac243f15fbba65bd261bfc75ffa1532b6 Author: Denis Efremov Date: Fri Jul 12 21:55:23 2019 +0300 floppy: fix out-of-bounds read in copy_buffer This fixes a global out-of-bounds read access in the copy_buffer function of the floppy driver. The FDDEFPRM ioctl allows one to set the geometry of a disk. The sect and head fields (unsigned int) of the floppy_drive structure are used to compute the max_sector (int) in the make_raw_rw_request function. It is possible to overflow the max_sector. Next, max_sector is passed to the copy_buffer function and used in one of the memcpy calls. An unprivileged user could trigger the bug if the device is accessible, but requires a floppy disk to be inserted. The patch adds the check for the .sect * .head multiplication for not overflowing in the set_geometry function. The bug was found by syzkaller. Signed-off-by: Denis Efremov Tested-by: Willy Tarreau Signed-off-by: Linus Torvalds commit 9b04609b784027968348796a18f601aed9db3789 Author: Denis Efremov Date: Fri Jul 12 21:55:22 2019 +0300 floppy: fix invalid pointer dereference in drive_name This fixes the invalid pointer dereference in the drive_name function of the floppy driver. The native_format field of the struct floppy_drive_params is used as floppy_type array index in the drive_name function. Thus, the field should be checked the same way as the autodetect field. To trigger the bug, one could use a value out of range and set the drive parameters with the FDSETDRVPRM ioctl. Next, FDGETDRVTYP ioctl should be used to call the drive_name. A floppy disk is not required to be inserted. CAP_SYS_ADMIN is required to call FDSETDRVPRM. The patch adds the check for a value of the native_format field to be in the '0 <= x < ARRAY_SIZE(floppy_type)' range of the floppy_type array indices. The bug was found by syzkaller. Signed-off-by: Denis Efremov Tested-by: Willy Tarreau Signed-off-by: Linus Torvalds commit 5635f897ed83fd539df78e98ba69ee91592f9bb8 Author: Denis Efremov Date: Fri Jul 12 21:55:21 2019 +0300 floppy: fix out-of-bounds read in next_valid_format This fixes a global out-of-bounds read access in the next_valid_format function of the floppy driver. The values from autodetect field of the struct floppy_drive_params are used as indices for the floppy_type array in the next_valid_format function 'floppy_type[DP->autodetect[probed_format]].sect'. To trigger the bug, one could use a value out of range and set the drive parameters with the FDSETDRVPRM ioctl. A floppy disk is not required to be inserted. CAP_SYS_ADMIN is required to call FDSETDRVPRM. The patch adds the check for values of the autodetect field to be in the '0 <= x < ARRAY_SIZE(floppy_type)' range of the floppy_type array indices. The bug was found by syzkaller. Signed-off-by: Denis Efremov Tested-by: Willy Tarreau Signed-off-by: Linus Torvalds commit f3554aeb991214cbfafd17d55e2bfddb50282e32 Author: Denis Efremov Date: Fri Jul 12 21:55:20 2019 +0300 floppy: fix div-by-zero in setup_format_params This fixes a divide by zero error in the setup_format_params function of the floppy driver. Two consecutive ioctls can trigger the bug: The first one should set the drive geometry with such .sect and .rate values for the F_SECT_PER_TRACK to become zero. Next, the floppy format operation should be called. A floppy disk is not required to be inserted. An unprivileged user could trigger the bug if the device is accessible. The patch checks F_SECT_PER_TRACK for a non-zero value in the set_geometry function. The proper check should involve a reasonable upper limit for the .sect and .rate fields, but it could change the UAPI. The patch also checks F_SECT_PER_TRACK in the setup_format_params, and cancels the formatting operation in case of zero. The bug was found by syzkaller. Signed-off-by: Denis Efremov Tested-by: Willy Tarreau Signed-off-by: Linus Torvalds commit a0d14b8909de55139b8702fe0c7e80b69763dcfb Author: Peter Zijlstra Date: Thu Jul 11 13:40:59 2019 +0200 x86/mm, tracing: Fix CR2 corruption Despite the current efforts to read CR2 before tracing happens there still exist a number of possible holes: idtentry page_fault do_page_fault has_error_code=1 call error_entry TRACE_IRQS_OFF call trace_hardirqs_off* #PF // modifies CR2 CALL_enter_from_user_mode __context_tracking_exit() trace_user_exit(0) #PF // modifies CR2 call do_page_fault address = read_cr2(); /* whoopsie */ And similar for i386. Fix it by pulling the CR2 read into the entry code, before any of that stuff gets a chance to run and ruin things. Reported-by: He Zhe Reported-by: Eiichi Tsukata Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Thomas Gleixner Reviewed-by: Andy Lutomirski Cc: bp@alien8.de Cc: rostedt@goodmis.org Cc: torvalds@linux-foundation.org Cc: hpa@zytor.com Cc: dave.hansen@linux.intel.com Cc: jgross@suse.com Cc: joel@joelfernandes.org Link: https://lkml.kernel.org/r/20190711114336.116812491@infradead.org Debugged-by: Steven Rostedt commit 4234653e882740cbf6625eeee294e388b3176583 Author: Peter Zijlstra Date: Thu Jul 11 13:40:58 2019 +0200 x86/entry/64: Update comments and sanity tests for create_gap Commit 2700fefdb2d9 ("x86_64: Add gap to int3 to allow for call emulation") forgot to update the comment, do so now. Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Thomas Gleixner Reviewed-by: Steven Rostedt (VMware) Acked-by: Andy Lutomirski Cc: bp@alien8.de Cc: torvalds@linux-foundation.org Cc: hpa@zytor.com Cc: dave.hansen@linux.intel.com Cc: jgross@suse.com Cc: zhe.he@windriver.com Cc: joel@joelfernandes.org Cc: devel@etsukata.com Link: https://lkml.kernel.org/r/20190711114336.059780563@infradead.org commit 2fd37912cfb019228bf246215938e6f7619516a2 Author: Peter Zijlstra Date: Thu Jul 11 13:40:57 2019 +0200 x86/entry/64: Simplify idtentry a little There's a bunch of duplication in idtentry, namely the .Lfrom_usermode_switch_stack is a paranoid=0 copy of the normal flow. Make this explicit by creating a idtentry_part helper macro. Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Thomas Gleixner Reviewed-by: Steven Rostedt (VMware) Acked-by: Andy Lutomirski Cc: bp@alien8.de Cc: torvalds@linux-foundation.org Cc: hpa@zytor.com Cc: dave.hansen@linux.intel.com Cc: jgross@suse.com Cc: zhe.he@windriver.com Cc: joel@joelfernandes.org Cc: devel@etsukata.com Link: https://lkml.kernel.org/r/20190711114336.002429503@infradead.org commit e67f1c11e5ea7fa47449a16325ecc997dbbf9bdf Author: Peter Zijlstra Date: Thu Jul 11 13:40:56 2019 +0200 x86/entry/32: Simplify common_exception Adding one more option to SAVE_ALL can be used in common_exception to simplify things. This also saves duplication later where page_fault will no longer use common_exception. Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Thomas Gleixner Reviewed-by: Steven Rostedt (VMware) Reviewed-by: Andy Lutomirski Cc: bp@alien8.de Cc: torvalds@linux-foundation.org Cc: hpa@zytor.com Cc: dave.hansen@linux.intel.com Cc: jgross@suse.com Cc: zhe.he@windriver.com Cc: joel@joelfernandes.org Cc: devel@etsukata.com Link: https://lkml.kernel.org/r/20190711114335.945136187@infradead.org commit 55aedddb6149ab71bec9f050846855113977b033 Author: Peter Zijlstra Date: Thu Jul 11 13:40:55 2019 +0200 x86/paravirt: Make read_cr2() CALLEE_SAVE The one paravirt read_cr2() implementation (Xen) is actually quite trivial and doesn't need to clobber anything other than the return register. Making read_cr2() CALLEE_SAVE avoids all the PUSH/POP nonsense and allows more convenient use from assembly. Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Thomas Gleixner Reviewed-by: Juergen Gross Cc: bp@alien8.de Cc: rostedt@goodmis.org Cc: luto@kernel.org Cc: torvalds@linux-foundation.org Cc: hpa@zytor.com Cc: dave.hansen@linux.intel.com Cc: zhe.he@windriver.com Cc: joel@joelfernandes.org Cc: devel@etsukata.com Link: https://lkml.kernel.org/r/20190711114335.887392493@infradead.org commit 45800fb45139284f0db4f5ac7fbbf5dad81e4172 Author: Helge Deller Date: Mon Jul 15 22:33:26 2019 +0200 parisc: Wire up clone3 syscall Signed-off-by: Helge Deller Tested-by: Sven Schnelle Acked-by: Christian Brauner commit 59a783dbc0d5fd6792aabff933055373b6dcbf2a Author: Helge Deller Date: Tue Jul 16 21:16:26 2019 +0200 parisc: Avoid kernel panic triggered by invalid kprobe When running gdb I was able to trigger this kernel panic: Kernel Fault: Code=26 (Data memory access rights trap) at addr 0000000000000060 CPU: 0 PID: 1401 Comm: gdb-crash Not tainted 5.2.0-rc7-64bit+ #1053 YZrvWESTHLNXBCVMcbcbcbcbOGFRQPDI PSW: 00001000000001000000000000001111 Not tainted r00-03 000000000804000f 0000000040dee1a0 0000000040c78cf0 00000000b8d50160 r04-07 0000000040d2b1a0 000000004360a098 00000000bbbe87b8 0000000000000003 r08-11 00000000fac20a70 00000000fac24160 00000000fac1bbe0 0000000000000000 r12-15 00000000fabfb79a 00000000fac244a4 0000000000010000 0000000000000001 r16-19 00000000bbbe87b8 00000000f8f02910 0000000000010034 0000000000000000 r20-23 00000000fac24630 00000000fac24630 000000006474e552 00000000fac1aa52 r24-27 0000000000000028 00000000bbbe87b8 00000000bbbe87b8 0000000040d2b1a0 r28-31 0000000000000000 00000000b8d501c0 00000000b8d501f0 0000000003424000 sr00-03 0000000000423000 0000000000000000 0000000000000000 0000000000423000 sr04-07 0000000000000000 0000000000000000 0000000000000000 0000000000000000 IASQ: 0000000000000000 0000000000000000 IAOQ: 0000000040c78cf0 0000000040c78cf4 IIR: 539f00c0 ISR: 0000000000000000 IOR: 0000000000000060 CPU: 0 CR30: 00000000b8d50000 CR31: 00000000d22345e2 ORIG_R28: 0000000040250798 IAOQ[0]: parisc_kprobe_ss_handler+0x58/0x170 IAOQ[1]: parisc_kprobe_ss_handler+0x5c/0x170 RP(r2): parisc_kprobe_ss_handler+0x58/0x170 Backtrace: [<0000000040206ff8>] handle_interruption+0x178/0xbb8 Kernel panic - not syncing: Kernel Fault Avoid this panic by checking the return value of kprobe_running() and skip kprobe if none is currently active. Cc: # v5.2 Acked-by: Sven Schnelle Tested-by: Rolf Eike Beer Signed-off-by: Helge Deller commit 34c32fc603311a72cb558e5e337555434f64c27b Author: Helge Deller Date: Thu Jul 4 03:44:17 2019 +0200 parisc: Ensure userspace privilege for ptraced processes in regset functions On parisc the privilege level of a process is stored in the lowest two bits of the instruction pointers (IAOQ0 and IAOQ1). On Linux we use privilege level 0 for the kernel and privilege level 3 for user-space. So userspace should not be allowed to modify IAOQ0 or IAOQ1 of a ptraced process to change it's privilege level to e.g. 0 to try to gain kernel privileges. This patch prevents such modifications in the regset support functions by always setting the two lowest bits to one (which relates to privilege level 3 for user-space) if IAOQ0 or IAOQ1 are modified via ptrace regset calls. Link: https://bugs.gentoo.org/481768 Cc: # v4.7+ Tested-by: Rolf Eike Beer Signed-off-by: Helge Deller commit 10835c854685393a921b68f529bf740fa7c9984d Author: Helge Deller Date: Tue Jul 16 21:43:11 2019 +0200 parisc: Fix kernel panic due invalid values in IAOQ0 or IAOQ1 On parisc the privilege level of a process is stored in the lowest two bits of the instruction pointers (IAOQ0 and IAOQ1). On Linux we use privilege level 0 for the kernel and privilege level 3 for user-space. So userspace should not be allowed to modify IAOQ0 or IAOQ1 of a ptraced process to change it's privilege level to e.g. 0 to try to gain kernel privileges. This patch prevents such modifications by always setting the two lowest bits to one (which relates to privilege level 3 for user-space) if IAOQ0 or IAOQ1 are modified via ptrace calls in the native and compat ptrace paths. Link: https://bugs.gentoo.org/481768 Reported-by: Jeroen Roovers Cc: Tested-by: Rolf Eike Beer Signed-off-by: Helge Deller commit 3f05e6886a595c9a29a309c52f45326be917823c Author: Cong Wang Date: Tue Jul 16 13:57:30 2019 -0700 net_sched: unset TCQ_F_CAN_BYPASS when adding filters For qdisc's that support TC filters and set TCQ_F_CAN_BYPASS, notably fq_codel, it makes no sense to let packets bypass the TC filters we setup in any scenario, otherwise our packets steering policy could not be enforced. This can be reproduced easily with the following script: ip li add dev dummy0 type dummy ifconfig dummy0 up tc qd add dev dummy0 root fq_codel tc filter add dev dummy0 parent 8001: protocol arp basic action mirred egress redirect dev lo tc filter add dev dummy0 parent 8001: protocol ip basic action mirred egress redirect dev lo ping -I dummy0 192.168.112.1 Without this patch, packets are sent directly to dummy0 without hitting any of the filters. With this patch, packets are redirected to loopback as expected. This fix is not perfect, it only unsets the flag but does not set it back because we have to save the information somewhere in the qdisc if we really want that. Note, both fq_codel and sfq clear this flag in their ->bind_tcf() but this is clearly not sufficient when we don't use any class ID. Fixes: 23624935e0c4 ("net_sched: TCQ_F_CAN_BYPASS generalization") Cc: Eric Dumazet Signed-off-by: Cong Wang Reviewed-by: Eric Dumazet Signed-off-by: David S. Miller commit 22051d9c4a57d3b4a8b5a7407efc80c71c7bfb16 Merge: aac09ce27556 9af93db9e140 Author: Linus Torvalds Date: Wed Jul 17 13:16:30 2019 -0700 Merge tag 'platform-drivers-x86-v5.3-2' of git://git.infradead.org/linux-platform-drivers-x86 Pull another x86 platform driver update from Andy Shevchenko: "Provide better naming for ABI, i.e. tell that we have fan boost mode. It won't break any ABI, but has to be done now to avoid confusion in the future" * tag 'platform-drivers-x86-v5.3-2' of git://git.infradead.org/linux-platform-drivers-x86: platform/x86: asus: Rename "fan mode" to "fan boost mode" commit aac09ce27556f79f20a860ae89d790d7bfbf1747 Merge: c3c08f939abe 6c395f66e98c Author: Linus Torvalds Date: Wed Jul 17 13:13:41 2019 -0700 Merge branch 'next' of git://git.kernel.org/pub/scm/linux/kernel/git/rzhang/linux Pull thermal management updates from Zhang Rui: - Convert thermal documents to ReST (Mauro Carvalho Chehab) - Fix a cyclic depedency in between thermal core and governors (Daniel Lezcano) - Fix processor_thermal_device driver to re-evaluate power limits after resume (Srinivas Pandruvada, Zhang Rui) * 'next' of git://git.kernel.org/pub/scm/linux/kernel/git/rzhang/linux: drivers: thermal: processor_thermal_device: Fix build warning docs: thermal: convert to ReST thermal/drivers/core: Use governor table to initialize thermal/drivers/core: Add init section table for self-encapsulation drivers: thermal: processor_thermal: Read PPCC on resume commit c3c08f939abe3a1c95338a246c550aca0989dade Merge: 57ab5f740202 88785b7fa74a Author: Linus Torvalds Date: Wed Jul 17 13:05:21 2019 -0700 Merge tag 'gpio-v5.3-2' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio Pull GPIO fixes from Linus Walleij: - Revert a SPIO GPIO fix that didn't fix anything but instead created new problems. - Remove the EM GPIO irqdomain in a safe manner. - Fix a memory leak in the gpio quirks. - Make the DaVinci error path silent on probe deferral. * tag 'gpio-v5.3-2' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio: Revert "gpio/spi: Fix spi-gpio regression on active high CS" gpio: em: remove the gpiochip before removing the irq domain gpiolib: of: fix a memory leak in of_gpio_flags_quirks() gpio: davinci: silence error prints in case of EPROBE_DEFER commit 4809bba7289b4594d93da4fa70fb9b5ef48b5cf4 Merge: f11fe1dae1c4 aa4948937b7d Author: David S. Miller Date: Wed Jul 17 12:06:52 2019 -0700 Merge branch 'net-rds-RDMA-fixes' Gerd Rausch says: ==================== net/rds: RDMA fixes A number of net/rds fixes necessary to make "rds_rdma.ko" pass some basic Oracle internal tests. ==================== Signed-off-by: David S. Miller commit aa4948937b7d5b4a8e6553f4938f8431b2fd783a Author: Gerd Rausch Date: Tue Jul 16 15:29:23 2019 -0700 net/rds: Initialize ic->i_fastreg_wrs upon allocation Otherwise, if an IB connection is torn down before "rds_ib_setup_qp" is called, the value of "ic->i_fastreg_wrs" is still at zero (as it wasn't initialized by "rds_ib_setup_qp"). Consequently "rds_ib_conn_path_shutdown" will spin forever, waiting for it to go back to "RDS_IB_DEFAULT_FR_WR", which of course will never happen as there are no outstanding work requests. Signed-off-by: Gerd Rausch Acked-by: Santosh Shilimkar Signed-off-by: David S. Miller commit 3a2886cca703fde5ee21baea9fedf8b1389c59d7 Author: Gerd Rausch Date: Tue Jul 16 15:29:17 2019 -0700 net/rds: Keep track of and wait for FRWR segments in use upon shutdown Since "rds_ib_free_frmr" and "rds_ib_free_frmr_list" simply put the FRMR memory segments on the "drop_list" or "free_list", and it is the job of "rds_ib_flush_mr_pool" to reap those entries by ultimately issuing a "IB_WR_LOCAL_INV" work-request, we need to trigger and then wait for all those memory segments attached to a particular connection to be fully released before we can move on to release the QP, CQ, etc. So we make "rds_ib_conn_path_shutdown" wait for one more atomic_t called "i_fastreg_inuse_count" that keeps track of how many FRWR memory segments are out there marked "FRMR_IS_INUSE" (and also wake_up rds_ib_ring_empty_wait, as they go away). Signed-off-by: Gerd Rausch Acked-by: Santosh Shilimkar Signed-off-by: David S. Miller commit 9547dff1085d5935d6070377023096821033e30c Author: Gerd Rausch Date: Tue Jul 16 15:29:12 2019 -0700 net/rds: Set fr_state only to FRMR_IS_FREE if IB_WR_LOCAL_INV had been successful Fix a bug where fr_state first goes to FRMR_IS_STALE, because of a failure of operation IB_WR_LOCAL_INV, but then gets set back to "FRMR_IS_FREE" uncoditionally, even though the operation failed. Signed-off-by: Gerd Rausch Acked-by: Santosh Shilimkar Signed-off-by: David S. Miller commit aea01a2234d26ffa9d9ee01e43705824c0c7b08a Author: Gerd Rausch Date: Tue Jul 16 15:29:07 2019 -0700 net/rds: Fix NULL/ERR_PTR inconsistency Make function "rds_ib_try_reuse_ibmr" return NULL in case memory region could not be allocated, since callers simply check if the return value is not NULL. Signed-off-by: Gerd Rausch Acked-by: Santosh Shilimkar Signed-off-by: David S. Miller commit 5f33141d2fc05a2d2134ba0e7b47ce4aa88340f0 Author: Gerd Rausch Date: Tue Jul 16 15:29:02 2019 -0700 net/rds: Wait for the FRMR_IS_FREE (or FRMR_IS_STALE) transition after posting IB_WR_LOCAL_INV In order to: 1) avoid a silly bouncing between "clean_list" and "drop_list" triggered by function "rds_ib_reg_frmr" as it is releases frmr regions whose state is not "FRMR_IS_FREE" right away. 2) prevent an invalid access error in a race from a pending "IB_WR_LOCAL_INV" operation with a teardown ("dma_unmap_sg", "put_page") and de-registration ("ib_dereg_mr") of the corresponding memory region. Signed-off-by: Gerd Rausch Acked-by: Santosh Shilimkar Signed-off-by: David S. Miller commit c9467447fc50ec3715d8ec98f4da874fce539235 Author: Gerd Rausch Date: Tue Jul 16 15:28:57 2019 -0700 net/rds: Get rid of "wait_clean_list_grace" and add locking Waiting for activity on the "clean_list" to quiesce is no substitute for proper locking. We can have multiple threads competing for "llist_del_first" via "rds_ib_reuse_mr", and a single thread competing for "llist_del_all" and "llist_del_first" via "rds_ib_flush_mr_pool". Since "llist_del_first" depends on "list->first->next" not to change in the midst of the operation, simply waiting for all current calls to "rds_ib_reuse_mr" to quiesce across all CPUs is woefully inadequate: By the time "wait_clean_list_grace" is done iterating over all CPUs to see that there is no concurrent caller to "rds_ib_reuse_mr", a new caller may have just shown up on the first CPU. Furthermore, explicitly calls out the need for locking: * Cases where locking is needed: * If we have multiple consumers with llist_del_first used in one consumer, * and llist_del_first or llist_del_all used in other consumers, * then a lock is needed. Also, while at it, drop the unused "pool" parameter from "list_to_llist_nodes". Signed-off-by: Gerd Rausch Acked-by: Santosh Shilimkar Signed-off-by: David S. Miller commit 2c7da8e6b041a8df2661def81ac90c9c0c719909 Author: Gerd Rausch Date: Tue Jul 16 15:28:51 2019 -0700 net/rds: Give fr_state a chance to transition to FRMR_IS_FREE In the context of FRMR (ib_frmr.c): Memory regions make it onto the "clean_list" via "rds_ib_flush_mr_pool", after the memory region has been posted for invalidation via "rds_ib_post_inv". At that point in time, "fr_state" may still be in state "FRMR_IS_INUSE", since the only place where "fr_state" transitions to "FRMR_IS_FREE" is in "rds_ib_mr_cqe_handler", which is triggered by a tasklet. So in case we notice that "fr_state != FRMR_IS_FREE" (see below), we wait for "fr_inv_done" to trigger with a maximum of 10msec. Then we check again, and only put the memory region onto the drop_list (via "rds_ib_free_frmr") in case the situation remains unchanged. This avoids the problem of memory-regions bouncing between "clean_list" and "drop_list" before they even have a chance to be properly invalidated. Signed-off-by: Gerd Rausch Acked-by: Santosh Shilimkar Signed-off-by: David S. Miller commit f11fe1dae1c46762a9a7b0dd142b6bfebe7783ff Author: YueHaibing Date: Tue Jul 16 15:16:02 2019 +0800 net/sched: Make NET_ACT_CT depends on NF_NAT If NF_NAT is m and NET_ACT_CT is y, build fails: net/sched/act_ct.o: In function `tcf_ct_act': act_ct.c:(.text+0x21ac): undefined reference to `nf_ct_nat_ext_add' act_ct.c:(.text+0x229a): undefined reference to `nf_nat_icmp_reply_translation' act_ct.c:(.text+0x233a): undefined reference to `nf_nat_setup_info' act_ct.c:(.text+0x234a): undefined reference to `nf_nat_alloc_null_binding' act_ct.c:(.text+0x237c): undefined reference to `nf_nat_packet' Reported-by: Hulk Robot Fixes: b57dc7c13ea9 ("net/sched: Introduce action ct") Signed-off-by: YueHaibing Signed-off-by: David S. Miller commit 86fda90ab5888d983f7307442ba62978e3504bd3 Author: Hariprasad Kelam Date: Tue Jul 16 07:50:02 2019 +0530 net: sctp: fix warning "NULL check before some freeing functions is not needed" This patch removes NULL checks before calling kfree. fixes below issues reported by coccicheck net/sctp/sm_make_chunk.c:2586:3-8: WARNING: NULL check before some freeing functions is not needed. net/sctp/sm_make_chunk.c:2652:3-8: WARNING: NULL check before some freeing functions is not needed. net/sctp/sm_make_chunk.c:2667:3-8: WARNING: NULL check before some freeing functions is not needed. net/sctp/sm_make_chunk.c:2684:3-8: WARNING: NULL check before some freeing functions is not needed. Signed-off-by: Hariprasad Kelam Acked-by: Marcelo Ricardo Leitner Acked-by: Neil Horman Signed-off-by: David S. Miller commit fdd258d49e88a9e0b49ef04a506a796f1c768a8e Author: Taehee Yoo Date: Mon Jul 15 14:10:17 2019 +0900 caif-hsi: fix possible deadlock in cfhsi_exit_module() cfhsi_exit_module() calls unregister_netdev() under rtnl_lock(). but unregister_netdev() internally calls rtnl_lock(). So deadlock would occur. Fixes: c41254006377 ("caif-hsi: Add rtnl support") Signed-off-by: Taehee Yoo Signed-off-by: David S. Miller commit 57ab5f740202babe93c8796013c5cfdfd6d08d7d Merge: fdcec00405fa 360aa640a59f Author: Linus Torvalds Date: Wed Jul 17 11:53:53 2019 -0700 Merge tag 'hwlock-v5.3' of git://github.com/andersson/remoteproc Pull hwspinlock updates from Bjorn Andersson: "This contains support for hardware spinlock TI K3 AM65x and J721E family of SoCs, support for using hwspinlocks from atomic context and better error reporting when dealing with hardware disabled in DeviceTree" * tag 'hwlock-v5.3' of git://github.com/andersson/remoteproc: hwspinlock: add the 'in_atomic' API hwspinlock: document the hwspinlock 'raw' API hwspinlock: stm32: implement the relax() ops hwspinlock: ignore disabled device hwspinlock/omap: Add a trace during probe hwspinlock/omap: Add support for TI K3 SoCs dt-bindings: hwlock: Update OMAP binding for TI K3 SoCs commit fdcec00405fae0befdd7bbcbe738b7325e5746fb Merge: 7636b7589f81 93f1d3e4b59c Author: Linus Torvalds Date: Wed Jul 17 11:44:41 2019 -0700 Merge tag 'rproc-v5.3' of git://github.com/andersson/remoteproc Pull remoteproc updates from Bjorn Andersson: "This adds support for the STM32 remoteproc, additional i.MX platforms with Cortex M4 remoteprocs and Qualcomm's QCS404 Compute DSP. Also initial support for vendor specific resource table entries and support for unprocessed Qualcomm firmware files" * tag 'rproc-v5.3' of git://github.com/andersson/remoteproc: remoteproc: stm32: fix building without ARM SMCC remoteproc: qcom: q6v5-mss: Fix build error without QCOM_MDT_LOADER remoteproc: copy parent dma_pfn_offset for vdev remoteproc: qcom: q6v5-mss: Support loading non-split images soc: qcom: mdt_loader: Support loading non-split images remoteproc: stm32: add an ST stm32_rproc driver dt-bindings: remoteproc: add bindings for stm32 remote processor driver dt-bindings: stm32: add bindings for ML-AHB interconnect remoteproc: Use struct_size() helper remoteproc: add vendor resources handling remoteproc: imx: Fix typo in "failed" remoteproc: imx: Broaden the Kconfig selection logic remoteproc,rpmsg: add missing MAINTAINERS file entries remoteproc: qcom: qdsp6-adsp: Add support for QCS404 CDSP dt-bindings: remoteproc: Rename and amend Hexagon v56 binding commit 6a5d4877544b9014c70533200ad4a5f9d6e005c5 Author: Joseph Greathouse Date: Wed Jul 17 09:47:58 2019 -0500 drm/amdkfd: Remove GWS from process during uninit If we shut down a process without having destroyed its GWS-using queues, it is possible that GWS BO will still be in the process BO list during the gpuvm destruction. This list should be empty at that time, so we should remove the GWS allocation at the process uninit point if it is still around. Signed-off-by: Joseph Greathouse Acked-by: Alex Deucher Reviewed-by: Felix Kuehling Signed-off-by: Alex Deucher commit 88891430a2c06b6be9b1ed08c095befb17fb4cb2 Author: Tom St Denis Date: Tue Jul 16 07:23:22 2019 -0400 drm/amd/amdgpu: Fix offset for vmid selection in debugfs interface The register debugfs interface was using the wrong bitmask for vmid selection for GFX_CNTL. Signed-off-by: Tom St Denis Acked-by: Christian König Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher commit cd6e0c4ba19375ec5a7bcb959015d5f90eef0a1c Author: Evan Quan Date: Fri Jul 12 10:53:11 2019 +0800 drm/amd/powerplay: update vega20 driver if to fit latest SMU firmware Optimization for the socket power calculation is introduced. Signed-off-by: Evan Quan Reviewed-by: Kenneth Feng Signed-off-by: Alex Deucher commit 93002849ffc7d1f12db60a37c30610d02844363b Author: Evan Quan Date: Tue Jul 16 14:20:22 2019 +0800 drm/amd/powerplay: maintain SMU FW backward compatibility Do not halt driver loading on if_version mismatch. As our driver and FWs are backward compatible. Signed-off-by: Evan Quan Reviewed-by: Kenneth Feng Signed-off-by: Alex Deucher commit 0d9d78b57bf32fdc4baf6eb8853e65059dcd5e06 Author: Evan Quan Date: Thu Jul 11 15:13:17 2019 +0800 drm/amd/powerplay: correct smu_update_table usage The interface was used in a confusing way. In profile mode scenario, the 2nd parameter of the interface was used in a different way from other scenarios. Signed-off-by: Evan Quan Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher commit f68ccf43acbc31751cff48d0ac1e5ff50d91a451 Author: Evan Quan Date: Fri Jul 12 13:18:16 2019 +0800 drm/amd/powerplay: fix deadlock around smu_handle_task V2 As the lock was already held on the entrance to smu_handle_task. - V2: lock in small granularity Signed-off-by: Evan Quan Reviewed-by: Kevin Wang Signed-off-by: Alex Deucher commit 7ef65bbd01fd59b749e8bd5b19d0c01e315fef8d Author: Evan Quan Date: Fri Jul 12 10:32:02 2019 +0800 drm/amd/powerplay: avoid access before allocation No access before allocation. Signed-off-by: Evan Quan Reviewed-by: Feifei Xu Signed-off-by: Alex Deucher commit 366cf03ec00f18e802f304c2cc057cac842e1244 Author: Evan Quan Date: Fri Jul 12 10:07:31 2019 +0800 drm/amd/powerplay: fix memory allocation failure check V2 Fix memory allocation failure check. - V2: fix one more similar error Signed-off-by: Evan Quan Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher commit 67adb569ddf4aee12de999e02c67c1a168dd1a15 Author: Felix Kuehling Date: Sat Jul 13 02:27:34 2019 -0400 drm/amdgpu: Fix silent amdgpu_bo_move failures Under memory pressure, buffer moves between RAM to VRAM can fail when there is no GTT space available. In those cases amdgpu_bo_move falls back to ttm_bo_move_memcpy, which seems to succeed, although it doesn't really support non-contiguous or invisible VRAM. This manifests as VM faults with corrupted page table entries in KFD eviction stress tests. Print some helpful messages when lack of GTT space is causing buffer moves to fail. Check that source and destination memory regions are supported by ttm_bo_move_memcpy before taking that fallback. Signed-off-by: Felix Kuehling Reviewed-by: Christian König Signed-off-by: Alex Deucher commit 6ea624f60393edc114feb33fa738d6f2f47e9032 Author: Alex Deucher Date: Tue Jul 16 09:28:41 2019 -0500 drm/amdgpu: drop dead header Not used anymore. Reviewed-by: Evan Quan Acked-by: Christian König Noticed-by: Dave Airlie Signed-off-by: Alex Deucher commit 7636b7589f81940c6d6518786f93de74495575fa Merge: 3a1d5384b7de 54119bc1110d Author: Linus Torvalds Date: Wed Jul 17 11:31:11 2019 -0700 Merge tag 'rpmsg-v5.3' of git://github.com/andersson/remoteproc Pull rpmsg updates from Bjorn Andersson: "This contains a DT binding update and a change to make the remote function of rpmsg_devices optional" * tag 'rpmsg-v5.3' of git://github.com/andersson/remoteproc: rpmsg: core: Make remove handler for rpmsg driver optional. dt-bindings: soc: qcom: Add remote-pid binding for GLINK SMEM commit 3a1d5384b7decbff6519daa9c65a35665e227323 Merge: 37d4607ebbbf 5e663f0410fa Author: Linus Torvalds Date: Wed Jul 17 11:26:09 2019 -0700 Merge tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost Pull virtio, vhost updates from Michael Tsirkin: "Fixes, features, performance: - new iommu device - vhost guest memory access using vmap (just meta-data for now) - minor fixes" * tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost: virtio-mmio: add error check for platform_get_irq scsi: virtio_scsi: Use struct_size() helper iommu/virtio: Add event queue iommu/virtio: Add probe request iommu: Add virtio-iommu driver PCI: OF: Initialize dev->fwnode appropriately of: Allow the iommu-map property to omit untranslated devices dt-bindings: virtio: Add virtio-pci-iommu node dt-bindings: virtio-mmio: Add IOMMU description vhost: fix clang build warning vhost: access vq metadata through kernel virtual address vhost: factor out setting vring addr and num vhost: introduce helpers to get the size of metadata area vhost: rename vq_iotlb_prefetch() to vq_meta_prefetch() vhost: fine grain userspace memory accessors vhost: generalize adding used elem commit 37d4607ebbbf5d8b74cbcb9434a5ce6897a51864 Merge: 916f562fb28a 1e4d09d2212d Author: Linus Torvalds Date: Wed Jul 17 11:23:13 2019 -0700 Merge tag 'vfio-v5.3-rc1' of git://github.com/awilliam/linux-vfio Pull VFIO updates from Alex Williamson: - Static symbol cleanup in mdev samples (Kefeng Wang) - Use vma help in nvlink code (Peng Hao) - Remove unused code in mbochs sample (YueHaibing) - Send uevents around mdev registration (Alex Williamson) * tag 'vfio-v5.3-rc1' of git://github.com/awilliam/linux-vfio: mdev: Send uevents around parent device registration sample/mdev/mbochs: remove set but not used variable 'mdev_state' vfio: vfio_pci_nvlink2: use a vma helper function vfio-mdev/samples: make some symbols static commit 2922d1cc1696200a3e1fd6d82a7798fcd2cadf12 Author: Linus Walleij Date: Tue Jul 16 22:46:51 2019 +0200 spi: gpio: Add SPI_MASTER_GPIO_SS flag The GPIO SPI master has some code in its local CS callback to set the initial sck GPIO value. This was lost in the commit converting it to use SPI core GPIO handling as this callback isn't called if the internal GPIO handling is active. Add the special SPI_MASTER_GPIO_SS to ascertain it gets called anyway so we get the initial SCK setting right. There is some platform provided GPIO handling there as well but this will be skipped as the cs_gpios will be NULL. My test targets seem not to care about the initial SCK value so I am uncertain if this is a regression, but to preserve the previous semantic we better do this. Cc: Andrey Smirnov Fixes: 249e2632dcd0 ("spi: gpio: Don't request CS GPIO in DT use-case") Signed-off-by: Linus Walleij Link: https://lore.kernel.org/r/20190716204651.7743-1-linus.walleij@linaro.org Signed-off-by: Mark Brown commit 9f69a496f1001bd27c484da43da30b2cdc8e06ed Author: Masahiro Yamada Date: Wed Jul 17 15:18:00 2019 +0900 kbuild: split out *.mod out of {single,multi}-used-m rules Currently, *.mod is created as a side-effect of obj-m. Split out *.mod as a dedicated build rule, which allows to unify the %.c -> %.o rule, and remove the single-used-m rule. This also makes the incremental build of allmodconfig faster because it saves $(NM) invocation when there is no change in the module. Signed-off-by: Masahiro Yamada commit 30527cefb37d2ad796feb1f469cd097dee8420cb Author: Masahiro Yamada Date: Wed Jul 17 15:17:59 2019 +0900 kbuild: remove 'prepare1' target Now that there is no rule for 'prepare1', it can go away. Signed-off-by: Masahiro Yamada commit 60ae1b194b4548102fea0f5091af83b478f2352b Author: Masahiro Yamada Date: Wed Jul 17 15:17:58 2019 +0900 kbuild: remove the first line of *.mod files The current format of *.mod is like this: line 1: directory path to the .ko file line 2: a list of objects linked into this module line 3: unresolved symbols (only when CONFIG_TRIM_UNUSED_KSYMS=y) Now that *.mod and *.ko are created in the same directory, the line 1 provides no valuable information. It can be derived by replacing the extension .mod with .ko. In fact, nobody uses the first line any more. Cut down the first line. Signed-off-by: Masahiro Yamada commit b7dca6dd1e591ad19a9aae716f3898be8063f880 Author: Masahiro Yamada Date: Wed Jul 17 15:17:57 2019 +0900 kbuild: create *.mod with full directory path and remove MODVERDIR While descending directories, Kbuild produces objects for modules, but do not link final *.ko files; it is done in the modpost. To keep track of modules, Kbuild creates a *.mod file in $(MODVERDIR) for every module it is building. Some post-processing steps read the necessary information from *.mod files. This avoids descending into directories again. This mechanism was introduced in 2003 or so. Later, commit 551559e13af1 ("kbuild: implement modules.order") added modules.order. So, we can simply read it out to know all the modules with directory paths. This is easier than parsing the first line of *.mod files. $(MODVERDIR) has a flat directory structure, that is, *.mod files are named only with base names. This is based on the assumption that the module name is unique across the tree. This assumption is really fragile. Stephen Rothwell reported a race condition caused by a module name conflict: https://lkml.org/lkml/2019/5/13/991 In parallel building, two different threads could write to the same $(MODVERDIR)/*.mod simultaneously. Non-unique module names are the source of all kind of troubles, hence commit 3a48a91901c5 ("kbuild: check uniqueness of module names") introduced a new checker script. However, it is still fragile in the build system point of view because this race happens before scripts/modules-check.sh is invoked. If it happens again, the modpost will emit unclear error messages. To fix this issue completely, create *.mod with full directory path so that two threads never attempt to write to the same file. $(MODVERDIR) is no longer needed. Since modules with directory paths are listed in modules.order, Kbuild is still able to find *.mod files without additional descending. I also killed cmd_secanalysis; scripts/mod/sumversion.c computes MD4 hash for modules with MODULE_VERSION(). When CONFIG_DEBUG_SECTION_MISMATCH=y, it occurs not only in the modpost stage, but also during directory descending, where sumversion.c may parse stale *.mod files. It would emit 'No such file or directory' warning when an object consisting a module is renamed, or when a single-obj module is turned into a multi-obj module or vice versa. Signed-off-by: Masahiro Yamada Acked-by: Nicolas Pitre commit 7deb55f57159f9de696ef8d5e93b201a6aba871c Author: Masahiro Yamada Date: Wed Jul 17 15:17:56 2019 +0900 kbuild: export_report: read modules.order instead of .tmp_versions/*.mod Towards the goal of removing MODVERDIR aka .tmp_versions, read out modules.order to get the list of modules to be processed. This is simpler than parsing *.mod files in .tmp_versions. Signed-off-by: Masahiro Yamada commit ff9b45c55b2659d14420424da0ce4e8aa3dbce28 Author: Masahiro Yamada Date: Wed Jul 17 15:17:55 2019 +0900 kbuild: modpost: read modules.order instead of $(MODVERDIR)/*.mod Towards the goal of removing MODVERDIR, read out modules.order to get the list of modules to be processed. This is simpler than parsing *.mod files in $(MODVERDIR). For external modules, $(KBUILD_EXTMOD)/modules.order should be read. I removed the single target %.ko from the top Makefile. To make sure modpost works correctly, vmlinux and the other modules must be built. You cannot build a particular .ko file alone. Signed-off-by: Masahiro Yamada commit 733232f8c852bcc2ad6fc1db7f4c43eb01c7c217 Author: Mike Snitzer Date: Wed Jul 17 12:57:06 2019 -0400 dm: use printk ratelimiting functions DM provided its own ratelimiting printk wrapper but given printk advances this is no longer needed. Also, switching DMDEBUG_LIMIT to using pr_debug_ratelimited() fixes the reported issue where DMDEBUG_LIMIT() still caused a flood of "callbacks suppressed" messages. Reported-by: Milan Broz Depends-on: 29fc2bc7539386 ("printk: pr_debug_ratelimited: check state first to reduce "callbacks suppressed" messages") Signed-off-by: Mike Snitzer commit 916f562fb28a49457d3d99d156ca415b50d6750e Merge: edafb6fe42cf b1511f7a48c3 Author: Linus Torvalds Date: Wed Jul 17 10:07:48 2019 -0700 Merge tag 'clk-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux Pull clk updates from Stephen Boyd: "This round of clk driver and framework updates is heavy on the driver update side. The two main highlights in the core framework are the addition of an bulk clk_get API that handles optional clks and an extra debugfs file that tells the developer about the current parent of a clk. The driver updates are dominated by i.MX in the diffstat, but that is mostly because that SoC has started converting to the clk_hw style of clk registration. The next big update is in the Amlogic meson clk driver that gained some support for audio, cpu, and temperature clks while fixing some PLL issues. Finally, the biggest thing that stands out is the conversion of a large part of the Allwinner sunxi-ng driver to the new clk parent scheme that uses less strings and more pointer comparisons to match clk parents and children up. In general, it looks like we have a lot of little fixes and tweaks here and there to clk data along with the normal addition of a handful of new drivers and a couple new core framework features. Core: - Add a 'clk_parent' file in clk debugfs - Add a clk_bulk_get_optional() API (with devm too) New Drivers: - Support gated clk controller on MIPS based BCM63XX SoCs - Support SiLabs Si5341 and Si5340 chips - Support for CPU clks on Raspberry Pi devices - Audsys clock driver for MediaTek MT8516 SoCs Updates: - Convert a large portion of the Allwinner sunxi-ng driver to new clk parent scheme - Small frequency support for SiLabs Si544 chips - Slow clk support for AT91 SAM9X60 SoCs - Remove dead code in various clk drivers (-Wunused) - Support for Marvell 98DX1135 SoCs - Get duty cycle of generic pwm clks - Improvement in mmc phase calculation and cleanup of some rate defintions - Switch i.MX6 and i.MX7 clock drivers to clk_hw based APIs - Add GPIO, SNVS and GIC clocks for i.MX8 drivers - Mark imx6sx/ul/ull/sll MMDC_P1_IPG and imx8mm DRAM_APB as critical clock - Correct imx7ulp nic1_bus_clk and imx8mm audio_pll2_clk clock setting - Add clks for new Exynos5422 Dynamic Memory Controller driver - Clock definition for Exynos4412 Mali - Add CMM (Color Management Module) clocks on Renesas R-Car H3, M3-N, E3, and D3 - Add TPU (Timer Pulse Unit / PWM) clocks on Renesas RZ/G2M - Support for 32 bit clock IDs in TI's sci-clks for J721e SoCs - TI clock probing done from DT by default instead of firmware - Fix Amlogic Meson mpll fractional part and spread sprectrum issues - Add Amlogic meson8 audio clocks - Add Amlogic g12a temperature sensors clocks - Add Amlogic g12a and g12b cpu clocks - Add TPU (Timer Pulse Unit / PWM) clocks on Renesas R-Car H3, M3-W, and M3-N - Add CMM (Color Management Module) clocks on Renesas R-Car M3-W - Add Clock Domain support on Renesas RZ/N1" * tag 'clk-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux: (190 commits) clk: consoldiate the __clk_get_hw() declarations clk: sprd: Add check for return value of sprd_clk_regmap_init() clk: lochnagar: Update DT binding doc to include the primary SPDIF MCLK clk: Add Si5341/Si5340 driver dt-bindings: clock: Add silabs,si5341 clk: clk-si544: Implement small frequency change support clk: add BCM63XX gated clock controller driver devicetree: document the BCM63XX gated clock bindings clk: at91: sckc: use dedicated functions to unregister clock clk: at91: sckc: improve error path for sama5d4 sck registration clk: at91: sckc: remove unnecessary line clk: at91: sckc: improve error path for sam9x5 sck register clk: at91: sckc: add support to free slow clock osclillator clk: at91: sckc: add support to free slow rc oscillator clk: at91: sckc: add support to free slow oscillator clk: rockchip: export HDMIPHY clock on rk3228 clk: rockchip: add watchdog pclk on rk3328 clk: rockchip: add clock id for hdmi_phy special clock on rk3228 clk: rockchip: add clock id for watchdog pclk on rk3328 clk: at91: sckc: add support for SAM9X60 ... commit edafb6fe42cfa98f4abf8c63acc5f4db011ed7b9 Merge: 47ebe00b684c f0162d21cc80 Author: Linus Torvalds Date: Wed Jul 17 10:03:50 2019 -0700 Merge tag 'rtc-5.3' of git://git.kernel.org/pub/scm/linux/kernel/git/abelloni/linux Pull RTC updates from Alexandre Belloni: "A quiet cycle this time. - ds1307: properly handle oscillator failure flags - imx-sc: alarm support - pcf2123: alarm support, correct offset handling - sun6i: add R40 support - simplify getting the adapter of an i2c client" * tag 'rtc-5.3' of git://git.kernel.org/pub/scm/linux/kernel/git/abelloni/linux: (37 commits) rtc: wm831x: Add IRQF_ONESHOT flag rtc: stm32: remove one condition check in stm32_rtc_set_alarm() rtc: pcf2123: Fix build error rtc: interface: Change type of 'count' from int to u64 rtc: pcf8563: Clear event flags and disable interrupts before requesting irq rtc: pcf8563: Fix interrupt trigger method rtc: pcf2123: fix negative offset rounding rtc: pcf2123: add alarm support rtc: pcf2123: use %ptR rtc: pcf2123: port to regmap rtc: pcf2123: remove sysfs register view rtc: rx8025: simplify getting the adapter of a client rtc: rx8010: simplify getting the adapter of a client rtc: rv8803: simplify getting the adapter of a client rtc: m41t80: simplify getting the adapter of a client rtc: fm3130: simplify getting the adapter of a client rtc: tegra: Drop MODULE_ALIAS rtc: sun6i: Add R40 compatible dt-bindings: rtc: sun6i: Add the R40 RTC compatible dt-bindings: rtc: Convert Allwinner A31 RTC to a schema ... commit 47ebe00b684c2bc183a766bc33c8b5943bc0df85 Merge: fa121bb3fed6 5c274ca4cfb2 Author: Linus Torvalds Date: Wed Jul 17 09:55:43 2019 -0700 Merge tag 'dmaengine-5.3-rc1' of git://git.infradead.org/users/vkoul/slave-dma Pull dmaengine updates from Vinod Koul: - Add support in dmaengine core to do device node checks for DT devices and update bunch of drivers to use that and remove open coding from drivers - New driver/driver support for new hardware, namely: - MediaTek UART APDMA - Freescale i.mx7ulp edma2 - Synopsys eDMA IP core version 0 - Allwinner H6 DMA - Updates to axi-dma and support for interleaved cyclic transfers - Greg's debugfs return value check removals on drivers - Updates to stm32-dma, hsu, dw, pl330, tegra drivers * tag 'dmaengine-5.3-rc1' of git://git.infradead.org/users/vkoul/slave-dma: (68 commits) dmaengine: Revert "dmaengine: fsl-edma: add i.mx7ulp edma2 version support" dmaengine: at_xdmac: check for non-empty xfers_list before invoking callback Documentation: dmaengine: clean up description of dmatest usage dmaengine: tegra210-adma: remove PM_CLK dependency dmaengine: fsl-edma: add i.mx7ulp edma2 version support dt-bindings: dma: fsl-edma: add new i.mx7ulp-edma dmaengine: fsl-edma-common: version check for v2 instead dmaengine: fsl-edma-common: move dmamux register to another single function dmaengine: fsl-edma: add drvdata for fsl-edma dmaengine: Revert "dmaengine: fsl-edma: support little endian for edma driver" dmaengine: rcar-dmac: Reject zero-length slave DMA requests dmaengine: dw: Enable iDMA 32-bit on Intel Elkhart Lake dmaengine: dw-edma: fix semicolon.cocci warnings dmaengine: sh: usb-dmac: Use [] to denote a flexible array member dmaengine: dmatest: timeout value of -1 should specify infinite wait dmaengine: dw: Distinguish ->remove() between DW and iDMA 32-bit dmaengine: fsl-edma: support little endian for edma driver dmaengine: hsu: Revert "set HSU_CH_MTSR to memory width" dmagengine: pl330: add code to get reset property dt-bindings: pl330: document the optional resets property ... commit fa121bb3fed6313b1f0af23952301e06cf6d32ed Merge: 7d4901c08ae5 e5793cd1b5fe Author: Linus Torvalds Date: Wed Jul 17 09:42:03 2019 -0700 Merge tag 'mips_5.3' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux Pull MIPS updates from Paul Burton: "A light batch this time around but significant improvements for certain systems: - Removal of readq & writeq for MIPS32 kernels where they would simply BUG() anyway, allowing drivers or other code that #ifdefs on their presence to work properly. - Improvements for Ingenic JZ4740 systems, including support for the external memory controller & pinmuxing fixes for qi_lb60/NanoNote systems. - Improvements for Lantiq systems, in particular around SMP & IPIs. - DT updates for ralink/MediaTek MT7628a systems to probe & configure a bunch more devices. - Miscellaneous cleanups & build fixes" * tag 'mips_5.3' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux: (30 commits) MIPS: fix some more fall through errors in arch/mips MIPS: perf events: handle switch statement falling through warnings mips/kprobes: Export kprobe_fault_handler() MAINTAINERS: Add myself as Ingenic SoCs maintainer MIPS: ralink: mt7628a.dtsi: Add watchdog controller DT node MIPS: ralink: mt7628a.dtsi: Add SPI controller DT node MIPS: ralink: mt7628a.dtsi: Add GPIO controller DT node MIPS: ralink: mt7628a.dtsi: Add pinctrl DT properties to the UART nodes MIPS: ralink: mt7628a.dtsi: Add pinmux DT node MIPS: ralink: mt7628a.dtsi: Add SPDX GPL-2.0 license identifier MIPS: lantiq: Add SMP support for lantiq interrupt controller MIPS: lantiq: Shorten register names, remove unused macros MIPS: lantiq: Fix bitfield masking MIPS: lantiq: Remove unused macros MIPS: lantiq: Fix attributes of of_device_id structure MIPS: lantiq: Change variables to the same type as the source MIPS: lantiq: Move macro directly to iomem function mips: Remove q-accessors from non-64bit platforms FDDI: defza: Include linux/io-64-nonatomic-lo-hi.h MIPS: configs: Remove useless UEVENT_HELPER_PATH ... commit 7d4901c08ae573e569dd01a29bef2ad404a40f97 Merge: 415bfd9cdb17 38ef0515e1e8 Author: Linus Torvalds Date: Wed Jul 17 09:36:38 2019 -0700 Merge tag 'h8300-for-linus-20190617' of git://git.sourceforge.jp/gitroot/uclinux-h8/linux Pull h8300 update from Yoshinori Sato: "Remove unused barrier defines" * tag 'h8300-for-linus-20190617' of git://git.sourceforge.jp/gitroot/uclinux-h8/linux: H8300: remove unused barrier defines commit 415bfd9cdb175cf870fb173ae9d3958862de2c97 Merge: 57a8ec387e14 d3023897b437 Author: Linus Torvalds Date: Wed Jul 17 09:34:10 2019 -0700 Merge tag 'for-linus-20190617' of git://git.sourceforge.jp/gitroot/uclinux-h8/linux Pull SH updates from Yoshinori Sato. kprobe fix, defconfig updates and a SH Kconfig fix. * tag 'for-linus-20190617' of git://git.sourceforge.jp/gitroot/uclinux-h8/linux: arch/sh: Check for kprobe trap number before trying to handle a kprobe trap sh: configs: Remove useless UEVENT_HELPER_PATH Fix allyesconfig output. commit 4d151bf3b89e71490e69defc811579b2bde617e2 Author: Wanpeng Li Date: Sat Jul 6 09:26:50 2019 +0800 KVM: LAPIC: Make lapic timer unpinned Commit 61abdbe0bcc2 ("kvm: x86: make lapic hrtimer pinned") pinned the lapic timer to avoid to wait until the next kvm exit for the guest to see KVM_REQ_PENDING_TIMER set. There is another solution to give a kick after setting the KVM_REQ_PENDING_TIMER bit, make lapic timer unpinned will be used in follow up patches. Cc: Paolo Bonzini Cc: Radim Krčmář Cc: Marcelo Tosatti Signed-off-by: Wanpeng Li Signed-off-by: Paolo Bonzini commit 9af93db9e140a4e6e79cdb098919bc928a72cd59 Author: Daniel Drake Date: Wed Jul 17 13:10:58 2019 +0800 platform/x86: asus: Rename "fan mode" to "fan boost mode" The Asus WMI spec indicates that the function being controlled here is called "Fan Boost Mode". The user-facing documentation also calls it this. The spec uses the term "fan mode" is used to refer to other things, including functionality expected to appear on future products. We missed this before as we are not dealing with the most readable of specs, and didn't forsee any confusion around shortening the name. Rename "fan mode" to "fan boost mode" to improve consistency with the spec and to avoid a future naming conflict. There is no interface breakage here since this has yet to be included in an official kernel release. I also updated the kernel version listed under ABI accordingly. Signed-off-by: Daniel Drake Acked-by: Yurii Pavlovskyi Signed-off-by: Andy Shevchenko commit 57a8ec387e1441ea5e1232bc0749fb99a8cba7e7 Merge: 0a8ad0ffa4d8 43e11fa2d1d3 Author: Linus Torvalds Date: Wed Jul 17 08:58:04 2019 -0700 Merge branch 'akpm' (patches from Andrew) Merge more updates from Andrew Morton: "VM: - z3fold fixes and enhancements by Henry Burns and Vitaly Wool - more accurate reclaimed slab caches calculations by Yafang Shao - fix MAP_UNINITIALIZED UAPI symbol to not depend on config, by Christoph Hellwig - !CONFIG_MMU fixes by Christoph Hellwig - new novmcoredd parameter to omit device dumps from vmcore, by Kairui Song - new test_meminit module for testing heap and pagealloc initialization, by Alexander Potapenko - ioremap improvements for huge mappings, by Anshuman Khandual - generalize kprobe page fault handling, by Anshuman Khandual - device-dax hotplug fixes and improvements, by Pavel Tatashin - enable synchronous DAX fault on powerpc, by Aneesh Kumar K.V - add pte_devmap() support for arm64, by Robin Murphy - unify locked_vm accounting with a helper, by Daniel Jordan - several misc fixes core/lib: - new typeof_member() macro including some users, by Alexey Dobriyan - make BIT() and GENMASK() available in asm, by Masahiro Yamada - changed LIST_POISON2 on x86_64 to 0xdead000000000122 for better code generation, by Alexey Dobriyan - rbtree code size optimizations, by Michel Lespinasse - convert struct pid count to refcount_t, by Joel Fernandes get_maintainer.pl: - add --no-moderated switch to skip moderated ML's, by Joe Perches misc: - ptrace PTRACE_GET_SYSCALL_INFO interface - coda updates - gdb scripts, various" [ Using merge message suggestion from Vlastimil Babka, with some editing - Linus ] * emailed patches from Andrew Morton : (100 commits) fs/select.c: use struct_size() in kmalloc() mm: add account_locked_vm utility function arm64: mm: implement pte_devmap support mm: introduce ARCH_HAS_PTE_DEVMAP mm: clean up is_device_*_page() definitions mm/mmap: move common defines to mman-common.h mm: move MAP_SYNC to asm-generic/mman-common.h device-dax: "Hotremove" persistent memory that is used like normal RAM mm/hotplug: make remove_memory() interface usable device-dax: fix memory and resource leak if hotplug fails include/linux/lz4.h: fix spelling and copy-paste errors in documentation ipc/mqueue.c: only perform resource calculation if user valid include/asm-generic/bug.h: fix "cut here" for WARN_ON for __WARN_TAINT architectures scripts/gdb: add helpers to find and list devices scripts/gdb: add lx-genpd-summary command drivers/pps/pps.c: clear offset flags in PPS_SETPARAMS ioctl kernel/pid.c: convert struct pid count to refcount_t drivers/rapidio/devices/rio_mport_cdev.c: NUL terminate some strings select: shift restore_saved_sigmask_unless() into poll_select_copy_remaining() select: change do_poll() to return -ERESTARTNOHAND rather than -EINTR ... commit c663e04097f4e286fc146f79eb5ef6a47c01d337 Author: Nikos Tsironis Date: Wed Jul 17 14:24:10 2019 +0300 dm kcopyd: Increase default sub-job size to 512KB Currently, kcopyd has a sub-job size of 64KB and a maximum number of 8 sub-jobs. As a result, for any kcopyd job, we have a maximum of 512KB of I/O in flight. This upper limit to the amount of in-flight I/O under-utilizes fast devices and results in decreased throughput, e.g., when writing to a snapshotted thin LV with I/O size less than the pool's block size (so COW is performed using kcopyd). Increase kcopyd's default sub-job size to 512KB, so we have a maximum of 4MB of I/O in flight for each kcopyd job. This results in an up to 96% improvement of bandwidth when writing to a snapshotted thin LV, with I/O sizes less than the pool's block size. Also, add dm_mod.kcopyd_subjob_size_kb module parameter to allow users to fine tune the sub-job size of kcopyd. The default value of this parameter is 512KB and the maximum allowed value is 1024KB. We evaluate the performance impact of the change by running the snap_breaking_throughput benchmark, from the device mapper test suite [1]. The benchmark: 1. Creates a 1G thin LV 2. Provisions the thin LV 3. Takes a snapshot of the thin LV 4. Writes to the thin LV with: dd if=/dev/zero of=/dev/vg/thin_lv oflag=direct bs= Running this benchmark with various thin pool block sizes and dd I/O sizes (all combinations triggering the use of kcopyd) we get the following results: +-----------------+-------------+------------------+-----------------+ | Pool block size | dd I/O size | BW before (MB/s) | BW after (MB/s) | +-----------------+-------------+------------------+-----------------+ | 1 MB | 256 KB | 242 | 280 | | 1 MB | 512 KB | 238 | 295 | | | | | | | 2 MB | 256 KB | 238 | 354 | | 2 MB | 512 KB | 241 | 380 | | 2 MB | 1 MB | 245 | 394 | | | | | | | 4 MB | 256 KB | 248 | 412 | | 4 MB | 512 KB | 234 | 432 | | 4 MB | 1 MB | 251 | 474 | | 4 MB | 2 MB | 257 | 504 | | | | | | | 8 MB | 256 KB | 239 | 420 | | 8 MB | 512 KB | 256 | 431 | | 8 MB | 1 MB | 264 | 467 | | 8 MB | 2 MB | 264 | 502 | | 8 MB | 4 MB | 281 | 537 | +-----------------+-------------+------------------+-----------------+ [1] https://github.com/jthornber/device-mapper-test-suite Signed-off-by: Nikos Tsironis Signed-off-by: Mike Snitzer commit 3ee25485ba8e8271fe9401eef5003c20ab648ddf Author: Mike Snitzer Date: Wed Jul 17 11:12:30 2019 -0400 dm snapshot: fix oversights in optional discard support __find_snapshots_sharing_cow() should always be used with _origins_lock held so fix snapshot_io_hints() accordingly. Also, once a snapshot is being merged discards must not be allowed -- otherwise incorrect or duplicate work will be performed. Fixes: 2e6023850e177d ("dm snapshot: add optional discard support features") Reported-by: Nikos Tsironis Signed-off-by: Mike Snitzer commit 3b8cafdd5436f9298b3bf6eb831df5eef5ee82b6 Author: Damien Le Moal Date: Tue Jul 16 14:39:34 2019 +0900 dm zoned: fix zone state management race dm-zoned uses the zone flag DMZ_ACTIVE to indicate that a zone of the backend device is being actively read or written and so cannot be reclaimed. This flag is set as long as the zone atomic reference counter is not 0. When this atomic is decremented and reaches 0 (e.g. on BIO completion), the active flag is cleared and set again whenever the zone is reused and BIO issued with the atomic counter incremented. These 2 operations (atomic inc/dec and flag set/clear) are however not always executed atomically under the target metadata mutex lock and this causes the warning: WARN_ON(!test_bit(DMZ_ACTIVE, &zone->flags)); in dmz_deactivate_zone() to be displayed. This problem is regularly triggered with xfstests generic/209, generic/300, generic/451 and xfs/077 with XFS being used as the file system on the dm-zoned target device. Similarly, xfstests ext4/303, ext4/304, generic/209 and generic/300 trigger the warning with ext4 use. This problem can be easily fixed by simply removing the DMZ_ACTIVE flag and managing the "ACTIVE" state by directly looking at the reference counter value. To do so, the functions dmz_activate_zone() and dmz_deactivate_zone() are changed to inline functions respectively calling atomic_inc() and atomic_dec(), while the dmz_is_active() macro is changed to an inline function calling atomic_read(). Fixes: 3b1a94c88b79 ("dm zoned: drive-managed zoned block device target") Cc: stable@vger.kernel.org Reported-by: Masato Suzuki Signed-off-by: Damien Le Moal Signed-off-by: Mike Snitzer commit 373c3b80e459cb57c34381b928588a3794eb5bbd Author: Johannes Thumshirn Date: Mon Jul 15 15:16:12 2019 +0200 btrfs: don't leak extent_map in btrfs_get_io_geometry() btrfs_get_io_geometry() calls btrfs_get_chunk_map() to acquire a reference on a extent_map, but on normal operation it does not drop this reference anymore. This leads to excessive kmemleak reports. Always call free_extent_map(), not just in the error case. Fixes: 5f1411265e16 ("btrfs: Introduce btrfs_io_geometry infrastructure") Reviewed-by: Nikolay Borisov Signed-off-by: Johannes Thumshirn Reviewed-by: David Sterba Signed-off-by: David Sterba commit bfcea1c661eddabd7b5fee85dd3399bb16712c5a Author: Johannes Thumshirn Date: Thu Jul 11 17:23:04 2019 +0200 btrfs: free checksum hash on in close_ctree fs_info::csum_hash gets initialized in btrfs_init_csum_hash() which is called by open_ctree(). But it only gets freed if open_ctree() fails, not on normal operation. This leads to a memory leak like the following found by kmemleak: unreferenced object 0xffff888132cb8720 (size 96): comm "mount", pid 450, jiffies 4294912436 (age 17.584s) hex dump (first 32 bytes): 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<000000000c9643d4>] crypto_create_tfm+0x2d/0xd0 [<00000000ae577f68>] crypto_alloc_tfm+0x4b/0xb0 [<000000002b5cdf30>] open_ctree+0xb84/0x2060 [btrfs] [<0000000043204297>] btrfs_mount_root+0x552/0x640 [btrfs] [<00000000c99b10ea>] legacy_get_tree+0x22/0x40 [<0000000071a6495f>] vfs_get_tree+0x1f/0xc0 [<00000000f180080e>] fc_mount+0x9/0x30 [<000000009e36cebd>] vfs_kern_mount.part.11+0x6a/0x80 [<0000000004594c05>] btrfs_mount+0x174/0x910 [btrfs] [<00000000c99b10ea>] legacy_get_tree+0x22/0x40 [<0000000071a6495f>] vfs_get_tree+0x1f/0xc0 [<00000000b86e92c5>] do_mount+0x6b0/0x940 [<0000000097464494>] ksys_mount+0x7b/0xd0 [<0000000057213c80>] __x64_sys_mount+0x1c/0x20 [<00000000cb689b5e>] do_syscall_64+0x43/0x130 [<000000002194e289>] entry_SYSCALL_64_after_hwframe+0x44/0xa9 Free fs_info::csum_hash in close_ctree() to avoid the memory leak. Fixes: 6d97c6e31b55 ("btrfs: add boilerplate code for directly including the crypto framework") Reviewed-by: Qu Wenruo Signed-off-by: Johannes Thumshirn Reviewed-by: David Sterba Signed-off-by: David Sterba commit 314c4cd6d9e60b9412dcd1b1783a66532f91ea2d Author: YueHaibing Date: Tue Jul 2 22:39:03 2019 +0800 btrfs: Fix build error while LIBCRC32C is module If CONFIG_BTRFS_FS is y and CONFIG_LIBCRC32C is m, building fails: fs/btrfs/super.o: In function `btrfs_mount_root': super.c:(.text+0xb7f9): undefined reference to `crc32c_impl' fs/btrfs/super.o: In function `init_btrfs_fs': super.c:(.init.text+0x3465): undefined reference to `crc32c_impl' fs/btrfs/extent-tree.o: In function `hash_extent_data_ref': extent-tree.c:(.text+0xe60): undefined reference to `crc32c' extent-tree.c:(.text+0xe78): undefined reference to `crc32c' extent-tree.c:(.text+0xe8b): undefined reference to `crc32c' fs/btrfs/dir-item.o: In function `btrfs_insert_xattr_item': dir-item.c:(.text+0x291): undefined reference to `crc32c' fs/btrfs/dir-item.o: In function `btrfs_insert_dir_item': dir-item.c:(.text+0x429): undefined reference to `crc32c' Select LIBCRC32C to fix it. Reported-by: Hulk Robot Fixes: d5178578bcd4 ("btrfs: directly call into crypto framework for checksumming") Reviewed-by: Johannes Thumshirn Signed-off-by: YueHaibing Reviewed-by: David Sterba Signed-off-by: David Sterba commit 42c16da6d684391db83788eb680accd84f6c2083 Author: Qu Wenruo Date: Mon Jul 1 05:12:46 2019 +0000 btrfs: inode: Don't compress if NODATASUM or NODATACOW set As btrfs(5) specified: Note If nodatacow or nodatasum are enabled, compression is disabled. If NODATASUM or NODATACOW set, we should not compress the extent. Normally NODATACOW is detected properly in run_delalloc_range() so compression won't happen for NODATACOW. However for NODATASUM we don't have any check, and it can cause compressed extent without csum pretty easily, just by: mkfs.btrfs -f $dev mount $dev $mnt -o nodatasum touch $mnt/foobar mount -o remount,datasum,compress $mnt xfs_io -f -c "pwrite 0 128K" $mnt/foobar And in fact, we have a bug report about corrupted compressed extent without proper data checksum so even RAID1 can't recover the corruption. (https://bugzilla.kernel.org/show_bug.cgi?id=199707) Running compression without proper checksum could cause more damage when corruption happens, as compressed data could make the whole extent unreadable, so there is no need to allow compression for NODATACSUM. The fix will refactor the inode compression check into two parts: - inode_can_compress() As the hard requirement, checked at btrfs_run_delalloc_range(), so no compression will happen for NODATASUM inode at all. - inode_need_compress() As the soft requirement, checked at btrfs_run_delalloc_range() and compress_file_range(). Reported-by: James Harvey CC: stable@vger.kernel.org # 4.4+ Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba commit 5d907307adc14cd5148b07629c2b4535acd06062 Author: Darrick J. Wong Date: Mon Jul 15 08:51:01 2019 -0700 iomap: move internal declarations into fs/iomap/ Move internal function declarations out of fs/internal.h into include/linux/iomap.h so that our transition is complete. Signed-off-by: Darrick J. Wong Reviewed-by: Christoph Hellwig commit cb7181ff4b1ca1e4a9dbea8a3982142ce4ed73fd Author: Darrick J. Wong Date: Mon Jul 15 08:51:00 2019 -0700 iomap: move the main iteration code into a separate file Move the main iteration code into a separate file so that we can group related functions in a single file instead of having a single enormous source file. Signed-off-by: Darrick J. Wong Reviewed-by: Christoph Hellwig commit afc51aaa22f26cb2894083c4f25097e0950f1609 Author: Darrick J. Wong Date: Mon Jul 15 08:50:59 2019 -0700 iomap: move the buffered IO code into a separate file Move the buffered IO code into a separate file so that we can group related functions in a single file instead of having a single enormous source file. Signed-off-by: Darrick J. Wong Reviewed-by: Christoph Hellwig commit db074436f421967f4f30cfbb6fbc2a728f3e62b3 Author: Darrick J. Wong Date: Mon Jul 15 08:50:59 2019 -0700 iomap: move the direct IO code into a separate file Move the direct IO code into a separate file so that we can group related functions in a single file instead of having a single enormous source file. Signed-off-by: Darrick J. Wong Reviewed-by: Christoph Hellwig commit 56a178981d47075f6fe5e1c4de77036c821d2877 Author: Darrick J. Wong Date: Mon Jul 15 08:50:58 2019 -0700 iomap: move the SEEK_HOLE code into a separate file Move the SEEK_HOLE/SEEK_DATA code into a separate file so that we can group related functions in a single file instead of having a single enormous source file. Signed-off-by: Darrick J. Wong Reviewed-by: Christoph Hellwig commit 5157fb8f5ae123badeeb5effd0716712066e20d8 Author: Darrick J. Wong Date: Mon Jul 15 08:50:58 2019 -0700 iomap: move the file mapping reporting code into a separate file Move the file mapping reporting code (FIEMAP/FIBMAP) into a separate file so that we can group related functions in a single file instead of having a single enormous source file. Signed-off-by: Darrick J. Wong Reviewed-by: Christoph Hellwig commit a45c0eccc564649541305c71539350c7a890226e Author: Darrick J. Wong Date: Mon Jul 15 08:50:57 2019 -0700 iomap: move the swapfile code into a separate file Move the swapfile activation code into a separate file so that we can group related functions in a single file instead of having a single enormous source file. Signed-off-by: Darrick J. Wong Reviewed-by: Christoph Hellwig commit c35c87d6f258ad943d0fb350ed45fa9302c36b52 Author: Masahiro Yamada Date: Wed Jul 17 15:17:54 2019 +0900 kbuild: modsign: read modules.order instead of $(MODVERDIR)/*.mod Towards the goal of removing MODVERDIR, read out modules.order to get the list of modules to be signed. This is simpler than parsing *.mod files in $(MODVERDIR). The modules_sign target is only supported for in-kernel modules. So, this commit does not take care of external modules. Signed-off-by: Masahiro Yamada commit d56aec102c0c462b94513421726e33938695cef4 Author: Masahiro Yamada Date: Wed Jul 17 15:17:53 2019 +0900 kbuild: modinst: read modules.order instead of $(MODVERDIR)/*.mod Towards the goal of removing MODVERDIR, read out modules.order to get the list of modules to be installed. This is simpler than parsing *.mod files in $(MODVERDIR). For external modules, $(KBUILD_EXTMOD)/modules.order should be read. Signed-off-by: Masahiro Yamada commit 0e5d8b7fb2c675b4fe45adee289e640e848dd881 Author: Masahiro Yamada Date: Wed Jul 17 15:17:52 2019 +0900 scsi: remove pointless $(MODVERDIR)/$(obj)/53c700.ver Nothing depends on this, so it is dead code. Signed-off-by: Masahiro Yamada commit e0e1b1ec397e153da10f90355545607d2fd13293 Author: Masahiro Yamada Date: Wed Jul 17 15:17:51 2019 +0900 kbuild: remove duplication from modules.order in sub-directories Currently, only the top-level modules.order drops duplicated entries. The modules.order files in sub-directories potentially contain duplication. To list out the paths of all modules, I want to use modules.order instead of parsing *.mod files in $(MODVERDIR). To achieve this, I want to rip off duplication from modules.order of external modules too. Signed-off-by: Masahiro Yamada commit 1bd9a468018dd318283c7c620729ddf1923f2024 Author: Masahiro Yamada Date: Wed Jul 17 15:17:50 2019 +0900 kbuild: get rid of kernel/ prefix from in-tree modules.{order,builtin} Removing the 'kernel/' prefix will make our life easier because we can simply do 'cat modules.order' to get all built modules with full paths. Currently, we parse the first line of '*.mod' files in $(MODVERDIR). Since we have duplicated functionality here, I plan to remove MODVERDIR entirely. In fact, modules.order is generated also for external modules in a broken format. It adds the 'kernel/' prefix to the absolute path of the module, like this: kernel//path/to/your/external/module/foo.ko This is fine for now since modules.order is not used for external modules. However, I want to sanitize the format everywhere towards the goal of removing MODVERDIR. We cannot change the format of installed module.{order,builtin}. So, 'make modules_install' will add the 'kernel/' prefix while copying them to $(MODLIB)/. Signed-off-by: Masahiro Yamada commit 7e13191879d6d589cd987a8db3a70019251fc757 Author: Masahiro Yamada Date: Wed Jul 17 15:17:49 2019 +0900 kbuild: do not create empty modules.order in the prepare stage Currently, $(objtree)/modules.order is touched in two places. In the 'prepare0' rule, scripts/Makefile.build creates an empty modules.order while processing 'obj=.' In the 'modules' rule, the top-level Makefile overwrites it with the correct list of modules. While this might be a good side-effect that modules.order is made empty every time (probably this is not intended functionality), I personally do not like this behavior. Create modules.order only when it is sensible to do so. This avoids creating the following pointless files: scripts/basic/modules.order scripts/dtc/modules.order scripts/gcc-plugins/modules.order scripts/genksyms/modules.order scripts/mod/modules.order scripts/modules.order scripts/selinux/genheaders/modules.order scripts/selinux/mdp/modules.order scripts/selinux/modules.order Going forward, $(objtree)/modules.order lists the modules that was built in the last successful build. Signed-off-by: Masahiro Yamada commit d09778d16e20bc4f1f4971cc9a9fd7ff6ba898ff Author: Himanshu Jha Date: Tue Jul 16 11:22:22 2019 +0530 coccinelle: api: add devm_platform_ioremap_resource script Use recently introduced devm_platform_ioremap_resource helper which wraps platform_get_resource() and devm_ioremap_resource() together. This helps produce much cleaner code and remove local `struct resource` declaration. Signed-off-by: Himanshu Jha Signed-off-by: Julia Lawall Signed-off-by: Masahiro Yamada commit 4bd01de8f201abb704ae9bda3af4ea9ba3a10b0a Author: Masahiro Yamada Date: Tue Jul 16 22:29:45 2019 +0900 kbuild: compile-test headers listed in header-test-m as well It will be useful to control the header-test by a tristate option. If CONFIG_FOO is a tristate option, you can write like this: header-test-$(CONFIG_FOO) += foo.h Signed-off-by: Masahiro Yamada commit c04d1e46fcd6090f2ae04e285e9d3adcf376f5b1 Author: Masahiro Yamada Date: Mon Jul 15 23:11:03 2019 +0900 kbuild: remove unused hostcc-option We can re-add this whenever it is needed. At this moment, it is unused. Signed-off-by: Masahiro Yamada commit 46457133ac9d55272ce410f5e701e23e4d68bcdb Author: Masahiro Yamada Date: Mon Jul 15 23:01:49 2019 +0900 kbuild: remove tag files by distclean instead of mrproper It takes somewhat long time to generate these tag files. Keep such precious files until we run 'make distclean'. Signed-off-by: Masahiro Yamada commit 89ff7131f78ad083665382146e66430d66399076 Author: Masahiro Yamada Date: Sat Jul 13 13:01:10 2019 +0900 kbuild: add --hash-style= and --build-id unconditionally As commit 1e0221374e30 ("mips: vdso: drop unnecessary cc-ldoption") explained, these flags are supported by the minimal required version of binutils. They are supported by ld.lld too. Signed-off-by: Masahiro Yamada Reviewed-by: Nathan Chancellor Tested-by: Nathan Chancellor commit 5ef872636ca71d35ddc5ee5951c9272a51c74418 Author: Masahiro Yamada Date: Sat Jul 13 11:45:58 2019 +0900 kbuild: get rid of misleading $(AS) from documents The assembler files in the kernel are *.S instead of *.s, so they must be preprocessed. Since 'as' of GNU binutils is not able to preprocess, we always use $(CC) as an assembler driver. $(AS) is almost unused in Kbuild. As of v5.2, there is just one place that directly invokes $(AS). $ git grep -e '$(AS)' -e '${AS}' -e '$AS' -e '$(AS:' -e '${AS:' -- :^Documentation drivers/net/wan/Makefile: AS68K = $(AS) The documentation about *_AFLAGS* sounds like the flags were passed to $(AS). This is somewhat misleading. Signed-off-by: Masahiro Yamada Reviewed-by: Nathan Chancellor commit 8e2442a5f86e1f77b86401fce274a7f622740bc4 Author: Masahiro Yamada Date: Fri Jul 12 15:07:09 2019 +0900 kconfig: fix missing choice values in auto.conf Since commit 00c864f8903d ("kconfig: allow all config targets to write auto.conf if missing"), Kconfig creates include/config/auto.conf in the defconfig stage when it is missing. Joonas Kylmälä reported incorrect auto.conf generation under some circumstances. To reproduce it, apply the following diff: | --- a/arch/arm/configs/imx_v6_v7_defconfig | +++ b/arch/arm/configs/imx_v6_v7_defconfig | @@ -345,14 +345,7 @@ CONFIG_USB_CONFIGFS_F_MIDI=y | CONFIG_USB_CONFIGFS_F_HID=y | CONFIG_USB_CONFIGFS_F_UVC=y | CONFIG_USB_CONFIGFS_F_PRINTER=y | -CONFIG_USB_ZERO=m | -CONFIG_USB_AUDIO=m | -CONFIG_USB_ETH=m | -CONFIG_USB_G_NCM=m | -CONFIG_USB_GADGETFS=m | -CONFIG_USB_FUNCTIONFS=m | -CONFIG_USB_MASS_STORAGE=m | -CONFIG_USB_G_SERIAL=m | +CONFIG_USB_FUNCTIONFS=y | CONFIG_MMC=y | CONFIG_MMC_SDHCI=y | CONFIG_MMC_SDHCI_PLTFM=y And then, run: $ make ARCH=arm mrproper imx_v6_v7_defconfig You will see CONFIG_USB_FUNCTIONFS=y is correctly contained in the .config, but not in the auto.conf. Please note drivers/usb/gadget/legacy/Kconfig is included from a choice block in drivers/usb/gadget/Kconfig. So USB_FUNCTIONFS is a choice value. This is probably a similar situation described in commit beaaddb62540 ("kconfig: tests: test defconfig when two choices interact"). When sym_calc_choice() is called, the choice symbol forgets the SYMBOL_DEF_USER unless all of its choice values are explicitly set by the user. The choice symbol is given just one chance to recall it because set_all_choice_values() is called if SYMBOL_NEED_SET_CHOICE_VALUES is set. When sym_calc_choice() is called again, the choice symbol forgets it forever, since SYMBOL_NEED_SET_CHOICE_VALUES is a one-time aid. Hence, we cannot call sym_clear_all_valid() again and again. It is crazy to repeat set and unset of internal flags. However, we cannot simply get rid of "sym->flags &= flags | ~SYMBOL_DEF_USER;" Doing so would re-introduce the problem solved by commit 5d09598d488f ("kconfig: fix new choices being skipped upon config update"). To work around the issue, conf_write_autoconf() stopped calling sym_clear_all_valid(). conf_write() must be changed accordingly. Currently, it clears SYMBOL_WRITE after the symbol is written into the .config file. This is needed to prevent it from writing the same symbol multiple times in case the symbol is declared in two or more locations. I added the new flag SYMBOL_WRITTEN, to track the symbols that have been written. Anyway, this is a cheesy workaround in order to suppress the issue as far as defconfig is concerned. Handling of choices is totally broken. sym_clear_all_valid() is called every time a user touches a symbol from the GUI interface. To reproduce it, just add a new symbol drivers/usb/gadget/legacy/Kconfig, then touch around unrelated symbols from menuconfig. USB_FUNCTIONFS will disappear from the .config file. I added the Fixes tag since it is more fatal than before. But, this has been broken since long long time before, and still it is. We should take a closer look to fix this correctly somehow. Fixes: 00c864f8903d ("kconfig: allow all config targets to write auto.conf if missing") Cc: linux-stable # 4.19+ Reported-by: Joonas Kylmälä Signed-off-by: Masahiro Yamada Tested-by: Joonas Kylmälä commit 64dbc122b20f75183d8822618c24f85144a5a94d Author: Josh Poimboeuf Date: Mon Jul 15 11:51:39 2019 -0500 x86/entry/64: Use JMP instead of JMPQ Somehow the swapgs mitigation entry code patch ended up with a JMPQ instruction instead of JMP, where only the short jump is needed. Some assembler versions apparently fail to optimize JMPQ into a two-byte JMP when possible, instead always using a 7-byte JMP with relocation. For some reason that makes the entry code explode with a #GP during boot. Change it back to "JMP" as originally intended. Fixes: 18ec54fdd6d1 ("x86/speculation: Prepare entry code for Spectre v1 swapgs mitigations") Signed-off-by: Josh Poimboeuf Signed-off-by: Thomas Gleixner commit 65f11c72780fa9d598df88def045ccb6a885cf80 Author: Ilya Trukhanov Date: Tue Jul 2 13:37:16 2019 +0300 HID: Add 044f:b320 ThrustMaster, Inc. 2 in 1 DT Enable force feedback for the Thrustmaster Dual Trigger 2 in 1 Rumble Force gamepad. Compared to other Thrustmaster devices, left and right rumble motors here are swapped. Signed-off-by: Ilya Trukhanov Signed-off-by: Jiri Kosina commit d79f7badd118e678cf85462df637329aff26e9d5 Author: Filipe Laíns Date: Tue Jul 16 08:37:47 2019 +0100 HID: logitech-dj: add the Powerplay receiver Add device ID for Powerplay receiver. Signed-off-by: Filipe Laíns Signed-off-by: Jiri Kosina commit 27fc32fd9417968a459d43d9a7c50fd423d53eb9 Author: Filipe Laíns Date: Tue Jul 16 08:37:26 2019 +0100 HID: logitech-hidpp: add USB PID for a few more supported mice Add more device IDs to logitech-hidpp driver. Signed-off-by: Filipe Laíns Signed-off-by: Jiri Kosina commit 600ea54dbaecdf3f68ec52b8d027bacbebf27d92 Author: Filipe Laíns Date: Tue Jul 16 08:36:21 2019 +0100 HID: logitech-dj: rename "gaming" receiver to "lightspeed" This should help people identify the receiver. there are several receivers used in gaming mice. the "lightspeed" technology is pretty well advertise so this won't just be an obscure name. Signed-off-by: Filipe Laíns Signed-off-by: Jiri Kosina commit 4d1a082da968ff0c9d7b69a7ec44e6be6fc6e213 Author: Like Xu Date: Wed Jul 17 10:51:18 2019 +0800 KVM: x86/vPMU: reset pmc->counter to 0 for pmu fixed_counters To avoid semantic inconsistency, the fixed_counters in Intel vPMU need to be reset to 0 in intel_pmu_reset() as gp_counters does. Signed-off-by: Like Xu Signed-off-by: Paolo Bonzini commit 518b7d55f80eb548595c7940b6975ba350e5255d Author: Mauro Carvalho Chehab Date: Tue Jun 18 15:13:40 2019 -0300 docs: virtual: add it to the documentation body As files are getting converted to ReST, add them to the documentation body. Signed-off-by: Mauro Carvalho Chehab commit 9fc3a18a942f74d245429211577a733930d365fa Author: Mauro Carvalho Chehab Date: Sun Jul 14 11:44:23 2019 -0300 docs: remove extra conf.py files Now that the latex_documents are handled automatically, we can remove those extra conf.py files. Signed-off-by: Mauro Carvalho Chehab commit a84d9e899683cd79cb134c6d962e57d0de9446cc Author: Mauro Carvalho Chehab Date: Sun Jul 14 11:18:13 2019 -0300 docs: load_config.py: avoid needing a conf.py just due to LaTeX docs Right now, for every directory that we need to have LaTeX output, a conf.py file is required. That causes an extra overhead and it is actually a hack, as the latex_documents line there are usually a copy of the ones that are there already at the main conf.py. So, instead, re-use the global latex_documents var, just adjusting the path to be relative ones. Signed-off-by: Mauro Carvalho Chehab commit 27eed923f715f6269b98e089ad2164f9b016eace Author: Mauro Carvalho Chehab Date: Sat Jul 13 08:19:44 2019 -0300 scripts/sphinx-pre-install: seek for Noto CJK fonts for pdf output The translations guide need Noto CJK fonts. So, add a logic that would suggest its install for distros. It also fix a few other issues while testing the script with several distributions. Signed-off-by: Mauro Carvalho Chehab commit 4ea96d57bbfda93ae6cfdc8e565a3c419a78f328 Author: Mauro Carvalho Chehab Date: Sat Jul 13 08:19:44 2019 -0300 scripts/sphinx-pre-install: cleanup Gentoo checks On Gentoo, the portage changes for ImageMagick to work are always suggested, even if already applied. While the two extra commands should be harmless, add a check to avoid reporting it without need. Signed-off-by: Mauro Carvalho Chehab commit 353290a9eb5362a80bc8e52fcd7eb77a30f48afc Author: Mauro Carvalho Chehab Date: Sat Jul 13 08:19:44 2019 -0300 scripts/sphinx-pre-install: fix latexmk dependencies The name of the package with carries latexmk is different on two distros: - On OpenSUSE, latexmk is packaged as "texlive-latexmk-bin" - On Mageia, latexmk is packaged at "texlive-collection-basic" Signed-off-by: Mauro Carvalho Chehab commit 56e5a633923793b31515795ad30156a307572c1e Author: Mauro Carvalho Chehab Date: Sat Jul 13 09:37:16 2019 -0300 scripts/sphinx-pre-install: don't use LaTeX with CentOS 7 There aren't enough texlive packages for LaTeX-based builds to work on CentOS/RHEL <= 7. Signed-off-by: Mauro Carvalho Chehab commit b308467c916aa7acc5069802ab76a9f657434701 Author: Mauro Carvalho Chehab Date: Sat Jul 13 08:50:24 2019 -0300 scripts/sphinx-pre-install: fix script for RHEL/CentOS There's a missing parenthesis at the script, with causes it to fail to detect non-Fedora releases (e. g. RHEL/CentOS). Tested with Centos 7.6.1810. Signed-off-by: Mauro Carvalho Chehab commit e0de2b59e243c88296fc983e32dd6484365e87a7 Author: Mauro Carvalho Chehab Date: Sun Jul 14 07:16:18 2019 -0300 docs: conf.py: only use CJK if the font is available If we try to build a book with asian characters with XeLaTeX and the font is not available, it will produce an error. So, instead, add a logic at conf.py to detect if the proper font is installed. This will avoid an error while building the document, although the result may not be readable. Signed-off-by: Mauro Carvalho Chehab commit 24889dad3d9e7c9e22f5be46d9ae7b8ca92cc1cc Author: Mauro Carvalho Chehab Date: Tue Jul 9 15:14:17 2019 -0300 docs: conf.py: add CJK package needed by translations In order to be able to output Asian symbols with XeLaTeX, we need the xeCJK package, and a default font for CJK symbols. Signed-off-by: Mauro Carvalho Chehab commit 9d42afbe6bd4ce6d424159715e4abf3ea3ddb789 Author: Mauro Carvalho Chehab Date: Tue Jul 9 06:52:36 2019 -0300 docs: pdf: add all Documentation/*/index.rst to PDF output Currently, all index files should be manually added to the latex_documents array at conf.py. While this allows fine-tuning some LaTeX specific things, like the name of the output file and the name of the document, it is not uncommon to forget adding new documents there. So, add a logic that will seek for all Documentation/*/index.rst. If the index is not yet at latex_documents, it includes using a reasonable default. Signed-off-by: Mauro Carvalho Chehab commit bff9e34c678552eb172916d9288913e8bd8cc9d1 Author: Mauro Carvalho Chehab Date: Mon Jul 15 05:31:06 2019 -0300 docs: fix broken doc references due to renames Some files got renamed but probably due to some merge conflicts, a few references still point to the old locations. Signed-off-by: Mauro Carvalho Chehab commit 08a69058c02f9588775360c8703e69fc0ec4626c Author: Mauro Carvalho Chehab Date: Mon Jul 15 09:39:57 2019 -0300 docs: power: add it to to the main documentation index The power docs are orphaned at the documentation body. While it could likely be moved to be inside some guide, I'm opting to just adding it to the main index.rst, removing the :orphan: and adding the SPDX header. The reason is similar to what it was done for other driver-specific subsystems: the docs there contain a mix of Kernelspace, uAPI and admin-guide. So, better to keep them on its own directory, while the docs there are not properly classified. Signed-off-by: Mauro Carvalho Chehab commit 4d2e26a38fbcde2ba14882cbdb845caa1c17e19b Author: Mauro Carvalho Chehab Date: Wed Apr 10 08:32:42 2019 -0300 docs: powerpc: convert docs to ReST and rename to *.rst Convert docs to ReST and add them to the arch-specific book. The conversion here was trivial, as almost every file there was already using an elegant format close to ReST standard. The changes were mostly to mark literal blocks and add a few missing section title identifiers. One note with regards to "--": on Sphinx, this can't be used to identify a list, as it will format it badly. This can be used, however, to identify a long hyphen - and "---" is an even longer one. At its new index.rst, let's add a :orphan: while this is not linked to the main index.rst file, in order to avoid build warnings. Signed-off-by: Mauro Carvalho Chehab Acked-by: Andrew Donnellan # cxl commit 4c4cbbaa693a5cc435664f2f220c8b0be873abd1 Author: Cornelia Huck Date: Wed Jul 17 11:35:35 2019 +0200 Documentation: fix vfio-ccw doc *Really* mark the literal block as such. Fixes: 127e62174041 ("vfio-ccw: Update documentation for csch/hsch") Signed-off-by: Cornelia Huck commit 22d6552f827ef76ade3edf6bbb3f05048a0a7d8b Author: Nicolas Dichtel Date: Mon Jul 15 12:00:23 2019 +0200 xfrm interface: fix management of phydev With the current implementation, phydev cannot be removed: $ ip link add dummy type dummy $ ip link add xfrm1 type xfrm dev dummy if_id 1 $ ip l d dummy kernel:[77938.465445] unregister_netdevice: waiting for dummy to become free. Usage count = 1 Manage it like in ip tunnels, ie just keep the ifindex. Not that the side effect, is that the phydev is now optional. Fixes: f203b76d7809 ("xfrm: Add virtual xfrm interfaces") Signed-off-by: Nicolas Dichtel Tested-by: Julien Floret Signed-off-by: Steffen Klassert commit c5d1030f23002430c2a336b2b629b9d6f72b3564 Author: Nicolas Dichtel Date: Mon Jul 15 12:00:22 2019 +0200 xfrm interface: fix list corruption for x-netns dev_net(dev) is the netns of the device and xi->net is the link netns, where the device has been linked. changelink() must operate in the link netns to avoid a corruption of the xfrm lists. Note that xi->net and dev_net(xi->physdev) are always the same. Before the patch, the xfrmi lists may be corrupted and can later trigger a kernel panic. Fixes: f203b76d7809 ("xfrm: Add virtual xfrm interfaces") Reported-by: Julien Floret Signed-off-by: Nicolas Dichtel Tested-by: Julien Floret Signed-off-by: Steffen Klassert commit e0aaa332e6a97dae57ad59cdb19e21f83c3d081c Author: Nicolas Dichtel Date: Mon Jul 15 12:00:21 2019 +0200 xfrm interface: ifname may be wrong in logs The ifname is copied when the interface is created, but is never updated later. In fact, this property is used only in one error message, where the netdevice pointer is available, thus let's use it. Fixes: f203b76d7809 ("xfrm: Add virtual xfrm interfaces") Signed-off-by: Nicolas Dichtel Signed-off-by: Steffen Klassert commit e9e7e85d75f3731079ffd77c1a66f037aef04fe7 Author: Nicolas Dichtel Date: Mon Jul 15 12:00:20 2019 +0200 xfrm interface: avoid corruption on changelink The new parameters must not be stored in the netdev_priv() before validation, it may corrupt the interface. Note also that if data is NULL, only a memset() is done. $ ip link add xfrm1 type xfrm dev lo if_id 1 $ ip link add xfrm2 type xfrm dev lo if_id 2 $ ip link set xfrm1 type xfrm dev lo if_id 2 RTNETLINK answers: File exists $ ip -d link list dev xfrm1 5: xfrm1@lo: mtu 1500 qdisc noop state DOWN mode DEFAULT group default qlen 1000 link/none 00:00:00:00:00:00 brd 00:00:00:00:00:00 promiscuity 0 minmtu 68 maxmtu 1500 xfrm if_id 0x2 addrgenmode eui64 numtxqueues 1 numrxqueues 1 gso_max_size 65536 gso_max_segs 65535 => "if_id 0x2" Fixes: f203b76d7809 ("xfrm: Add virtual xfrm interfaces") Signed-off-by: Nicolas Dichtel Tested-by: Julien Floret Signed-off-by: Steffen Klassert commit a5008b59cd9d8de12ab623cb5052bb4735330e5c Author: Christoph Hellwig Date: Tue Jul 16 22:00:54 2019 +0200 dma-direct: only limit the mapping size if swiotlb could be used Don't just check for a swiotlb buffer, but also if buffering might be required for this particular device. Fixes: 133d624b1cee ("dma: Introduce dma_max_mapping_size()") Reported-by: Benjamin Herrenschmidt Signed-off-by: Christoph Hellwig Tested-by: Benjamin Herrenschmidt commit b866455423e040813f113d8b87e8297778ee2014 Author: Christoph Hellwig Date: Tue Jul 16 21:59:11 2019 +0200 dma-mapping: add a dma_addressing_limited helper This helper returns if the device has issues addressing all present memory in the system. Signed-off-by: Christoph Hellwig commit b23e5844dfe78a80ba672793187d3f52e4b528d7 Author: Zhenzhong Duan Date: Sun Jul 14 17:15:32 2019 +0800 xen/pv: Fix a boot up hang revealed by int3 self test Commit 7457c0da024b ("x86/alternatives: Add int3_emulate_call() selftest") is used to ensure there is a gap setup in int3 exception stack which could be used for inserting call return address. This gap is missed in XEN PV int3 exception entry path, then below panic triggered: [ 0.772876] general protection fault: 0000 [#1] SMP NOPTI [ 0.772886] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.2.0+ #11 [ 0.772893] RIP: e030:int3_magic+0x0/0x7 [ 0.772905] RSP: 3507:ffffffff82203e98 EFLAGS: 00000246 [ 0.773334] Call Trace: [ 0.773334] alternative_instructions+0x3d/0x12e [ 0.773334] check_bugs+0x7c9/0x887 [ 0.773334] ? __get_locked_pte+0x178/0x1f0 [ 0.773334] start_kernel+0x4ff/0x535 [ 0.773334] ? set_init_arg+0x55/0x55 [ 0.773334] xen_start_kernel+0x571/0x57a For 64bit PV guests, Xen's ABI enters the kernel with using SYSRET, with %rcx/%r11 on the stack. To convert back to "normal" looking exceptions, the xen thunks do 'xen_*: pop %rcx; pop %r11; jmp *'. E.g. Extracting 'xen_pv_trap xenint3' we have: xen_xenint3: pop %rcx; pop %r11; jmp xenint3 As xenint3 and int3 entry code are same except xenint3 doesn't generate a gap, we can fix it by using int3 and drop useless xenint3. Signed-off-by: Zhenzhong Duan Reviewed-by: Juergen Gross Cc: Boris Ostrovsky Cc: Juergen Gross Cc: Stefano Stabellini Cc: Andy Lutomirski Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: Ingo Molnar Cc: Borislav Petkov Cc: Andrew Cooper Signed-off-by: Juergen Gross commit bef6e0ae7420bfddfb150dda529bbe835f87b9f2 Author: Zhenzhong Duan Date: Tue Jul 16 12:26:09 2019 +0800 x86/xen: Add "nopv" support for HVM guest PVH guest needs PV extentions to work, so "nopv" parameter should be ignored for PVH but not for HVM guest. If PVH guest boots up via the Xen-PVH boot entry, xen_pvh is set early, we know it's PVH guest and ignore "nopv" parameter directly. If PVH guest boots up via the normal boot entry same as HVM guest, it's hard to distinguish PVH and HVM guest at that time. In this case, we have to panic early if PVH is detected and nopv is enabled to avoid a worse situation later. Remove static from bool_x86_init_noop/x86_op_int_noop so they could be used globally. Move xen_platform_hvm() after xen_hvm_guest_late_init() to avoid compile error. Signed-off-by: Zhenzhong Duan Reviewed-by: Boris Ostrovsky Cc: Juergen Gross Cc: Stefano Stabellini Cc: Thomas Gleixner Cc: Ingo Molnar Cc: Borislav Petkov Signed-off-by: Juergen Gross commit cc8f3b4dd2eb859bc57187ccd94b5cd715d9cfba Author: Zhenzhong Duan Date: Tue Jul 16 12:26:08 2019 +0800 x86/paravirt: Remove const mark from x86_hyper_xen_hvm variable .. as "nopv" support needs it to be changeable at boot up stage. Checkpatch reports warning, so move variable declarations from hypervisor.c to hypervisor.h Signed-off-by: Zhenzhong Duan Reviewed-by: Juergen Gross Cc: Boris Ostrovsky Cc: Juergen Gross Cc: Stefano Stabellini Cc: Thomas Gleixner Cc: Ingo Molnar Cc: Borislav Petkov Signed-off-by: Juergen Gross commit b39b049749ce08c7756be57082177730617bb9a0 Author: Zhenzhong Duan Date: Thu Jul 11 20:02:10 2019 +0800 xen: Map "xen_nopv" parameter to "nopv" and mark it obsolete Clean up unnecessory code after that operation. Signed-off-by: Zhenzhong Duan Reviewed-by: Boris Ostrovsky Cc: Juergen Gross Cc: Stefano Stabellini Cc: Thomas Gleixner Cc: Ingo Molnar Cc: Borislav Petkov Signed-off-by: Juergen Gross commit 30978346372e5c43a652cfbd4533c6bd5427c33b Author: Zhenzhong Duan Date: Thu Jul 11 20:02:09 2019 +0800 x86: Add "nopv" parameter to disable PV extensions In virtualization environment, PV extensions (drivers, interrupts, timers, etc) are enabled in the majority of use cases which is the best option. However, in some cases (kexec not fully working, benchmarking) we want to disable PV extensions. We have "xen_nopv" for that purpose but only for XEN. For a consistent admin experience a common command line parameter "nopv" set across all PV guest implementations is a better choice. There are guest types which just won't work without PV extensions, like Xen PV, Xen PVH and jailhouse. add a "ignore_nopv" member to struct hypervisor_x86 set to true for those guest types and call the detect functions only if nopv is false or ignore_nopv is true. Suggested-by: Juergen Gross Signed-off-by: Zhenzhong Duan Reviewed-by: Juergen Gross Cc: Thomas Gleixner Cc: Ingo Molnar Cc: Borislav Petkov Cc: Jan Kiszka Cc: Boris Ostrovsky Cc: Stefano Stabellini Signed-off-by: Juergen Gross commit 1b37683cda0217305837fd1b79e7c57104d4f983 Author: Zhenzhong Duan Date: Thu Jul 11 20:02:08 2019 +0800 x86/xen: Mark xen_hvm_need_lapic() and xen_x2apic_para_available() as __init .. as they are only called at early bootup stage. In fact, other functions in x86_hyper_xen_hvm.init.* are all marked as __init. Unexport xen_hvm_need_lapic as it's never used outside. Signed-off-by: Zhenzhong Duan Reviewed-by: Juergen Gross Cc: Boris Ostrovsky Cc: Stefano Stabellini Cc: Thomas Gleixner Cc: Ingo Molnar Cc: Borislav Petkov Signed-off-by: Juergen Gross commit 814bbf49dcd0ad642e7ceb8991e57555c5472cce Author: Juergen Gross Date: Sun Jul 14 14:04:14 2019 +0200 xen: remove tmem driver The Xen tmem (transcendent memory) driver can be removed, as the related Xen hypervisor feature never made it past the "experimental" state and will be removed in future Xen versions (>= 4.13). The xen-selfballoon driver depends on tmem, so it can be removed, too. Signed-off-by: Juergen Gross Acked-by: Boris Ostrovsky Signed-off-by: Juergen Gross commit 090d54bcbc54af75e94442e60f42d973341a5f53 Author: Zhenzhong Duan Date: Wed Jun 26 16:57:09 2019 +0800 Revert "x86/paravirt: Set up the virt_spin_lock_key after static keys get initialized" This reverts commit ca5d376e17072c1b60c3fee66f3be58ef018952d. Commit 8990cac6e5ea ("x86/jump_label: Initialize static branching early") adds jump_label_init() call in setup_arch() to make static keys initialized early, so we could use the original simpler code again. Signed-off-by: Zhenzhong Duan Reviewed-by: Thomas Gleixner Signed-off-by: Juergen Gross commit bce5963bcb4f9934faa52be323994511d59fd13c Author: Juergen Gross Date: Fri Jun 21 20:47:03 2019 +0200 xen/events: fix binding user event channels to cpus When binding an interdomain event channel to a vcpu via IOCTL_EVTCHN_BIND_INTERDOMAIN not only the event channel needs to be bound, but the affinity of the associated IRQi must be changed, too. Otherwise the IRQ and the event channel won't be moved to another vcpu in case the original vcpu they were bound to is going offline. Cc: # 4.13 Fixes: c48f64ab472389df ("xen-evtchn: Bind dyn evtchn:qemu-dm interrupt to next online VCPU") Signed-off-by: Juergen Gross Reviewed-by: Boris Ostrovsky Signed-off-by: Juergen Gross commit 07d9aa14346489d6facae5777ceb267a1dcadbc5 Author: Christoph Hellwig Date: Mon Jun 17 14:20:00 2019 +0200 scsi: megaraid_sas: set an unlimited max_segment_size When using a virt_boundary_mask, as done for NVMe devices attached to megaraid_sas controllers, we require an unlimited max_segment_size as the virt boundary merging code assumes that. But we also need to propagate that to the DMA mapping layer to make dma-debug happy. The SCSI layer takes care of that when using the per-host virt_boundary setting, but given that megaraid_sas only wants to set the virt_boundary for actual NVMe devices, we can't rely on that. The DMA layer maximum segment is global to the HBA however, so we have to set it explicitly. This patch assumes that megaraid_sas does not have a segment size limitation, which seems true based on the SGL format, but will need to be verified. Signed-off-by: Christoph Hellwig Signed-off-by: Martin K. Petersen commit ce0ad853109733d772d26224297fda0de313bf13 Author: Christoph Hellwig Date: Mon Jun 17 14:19:59 2019 +0200 scsi: mpt3sas: set an unlimited max_segment_size for SAS 3.0 HBAs When using a virt_boundary_mask, as done for NVMe devices attached to mpt3sas controllers, we require an unlimited max_segment_size as the virt boundary merging code assumes that. But we also need to propagate that to the DMA mapping layer to make dma-debug happy. The SCSI layer takes care of that when using the per-host virt_boundary setting, but given that mpt3sas only wants to set the virt_boundary for actual NVMe devices, we can't rely on that. The DMA layer maximum segment is global to the HBA however, so we have to set it explicitly. This patch assumes that mpt3sas does not have a segment size limitation, which seems true based on the SGL format, but will need to be verified. Signed-off-by: Christoph Hellwig Acked-by: Suganath Prabu Signed-off-by: Martin K. Petersen commit 8c175d3131acd166ba57f1fd31f0d76f6fa4f376 Author: Christoph Hellwig Date: Mon Jun 17 14:19:58 2019 +0200 scsi: IB/srp: set virt_boundary_mask in the scsi host This ensures all proper DMA layer handling is taken care of by the SCSI midlayer. Signed-off-by: Christoph Hellwig Reviewed-by: Sagi Grimberg Acked-by: Bart Van Assche Reviewed-by: Max Gurtovoy Signed-off-by: Martin K. Petersen commit 09a4460ba4434ef0327cd26bf25f2d7afb973251 Author: Christoph Hellwig Date: Mon Jun 17 14:19:57 2019 +0200 scsi: IB/iser: set virt_boundary_mask in the scsi host This ensures all proper DMA layer handling is taken care of by the SCSI midlayer. Signed-off-by: Christoph Hellwig Acked-by: Sagi Grimberg Reviewed-by: Max Gurtovoy Signed-off-by: Martin K. Petersen commit 83eed4592f19a04004c80e6f256236264db95dd8 Author: Christoph Hellwig Date: Mon Jun 17 14:19:56 2019 +0200 scsi: storvsc: set virt_boundary_mask in the scsi host template This ensures all proper DMA layer handling is taken care of by the SCSI midlayer. Signed-off-by: Christoph Hellwig Reviewed-by: Bart Van Assche Signed-off-by: Martin K. Petersen commit 552a990ca1668895851271df1224cb02003af348 Author: Christoph Hellwig Date: Mon Jun 17 14:19:55 2019 +0200 scsi: ufshcd: set max_segment_size in the scsi host template We need to also mirror the value to the device to ensure IOMMU merging doesn't undo it, and the SCSI host level parameter will ensure that. Signed-off-by: Christoph Hellwig Reviewed-by: Bart Van Assche Signed-off-by: Martin K. Petersen commit bdd17bdef7d8da4d8eee254abb4c92d8a566bdc1 Author: Christoph Hellwig Date: Mon Jun 17 14:19:54 2019 +0200 scsi: core: take the DMA max mapping size into account We need to limit the device's max_sectors to what the DMA mapping implementation can support. If not, we risk running out of swiotlb buffers easily. Signed-off-by: Christoph Hellwig Signed-off-by: Martin K. Petersen commit 7ad388d8e4c703980b7018b938cdeec58832d78d Author: Christoph Hellwig Date: Mon Jun 17 14:19:53 2019 +0200 scsi: core: add a host / host template field for the virt boundary This allows drivers setting it up easily instead of branching out to block layer calls in slave_alloc, and ensures the upgraded max_segment_size setting gets picked up by the DMA layer. Signed-off-by: Christoph Hellwig Acked-by: Kashyap Desai < kashyap.desai@broadcom.com> Signed-off-by: Martin K. Petersen commit 56cbb429d911991170fe867b4bba14f0efed5829 Author: Al Viro Date: Thu Jul 4 16:57:51 2019 -0400 switch the remnants of releasing the mountpoint away from fs_pin We used to need rather convoluted ordering trickery to guarantee that dput() of ex-mountpoints happens before the final mntput() of the same. Since we don't need that anymore, there's no point playing with fs_pin for that. Signed-off-by: Al Viro commit 2763d11912317a12318135ca03e592bb6df65624 Author: Al Viro Date: Sun Jun 30 19:18:53 2019 -0400 get rid of detach_mnt() Lift getting the original mount (dentry is actually not needed at all) of the mountpoint into the callers - to do_move_mount() and pivot_root() level. That simplifies the cleanup in those and allows to get saner arguments for attach_mnt_recursive(). Signed-off-by: Al Viro commit 8c2e408e73f735d2e6e8b43f9b038c9abb082939 Author: Pankaj Gupta Date: Fri Jul 12 10:46:10 2019 +0530 virtio_pmem: fix sparse warning This patch fixes below sparse warning related to __virtio type in virtio pmem driver. This is reported by Intel test bot on linux-next tree. nd_virtio.c:56:28: warning: incorrect type in assignment (different base types) nd_virtio.c:56:28: expected unsigned int [unsigned] [usertype] type nd_virtio.c:56:28: got restricted __virtio32 nd_virtio.c:93:59: warning: incorrect type in argument 2 (different base types) nd_virtio.c:93:59: expected restricted __virtio32 [usertype] val nd_virtio.c:93:59: got unsigned int [unsigned] [usertype] ret Reported-by: kbuild test robot Signed-off-by: Pankaj Gupta Acked-by: Michael S. Tsirkin Signed-off-by: Dan Williams commit 4edbe133f851c9e3a2f2a1db367e826b01e72594 Author: Al Viro Date: Sun Jun 30 10:39:08 2019 -0400 make struct mountpoint bear the dentry reference to mountpoint, not struct mount Using dput_to_list() to shift the contributing reference from ->mnt_mountpoint to ->mnt_mp->m_dentry. Dentries are dropped (with dput_to_list()) as soon as struct mountpoint is destroyed; in cases where we are under namespace_sem we use the global list, shrinking it in namespace_unlock(). In case of detaching stuck MNT_LOCKed children at final mntput_no_expire() we use a local list and shrink it ourselves. ->mnt_ex_mountpoint crap is gone. Signed-off-by: Al Viro commit f9b0530fa02e0c73f31a49ef743e8f44eb8e32cc Author: Ming Lei Date: Fri Jul 12 10:08:19 2019 +0800 scsi: core: Fix race on creating sense cache When scsi_init_sense_cache(host) is called concurrently from different hosts, each code path may find that no cache has been created and allocate a new one. The lack of locking can lead to potentially overriding a cache allocated by a different host. Fix the issue by moving 'mutex_lock(&scsi_sense_cache_mutex)' before scsi_select_sense_cache(). Fixes: 0a6ac4ee7c21 ("scsi: respect unchecked_isa_dma for blk-mq") Cc: Stable Cc: Christoph Hellwig Cc: Hannes Reinecke Cc: Ewan D. Milne Signed-off-by: Ming Lei Signed-off-by: Martin K. Petersen commit 0cdc58580b37a160fac4b884266b8b7cb096f539 Author: Damien Le Moal Date: Wed Jul 17 10:51:49 2019 +0900 scsi: sd_zbc: Fix compilation warning kbuild test robot gets the following compilation warning using gcc 7.4 cross compilation for c6x (GCC_VERSION=7.4.0 make.cross ARCH=c6x). In file included from include/asm-generic/bug.h:18:0, from arch/c6x/include/asm/bug.h:12, from include/linux/bug.h:5, from include/linux/thread_info.h:12, from include/asm-generic/current.h:5, from ./arch/c6x/include/generated/asm/current.h:1, from include/linux/sched.h:12, from include/linux/blkdev.h:5, from drivers//scsi/sd_zbc.c:11: drivers//scsi/sd_zbc.c: In function 'sd_zbc_read_zones': >> include/linux/kernel.h:62:48: warning: 'zone_blocks' may be used uninitialized in this function [-Wmaybe-uninitialized] #define __round_mask(x, y) ((__typeof__(x))((y)-1)) ^ drivers//scsi/sd_zbc.c:464:6: note: 'zone_blocks' was declared here u32 zone_blocks; ^~~~~~~~~~~ This is a false-positive report. The variable zone_blocks is always initialized in sd_zbc_check_zones() before use. It is not initialized only and only if sd_zbc_check_zones() fails. Avoid this warning by initializing the zone_blocks variable to 0. Fixes: 5f832a395859 ("scsi: sd_zbc: Fix sd_zbc_check_zones() error checks") Cc: Stable Signed-off-by: Damien Le Moal Signed-off-by: Martin K. Petersen commit 41a6bf6529edd10a6def42e3b2c34a7474bcc2f5 Author: Colin Ian King Date: Tue Jul 2 10:18:35 2019 +0100 scsi: libfc: fix null pointer dereference on a null lport Currently if lport is null then the null lport pointer is dereference when printing out debug via the FC_LPORT_DB macro. Fix this by using the more generic FC_LIBFC_DBG debug macro instead that does not use lport. Addresses-Coverity: ("Dereference after null check") Fixes: 7414705ea4ae ("libfc: Add runtime debugging with debug_logging module parameter") Signed-off-by: Colin Ian King Reviewed-by: Hannes Reinecke Signed-off-by: Martin K. Petersen commit 23c84eb7837514e16d79ed6d849b13745e0ce688 Author: Matthew Wilcox (Oracle) Date: Wed Jul 3 23:21:25 2019 -0400 dax: Fix missed wakeup with PMD faults RocksDB can hang indefinitely when using a DAX file. This is due to a bug in the XArray conversion when handling a PMD fault and finding a PTE entry. We use the wrong index in the hash and end up waiting on the wrong waitqueue. There's actually no need to wait; if we find a PTE entry while looking for a PMD entry, we can return immediately as we know we should fall back to a PTE fault (which may not conflict with the lock held). We reuse the XA_RETRY_ENTRY to signal a conflicting entry was found. This value can never be found in an XArray while holding its lock, so it does not create an ambiguity. Cc: Link: http://lkml.kernel.org/r/CAPcyv4hwHpX-MkUEqxwdTj7wCCZCN4RV-L4jsnuwLGyL_UEG4A@mail.gmail.com Fixes: b15cd800682f ("dax: Convert page fault handlers to XArray") Signed-off-by: Matthew Wilcox (Oracle) Tested-by: Dan Williams Reported-by: Robert Barror Reported-by: Seema Pandit Reviewed-by: Jan Kara Signed-off-by: Dan Williams commit 43e11fa2d1d3b6e35629fa556eb7d571edba2010 Author: Gustavo A. R. Silva Date: Tue Jul 16 16:30:58 2019 -0700 fs/select.c: use struct_size() in kmalloc() One of the more common cases of allocation size calculations is finding the size of a structure that has a zero-sized array at the end, along with memory for some number of elements for that array. For example: struct foo { int stuff; struct boo entry[]; }; size = sizeof(struct foo) + count * sizeof(struct boo); instance = kmalloc(size, GFP_KERNEL); Instead of leaving these open-coded and prone to type mistakes, we can now use the new struct_size() helper: instance = kmalloc(struct_size(instance, entry, count), GFP_KERNEL); Also, notice that variable size is unnecessary, hence it is removed. This code was detected with the help of Coccinelle. Link: http://lkml.kernel.org/r/20190604164226.GA13823@embeddedor Signed-off-by: Gustavo A. R. Silva Reviewed-by: Andrew Morton Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 79eb597cba06c435b72f220e9d426ae413fc2579 Author: Daniel Jordan Date: Tue Jul 16 16:30:54 2019 -0700 mm: add account_locked_vm utility function locked_vm accounting is done roughly the same way in five places, so unify them in a helper. Include the helper's caller in the debug print to distinguish between callsites. Error codes stay the same, so user-visible behavior does too. The one exception is that the -EPERM case in tce_account_locked_vm is removed because Alexey has never seen it triggered. [daniel.m.jordan@oracle.com: v3] Link: http://lkml.kernel.org/r/20190529205019.20927-1-daniel.m.jordan@oracle.com [sfr@canb.auug.org.au: fix mm/util.c] Link: http://lkml.kernel.org/r/20190524175045.26897-1-daniel.m.jordan@oracle.com Signed-off-by: Daniel Jordan Signed-off-by: Stephen Rothwell Tested-by: Alexey Kardashevskiy Acked-by: Alex Williamson Cc: Alan Tull Cc: Alex Williamson Cc: Benjamin Herrenschmidt Cc: Christoph Lameter Cc: Christophe Leroy Cc: Davidlohr Bueso Cc: Jason Gunthorpe Cc: Mark Rutland Cc: Michael Ellerman Cc: Moritz Fischer Cc: Paul Mackerras Cc: Steve Sistare Cc: Wu Hao Cc: Ira Weiny Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 73b20c84d42de14673a987816dd4d132c7b1f801 Author: Robin Murphy Date: Tue Jul 16 16:30:51 2019 -0700 arm64: mm: implement pte_devmap support In order for things like get_user_pages() to work on ZONE_DEVICE memory, we need a software PTE bit to identify device-backed PFNs. Hook this up along with the relevant helpers to join in with ARCH_HAS_PTE_DEVMAP. [robin.murphy@arm.com: build fixes] Link: http://lkml.kernel.org/r/13026c4e64abc17133bbfa07d7731ec6691c0bcd.1559050949.git.robin.murphy@arm.com Link: http://lkml.kernel.org/r/817d92886fc3b33bcbf6e105ee83a74babb3a5aa.1558547956.git.robin.murphy@arm.com Signed-off-by: Robin Murphy Acked-by: Will Deacon Cc: Anshuman Khandual Cc: Catalin Marinas Cc: Dan Williams Cc: David Hildenbrand Cc: Ira Weiny Cc: Jerome Glisse Cc: Michael Ellerman Cc: Michal Hocko Cc: Oliver O'Halloran Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 175967318c3018d01931ac950c82adab5deb47ca Author: Robin Murphy Date: Tue Jul 16 16:30:47 2019 -0700 mm: introduce ARCH_HAS_PTE_DEVMAP ARCH_HAS_ZONE_DEVICE is somewhat meaningless in itself, and combined with the long-out-of-date comment can lead to the impression than an architecture may just enable it (since __add_pages() now "comprehends device memory" for itself) and expect things to work. In practice, however, ZONE_DEVICE users have little chance of functioning correctly without __HAVE_ARCH_PTE_DEVMAP, so let's clean that up the same way as ARCH_HAS_PTE_SPECIAL and make it the proper dependency so the real situation is clearer. Link: http://lkml.kernel.org/r/87554aa78478a02a63f2c4cf60a847279ae3eb3b.1558547956.git.robin.murphy@arm.com Signed-off-by: Robin Murphy Acked-by: Dan Williams Reviewed-by: Ira Weiny Acked-by: Oliver O'Halloran Reviewed-by: Anshuman Khandual Cc: Michael Ellerman Cc: Catalin Marinas Cc: David Hildenbrand Cc: Jerome Glisse Cc: Michal Hocko Cc: Will Deacon Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 7588adf8dff12c4b358557a13796a25fef796548 Author: Robin Murphy Date: Tue Jul 16 16:30:44 2019 -0700 mm: clean up is_device_*_page() definitions Refactor is_device_{public,private}_page() with is_pci_p2pdma_page() to make them all consistent in depending on their respective config options even when CONFIG_DEV_PAGEMAP_OPS is enabled for other reasons. This allows a little more compile-time optimisation as well as the conceptual and cosmetic cleanup. Link: http://lkml.kernel.org/r/187c2ab27dea70635d375a61b2f2076d26c032b0.1558547956.git.robin.murphy@arm.com Signed-off-by: Robin Murphy Suggested-by: Jerome Glisse Reviewed-by: Anshuman Khandual Cc: Catalin Marinas Cc: Dan Williams Cc: David Hildenbrand Cc: Ira Weiny Cc: Michael Ellerman Cc: Michal Hocko Cc: Oliver O'Halloran Cc: Will Deacon Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 8aa3c927ec10d1230c3ace8357f624479665f701 Author: Aneesh Kumar K.V Date: Tue Jul 16 16:30:41 2019 -0700 mm/mmap: move common defines to mman-common.h Two architecture that use arch specific MMAP flags are powerpc and sparc. We still have few flag values common across them and other architectures. Consolidate this in mman-common.h. Also update the comment to indicate where to find HugeTLB specific reserved values Link: http://lkml.kernel.org/r/20190604090950.31417-1-aneesh.kumar@linux.ibm.com Signed-off-by: Aneesh Kumar K.V Reviewed-by: Andrew Morton Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 22fcea6f85f2cc74e61bd8b3640faa8467553c24 Author: Aneesh Kumar K.V Date: Tue Jul 16 16:30:38 2019 -0700 mm: move MAP_SYNC to asm-generic/mman-common.h This enables support for synchronous DAX fault on powerpc The generic changes are added as part of b6fb293f2497 ("mm: Define MAP_SYNC and VM_SYNC flags") Without this, mmap returns EOPNOTSUPP for MAP_SYNC with MAP_SHARED_VALIDATE Instead of adding MAP_SYNC with same value to arch/powerpc/include/uapi/asm/mman.h, I am moving the #define to asm-generic/mman-common.h. Two architectures using mman-common.h directly are sparc and powerpc. We should be able to consloidate more #defines to mman-common.h. That can be done as a separate patch. Link: http://lkml.kernel.org/r/20190528091120.13322-1-aneesh.kumar@linux.ibm.com Signed-off-by: Aneesh Kumar K.V Reviewed-by: Jan Kara Cc: Michael Ellerman Cc: Ross Zwisler Cc: Dan Williams Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 9f960da72b25054163cf555e622dcdc3b8ccc488 Author: Pavel Tatashin Date: Tue Jul 16 16:30:35 2019 -0700 device-dax: "Hotremove" persistent memory that is used like normal RAM It is now allowed to use persistent memory like a regular RAM, but currently there is no way to remove this memory until machine is rebooted. This work expands the functionality to also allows hotremoving previously hotplugged persistent memory, and recover the device for use for other purposes. To hotremove persistent memory, the management software must first offline all memory blocks of dax region, and than unbind it from device-dax/kmem driver. So, operations should look like this: echo offline > /sys/devices/system/memory/memoryN/state ... echo dax0.0 > /sys/bus/dax/drivers/kmem/unbind Note: if unbind is done without offlining memory beforehand, it won't be possible to do dax0.0 hotremove, and dax's memory is going to be part of System RAM until reboot. Link: http://lkml.kernel.org/r/20190517215438.6487-4-pasha.tatashin@soleen.com Signed-off-by: Pavel Tatashin Reviewed-by: David Hildenbrand Cc: James Morris Cc: Sasha Levin Cc: Michal Hocko Cc: Dave Hansen Cc: Dan Williams Cc: Keith Busch Cc: Vishal Verma Cc: Dave Jiang Cc: Ross Zwisler Cc: Tom Lendacky Cc: Huang Ying Cc: Fengguang Wu Cc: Borislav Petkov Cc: Bjorn Helgaas Cc: Yaowei Bai Cc: Takashi Iwai Cc: Jérôme Glisse Cc: Dave Hansen Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit eca499ab3749a4537dee77ffead47a1a2c0dee19 Author: Pavel Tatashin Date: Tue Jul 16 16:30:31 2019 -0700 mm/hotplug: make remove_memory() interface usable Presently the remove_memory() interface is inherently broken. It tries to remove memory but panics if some memory is not offline. The problem is that it is impossible to ensure that all memory blocks are offline as this function also takes lock_device_hotplug that is required to change memory state via sysfs. So, between calling this function and offlining all memory blocks there is always a window when lock_device_hotplug is released, and therefore, there is always a chance for a panic during this window. Make this interface to return an error if memory removal fails. This way it is safe to call this function without panicking machine, and also makes it symmetric to add_memory() which already returns an error. Link: http://lkml.kernel.org/r/20190517215438.6487-3-pasha.tatashin@soleen.com Signed-off-by: Pavel Tatashin Reviewed-by: David Hildenbrand Acked-by: Michal Hocko Cc: Bjorn Helgaas Cc: Borislav Petkov Cc: Dan Williams Cc: Dave Hansen Cc: Dave Hansen Cc: Dave Jiang Cc: Fengguang Wu Cc: Huang Ying Cc: James Morris Cc: Jérôme Glisse Cc: Keith Busch Cc: Ross Zwisler Cc: Sasha Levin Cc: Takashi Iwai Cc: Tom Lendacky Cc: Vishal Verma Cc: Yaowei Bai Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 31e4ca92a7dd4cdebd7fe1456b3b0b6ace9a816f Author: Pavel Tatashin Date: Tue Jul 16 16:30:27 2019 -0700 device-dax: fix memory and resource leak if hotplug fails Patch series ""Hotremove" persistent memory", v6. Recently, adding a persistent memory to be used like a regular RAM was added to Linux. This work extends this functionality to also allow hot removing persistent memory. We (Microsoft) have an important use case for this functionality. The requirement is for physical machines with small amount of RAM (~8G) to be able to reboot in a very short period of time (<1s). Yet, there is a userland state that is expensive to recreate (~2G). The solution is to boot machines with 2G preserved for persistent memory. Copy the state, and hotadd the persistent memory so machine still has all 8G available for runtime. Before reboot, offline and hotremove device-dax 2G, copy the memory that is needed to be preserved to pmem0 device, and reboot. The series of operations look like this: 1. After boot restore /dev/pmem0 to ramdisk to be consumed by apps. and free ramdisk. 2. Convert raw pmem0 to devdax ndctl create-namespace --mode devdax --map mem -e namespace0.0 -f 3. Hotadd to System RAM echo dax0.0 > /sys/bus/dax/drivers/device_dax/unbind echo dax0.0 > /sys/bus/dax/drivers/kmem/new_id echo online_movable > /sys/devices/system/memoryXXX/state 4. Before reboot hotremove device-dax memory from System RAM echo offline > /sys/devices/system/memoryXXX/state echo dax0.0 > /sys/bus/dax/drivers/kmem/unbind 5. Create raw pmem0 device ndctl create-namespace --mode raw -e namespace0.0 -f 6. Copy the state that was stored by apps to ramdisk to pmem device 7. Do kexec reboot or reboot through firmware if firmware does not zero memory in pmem0 region (These machines have only regular volatile memory). So to have pmem0 device either memmap kernel parameter is used, or devices nodes in dtb are specified. This patch (of 3): When add_memory() fails, the resource and the memory should be freed. Link: http://lkml.kernel.org/r/20190517215438.6487-2-pasha.tatashin@soleen.com Fixes: c221c0b0308f ("device-dax: "Hotplug" persistent memory for use like normal RAM") Signed-off-by: Pavel Tatashin Reviewed-by: Dave Hansen Cc: Bjorn Helgaas Cc: Borislav Petkov Cc: Dan Williams Cc: Dave Hansen Cc: Dave Jiang Cc: David Hildenbrand Cc: Fengguang Wu Cc: Huang Ying Cc: James Morris Cc: Jérôme Glisse Cc: Keith Busch Cc: Michal Hocko Cc: Ross Zwisler Cc: Sasha Levin Cc: Takashi Iwai Cc: Tom Lendacky Cc: Vishal Verma Cc: Yaowei Bai Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 97a0efea657e986322b09b99016b3f7d2ce37021 Author: Tom Levy Date: Tue Jul 16 16:30:24 2019 -0700 include/linux/lz4.h: fix spelling and copy-paste errors in documentation Fix a few spelling and grammar errors, and two places where fast/safe in the documentation did not match the function. Link: http://lkml.kernel.org/r/20190321014452.13297-1-tomlevy93@gmail.com Signed-off-by: Tom Levy Reviewed-by: Andrew Morton Cc: Jiri Kosina Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit a318f12ed8843cfac53198390c74a565c632f417 Author: Kees Cook Date: Tue Jul 16 16:30:21 2019 -0700 ipc/mqueue.c: only perform resource calculation if user valid Andreas Christoforou reported: UBSAN: Undefined behaviour in ipc/mqueue.c:414:49 signed integer overflow: 9 * 2305843009213693951 cannot be represented in type 'long int' ... Call Trace: mqueue_evict_inode+0x8e7/0xa10 ipc/mqueue.c:414 evict+0x472/0x8c0 fs/inode.c:558 iput_final fs/inode.c:1547 [inline] iput+0x51d/0x8c0 fs/inode.c:1573 mqueue_get_inode+0x8eb/0x1070 ipc/mqueue.c:320 mqueue_create_attr+0x198/0x440 ipc/mqueue.c:459 vfs_mkobj+0x39e/0x580 fs/namei.c:2892 prepare_open ipc/mqueue.c:731 [inline] do_mq_open+0x6da/0x8e0 ipc/mqueue.c:771 Which could be triggered by: struct mq_attr attr = { .mq_flags = 0, .mq_maxmsg = 9, .mq_msgsize = 0x1fffffffffffffff, .mq_curmsgs = 0, }; if (mq_open("/testing", 0x40, 3, &attr) == (mqd_t) -1) perror("mq_open"); mqueue_get_inode() was correctly rejecting the giant mq_msgsize, and preparing to return -EINVAL. During the cleanup, it calls mqueue_evict_inode() which performed resource usage tracking math for updating "user", before checking if there was a valid "user" at all (which would indicate that the calculations would be sane). Instead, delay this check to after seeing a valid "user". The overflow was real, but the results went unused, so while the flaw is harmless, it's noisy for kernel fuzzers, so just fix it by moving the calculation under the non-NULL "user" where it actually gets used. Link: http://lkml.kernel.org/r/201906072207.ECB65450@keescook Signed-off-by: Kees Cook Reported-by: Andreas Christoforou Acked-by: "Eric W. Biederman" Cc: Al Viro Cc: Arnd Bergmann Cc: Davidlohr Bueso Cc: Manfred Spraul Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 6b15f678fb7d5ef54e089e6ace72f007fe6e9895 Author: Drew Davenport Date: Tue Jul 16 16:30:18 2019 -0700 include/asm-generic/bug.h: fix "cut here" for WARN_ON for __WARN_TAINT architectures For architectures using __WARN_TAINT, the WARN_ON macro did not print out the "cut here" string. The other WARN_XXX macros would print "cut here" inside __warn_printk, which is not called for WARN_ON since it doesn't have a message to print. Link: http://lkml.kernel.org/r/20190624154831.163888-1-ddavenport@chromium.org Fixes: a7bed27af194 ("bug: fix "cut here" location for __WARN_TAINT architectures") Signed-off-by: Drew Davenport Acked-by: Kees Cook Tested-by: Kees Cook Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 778c1f5ccbd95722cf84d2233c6acbf4d01a3ec7 Author: Leonard Crestez Date: Tue Jul 16 16:30:15 2019 -0700 scripts/gdb: add helpers to find and list devices Add helper commands and functions for finding pointers to struct device by enumerating linux device bus/class infrastructure. This can be used to fetch subsystem and driver-specific structs: (gdb) p *$container_of($lx_device_find_by_class_name("net", "eth0"), "struct net_device", "dev") (gdb) p *$container_of($lx_device_find_by_bus_name("i2c", "0-004b"), "struct i2c_client", "dev") (gdb) p *(struct imx_port*)$lx_device_find_by_class_name("tty", "ttymxc1")->parent->driver_data Several generic "lx-device-list" functions are included to enumerate devices by bus and class: (gdb) lx-device-list-bus usb (gdb) lx-device-list-class (gdb) lx-device-list-tree &platform_bus Similar information is available in /sys but pointer values are deliberately hidden. Link: http://lkml.kernel.org/r/c948628041311cbf1b9b4cff3dda7d2073cb3eaa.1561492937.git.leonard.crestez@nxp.com Signed-off-by: Leonard Crestez Reviewed-by: Stephen Boyd Cc: Kieran Bingham Cc: Jan Kiszka Cc: "Rafael J. Wysocki" Cc: Greg Kroah-Hartman Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 8207d4a88e1ef4ab54f05f2f18edd444a5099099 Author: Leonard Crestez Date: Tue Jul 16 16:30:12 2019 -0700 scripts/gdb: add lx-genpd-summary command This is like /sys/kernel/debug/pm/pm_genpd_summary except it's accessible through a debugger. This can be useful if the target crashes or hangs because power domains were not properly enabled. Link: http://lkml.kernel.org/r/f9ee627a0d4f94b894aa202fee8a98444049bed8.1561492937.git.leonard.crestez@nxp.com Signed-off-by: Leonard Crestez Reviewed-by: Stephen Boyd Cc: Kieran Bingham Cc: Jan Kiszka Cc: "Rafael J. Wysocki" Cc: Greg Kroah-Hartman Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 5515e9a6273b8c02034466bcbd717ac9f53dab99 Author: Miroslav Lichvar Date: Tue Jul 16 16:30:09 2019 -0700 drivers/pps/pps.c: clear offset flags in PPS_SETPARAMS ioctl The PPS assert/clear offset corrections are set by the PPS_SETPARAMS ioctl in the pps_ktime structs, which also contain flags. The flags are not initialized by applications (using the timepps.h header) and they are not used by the kernel for anything except returning them back in the PPS_GETPARAMS ioctl. Set the flags to zero to make it clear they are unused and avoid leaking uninitialized data of the PPS_SETPARAMS caller to other applications that have a read access to the PPS device. Link: http://lkml.kernel.org/r/20190702092251.24303-1-mlichvar@redhat.com Signed-off-by: Miroslav Lichvar Reviewed-by: Thomas Gleixner Acked-by: Rodolfo Giometti Cc: Greg KH Cc: Dan Carpenter Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit f57e515a1b56325a28a0972c632a623a9c84590c Author: Joel Fernandes (Google) Date: Tue Jul 16 16:30:06 2019 -0700 kernel/pid.c: convert struct pid count to refcount_t struct pid's count is an atomic_t field used as a refcount. Use refcount_t for it which is basically atomic_t but does additional checking to prevent use-after-free bugs. For memory ordering, the only change is with the following: - if ((atomic_read(&pid->count) == 1) || - atomic_dec_and_test(&pid->count)) { + if (refcount_dec_and_test(&pid->count)) { kmem_cache_free(ns->pid_cachep, pid); Here the change is from: Fully ordered --> RELEASE + ACQUIRE (as per refcount-vs-atomic.rst) This ACQUIRE should take care of making sure the free happens after the refcount_dec_and_test(). The above hunk also removes atomic_read() since it is not needed for the code to work and it is unclear how beneficial it is. The removal lets refcount_dec_and_test() check for cases where get_pid() happened before the object was freed. Link: http://lkml.kernel.org/r/20190701183826.191936-1-joel@joelfernandes.org Signed-off-by: Joel Fernandes (Google) Reviewed-by: Andrea Parri Reviewed-by: Kees Cook Cc: Mathieu Desnoyers Cc: Matthew Wilcox Cc: Peter Zijlstra Cc: Will Deacon Cc: Paul E. McKenney Cc: Elena Reshetova Cc: Jann Horn Cc: Eric W. Biederman Cc: KJ Tsanaktsidis Cc: Michal Hocko Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 156e0b1a8112b76e351684ac948c59757037ac36 Author: Dan Carpenter Date: Tue Jul 16 16:30:03 2019 -0700 drivers/rapidio/devices/rio_mport_cdev.c: NUL terminate some strings The dev_info.name[] array has space for RIO_MAX_DEVNAME_SZ + 1 characters. But the problem here is that we don't ensure that the user put a NUL terminator on the end of the string. It could lead to an out of bounds read. Link: http://lkml.kernel.org/r/20190529110601.GB19119@mwanda Fixes: e8de370188d0 ("rapidio: add mport char device driver") Signed-off-by: Dan Carpenter Acked-by: Alexandre Bounine Cc: Ira Weiny Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit ac301020627e258a304f40cab5b35b6814a6f033 Author: Oleg Nesterov Date: Tue Jul 16 16:29:59 2019 -0700 select: shift restore_saved_sigmask_unless() into poll_select_copy_remaining() Now that restore_saved_sigmask_unless() is always called with the same argument right before poll_select_copy_remaining() we can move it into poll_select_copy_remaining() and make it the only caller of restore() in fs/select.c. The patch also renames poll_select_copy_remaining(), poll_select_finish() looks better after this change. kern_select() doesn't use set_user_sigmask(), so in this case poll_select_finish() does restore_saved_sigmask_unless() "for no reason". But this won't hurt, and WARN_ON(!TIF_SIGPENDING) is still valid. Link: http://lkml.kernel.org/r/20190606140915.GC13440@redhat.com Signed-off-by: Oleg Nesterov Cc: Al Viro Cc: Arnd Bergmann Cc: David Laight Cc: Davidlohr Bueso Cc: Deepa Dinamani Cc: Eric W. Biederman Cc: Eric Wong Cc: Jason Baron Cc: Jens Axboe Cc: Thomas Gleixner Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 8cf8b5539a414da3257db6d121bcee2d883135cb Author: Oleg Nesterov Date: Tue Jul 16 16:29:56 2019 -0700 select: change do_poll() to return -ERESTARTNOHAND rather than -EINTR do_poll() returns -EINTR if interrupted and after that all its callers have to translate it into -ERESTARTNOHAND. Change do_poll() to return -ERESTARTNOHAND and update (simplify) the callers. Note that this also unifies all users of restore_saved_sigmask_unless(), see the next patch. Linus: : The *right* return value will actually be then chosen by : poll_select_copy_remaining(), which will turn ERESTARTNOHAND to EINTR : when it can't update the timeout. : : Except for the cases that use restart_block and do that instead and : don't have the whole timeout restart issue as a result. Link: http://lkml.kernel.org/r/20190606140852.GB13440@redhat.com Signed-off-by: Oleg Nesterov Acked-by: Linus Torvalds Cc: Al Viro Cc: Arnd Bergmann Cc: David Laight Cc: Davidlohr Bueso Cc: Deepa Dinamani Cc: Eric W. Biederman Cc: Eric Wong Cc: Jason Baron Cc: Jens Axboe Cc: Thomas Gleixner Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit b772434be0891ed1081a08ae7cfd4666728f8e82 Author: Oleg Nesterov Date: Tue Jul 16 16:29:53 2019 -0700 signal: simplify set_user_sigmask/restore_user_sigmask task->saved_sigmask and ->restore_sigmask are only used in the ret-from- syscall paths. This means that set_user_sigmask() can save ->blocked in ->saved_sigmask and do set_restore_sigmask() to indicate that ->blocked was modified. This way the callers do not need 2 sigset_t's passed to set/restore and restore_user_sigmask() renamed to restore_saved_sigmask_unless() turns into the trivial helper which just calls restore_saved_sigmask(). Link: http://lkml.kernel.org/r/20190606113206.GA9464@redhat.com Signed-off-by: Oleg Nesterov Cc: Deepa Dinamani Cc: Arnd Bergmann Cc: Jens Axboe Cc: Davidlohr Bueso Cc: Eric Wong Cc: Jason Baron Cc: Thomas Gleixner Cc: Al Viro Cc: Eric W. Biederman Cc: David Laight Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit e2d9018e81ba9357d3bb8bddc0ee58d460d092fe Author: Alexey Dobriyan Date: Tue Jul 16 16:29:50 2019 -0700 signal: reorder struct sighand_struct struct sighand_struct::siglock field is the most used field by far, put it first so that is can be accessed without IMM8 or IMM32 encoding on x86_64. Space savings (on trimmed down VM test config): add/remove: 0/0 grow/shrink: 8/68 up/down: 49/-1147 (-1098) Function old new delta complete_signal 512 533 +21 do_signalfd4 335 346 +11 __cleanup_sighand 39 43 +4 unhandled_signal 49 52 +3 prepare_signal 692 695 +3 ignore_signals 37 40 +3 __tty_check_change.part 248 251 +3 ksys_unshare 780 781 +1 sighand_ctor 33 29 -4 ptrace_trap_notify 60 56 -4 sigqueue_free 98 91 -7 run_posix_cpu_timers 1389 1382 -7 proc_pid_status 2448 2441 -7 proc_pid_limits 344 337 -7 posix_cpu_timer_rearm 222 215 -7 posix_cpu_timer_get 249 242 -7 kill_pid_info_as_cred 243 236 -7 freeze_task 197 190 -7 flush_old_exec 1873 1866 -7 do_task_stat 3363 3356 -7 do_send_sig_info 98 91 -7 do_group_exit 147 140 -7 init_sighand 2088 2080 -8 do_notify_parent_cldstop 399 391 -8 signalfd_cleanup 50 41 -9 do_notify_parent 557 545 -12 __send_signal 1029 1017 -12 ptrace_stop 590 577 -13 get_signal 1576 1563 -13 __lock_task_sighand 112 99 -13 zap_pid_ns_processes 391 377 -14 update_rlimit_cpu 78 64 -14 tty_signal_session_leader 413 399 -14 tty_open_proc_set_tty 149 135 -14 tty_jobctrl_ioctl 936 922 -14 set_cpu_itimer 339 325 -14 ptrace_resume 226 212 -14 ptrace_notify 110 96 -14 proc_clear_tty 81 67 -14 posix_cpu_timer_del 229 215 -14 kernel_sigaction 156 142 -14 getrusage 977 963 -14 get_current_tty 98 84 -14 force_sigsegv 89 75 -14 force_sig_info 205 191 -14 flush_signals 83 69 -14 flush_itimer_signals 85 71 -14 do_timer_create 1120 1106 -14 do_sigpending 88 74 -14 do_signal_stop 537 523 -14 cgroup_init_fs_context 644 630 -14 call_usermodehelper_exec_async 402 388 -14 calculate_sigpending 58 44 -14 __x64_sys_timer_delete 248 234 -14 __set_current_blocked 80 66 -14 __ptrace_unlink 310 296 -14 __ptrace_detach.part 187 173 -14 send_sigqueue 362 347 -15 get_cpu_itimer 214 199 -15 signalfd_poll 175 159 -16 dequeue_signal 340 323 -17 do_getitimer 192 174 -18 release_task.part 1060 1040 -20 ptrace_peek_siginfo 408 387 -21 posix_cpu_timer_set 827 806 -21 exit_signals 437 416 -21 do_sigaction 541 520 -21 do_setitimer 485 464 -21 disassociate_ctty.part 545 517 -28 __x64_sys_rt_sigtimedwait 721 679 -42 __x64_sys_ptrace 1319 1277 -42 ptrace_request 1828 1782 -46 signalfd_read 507 459 -48 wait_consider_task 2027 1971 -56 do_coredump 3672 3616 -56 copy_process.part 6936 6871 -65 Link: http://lkml.kernel.org/r/20190503192800.GA18004@avx2 Signed-off-by: Alexey Dobriyan Cc: Michal Hocko Cc: Oleg Nesterov Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit ac76de555d76b8cc7f8ef231692a3ad9cbd0ce63 Author: Dmitry V. Levin Date: Tue Jul 16 16:29:46 2019 -0700 selftests/ptrace: add a test case for PTRACE_GET_SYSCALL_INFO Check whether PTRACE_GET_SYSCALL_INFO semantics implemented in the kernel matches userspace expectations. [akpm@linux-foundation.org: coding-style fixes] Link: http://lkml.kernel.org/r/20190510152852.GG28558@altlinux.org Signed-off-by: Dmitry V. Levin Acked-by: Shuah Khan Cc: Oleg Nesterov Cc: Andy Lutomirski Cc: Elvira Khabirova Cc: Eugene Syromyatnikov Cc: Benjamin Herrenschmidt Cc: Greentime Hu Cc: Helge Deller [parisc] Cc: James E.J. Bottomley Cc: James Hogan Cc: kbuild test robot Cc: Kees Cook Cc: Michael Ellerman Cc: Paul Burton Cc: Paul Mackerras Cc: Ralf Baechle Cc: Richard Kuo Cc: Vincent Chen Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 201766a20e30f982ccfe36bebfad9602c3ff574a Author: Elvira Khabirova Date: Tue Jul 16 16:29:42 2019 -0700 ptrace: add PTRACE_GET_SYSCALL_INFO request PTRACE_GET_SYSCALL_INFO is a generic ptrace API that lets ptracer obtain details of the syscall the tracee is blocked in. There are two reasons for a special syscall-related ptrace request. Firstly, with the current ptrace API there are cases when ptracer cannot retrieve necessary information about syscalls. Some examples include: * The notorious int-0x80-from-64-bit-task issue. See [1] for details. In short, if a 64-bit task performs a syscall through int 0x80, its tracer has no reliable means to find out that the syscall was, in fact, a compat syscall, and misidentifies it. * Syscall-enter-stop and syscall-exit-stop look the same for the tracer. Common practice is to keep track of the sequence of ptrace-stops in order not to mix the two syscall-stops up. But it is not as simple as it looks; for example, strace had a (just recently fixed) long-standing bug where attaching strace to a tracee that is performing the execve system call led to the tracer identifying the following syscall-exit-stop as syscall-enter-stop, which messed up all the state tracking. * Since the introduction of commit 84d77d3f06e7 ("ptrace: Don't allow accessing an undumpable mm"), both PTRACE_PEEKDATA and process_vm_readv become unavailable when the process dumpable flag is cleared. On such architectures as ia64 this results in all syscall arguments being unavailable for the tracer. Secondly, ptracers also have to support a lot of arch-specific code for obtaining information about the tracee. For some architectures, this requires a ptrace(PTRACE_PEEKUSER, ...) invocation for every syscall argument and return value. ptrace(2) man page: long ptrace(enum __ptrace_request request, pid_t pid, void *addr, void *data); ... PTRACE_GET_SYSCALL_INFO Retrieve information about the syscall that caused the stop. The information is placed into the buffer pointed by "data" argument, which should be a pointer to a buffer of type "struct ptrace_syscall_info". The "addr" argument contains the size of the buffer pointed to by "data" argument (i.e., sizeof(struct ptrace_syscall_info)). The return value contains the number of bytes available to be written by the kernel. If the size of data to be written by the kernel exceeds the size specified by "addr" argument, the output is truncated. [ldv@altlinux.org: selftests/seccomp/seccomp_bpf: update for PTRACE_GET_SYSCALL_INFO] Link: http://lkml.kernel.org/r/20190708182904.GA12332@altlinux.org Link: http://lkml.kernel.org/r/20190510152842.GF28558@altlinux.org Signed-off-by: Elvira Khabirova Co-developed-by: Dmitry V. Levin Signed-off-by: Dmitry V. Levin Reviewed-by: Oleg Nesterov Reviewed-by: Kees Cook Reviewed-by: Andy Lutomirski Cc: Eugene Syromyatnikov Cc: Benjamin Herrenschmidt Cc: Greentime Hu Cc: Helge Deller [parisc] Cc: James E.J. Bottomley Cc: James Hogan Cc: kbuild test robot Cc: Michael Ellerman Cc: Paul Burton Cc: Paul Mackerras Cc: Ralf Baechle Cc: Richard Kuo Cc: Shuah Khan Cc: Vincent Chen Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit f296f1df6e0e5b17654709c05b1821a1b58d329f Author: Dmitry V. Levin Date: Tue Jul 16 16:29:39 2019 -0700 powerpc: define syscall_get_error() syscall_get_error() is required to be implemented on this architecture in addition to already implemented syscall_get_nr(), syscall_get_arguments(), syscall_get_return_value(), and syscall_get_arch() functions in order to extend the generic ptrace API with PTRACE_GET_SYSCALL_INFO request. Link: http://lkml.kernel.org/r/20190510152824.GE28558@altlinux.org Signed-off-by: Dmitry V. Levin Acked-by: Michael Ellerman Cc: Elvira Khabirova Cc: Eugene Syromyatnikov Cc: Benjamin Herrenschmidt Cc: Paul Mackerras Cc: Oleg Nesterov Cc: Andy Lutomirski Cc: Greentime Hu Cc: Helge Deller [parisc] Cc: James E.J. Bottomley Cc: James Hogan Cc: kbuild test robot Cc: Kees Cook Cc: Paul Burton Cc: Ralf Baechle Cc: Richard Kuo Cc: Shuah Khan Cc: Vincent Chen Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 2938c1f8faa0b3b95581eba9738cd24f7b791c80 Author: Dmitry V. Levin Date: Tue Jul 16 16:29:35 2019 -0700 parisc: define syscall_get_error() syscall_get_error() is required to be implemented on all architectures in addition to already implemented syscall_get_nr(), syscall_get_arguments(), syscall_get_return_value(), and syscall_get_arch() functions in order to extend the generic ptrace API with PTRACE_GET_SYSCALL_INFO request. Link: http://lkml.kernel.org/r/20190510152812.GD28558@altlinux.org Signed-off-by: Dmitry V. Levin Acked-by: Helge Deller [parisc] Cc: James E.J. Bottomley Cc: Elvira Khabirova Cc: Eugene Syromyatnikov Cc: Oleg Nesterov Cc: Andy Lutomirski Cc: Benjamin Herrenschmidt Cc: Greentime Hu Cc: James Hogan Cc: kbuild test robot Cc: Kees Cook Cc: Michael Ellerman Cc: Paul Burton Cc: Paul Mackerras Cc: Ralf Baechle Cc: Richard Kuo Cc: Shuah Khan Cc: Vincent Chen Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit ba849160a0fa634eaad34183632f84ac82506f14 Author: Dmitry V. Levin Date: Tue Jul 16 16:29:32 2019 -0700 mips: define syscall_get_error() syscall_get_error() is required to be implemented on all architectures in addition to already implemented syscall_get_nr(), syscall_get_arguments(), syscall_get_return_value(), and syscall_get_arch() functions in order to extend the generic ptrace API with PTRACE_GET_SYSCALL_INFO request. Link: http://lkml.kernel.org/r/20190510152803.GC28558@altlinux.org Signed-off-by: Dmitry V. Levin Acked-by: Paul Burton Cc: Elvira Khabirova Cc: Eugene Syromyatnikov Cc: Ralf Baechle Cc: James Hogan Cc: Oleg Nesterov Cc: Andy Lutomirski Cc: Benjamin Herrenschmidt Cc: Greentime Hu Cc: Helge Deller [parisc] Cc: James E.J. Bottomley Cc: kbuild test robot Cc: Kees Cook Cc: Michael Ellerman Cc: Paul Mackerras Cc: Richard Kuo Cc: Shuah Khan Cc: Vincent Chen Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 6c132dd6d4020ab37a842be93125d3f96432d01d Author: Dmitry V. Levin Date: Tue Jul 16 16:29:28 2019 -0700 hexagon: define syscall_get_error() and syscall_get_return_value() syscall_get_* functions are required to be implemented on all architectures in order to extend the generic ptrace API with PTRACE_GET_SYSCALL_INFO request. This adds remaining 2 syscall_get_* functions as documented in asm-generic/syscall.h: syscall_get_error and syscall_get_return_value. Link: http://lkml.kernel.org/r/20190510152756.GB28558@altlinux.org Signed-off-by: Dmitry V. Levin Cc: Richard Kuo Cc: Elvira Khabirova Cc: Eugene Syromyatnikov Cc: Oleg Nesterov Cc: Andy Lutomirski Cc: Benjamin Herrenschmidt Cc: Greentime Hu Cc: Helge Deller [parisc] Cc: James E.J. Bottomley Cc: James Hogan Cc: kbuild test robot Cc: Kees Cook Cc: Michael Ellerman Cc: Paul Burton Cc: Paul Mackerras Cc: Ralf Baechle Cc: Shuah Khan Cc: Vincent Chen Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 33644b95eb342201511fc951d8fcd10362bd435b Author: Dmitry V. Levin Date: Tue Jul 16 16:29:24 2019 -0700 nds32: fix asm/syscall.h PTRACE_GET_SYSCALL_INFO is a generic ptrace API that lets ptracer obtain details of the syscall the tracee is blocked in. There are two reasons for a special syscall-related ptrace request. Firstly, with the current ptrace API there are cases when ptracer cannot retrieve necessary information about syscalls. Some examples include: * The notorious int-0x80-from-64-bit-task issue. See [1] for details. In short, if a 64-bit task performs a syscall through int 0x80, its tracer has no reliable means to find out that the syscall was, in fact, a compat syscall, and misidentifies it. * Syscall-enter-stop and syscall-exit-stop look the same for the tracer. Common practice is to keep track of the sequence of ptrace-stops in order not to mix the two syscall-stops up. But it is not as simple as it looks; for example, strace had a (just recently fixed) long-standing bug where attaching strace to a tracee that is performing the execve system call led to the tracer identifying the following syscall-exit-stop as syscall-enter-stop, which messed up all the state tracking. * Since the introduction of commit 84d77d3f06e7 ("ptrace: Don't allow accessing an undumpable mm"), both PTRACE_PEEKDATA and process_vm_readv become unavailable when the process dumpable flag is cleared. On such architectures as ia64 this results in all syscall arguments being unavailable for the tracer. Secondly, ptracers also have to support a lot of arch-specific code for obtaining information about the tracee. For some architectures, this requires a ptrace(PTRACE_PEEKUSER, ...) invocation for every syscall argument and return value. PTRACE_GET_SYSCALL_INFO returns the following structure: struct ptrace_syscall_info { __u8 op; /* PTRACE_SYSCALL_INFO_* */ __u32 arch __attribute__((__aligned__(sizeof(__u32)))); __u64 instruction_pointer; __u64 stack_pointer; union { struct { __u64 nr; __u64 args[6]; } entry; struct { __s64 rval; __u8 is_error; } exit; struct { __u64 nr; __u64 args[6]; __u32 ret_data; } seccomp; }; }; The structure was chosen according to [2], except for the following changes: * seccomp substructure was added as a superset of entry substructure * the type of nr field was changed from int to __u64 because syscall numbers are, as a practical matter, 64 bits * stack_pointer field was added along with instruction_pointer field since it is readily available and can save the tracer from extra PTRACE_GETREGS/PTRACE_GETREGSET calls * arch is always initialized to aid with tracing system calls such as execve() * instruction_pointer and stack_pointer are always initialized so they could be easily obtained for non-syscall stops * a boolean is_error field was added along with rval field, this way the tracer can more reliably distinguish a return value from an error value strace has been ported to PTRACE_GET_SYSCALL_INFO. Starting with release 4.26, strace uses PTRACE_GET_SYSCALL_INFO API as the preferred mechanism of obtaining syscall information. [1] https://lore.kernel.org/lkml/CA+55aFzcSVmdDj9Lh_gdbz1OzHyEm6ZrGPBDAJnywm2LF_eVyg@mail.gmail.com/ [2] https://lore.kernel.org/lkml/CAObL_7GM0n80N7J_DFw_eQyfLyzq+sf4y2AvsCCV88Tb3AwEHA@mail.gmail.com/ This patch (of 7): All syscall_get_*() and syscall_set_*() functions must be defined as static inline as on all other architectures, otherwise asm/syscall.h cannot be included in more than one compilation unit. This bug has to be fixed in order to extend the generic ptrace API with PTRACE_GET_SYSCALL_INFO request. Link: http://lkml.kernel.org/r/20190510152749.GA28558@altlinux.org Fixes: 1932fbe36e02 ("nds32: System calls handling") Signed-off-by: Dmitry V. Levin Reported-by: kbuild test robot Acked-by: Greentime Hu Cc: Vincent Chen Cc: Elvira Khabirova Cc: Eugene Syromyatnikov Cc: Oleg Nesterov Cc: Andy Lutomirski Cc: Benjamin Herrenschmidt Cc: Helge Deller [parisc] Cc: James E.J. Bottomley Cc: James Hogan Cc: Kees Cook Cc: Michael Ellerman Cc: Paul Burton Cc: Paul Mackerras Cc: Ralf Baechle Cc: Richard Kuo Cc: Shuah Khan Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit dc0dde61f17d4e83776e7c5d8b81787436447346 Author: Hariprasad Kelam Date: Tue Jul 16 16:29:21 2019 -0700 fs/reiserfs/journal.c: change return type of dirty_one_transaction Change return type of dirty_one_transaction from int to void. As this function always return success. Fixes below issue reported by coccicheck: fs/reiserfs/journal.c:1690:5-8: Unneeded variable: "ret". Return "0" on line 1719 Link: http://lkml.kernel.org/r/20190702175430.GA5882@hari-Inspiron-1545 Signed-off-by: Hariprasad Kelam Reviewed-by: Jan Kara Cc: Arnd Bergmann Cc: Bharath Vedartham Cc: Hariprasad Kelam Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit ba542f20f97e7cee83c50b52ff7418c3ec599796 Author: YueHaibing Date: Tue Jul 16 16:29:18 2019 -0700 fs/ufs/super.c: remove set but not used variable 'usb3' Fixes gcc '-Wunused-but-set-variable' warning: fs/ufs/super.c: In function ufs_statfs: fs/ufs/super.c:1409:32: warning: variable usb3 set but not used [-Wunused-but-set-variable] It is not used since commmit c596961d1b4c ("ufs: fix s_size/s_dsize users") Link: http://lkml.kernel.org/r/20190525140654.15924-1-yuehaibing@huawei.com Signed-off-by: YueHaibing Cc: Evgeniy Dushistov Cc: Al Viro Cc: Arnd Bergmann Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 29774f3f4e5af8f01dc5410e807b32ac6b765106 Author: Mathieu Malaterre Date: Tue Jul 16 16:29:15 2019 -0700 fs/hfsplus/xattr.c: replace strncpy with memcpy strncpy() was used to copy a fixed size buffer. Since NUL-terminating string is not required here, prefer a memcpy function. The generated code (ppc32) remains the same. Silence the following warning triggered using W=1: fs/hfsplus/xattr.c:410:3: warning: 'strncpy' output truncated before terminating nul copying 4 bytes from a string of the same length [-Wstringop-truncation] Link: http://lkml.kernel.org/r/20190529113341.11972-1-malat@debian.org Signed-off-by: Mathieu Malaterre Reviewed-by: Vyacheslav Dubeyko Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit a9fba24c6ac9b66c09dfc2a0e845ecace187e89c Author: Pedro Cuadra Date: Tue Jul 16 16:29:13 2019 -0700 coda: add hinting support for partial file caching This adds support for partial file caching in Coda. Every read, write and mmap informs the userspace cache manager about what part of a file is about to be accessed so that the cache manager can ensure the relevant parts are available before the operation is allowed to proceed. When a read or write operation completes, this is also reported to allow the cache manager to track when partially cached content can be released. If the cache manager does not support partial file caching, or when the entire file has been fetched into the local cache, the cache manager may return an EOPNOTSUPP error to indicate that intent upcalls are no longer necessary until the file is closed. [akpm@linux-foundation.org: little whitespace fixup] Link: http://lkml.kernel.org/r/20190618181301.6960-1-jaharkes@cs.cmu.edu Signed-off-by: Pedro Cuadra Signed-off-by: Jan Harkes Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 5bb44810f47a00b608ed2cb9f892ae7ce37b02bd Author: Fabian Frederick Date: Tue Jul 16 16:29:09 2019 -0700 coda: ftoc validity check integration This patch moves cfi check in coda_ftoc() instead of repeating it in the wild. Module size text data bss dec hex filename 28297 1040 700 30037 7555 fs/coda/coda.ko.before 28263 980 700 29943 74f7 fs/coda/coda.ko.after Link: http://lkml.kernel.org/r/a2c27663ec4547018c92d71c63b1dff4650b6546.1558117389.git.jaharkes@cs.cmu.edu Signed-off-by: Fabian Frederick Signed-off-by: Jan Harkes Cc: Arnd Bergmann Cc: Colin Ian King Cc: Dan Carpenter Cc: David Howells Cc: Mikko Rapeli Cc: Sam Protsenko Cc: Yann Droneaud Cc: Zhouyang Jia Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 7f6118ce95d2673f8c936dd47d9bbeb60f4d16ad Author: Fabian Frederick Date: Tue Jul 16 16:29:06 2019 -0700 coda: remove sb test in coda_fid_to_inode() coda_fid_to_inode() is only called by coda_downcall() where sb is already being tested. Link: http://lkml.kernel.org/r/d2163b3136348faf83ba47dc2d65a5d0a9a135dd.1558117389.git.jaharkes@cs.cmu.edu Signed-off-by: Fabian Frederick Signed-off-by: Jan Harkes Cc: Arnd Bergmann Cc: Colin Ian King Cc: Dan Carpenter Cc: David Howells Cc: Mikko Rapeli Cc: Sam Protsenko Cc: Yann Droneaud Cc: Zhouyang Jia Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 6975259ae30e05068e87ab35dfc4caefb47cffe2 Author: Fabian Frederick Date: Tue Jul 16 16:29:03 2019 -0700 coda: remove sysctl object from module when unused Inspired by NFS sysctl process Link: http://lkml.kernel.org/r/9afcc2cd09490849b309786bbf47fef75de7f91c.1558117389.git.jaharkes@cs.cmu.edu Signed-off-by: Fabian Frederick Signed-off-by: Jan Harkes Cc: Arnd Bergmann Cc: Colin Ian King Cc: Dan Carpenter Cc: David Howells Cc: Mikko Rapeli Cc: Sam Protsenko Cc: Yann Droneaud Cc: Zhouyang Jia Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit f94845284abedf80b8d9ab37eafe0d8f737543e8 Author: Fabian Frederick Date: Tue Jul 16 16:29:00 2019 -0700 coda: add __init to init_coda_psdev() init_coda_psdev() was only called by __init function. Link: http://lkml.kernel.org/r/a12a5a135fa6b0ea997e1a0af4be0a235c463a24.1558117389.git.jaharkes@cs.cmu.edu Signed-off-by: Fabian Frederick Signed-off-by: Jan Harkes Cc: Arnd Bergmann Cc: Colin Ian King Cc: Dan Carpenter Cc: David Howells Cc: Mikko Rapeli Cc: Sam Protsenko Cc: Yann Droneaud Cc: Zhouyang Jia Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 50e9a6efb0fa6ee54b2b8a311a75fc6ae2d6a0ec Author: Fabian Frederick Date: Tue Jul 16 16:28:57 2019 -0700 coda: use SIZE() for stat max_t expression was already defined in coda sources Link: http://lkml.kernel.org/r/e6cda497ce8691db155cb35f8d13ea44ca6cedeb.1558117389.git.jaharkes@cs.cmu.edu Signed-off-by: Fabian Frederick Signed-off-by: Jan Harkes Cc: Arnd Bergmann Cc: Colin Ian King Cc: Dan Carpenter Cc: David Howells Cc: Mikko Rapeli Cc: Sam Protsenko Cc: Yann Droneaud Cc: Zhouyang Jia Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 79a0d65e77ed5e9081492848a1b936d19cdfbb0f Author: Fabian Frederick Date: Tue Jul 16 16:28:54 2019 -0700 coda: destroy mutex in put_super() We can safely destroy vc_mutex at the end of umount process. Link: http://lkml.kernel.org/r/f436f68908c467c5663bc6a9251b52cd7b95d2a5.1558117389.git.jaharkes@cs.cmu.edu Signed-off-by: Fabian Frederick Signed-off-by: Jan Harkes Cc: Arnd Bergmann Cc: Colin Ian King Cc: Dan Carpenter Cc: David Howells Cc: Mikko Rapeli Cc: Sam Protsenko Cc: Yann Droneaud Cc: Zhouyang Jia Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 6dc280ebeed2c96a2fb933103dafe655a922b9c1 Author: Jan Harkes Date: Tue Jul 16 16:28:51 2019 -0700 coda: remove uapi/linux/coda_psdev.h Nothing is left in this header that is used by userspace. Link: http://lkml.kernel.org/r/bb11378cef94739f2cf89425dd6d302a52c64480.1558117389.git.jaharkes@cs.cmu.edu Signed-off-by: Jan Harkes Cc: Arnd Bergmann Cc: Colin Ian King Cc: Dan Carpenter Cc: David Howells Cc: Fabian Frederick Cc: Mikko Rapeli Cc: Sam Protsenko Cc: Yann Droneaud Cc: Zhouyang Jia Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 8fc8b9df831387e0d02c1d0f5bb53d327e0d477a Author: David Howells Date: Tue Jul 16 16:28:47 2019 -0700 coda: move internal defs out of include/linux/ [ver #2] Move include/linux/coda_psdev.h to fs/coda/ as there's nothing else that uses it. Link: http://lkml.kernel.org/r/3ceeee0415a929b89fb02700b6b4b3a07938acb8.1558117389.git.jaharkes@cs.cmu.edu Link: https://patchwork.kernel.org/patch/10590257/ Signed-off-by: David Howells Signed-off-by: Jan Harkes Cc: Yann Droneaud Cc: Jan Harkes Cc: Arnd Bergmann Cc: Colin Ian King Cc: Dan Carpenter Cc: Fabian Frederick Cc: Mikko Rapeli Cc: Sam Protsenko Cc: Zhouyang Jia Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit b6a18c60080fcff0921e81991fec049394fb04e9 Author: Jan Harkes Date: Tue Jul 16 16:28:44 2019 -0700 coda: bump module version The out of tree module version had been bumped several times already, but we haven't kept this in-tree one in sync, partly because most changes go from here to the out-of-tree copy. Link: http://lkml.kernel.org/r/8b0ab50a2da2f0180ac32c79d91811b4d1d0bd8b.1558117389.git.jaharkes@cs.cmu.edu Signed-off-by: Jan Harkes Cc: Arnd Bergmann Cc: Colin Ian King Cc: Dan Carpenter Cc: David Howells Cc: Fabian Frederick Cc: Mikko Rapeli Cc: Sam Protsenko Cc: Yann Droneaud Cc: Zhouyang Jia Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 936dae4525322fb46f6f7bb407c5663c83e5d353 Author: Dan Carpenter Date: Tue Jul 16 16:28:41 2019 -0700 coda: get rid of CODA_FREE() The CODA_FREE() macro just calls kvfree(). We can call that directly instead. Link: http://lkml.kernel.org/r/4950a94fd30ec5f84835dd4ca0bb67c0448672f5.1558117389.git.jaharkes@cs.cmu.edu Signed-off-by: Dan Carpenter Signed-off-by: Jan Harkes Cc: Arnd Bergmann Cc: Colin Ian King Cc: David Howells Cc: Fabian Frederick Cc: Mikko Rapeli Cc: Sam Protsenko Cc: Yann Droneaud Cc: Zhouyang Jia Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 4dc48193d748f0f0fbe37105a905466ff3a6ad50 Author: Dan Carpenter Date: Tue Jul 16 16:28:38 2019 -0700 coda: get rid of CODA_ALLOC() These days we have kvzalloc() so we can delete CODA_ALLOC(). I made a couple related changes in coda_psdev_write(). First, I added some error handling to avoid a NULL dereference if the allocation failed. Second, I used kvmalloc() instead of kvzalloc() because we copy over the memory on the next line so there is no need to zero it first. Link: http://lkml.kernel.org/r/e56010c822e7a7cbaa8a238cf82ad31c67eaa800.1558117389.git.jaharkes@cs.cmu.edu Signed-off-by: Dan Carpenter Signed-off-by: Jan Harkes Cc: Arnd Bergmann Cc: Colin Ian King Cc: David Howells Cc: Fabian Frederick Cc: Mikko Rapeli Cc: Sam Protsenko Cc: Yann Droneaud Cc: Zhouyang Jia Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 5e7c31dfe74703f428220384b2863525957cc160 Author: Jan Harkes Date: Tue Jul 16 16:28:35 2019 -0700 coda: change Coda's user api to use 64-bit time_t in timespec Move the 32-bit time_t problems to userspace. Link: http://lkml.kernel.org/r/8d089068823bfb292a4020f773922fbd82ffad39.1558117389.git.jaharkes@cs.cmu.edu Signed-off-by: Jan Harkes Cc: Arnd Bergmann Cc: Colin Ian King Cc: Dan Carpenter Cc: David Howells Cc: Fabian Frederick Cc: Mikko Rapeli Cc: Sam Protsenko Cc: Yann Droneaud Cc: Zhouyang Jia Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 6ced9aa7b56baeb241a715df4539e60d5e3118e2 Author: Arnd Bergmann Date: Tue Jul 16 16:28:32 2019 -0700 coda: stop using 'struct timespec' in user API We exchange file timestamps with user space using psdev device read/write operations with a fixed but architecture specific binary layout. On 32-bit systems, this uses a 'timespec' structure that is defined by the C library to contain two 32-bit values for seconds and nanoseconds. As we get ready for the year 2038 overflow of the 32-bit signed seconds, the kernel now uses 64-bit timestamps internally, and user space will do the same change by changing the 'timespec' definition in the future. Unfortunately, this breaks the layout of the coda_vattr structure, so we need to redefine that in terms of something that does not change. I'm introducing a new 'struct vtimespec' structure here that keeps the existing layout, and the same change has to be done in the coda user space copy of linux/coda.h before anyone can use that on a 32-bit architecture with 64-bit time_t. An open question is what should happen to actual times past y2038, as they are now truncated to the last valid date when sent to user space, and interpreted as pre-1970 times when a timestamp with the MSB set is read back into the kernel. Alternatively, we could change the new timespec64_to_coda()/coda_to_timespec64() functions to use a different interpretation and extend the available range further to the future by disallowing past timestamps. This would require more changes in the user space side though. Link: http://lkml.kernel.org/r/562b7324149461743e4fbe2fedbf7c242f7e274a.1558117389.git.jaharkes@cs.cmu.edu Link: https://patchwork.kernel.org/patch/10474735/ Signed-off-by: Arnd Bergmann Signed-off-by: Jan Harkes Acked-by: Jan Harkes Cc: Colin Ian King Cc: Dan Carpenter Cc: David Howells Cc: Fabian Frederick Cc: Mikko Rapeli Cc: Sam Protsenko Cc: Yann Droneaud Cc: Zhouyang Jia Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 850622136ff2a1296b2c8aa5280a74a6a3aabe4e Author: Colin Ian King Date: Tue Jul 16 16:28:29 2019 -0700 coda: clean up indentation, replace spaces with tab Trivial fix to clean up indentation, replace spaces with tab Link: http://lkml.kernel.org/r/ffc2bfa5a37ffcdf891c51b2e2ed618103965b24.1558117389.git.jaharkes@cs.cmu.edu Signed-off-by: Colin Ian King Signed-off-by: Jan Harkes Cc: Arnd Bergmann Cc: Dan Carpenter Cc: David Howells Cc: Fabian Frederick Cc: Mikko Rapeli Cc: Sam Protsenko Cc: Yann Droneaud Cc: Zhouyang Jia Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 2fe7491d219428a32f09948e88bfaf8e71b9a66b Author: Jan Harkes Date: Tue Jul 16 16:28:26 2019 -0700 uapi linux/coda_psdev.h: move CODA_REQ_ from uapi to kernel side headers These constants only used internally and not exposed to userspace. Link: http://lkml.kernel.org/r/baeafc30dad70d8b422ee679420099c2d8aa7da0.1558117389.git.jaharkes@cs.cmu.edu Signed-off-by: Jan Harkes Cc: Arnd Bergmann Cc: Colin Ian King Cc: Dan Carpenter Cc: David Howells Cc: Fabian Frederick Cc: Mikko Rapeli Cc: Sam Protsenko Cc: Yann Droneaud Cc: Zhouyang Jia Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 9a05671dd8d85cbce6cf1a00727d5919c1e56192 Author: Jan Harkes Date: Tue Jul 16 16:28:23 2019 -0700 coda: don't try to print names that were considered too long Probably safer to just show the unexpected length and debug it from the userspace side. Link: http://lkml.kernel.org/r/582ae759a4fdfa31a64c35de489fa4efabac09d6.1558117389.git.jaharkes@cs.cmu.edu Signed-off-by: Jan Harkes Cc: Arnd Bergmann Cc: Colin Ian King Cc: Dan Carpenter Cc: David Howells Cc: Fabian Frederick Cc: Mikko Rapeli Cc: Sam Protsenko Cc: Yann Droneaud Cc: Zhouyang Jia Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit b2a57e334086602be56b74958d9f29b955cd157f Author: Sam Protsenko Date: Tue Jul 16 16:28:20 2019 -0700 coda: fix build using bare-metal toolchain The kernel is self-contained project and can be built with bare-metal toolchain. But bare-metal toolchain doesn't define __linux__. Because of this u_quad_t type is not defined when using bare-metal toolchain and codafs build fails. This patch fixes it by defining u_quad_t type unconditionally. Link: http://lkml.kernel.org/r/3cbb40b0a57b6f9923a9d67b53473c0b691a3eaa.1558117389.git.jaharkes@cs.cmu.edu Signed-off-by: Sam Protsenko Signed-off-by: Jan Harkes Cc: Arnd Bergmann Cc: Colin Ian King Cc: Dan Carpenter Cc: David Howells Cc: Fabian Frederick Cc: Mikko Rapeli Cc: Yann Droneaud Cc: Zhouyang Jia Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 6e51f8aa76b67d0a6eb168fd41a81e8478ae07a9 Author: Jan Harkes Date: Tue Jul 16 16:28:16 2019 -0700 coda: potential buffer overflow in coda_psdev_write() Add checks to make sure the downcall message we got from the Coda cache manager is large enough to contain the data it is supposed to have. i.e. when we get a CODA_ZAPDIR we can access &out->coda_zapdir.CodaFid. Link: http://lkml.kernel.org/r/894fb6b250add09e4e3935f14649f21284a5cb18.1558117389.git.jaharkes@cs.cmu.edu Signed-off-by: Jan Harkes Reported-by: Dan Carpenter Cc: Arnd Bergmann Cc: Colin Ian King Cc: David Howells Cc: Fabian Frederick Cc: Mikko Rapeli Cc: Sam Protsenko Cc: Yann Droneaud Cc: Zhouyang Jia Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 02551c23bcd85f0c68a8259c7b953d49d44f86af Author: Zhouyang Jia Date: Tue Jul 16 16:28:13 2019 -0700 coda: add error handling for fget When fget fails, the lack of error-handling code may cause unexpected results. This patch adds error-handling code after calling fget. Link: http://lkml.kernel.org/r/2514ec03df9c33b86e56748513267a80dd8004d9.1558117389.git.jaharkes@cs.cmu.edu Signed-off-by: Zhouyang Jia Signed-off-by: Jan Harkes Cc: Arnd Bergmann Cc: Colin Ian King Cc: Dan Carpenter Cc: David Howells Cc: Fabian Frederick Cc: Mikko Rapeli Cc: Sam Protsenko Cc: Yann Droneaud Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit f90fb3c7e2c13ae829db2274b88b845a75038b8a Author: Mikko Rapeli Date: Tue Jul 16 16:28:10 2019 -0700 uapi linux/coda_psdev.h: move upc_req definition from uapi to kernel side headers Only users of upc_req in kernel side fs/coda/psdev.c and fs/coda/upcall.c already include linux/coda_psdev.h. Suggested by Jan Harkes in https://lore.kernel.org/lkml/20150531111913.GA23377@cs.cmu.edu/ Fixes these include/uapi/linux/coda_psdev.h compilation errors in userspace: linux/coda_psdev.h:12:19: error: field `uc_chain' has incomplete type struct list_head uc_chain; ^ linux/coda_psdev.h:13:2: error: unknown type name `caddr_t' caddr_t uc_data; ^ linux/coda_psdev.h:14:2: error: unknown type name `u_short' u_short uc_flags; ^ linux/coda_psdev.h:15:2: error: unknown type name `u_short' u_short uc_inSize; /* Size is at most 5000 bytes */ ^ linux/coda_psdev.h:16:2: error: unknown type name `u_short' u_short uc_outSize; ^ linux/coda_psdev.h:17:2: error: unknown type name `u_short' u_short uc_opcode; /* copied from data to save lookup */ ^ linux/coda_psdev.h:19:2: error: unknown type name `wait_queue_head_t' wait_queue_head_t uc_sleep; /* process' wait queue */ ^ Link: http://lkml.kernel.org/r/9f99f5ce6a0563d5266e6cf7aa9585aac2cae971.1558117389.git.jaharkes@cs.cmu.edu Signed-off-by: Mikko Rapeli Signed-off-by: Jan Harkes Cc: Arnd Bergmann Cc: Colin Ian King Cc: Dan Carpenter Cc: David Howells Cc: Fabian Frederick Cc: Sam Protsenko Cc: Yann Droneaud Cc: Zhouyang Jia Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 694a58e29ef27c4c26f103a9decfd053f94dd34c Author: Mikko Rapeli Date: Tue Jul 16 16:28:07 2019 -0700 uapi linux/coda.h: use __kernel_pid_t for userspace Part of a patch by Mikko Rapeli, as Arnd Bergman commented on the original patch. pid_t might differ between libc and the kernel, so the kernel interface has to use types that the kernel defines. Link: http://lkml.kernel.org/r/f374a71f4d351bc8c8b3ac18ad7765c88d806d10.1558117389.git.jaharkes@cs.cmu.edu Signed-off-by: Mikko Rapeli Signed-off-by: Jan Harkes Cc: Arnd Bergmann Cc: Colin Ian King Cc: Dan Carpenter Cc: David Howells Cc: Fabian Frederick Cc: Sam Protsenko Cc: Yann Droneaud Cc: Zhouyang Jia Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 7fa0a1da3dadfd9216df7745a1331fdaa0940d1c Author: Jan Harkes Date: Tue Jul 16 16:28:04 2019 -0700 coda: pass the host file in vma->vm_file on mmap Patch series "Coda updates". The following patch series is a collection of various fixes for Coda, most of which were collected from linux-fsdevel or linux-kernel but which have as yet not found their way upstream. This patch (of 22): Various file systems expect that vma->vm_file points at their own file handle, several use file_inode(vma->vm_file) to get at their inode or use vma->vm_file->private_data. However the way Coda wrapped mmap on a host file broke this assumption, vm_file was still pointing at the Coda file and the host file systems would scribble over Coda's inode and private file data. This patch fixes the incorrect expectation and wraps vm_ops->open and vm_ops->close to allow Coda to track when the vm_area_struct is destroyed so we still release the reference on the Coda file handle at the right time. Link: http://lkml.kernel.org/r/0e850c6e59c0b147dc2dcd51a3af004c948c3697.1558117389.git.jaharkes@cs.cmu.edu Signed-off-by: Jan Harkes Cc: Arnd Bergmann Cc: Colin Ian King Cc: Dan Carpenter Cc: David Howells Cc: Fabian Frederick Cc: Mikko Rapeli Cc: Sam Protsenko Cc: Yann Droneaud Cc: Zhouyang Jia Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit b98cca444d287a63dd96df04af7fb9793567599e Author: Anshuman Khandual Date: Tue Jul 16 16:28:00 2019 -0700 mm, kprobes: generalize and rename notify_page_fault() as kprobe_page_fault() Architectures which support kprobes have very similar boilerplate around calling kprobe_fault_handler(). Use a helper function in kprobes.h to unify them, based on the x86 code. This changes the behaviour for other architectures when preemption is enabled. Previously, they would have disabled preemption while calling the kprobe handler. However, preemption would be disabled if this fault was due to a kprobe, so we know the fault was not due to a kprobe handler and can simply return failure. This behaviour was introduced in commit a980c0ef9f6d ("x86/kprobes: Refactor kprobes_fault() like kprobe_exceptions_notify()") [anshuman.khandual@arm.com: export kprobe_fault_handler()] Link: http://lkml.kernel.org/r/1561133358-8876-1-git-send-email-anshuman.khandual@arm.com Link: http://lkml.kernel.org/r/1560420444-25737-1-git-send-email-anshuman.khandual@arm.com Signed-off-by: Anshuman Khandual Reviewed-by: Dave Hansen Cc: Michal Hocko Cc: Matthew Wilcox Cc: Mark Rutland Cc: Christophe Leroy Cc: Stephen Rothwell Cc: Andrey Konovalov Cc: Michael Ellerman Cc: Paul Mackerras Cc: Russell King Cc: Catalin Marinas Cc: Will Deacon Cc: Tony Luck Cc: Fenghua Yu Cc: Martin Schwidefsky Cc: Heiko Carstens Cc: Yoshinori Sato Cc: "David S. Miller" Cc: Thomas Gleixner Cc: Peter Zijlstra Cc: Ingo Molnar Cc: Andy Lutomirski Cc: Vineet Gupta Cc: James Hogan Cc: Paul Burton Cc: Ralf Baechle Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 92bae787c483b015d8985c43784e5afb5ec67895 Author: Kees Cook Date: Tue Jul 16 16:27:57 2019 -0700 init/Kconfig: fix neighboring typos This fixes a couple typos I noticed in the slab Kconfig: sacrifies -> sacrifices accellerate -> accelerate Seeing as no other instances of these typos are found elsewhere in the kernel and that I originally added one of the two, I can only assume working on slab must have caused damage to the spelling centers of my brain. Link: http://lkml.kernel.org/r/201905292203.CD000546EB@keescook Signed-off-by: Kees Cook Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit aa94b1dc5bca1c23d1a1f4110b4e77bfe88c0061 Author: Alexey Dobriyan Date: Tue Jul 16 16:27:54 2019 -0700 fs/binfmt_elf.c: delete stale comment "passed_fileno" variable was deleted 11 years ago in 2.6.25. Link: http://lkml.kernel.org/r/20190529201747.GA23248@avx2 Fixes: d20894a23708 ("Remove a.out interpreter support in ELF loader") Signed-off-by: Alexey Dobriyan Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 1b113e04e20298b08c82c709a4501c0d6e1e4374 Author: YueHaibing Date: Tue Jul 16 16:27:51 2019 -0700 fs/binfmt_flat.c: remove set but not used variable 'inode' Fixes gcc '-Wunused-but-set-variable' warning: fs/binfmt_flat.c: In function load_flat_file: fs/binfmt_flat.c:419:16: warning: variable inode set but not used [-Wunused-but-set-variable] It's never used and can be removed. Link: http://lkml.kernel.org/r/20190525125341.9844-1-yuehaibing@huawei.com Signed-off-by: YueHaibing Cc: Al Viro Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 6a8d76cbd647d414248d314300106d1ce04daa4b Author: Matteo Croce Date: Tue Jul 16 16:27:48 2019 -0700 checkpatch.pl: warn on duplicate sysctl local variable Commit d91bff3011cf ("proc/sysctl: add shared variables for range check") adds some shared const variables to be used instead of a local copy in each source file. Warn when a chunk duplicates one of these values in a ctl_table struct: $ scripts/checkpatch.pl 0001-test-commit.patch WARNING: duplicated sysctl range checking value 'zero', consider using the shared one in include/linux/sysctl.h #27: FILE: arch/arm/kernel/isa.c:48: + .extra1 = &zero, WARNING: duplicated sysctl range checking value 'int_max', consider using the shared one in include/linux/sysctl.h #28: FILE: arch/arm/kernel/isa.c:49: + .extra2 = &int_max, total: 0 errors, 2 warnings, 14 lines checked Link: http://lkml.kernel.org/r/20190531131422.14970-1-mcroce@redhat.com Signed-off-by: Matteo Croce Reviewed-by: Kees Cook Cc: Joe Perches Cc: Aaron Tomlin Cc: Matthew Wilcox Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 9f973cb38088e0cf42e0bae97ff140813e623f13 Author: Michel Lespinasse Date: Tue Jul 16 16:27:45 2019 -0700 lib/rbtree: avoid generating code twice for the cached versions As was already noted in rbtree.h, the logic to cache rb_first (or rb_last) can easily be implemented externally to the core rbtree api. Change the implementation to do just that. Previously the update of rb_leftmost was wired deeper into the implmentation, but there were some disadvantages to that - mostly, lib/rbtree.c had separate instantiations for rb_insert_color() vs rb_insert_color_cached(), as well as rb_erase() vs rb_erase_cached(), which were doing exactly the same thing save for the rb_leftmost update at the start of either function. text data bss dec hex filename 5405 120 0 5525 1595 lib/rbtree.o-vanilla 3827 96 0 3923 f53 lib/rbtree.o-patch [dave@stgolabs.net: changelog addition] Link: http://lkml.kernel.org/r/20190628171416.by5gdizl3rcxk5h5@linux-r8p5 [akpm@linux-foundation.org: coding-style fixes] Link: http://lkml.kernel.org/r/20190628045008.39926-1-walken@google.com Signed-off-by: Michel Lespinasse Acked-by: Davidlohr Bueso Acked-by: Peter Zijlstra (Intel) Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 4ab7ace465466d25c12cee9854e7140077e208cb Author: Alexander Potapenko Date: Tue Jul 16 16:27:42 2019 -0700 lib/test_meminit.c: minor test fixes Fix the following issues in test_meminit.c: - |size| in fill_with_garbage_skip() should be signed so that it doesn't overflow if it's not aligned on sizeof(*p); - fill_with_garbage_skip() should actually skip |skip| bytes; - do_kmem_cache_size() should deallocate memory in the RCU case. Link: http://lkml.kernel.org/r/20190626133135.217355-1-glider@google.com Fixes: 7e659650cbda ("lib: introduce test_meminit module") Fixes: 94e8988d91c7 ("lib/test_meminit.c: fix -Wmaybe-uninitialized false positive") Signed-off-by: Alexander Potapenko Cc: Arnd Bergmann Cc: Kees Cook Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit d3a811617ae629d7c0c5b7f0b7b0a72715ae3407 Author: Arnd Bergmann Date: Tue Jul 16 16:27:39 2019 -0700 lib/test_meminit.c: fix -Wmaybe-uninitialized false positive The conditional logic is too complicated for the compiler to fully comprehend: lib/test_meminit.c: In function 'test_meminit_init': lib/test_meminit.c:236:5: error: 'buf_copy' may be used uninitialized in this function [-Werror=maybe-uninitialized] kfree(buf_copy); ^~~~~~~~~~~~~~~ lib/test_meminit.c:201:14: note: 'buf_copy' was declared here Simplify it by splitting out the non-rcu section. Link: http://lkml.kernel.org/r/20190617131210.2190280-1-arnd@arndb.de Fixes: af734ee6ec85 ("lib: introduce test_meminit module") Signed-off-by: Arnd Bergmann Acked-by: Alexander Potapenko Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit b4658cdd8cab49c978334dc5db9070d0d881e3dd Author: Jonathan Corbet Date: Tue Jul 16 16:27:36 2019 -0700 lib/string_helpers: fix some kerneldoc warnings Due to some sad limitations in how kerneldoc comments are parsed, the documentation in lib/string_helpers.c generates these warnings: lib/string_helpers.c:236: WARNING: Unexpected indentation. lib/string_helpers.c:241: WARNING: Block quote ends without a blank line; unexpected unindent. lib/string_helpers.c:446: WARNING: Unexpected indentation. lib/string_helpers.c:451: WARNING: Block quote ends without a blank line; unexpected unindent. lib/string_helpers.c:474: WARNING: Unexpected indentation. Rework the comments to obtain something like the desired result. Link: http://lkml.kernel.org/r/20190607110952.409011ba@lwn.net Signed-off-by: Jonathan Corbet Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 0f472d04f59ff89d15b2a1c4eafde7317ddd67a2 Author: Anshuman Khandual Date: Tue Jul 16 16:27:33 2019 -0700 mm/ioremap: probe platform for p4d huge map support Finish up what commit c2febafc6773 ("mm: convert generic code to 5-level paging") started while levelling up P4D huge mapping support at par with PUD and PMD. A new arch call back arch_ioremap_p4d_supported() is added which just maintains status quo (P4D huge map not supported) on x86, arm64 and powerpc. When HAVE_ARCH_HUGE_VMAP is enabled its just a simple check from the arch about the support, hence runtime effects are minimal. Link: http://lkml.kernel.org/r/1561699231-20991-1-git-send-email-anshuman.khandual@arm.com Signed-off-by: Anshuman Khandual Acked-by: Thomas Gleixner Acked-by: Michael Ellerman (powerpc) Cc: Catalin Marinas Cc: Will Deacon Cc: Dave Hansen Cc: Andy Lutomirski Cc: Peter Zijlstra Cc: Ingo Molnar Cc: Kirill A. Shutemov Cc: Michal Hocko Cc: Stephen Rothwell Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 6b95ab4218bfa59bc315105127ffe03aef3b5742 Author: Anshuman Khandual Date: Tue Jul 16 16:27:30 2019 -0700 mm/ioremap: check virtual address alignment while creating huge mappings Virtual address alignment is essential in ensuring correct clearing for all intermediate level pgtable entries and freeing associated pgtable pages. An unaligned address can end up randomly freeing pgtable page that potentially still contains valid mappings. Hence also check it's alignment along with existing phys_addr check. Signed-off-by: Anshuman Khandual Reviewed-by: Catalin Marinas Cc: Toshi Kani Cc: Will Deacon Cc: Chintan Pandya Cc: Thomas Gleixner Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 5015a300a522c8fb542dc993140e4c360cf4cf5f Author: Alexander Potapenko Date: Tue Jul 16 16:27:27 2019 -0700 lib: introduce test_meminit module Add tests for heap and pagealloc initialization. These can be used to check init_on_alloc and init_on_free implementations as well as other approaches to initialization. Expected test output in the case the kernel provides heap initialization (e.g. when running with either init_on_alloc=1 or init_on_free=1): test_meminit: all 10 tests in test_pages passed test_meminit: all 40 tests in test_kvmalloc passed test_meminit: all 60 tests in test_kmemcache passed test_meminit: all 10 tests in test_rcu_persistent passed test_meminit: all 120 tests passed! Link: http://lkml.kernel.org/r/20190529123812.43089-4-glider@google.com Signed-off-by: Alexander Potapenko Acked-by: Kees Cook Cc: Christoph Lameter Cc: Nick Desaulniers Cc: Kostya Serebryany Cc: Dmitry Vyukov Cc: Sandeep Patil Cc: Laura Abbott Cc: Jann Horn Cc: Marco Elver Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 8e060c21ae2c265a2b596e9e7f9f97ec274151a4 Author: Kees Cook Date: Tue Jul 16 16:27:24 2019 -0700 lib/test_overflow.c: avoid tainting the kernel and fix wrap size This adds __GFP_NOWARN to the kmalloc()-portions of the overflow test to avoid tainting the kernel. Additionally fixes up the math on wrap size to be architecture and page size agnostic. Link: http://lkml.kernel.org/r/201905282012.0A8767E24@keescook Fixes: ca90800a91ba ("test_overflow: Add memory allocation overflow tests") Signed-off-by: Kees Cook Reported-by: Randy Dunlap Suggested-by: Rasmus Villemoes Cc: Joe Perches Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit d1a5dc5e6accbeaabe59e3d55b47f15a8b19c2bd Author: Peter Rosin Date: Tue Jul 16 16:27:21 2019 -0700 lib/test_string.c: add some testcases for strchr and strnchr Make sure that the trailing NUL is considered part of the string and can be found. Link: http://lkml.kernel.org/r/20190506124634.6807-4-peda@axentia.se Signed-off-by: Peter Rosin Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 33d6e0ff68af74be0c846c8e042e84a9a1a0561e Author: Peter Rosin Date: Tue Jul 16 16:27:18 2019 -0700 lib/test_string.c: avoid masking memset16/32/64 failures If a memsetXX implementation is completely broken and fails in the first iteration, when i, j, and k are all zero, the failure is masked as zero is returned. Failing in the first iteration is perhaps the most likely failure, so this makes the tests pretty much useless. Avoid the situation by always setting a random unused bit in the result on failure. Link: http://lkml.kernel.org/r/20190506124634.6807-3-peda@axentia.se Fixes: 03270c13c5ff ("lib/string.c: add testcases for memset16/32/64") Signed-off-by: Peter Rosin Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit b09757104e433447226a95eff4b92583acc0b0fb Author: Peter Rosin Date: Tue Jul 16 16:27:15 2019 -0700 lib/string.c: allow searching for NUL with strnchr Patch series "lib/string: search for NUL with strchr/strnchr". I noticed an inconsistency where strchr and strnchr do not behave the same with respect to the trailing NUL. strchr is standardised and the kernel function conforms, and the kernel relies on the behavior. So, naturally strchr stays as-is and strnchr is what I change. While writing a few tests to verify that my new strnchr loop was sane, I noticed that the tests for memset16/32/64 had a problem. Since it's all about the lib/string.c file I made a short series of it all... This patch (of 3): strchr considers the terminating NUL to be part of the string, and NUL can thus be searched for with that function. For consistency, do the same with strnchr. Link: http://lkml.kernel.org/r/20190506124634.6807-2-peda@axentia.se Signed-off-by: Peter Rosin Cc: Matthew Wilcox Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 4c6080cd6f8baad9f7faa3deac9a90e59726b119 Author: Alexey Dobriyan Date: Tue Jul 16 16:27:12 2019 -0700 lib/list: tweak LIST_POISON2 for better code generation on x86_64 list_del() poisoning can generate 2 64-bit immediate loads but it also can generate one 64-bit immediate load and an addition: 48 b8 00 01 00 00 00 00 ad de movabs rax,0xdead000000000100 48 89 47 58 mov QWORD PTR [rdi+0x58],rax 48 05 00 01 00 00 <=====> add rax,0x100 48 89 47 60 mov QWORD PTR [rdi+0x60],rax However on x86_64 not all constants are equal: those within [-128, 127] range can be added with shorter "add r64, imm32" instruction: 48 b8 00 01 00 00 00 00 ad de movabs rax,0xdead000000000100 48 89 47 58 mov QWORD PTR [rdi+0x58],rax 48 83 c0 22 <======> add rax,0x22 48 89 47 60 mov QWORD PTR [rdi+0x60],rax Patch saves 2 bytes per some LIST_POISON2 usage. (Slightly disappointing) space savings on F29 x86_64 config: add/remove: 0/0 grow/shrink: 0/2164 up/down: 0/-5184 (-5184) Function old new delta zstd_get_workspace 548 546 -2 ... mlx4_delete_all_resources_for_slave 4826 4804 -22 Total: Before=83304131, After=83298947, chg -0.01% New constants are: 0xdead000000000100 0xdead000000000122 Note: LIST_POISON1 can't be changed to ...11 because something in page allocator requires low bit unset. Link: http://lkml.kernel.org/r/20190513191502.GA8492@avx2 Signed-off-by: Alexey Dobriyan Cc: Vasiliy Kulikov Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 49662503e8e4df9db29bfc354112a9a6312d7a25 Author: Joe Perches Date: Tue Jul 16 16:27:09 2019 -0700 get_maintainer: add ability to skip moderated mailing lists Add a command line switch --no-moderated to skip L: mailing lists marked with 'moderated'. Some people prefer not emailing moderated mailing lists as the moderation time can be indeterminate and some emails can be intentionally dropped by a moderator. This can cause fragmentation of email threads when some are subscribed to a moderated list but others are not and emails are dropped. Link: http://lkml.kernel.org/r/6f23c2918ad9fc744269feb8f909bdfb105c5afc.camel@perches.com Signed-off-by: Joe Perches Tested-by: Peter Zijlstra (Intel) Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit c296d4dc13aefe96792538a949996b8938f28f13 Author: Qian Cai Date: Tue Jul 16 16:27:06 2019 -0700 asm-generic: fix a compilation warning Fix this compilation warning on x86 by making flush_cache_vmap() inline. lib/ioremap.c: In function 'ioremap_page_range': lib/ioremap.c:214:16: warning: variable 'start' set but not used [-Wunused-but-set-variable] unsigned long start; ^~~~~ While at it, convert all other similar functions to inline for consistency. Link: http://lkml.kernel.org/r/1562594592-15228-1-git-send-email-cai@lca.pw Signed-off-by: Qian Cai Reviewed-by: Andrew Morton Cc: Arnd Bergmann Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 3a7f0adfe7c27cdaf6dc3456226a430398732e2c Author: Stephen Kitt Date: Tue Jul 16 16:27:04 2019 -0700 arch/*: remove unused isa_page_to_bus() isa_page_to_bus() is deprecated and is no longer used anywhere. Remove it entirely. Link: http://lkml.kernel.org/r/20190613161155.16946-1-steve@sk2.org Signed-off-by: Stephen Kitt Acked-by: Thomas Gleixner Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit fe6ba88b251aa76a94be2cb441d2e6b7c623b989 Author: Masahiro Yamada Date: Tue Jul 16 16:27:01 2019 -0700 arch: replace _BITUL() in kernel-space headers with BIT() Now that BIT() can be used from assembly code, we can safely replace _BITUL() with equivalent BIT(). UAPI headers are still required to use _BITUL(), but there is no more reason to use it in kernel headers. BIT() is shorter. Link: http://lkml.kernel.org/r/20190609153941.17249-2-yamada.masahiro@socionext.com Signed-off-by: Masahiro Yamada Cc: Heiko Carstens Cc: Vasily Gorbik Cc: Christian Borntraeger Cc: Vineet Gupta Cc: Catalin Marinas Cc: Will Deacon Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 95b980d62d52c4c1768ee719e8db3efe27ef52b2 Author: Masahiro Yamada Date: Tue Jul 16 16:26:57 2019 -0700 linux/bits.h: make BIT(), GENMASK(), and friends available in assembly BIT(), GENMASK(), etc. are useful to define register bits of hardware. However, low-level code is often written in assembly, where they are not available due to the hard-coded 1UL, 0UL. In fact, in-kernel headers such as arch/arm64/include/asm/sysreg.h use _BITUL() instead of BIT() so that the register bit macros are available in assembly. Using macros in include/uapi/linux/const.h have two reasons: [1] For use in uapi headers We should use underscore-prefixed variants for user-space. [2] For use in assembly code Since _BITUL() uses UL(1) instead of 1UL, it can be used as an alternative of BIT(). For [2], it is pretty easy to change BIT() etc. for use in assembly. This allows to replace _BUTUL() in kernel-space headers with BIT(). Link: http://lkml.kernel.org/r/20190609153941.17249-1-yamada.masahiro@socionext.com Signed-off-by: Masahiro Yamada Cc: Catalin Marinas Cc: Christian Borntraeger Cc: Heiko Carstens Cc: Vasily Gorbik Cc: Vineet Gupta Cc: Will Deacon Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 65f50f255349959f15f2761abd17ead8530b2f33 Author: Weitao Hou Date: Tue Jul 16 16:26:54 2019 -0700 kernel: fix typos and some coding style in comments fix lenght to length Link: http://lkml.kernel.org/r/20190521050937.4370-1-houweitaoo@gmail.com Signed-off-by: Weitao Hou Acked-by: Kees Cook Cc: Colin Ian King Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 5ec27ec735ba0477d48c80561cc5e856f0c5dfaf Author: Radoslaw Burny Date: Tue Jul 16 16:26:51 2019 -0700 fs/proc/proc_sysctl.c: fix the default values of i_uid/i_gid on /proc/sys inodes. Normally, the inode's i_uid/i_gid are translated relative to s_user_ns, but this is not a correct behavior for proc. Since sysctl permission check in test_perm is done against GLOBAL_ROOT_[UG]ID, it makes more sense to use these values in u_[ug]id of proc inodes. In other words: although uid/gid in the inode is not read during test_perm, the inode logically belongs to the root of the namespace. I have confirmed this with Eric Biederman at LPC and in this thread: https://lore.kernel.org/lkml/87k1kzjdff.fsf@xmission.com Consequences ============ Since the i_[ug]id values of proc nodes are not used for permissions checks, this change usually makes no functional difference. However, it causes an issue in a setup where: * a namespace container is created without root user in container - hence the i_[ug]id of proc nodes are set to INVALID_[UG]ID * container creator tries to configure it by writing /proc/sys files, e.g. writing /proc/sys/kernel/shmmax to configure shared memory limit Kernel does not allow to open an inode for writing if its i_[ug]id are invalid, making it impossible to write shmmax and thus - configure the container. Using a container with no root mapping is apparently rare, but we do use this configuration at Google. Also, we use a generic tool to configure the container limits, and the inability to write any of them causes a failure. History ======= The invalid uids/gids in inodes first appeared due to 81754357770e (fs: Update i_[ug]id_(read|write) to translate relative to s_user_ns). However, AFAIK, this did not immediately cause any issues. The inability to write to these "invalid" inodes was only caused by a later commit 0bd23d09b874 (vfs: Don't modify inodes with a uid or gid unknown to the vfs). Tested: Used a repro program that creates a user namespace without any mapping and stat'ed /proc/$PID/root/proc/sys/kernel/shmmax from outside. Before the change, it shows the overflow uid, with the change it's 0. The overflow uid indicates that the uid in the inode is not correct and thus it is not possible to open the file for writing. Link: http://lkml.kernel.org/r/20190708115130.250149-1-rburny@google.com Fixes: 0bd23d09b874 ("vfs: Don't modify inodes with a uid or gid unknown to the vfs") Signed-off-by: Radoslaw Burny Acked-by: Luis Chamberlain Cc: Kees Cook Cc: "Eric W . Biederman" Cc: Seth Forshee Cc: John Sperbeck Cc: Alexey Dobriyan Cc: [4.8+] Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 7dbbade1f285e881119049563ab2a036c96dd9f3 Author: Alexey Dobriyan Date: Tue Jul 16 16:26:48 2019 -0700 proc: test /proc/sysvipc vs setns(CLONE_NEWIPC) I thought that /proc/sysvipc has the same bug as /proc/net commit 1fde6f21d90f8ba5da3cb9c54ca991ed72696c43 proc: fix /proc/net/* after setns(2) However, it doesn't! /proc/sysvipc files do get_ipc_ns(current->nsproxy->ipc_ns); in their open() hook and avoid the problem. Keep the test, maybe /proc/sysvipc will become broken someday :-\ Link: http://lkml.kernel.org/r/20190706180146.GA21015@avx2 Signed-off-by: Alexey Dobriyan Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 9af27b28b1da1020e427b626c4967d0206b55100 Author: Alexey Dobriyan Date: Tue Jul 16 16:26:45 2019 -0700 fs/proc/inode.c: use typeof_member() macro Don't repeat function signatures twice. This is a kind-of-precursor for "struct proc_ops". Note: typeof(pde->proc_fops->...) ...; can't be used because ->proc_fops is "const struct file_operations *". "const" prevents assignment down the code and it can't be deleted in the type system. Link: http://lkml.kernel.org/r/20190529191110.GB5703@avx2 Signed-off-by: Alexey Dobriyan Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit ce251e0e3c0597ea8cab5787df579bd1f9c1aca1 Author: Alexey Dobriyan Date: Tue Jul 16 16:26:42 2019 -0700 include/linux/kernel.h: add typeof_member() macro Add typeof_member() macro so that types can be extracted without introducing dummy variables. Link: http://lkml.kernel.org/r/20190529190720.GA5703@avx2 Signed-off-by: Alexey Dobriyan Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit c6c405336bd3b0ebd1d76aaf9ea88b35dba77e61 Author: Kairui Song Date: Tue Jul 16 16:26:39 2019 -0700 vmcore: add a kernel parameter novmcoredd Since commit 2724273e8fd0 ("vmcore: add API to collect hardware dump in second kernel"), drivers are allowed to add device related dump data to vmcore as they want by using the device dump API. This has a potential issue, the data is stored in memory, drivers may append too much data and use too much memory. The vmcore is typically used in a kdump kernel which runs in a pre-reserved small chunk of memory. So as a result it will make kdump unusable at all due to OOM issues. So introduce new 'novmcoredd' command line option. User can disable device dump to reduce memory usage. This is helpful if device dump is using too much memory, disabling device dump could make sure a regular vmcore without device dump data is still available. [akpm@linux-foundation.org: tweak documentation] [akpm@linux-foundation.org: vmcore.c needs moduleparam.h] Link: http://lkml.kernel.org/r/20190528111856.7276-1-kasong@redhat.com Signed-off-by: Kairui Song Acked-by: Dave Young Reviewed-by: Bhupesh Sharma Cc: Rahul Lakkireddy Cc: "David S . Miller" Cc: Eric Biederman Cc: Alexey Dobriyan Cc: Baoquan He Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit bca1eac55a940025065645158c1a3429ac697df6 Author: Alexey Dobriyan Date: Tue Jul 16 16:26:36 2019 -0700 tools/testing/selftests/proc/proc-pid-vm.c: hide "segfault at ffffffffff600000" dmesg spam Test tries to access vsyscall page and if it doesn't exist gets SIGSEGV which can spam into dmesg. However the segfault happens by design. Handle it and carry information via exit code to parent. Link: http://lkml.kernel.org/r/20190524181256.GA2260@avx2 Signed-off-by: Alexey Dobriyan Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 9b98fa22948551e20a15b0b9d22589e3724c361a Author: Christoph Hellwig Date: Tue Jul 16 16:26:33 2019 -0700 mm: stub out all of swapops.h for !CONFIG_MMU The whole header file deals with swap entries and PTEs, none of which can exist for nommu builds. The current nommu ports have lots of stubs to allow the inline functions in swapops.h to compile, but as none of this functionality is actually used there is no point in even providing it. This way we don't have to provide the stubs for the upcoming RISC-V nommu port, and can eventually remove it from the existing ports. Link: http://lkml.kernel.org/r/20190703122359.18200-4-hch@lst.de Signed-off-by: Christoph Hellwig Cc: Vladimir Murzin Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 89165b8b0ee97bd775ac4376b932fd030f7462bd Author: Christoph Hellwig Date: Tue Jul 16 16:26:30 2019 -0700 mm: provide a print_vma_addr stub for !CONFIG_MMU Link: http://lkml.kernel.org/r/20190703122359.18200-3-hch@lst.de Signed-off-by: Christoph Hellwig Reviewed-by: Vladimir Murzin Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 0bf5f9492389aa8df5c8e38fcb4488802d24504d Author: Christoph Hellwig Date: Tue Jul 16 16:26:27 2019 -0700 mm: fix the MAP_UNINITIALIZED flag We can't expose UAPI symbols differently based on CONFIG_ symbols, as userspace won't have them available. Instead always define the flag, but only respect it based on the config option. Link: http://lkml.kernel.org/r/20190703122359.18200-2-hch@lst.de Signed-off-by: Christoph Hellwig Reviewed-by: Vladimir Murzin Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit c633324e311243586675e732249339685e5d6faa Author: Doug Berger Date: Tue Jul 16 16:26:24 2019 -0700 mm/cma.c: fail if fixed declaration can't be honored The description of cma_declare_contiguous() indicates that if the 'fixed' argument is true the reserved contiguous area must be exactly at the address of the 'base' argument. However, the function currently allows the 'base', 'size', and 'limit' arguments to be silently adjusted to meet alignment constraints. This commit enforces the documented behavior through explicit checks that return an error if the region does not fit within a specified region. Link: http://lkml.kernel.org/r/1561422051-16142-1-git-send-email-opendmb@gmail.com Fixes: 5ea3b1b2f8ad ("cma: add placement specifier for "cma=" kernel parameter") Signed-off-by: Doug Berger Acked-by: Michal Nazarewicz Cc: Yue Hu Cc: Mike Rapoport Cc: Laura Abbott Cc: Peng Fan Cc: Thomas Gleixner Cc: Marek Szyprowski Cc: Andrey Konovalov Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit c92d2f38563db20c20c8db2f98fa1349290477d5 Author: Henry Burns Date: Tue Jul 16 16:26:21 2019 -0700 mm/z3fold.c: reinitialize zhdr structs after migration z3fold_page_migration() calls memcpy(new_zhdr, zhdr, PAGE_SIZE). However, zhdr contains fields that can't be directly coppied over (ex: list_head, a circular linked list). We only need to initialize the linked lists in new_zhdr, as z3fold_isolate_page() already ensures that these lists are empty Additionally it is possible that zhdr->work has been placed in a workqueue. In this case we shouldn't migrate the page, as zhdr->work references zhdr as opposed to new_zhdr. Link: http://lkml.kernel.org/r/20190716000520.230595-1-henryburns@google.com Fixes: 1f862989b04ade61d3 ("mm/z3fold.c: support page migration") Signed-off-by: Henry Burns Reviewed-by: Shakeel Butt Cc: Vitaly Vul Cc: Vitaly Wool Cc: Jonathan Adams Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit be03074c9af25d06cf8e9ebddfcd284c0bf7f947 Author: Henry Burns Date: Tue Jul 16 16:26:18 2019 -0700 mm/z3fold.c: remove z3fold_migration trylock z3fold_page_migrate() will never succeed because it attempts to acquire a lock that has already been taken by migrate.c in __unmap_and_move(). __unmap_and_move() migrate.c trylock_page(oldpage) move_to_new_page(oldpage_newpage) a_ops->migrate_page(oldpage, newpage) z3fold_page_migrate(oldpage, newpage) trylock_page(oldpage) Link: http://lkml.kernel.org/r/20190710213238.91835-1-henryburns@google.com Fixes: 1f862989b04a ("mm/z3fold.c: support page migration") Signed-off-by: Henry Burns Reviewed-by: Shakeel Butt Cc: Vitaly Wool Cc: Vitaly Vul Cc: Jonathan Adams Cc: Greg Kroah-Hartman Cc: Snild Dolkow Cc: Thomas Gleixner Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 1732d2b0117c26a6bf6027c919e49603156ea93d Author: Andrew Morton Date: Tue Jul 16 16:26:15 2019 -0700 mm/vmscan.c: add checks for incorrect handling of current->reclaim_state Six sites are presently altering current->reclaim_state. There is a risk that one function stomps on a caller's value. Use a helper function to catch such errors. Cc: Yafang Shao Cc: Kirill Tkhai Cc: Michal Hocko Cc: Johannes Weiner Cc: Vladimir Davydov Cc: Mel Gorman Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 0308f7cf19c9741837f5b4c8cde14342bba72604 Author: Yafang Shao Date: Tue Jul 16 16:26:12 2019 -0700 mm/vmscan.c: calculate reclaimed slab caches in all reclaim paths There are six different reclaim paths by now: - kswapd reclaim path - node reclaim path - hibernate preallocate memory reclaim path - direct reclaim path - memcg reclaim path - memcg softlimit reclaim path The slab caches reclaimed in these paths are only calculated in the above three paths. There're some drawbacks if we don't calculate the reclaimed slab caches. - The sc->nr_reclaimed isn't correct if there're some slab caches relcaimed in this path. - The slab caches may be reclaimed thoroughly if there're lots of reclaimable slab caches and few page caches. Let's take an easy example for this case. If one memcg is full of slab caches and the limit of it is 512M, in other words there're approximately 512M slab caches in this memcg. Then the limit of the memcg is reached and the memcg reclaim begins, and then in this memcg reclaim path it will continuesly reclaim the slab caches until the sc->priority drops to 0. After this reclaim stops, you will find there're few slab caches left, which is less than 20M in my test case. While after this patch applied the number is greater than 300M and the sc->priority only drops to 3. Link: http://lkml.kernel.org/r/1561112086-6169-3-git-send-email-laoar.shao@gmail.com Signed-off-by: Yafang Shao Reviewed-by: Kirill Tkhai Reviewed-by: Andrew Morton Cc: Kirill Tkhai Cc: Michal Hocko Cc: Johannes Weiner Cc: Vladimir Davydov Cc: Mel Gorman Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit e5ca8071fe65f409ba074d1c45ec2db977b5b222 Author: Yafang Shao Date: Tue Jul 16 16:26:09 2019 -0700 mm/vmscan.c: add a new member reclaim_state in struct shrink_control Patch series "mm/vmscan: calculate reclaimed slab in all reclaim paths". This patchset is to fix the issues in doing shrink slab. There're six different reclaim paths by now, - kswapd reclaim path - node reclaim path - hibernate preallocate memory reclaim path - direct reclaim path - memcg reclaim path - memcg softlimit reclaim path The slab caches reclaimed in these paths are only calculated in the above three paths. The issues are detailed explained in patch #2. We should calculate the reclaimed slab caches in every reclaim path. In order to do it, the struct reclaim_state is placed into the struct shrink_control. In node reclaim path, there'is another issue about shrinking slab, which is adressed in "mm/vmscan: shrink slab in node reclaim" (https://lore.kernel.org/linux-mm/1559874946-22960-1-git-send-email-laoar.shao@gmail.com/). This patch (of 2): The struct reclaim_state is used to record how many slab caches are reclaimed in one reclaim path. The struct shrink_control is used to control one reclaim path. So we'd better put reclaim_state into shrink_control. [laoar.shao@gmail.com: remove reclaim_state assignment from __perform_reclaim()] Link: http://lkml.kernel.org/r/1561381582-13697-1-git-send-email-laoar.shao@gmail.com Link: http://lkml.kernel.org/r/1561112086-6169-2-git-send-email-laoar.shao@gmail.com Signed-off-by: Yafang Shao Reviewed-by: Andrew Morton Reviewed-by: Kirill Tkhai Cc: Michal Hocko Cc: Johannes Weiner Cc: Vladimir Davydov Cc: Mel Gorman Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 766a4c19d880887c457811b86f1f68525e416965 Author: Yafang Shao Date: Tue Jul 16 16:26:06 2019 -0700 mm/memcontrol.c: keep local VM counters in sync with the hierarchical ones After commit 815744d75152 ("mm: memcontrol: don't batch updates of local VM stats and events"), the local VM counter are not in sync with the hierarchical ones. Below is one example in a leaf memcg on my server (with 8 CPUs): inactive_file 3567570944 total_inactive_file 3568029696 We find that the deviation is very great because the 'val' in __mod_memcg_state() is in pages while the effective value in memcg_stat_show() is in bytes. So the maximum of this deviation between local VM stats and total VM stats can be (32 * number_of_cpu * PAGE_SIZE), that may be an unacceptably great value. We should keep the local VM stats in sync with the total stats. In order to keep this behavior the same across counters, this patch updates __mod_lruvec_state() and __count_memcg_events() as well. Link: http://lkml.kernel.org/r/1562851979-10610-1-git-send-email-laoar.shao@gmail.com Signed-off-by: Yafang Shao Acked-by: Johannes Weiner Cc: Michal Hocko Cc: Vladimir Davydov Cc: Yafang Shao Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit f1549cb5ab2bd04cb370502b720268f610e21baa Author: Henry Burns Date: Tue Jul 16 16:26:03 2019 -0700 mm/z3fold.c: allow __GFP_HIGHMEM in z3fold_alloc One of the gfp flags used to show that a page is movable is __GFP_HIGHMEM. Currently z3fold_alloc() fails when __GFP_HIGHMEM is passed. Now that z3fold pages are movable, we allow __GFP_HIGHMEM. We strip the movability related flags from the call to kmem_cache_alloc() for our slots since it is a kernel allocation. [akpm@linux-foundation.org: coding-style fixes] Link: http://lkml.kernel.org/r/20190712222118.108192-1-henryburns@google.com Signed-off-by: Henry Burns Acked-by: Vitaly Wool Reviewed-by: Shakeel Butt Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 929f92f78068a18ffa38ea7af3faad7fceca529c Author: Ryohei Suzuki Date: Tue Jul 16 16:26:00 2019 -0700 mm/cma.c: fix a typo ("alloc_cma" -> "cma_alloc") in cma_release() comments A comment referred to a non-existent function alloc_cma(), which should have been cma_alloc(). Link: http://lkml.kernel.org/r/20190712085549.5920-1-ryh.szk.cmnty@gmail.com Signed-off-by: Ryohei Suzuki Reviewed-by: Andrew Morton Cc: Joonsoo Kim Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit a07057dce2823e10d64a2b73cefbf09d8645efe9 Author: Arnd Bergmann Date: Tue Jul 16 16:25:57 2019 -0700 mm/slab_common.c: work around clang bug #42570 Clang gets rather confused about two variables in the same special section when one of them is not initialized, leading to an assembler warning later: /tmp/slab_common-18f869.s: Assembler messages: /tmp/slab_common-18f869.s:7526: Warning: ignoring changed section attributes for .data..ro_after_init Adding an initialization to kmalloc_caches is rather silly here but does avoid the issue. Link: https://bugs.llvm.org/show_bug.cgi?id=42570 Link: http://lkml.kernel.org/r/20190712090455.266021-1-arnd@arndb.de Signed-off-by: Arnd Bergmann Acked-by: David Rientjes Reviewed-by: Andrew Morton Cc: Christoph Lameter Cc: Pekka Enberg Cc: Joonsoo Kim Cc: Stephen Rothwell Cc: Roman Gushchin Cc: Shakeel Butt Cc: Vladimir Davydov Cc: Andrey Konovalov Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 7b7c1df2883dd4393592859758c3e76207da8b1d Author: Arnd Bergmann Date: Tue Jul 16 16:25:54 2019 -0700 lib/mpi/longlong.h: fix building with 32-bit x86 The mpi library contains some rather old inline assembly statements that produce a lot of warnings for 32-bit x86, such as: lib/mpi/mpih-div.c:76:16: error: invalid use of a cast in a inline asm context requiring an l-value: remove the cast or build with -fheinous-gnu-extensions udiv_qrnnd(qp[i], n1, n1, np[i], d); ~~~~~~~~~~~^~~~~~~~~~~~~~~~~~~~~~~~ lib/mpi/longlong.h:423:20: note: expanded from macro 'udiv_qrnnd' : "=a" ((USItype)(q)), \ ~~~~~~~~~~^~ There is no point in doing a type cast for the output of an inline assembler statement, so just remove the cast here, as we have done for other architectures in the past. See also dea632cadd12 ("lib/mpi: fix build with clang"). Link: http://lkml.kernel.org/r/20190712090740.340186-1-arnd@arndb.de Signed-off-by: Arnd Bergmann Reviewed-by: Nick Desaulniers Cc: Stefan Agner Cc: Dmitry Kasatkin Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit e5f2249ab8538feb86ba844fea87974c1973f63f Author: Arnd Bergmann Date: Tue Jul 16 16:25:51 2019 -0700 mm/shmem.c: fix unused shmem_parse_huge() function warning When CONFIG_SYSFS is disabled but CONFIG_TMPFS is enabled, we get a warning about shmem_parse_huge() never being called: mm/shmem.c:417:12: error: unused function 'shmem_parse_huge' [-Werror,-Wunused-function] static int shmem_parse_huge(const char *str) Change the #ifdef so we no longer build this function in that configuration. Link: http://lkml.kernel.org/r/20190712091141.673355-1-arnd@arndb.de Fixes: 144df3b288c4 ("vfs: Convert ramfs, shmem, tmpfs, devtmpfs, rootfs to use the new mount API") Signed-off-by: Arnd Bergmann Cc: Hugh Dickins Cc: Arnd Bergmann Cc: David Howells Cc: Al Viro Cc: Matthew Wilcox Cc: Vlastimil Babka Cc: Andrea Arcangeli Cc: Vineeth Remanan Pillai Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit bb9a374dfa3a2f46581455ab66cd1d24c5e3d183 Author: Vitaly Wool Date: Tue Jul 16 16:25:48 2019 -0700 mm/z3fold: don't try to use buddy slots after free As reported by Henry Burns: Running z3fold stress testing with address sanitization showed zhdr->slots was being used after it was freed. z3fold_free(z3fold_pool, handle) free_handle(handle) kmem_cache_free(pool->c_handle, zhdr->slots) release_z3fold_page_locked_list(kref) __release_z3fold_page(zhdr, true) zhdr_to_pool(zhdr) slots_to_pool(zhdr->slots) *BOOM* To fix this, add pointer to the pool back to z3fold_header and modify zhdr_to_pool to return zhdr->pool. Link: http://lkml.kernel.org/r/20190708134808.e89f3bfadd9f6ffd7eff9ba9@gmail.com Fixes: 7c2b8baa61fe ("mm/z3fold.c: add structure for buddy handles") Signed-off-by: Vitaly Wool Reported-by: Henry Burns Reviewed-by: Shakeel Butt Cc: Jonathan Adams Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 1cb59a6074e23c6f6513642f752a6d8d38327354 Author: Ilya Leoshkevich Date: Tue Jul 16 14:58:27 2019 +0200 selftests/bpf: fix perf_buffer on s390 perf_buffer test fails for exactly the same reason test_attach_probe used to fail: different nanosleep syscall kprobe name. Reuse the test_attach_probe fix. Fixes: ee5cf82ce04a ("selftests/bpf: test perf buffer API") Signed-off-by: Ilya Leoshkevich Acked-by: Andrii Nakryiko Signed-off-by: Alexei Starovoitov commit 9d1f62a6dcf0de3ab184c1f7b7d82117dcbab090 Author: Andrii Nakryiko Date: Tue Jul 16 12:38:37 2019 -0700 selftests/bpf: structure test_{progs, maps, verifier} test runners uniformly It's easier to follow the logic if it's structured the same. There is just slight difference between test_progs/test_maps and test_verifier. test_verifier's verifier/*.c files are not really compilable C files (they are more of include headers), so they can't be specified as explicit dependencies of test_verifier. Cc: Alexei Starovoitov Signed-off-by: Andrii Nakryiko Signed-off-by: Alexei Starovoitov commit 36646b22ce2455c25c76c9023a0e5ca58d62899a Author: Andrii Nakryiko Date: Tue Jul 16 12:38:36 2019 -0700 selftests/bpf: fix test_verifier/test_maps make dependencies e46fc22e60a4 ("selftests/bpf: make directory prerequisites order-only") exposed existing problem in Makefile for test_verifier and test_maps tests: their dependency on auto-generated header file with a list of all tests wasn't recorded explicitly. This patch fixes these issues. Fixes: 51a0e301a563 ("bpf: Add BPF_MAP_TYPE_SK_STORAGE test to test_maps") Fixes: 6b7b6995c43e ("selftests: bpf: tests.h should depend on .c files, not the output") Cc: Ilya Leoshkevich Cc: Stanislav Fomichev Cc: Martin KaFai Lau Signed-off-by: Andrii Nakryiko Signed-off-by: Alexei Starovoitov commit 5a46421789f46165416d2b4834647b153c231c55 Author: Cedric Hombourger Date: Tue Jul 9 09:43:35 2019 +0200 builddeb: generate multi-arch friendly linux-libc-dev package Debian-based distributions place libc header files in a machine specific directory (/usr/include/) instead of /usr/include/asm to support installation of the linux-libc-dev package from multiple architectures. Move headers installed by "make headers_install" accordingly using Debian's tuple from dpkg-architecture (stored in debian/arch). Signed-off-by: Cedric Hombourger Signed-off-by: Masahiro Yamada commit 3266c806dc8692e079768ee2814498dcd6a91e61 Author: Masahiro Yamada Date: Wed Jun 5 03:14:53 2019 +0900 kconfig: run olddefconfig instead of oldconfig after merging fragments 'make olddefconfig' is non-interactive, so we can drop 'yes'. The behavior is equivalent. Signed-off-by: Masahiro Yamada commit b74c0cad3d5f4f2252f1a42e160dc0e202e88e93 Author: Masahiro Yamada Date: Wed May 15 13:27:21 2019 +0900 riscv: drop unneeded -Wall addition The top level Makefile adds -Wall globally: KBUILD_CFLAGS := -Wall -Wundef -Werror=strict-prototypes -Wno-trigraphs \ For riscv, I see two "-Wall" added for compiling each object. Signed-off-by: Masahiro Yamada commit eef58fdd010796a39be721b66c80d4a19b876e79 Author: Masahiro Yamada Date: Fri Apr 12 12:09:41 2019 +0900 memory: ti-emif-sram: move driver-specific asm-offset.h to drivers/memory/ is only generated and included by drivers/memory/, so it does not need to reside in the globally visible include/generated/. Signed-off-by: Masahiro Yamada Acked-by: Santosh Shilimkar commit 406de552c2be6ded524c75d14a73cf7f027f587e Author: Thomas Hellstrom Date: Thu Mar 28 12:06:37 2019 +0000 MAINTAINERS: Update PARAVIRT_OPS_INTERFACE and VMWARE_HYPERVISOR_INTERFACE Alok Kataria will be handing over VMware's maintainership of these interfaces to Thomas Hellström, with pv-drivers as backup contact. Signed-off-by: Thomas Hellstrom Signed-off-by: Thomas Gleixner Acked-by: Alok Kataria Acked-by: Juergen Gross Link: https://lkml.kernel.org/r/20190328120558.29897-1-thellstrom@vmware.com commit 50e04acf2990d0d93983720b0a85b11ef805df60 Author: Jann Horn Date: Sat Jul 13 00:41:52 2019 +0200 x86/process: Delete useless check for dead process with LDT At release_thread(), ->mm is NULL; and it is fine for the former mm to still have an LDT. Delete this check in process_64.c, similar to commit 2684927c6b93 ("[PATCH] x86: Deprecate useless bug"), which did the same in process_32.c. Signed-off-by: Jann Horn Signed-off-by: Thomas Gleixner Link: https://lkml.kernel.org/r/20190712224152.13129-1-jannh@google.com commit 29e7e9664aec17b94a9c8c5a75f8d216a206aa3a Author: Arnd Bergmann Date: Fri Jul 12 11:08:05 2019 +0200 x86: math-emu: Hide clang warnings for 16-bit overflow clang warns about a few parts of the math-emu implementation where a 16-bit integer becomes negative during assignment: arch/x86/math-emu/poly_tan.c:88:35: error: implicit conversion from 'int' to 'short' changes value from 49216 to -16320 [-Werror,-Wconstant-conversion] (0x41 + EXTENDED_Ebias) | SIGN_Negative); ~~~~~~~~~~~~~~~~~~~~~~~~^~~~~~~~~~~~~~~~ arch/x86/math-emu/fpu_emu.h:180:58: note: expanded from macro 'setexponent16' #define setexponent16(x,y) { (*(short *)&((x)->exp)) = (y); } ~ ^ arch/x86/math-emu/reg_constant.c:37:32: error: implicit conversion from 'int' to 'short' changes value from 49085 to -16451 [-Werror,-Wconstant-conversion] FPU_REG const CONST_PI2extra = MAKE_REG(NEG, -66, ^~~~~~~~~~~~~~~~~~ arch/x86/math-emu/reg_constant.c:21:25: note: expanded from macro 'MAKE_REG' ((EXTENDED_Ebias+(e)) | ((SIGN_##s != 0)*0x8000)) } ~~~~~~~~~~~~~~~~~~~~~^~~~~~~~~~~~~~~~~~~~~~~~~~ arch/x86/math-emu/reg_constant.c:48:28: error: implicit conversion from 'int' to 'short' changes value from 65535 to -1 [-Werror,-Wconstant-conversion] FPU_REG const CONST_QNaN = MAKE_REG(NEG, EXP_OVER, 0x00000000, 0xC0000000); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ arch/x86/math-emu/reg_constant.c:21:25: note: expanded from macro 'MAKE_REG' ((EXTENDED_Ebias+(e)) | ((SIGN_##s != 0)*0x8000)) } ~~~~~~~~~~~~~~~~~~~~~^~~~~~~~~~~~~~~~~~~~~~~~~~ The code is correct as is, so add a typecast to shut up the warnings. Signed-off-by: Arnd Bergmann Signed-off-by: Thomas Gleixner Link: https://lkml.kernel.org/r/20190712090816.350668-1-arnd@arndb.de commit 0a8ad0ffa4d80a544f6cbff703bf6394339afcdf Merge: a18f8775419d e65682b55956 Author: Linus Torvalds Date: Tue Jul 16 15:15:29 2019 -0700 Merge tag 'for-linus-5.3-ofs1' of git://git.kernel.org/pub/scm/linux/kernel/git/hubcap/linux Pull orangefs updates from Mike Marshall: "Two small fixes. This is just a fix for an unused value that Colin King sent me and a related fix I added" * tag 'for-linus-5.3-ofs1' of git://git.kernel.org/pub/scm/linux/kernel/git/hubcap/linux: orangefs: eliminate needless variable assignments orangefs: remove redundant assignment to variable buffer_index commit a18f8775419d3df282dd83efdb51c5a64d092f31 Merge: 3eb514866f20 e02d48eaaed7 Author: Linus Torvalds Date: Tue Jul 16 15:12:56 2019 -0700 Merge tag 'for-5.3-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux Pull btrfs updates from David Sterba: "Highlights: - chunks that have been trimmed and unchanged since last mount are tracked and skipped on repeated trims - use hw assissed crc32c on more arches, speedups if native instructions or optimized implementation is available - the RAID56 incompat bit is automatically removed when the last block group of that type is removed Fixes: - fsync fix for reflink on NODATACOW files that could lead to ENOSPC - fix data loss after inode eviction, renaming it, and fsync it - fix fsync not persisting dentry deletions due to inode evictions - update ctime/mtime/iversion after hole punching - fix compression type validation (reported by KASAN) - send won't be allowed to start when relocation is in progress, this can cause spurious errors or produce incorrect send stream Core: - new tracepoints for space update - tree-checker: better check for end of extents for some tree items - preparatory work for more checksum algorithms - run delayed iput at unlink time and don't push the work to cleaner thread where it's not properly throttled - wrap block mapping to structures and helpers, base for further refactoring - split large files, part 1: - space info handling - block group reservations - delayed refs - delayed allocation - other cleanups and refactoring" * tag 'for-5.3-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux: (103 commits) btrfs: fix memory leak of path on error return path btrfs: move the subvolume reservation stuff out of extent-tree.c btrfs: migrate the delalloc space stuff to it's own home btrfs: migrate btrfs_trans_release_chunk_metadata btrfs: migrate the delayed refs rsv code btrfs: Evaluate io_tree in find_lock_delalloc_range() btrfs: migrate the global_block_rsv helpers to block-rsv.c btrfs: migrate the block-rsv code to block-rsv.c btrfs: stop using block_rsv_release_bytes everywhere btrfs: cleanup the target logic in __btrfs_block_rsv_release btrfs: export __btrfs_block_rsv_release btrfs: export btrfs_block_rsv_add_bytes btrfs: move btrfs_block_rsv definitions into it's own header btrfs: Simplify update of space_info in __reserve_metadata_bytes() btrfs: unexport can_overcommit btrfs: move reserve_metadata_bytes and supporting code to space-info.c btrfs: move dump_space_info to space-info.c btrfs: export block_rsv_use_bytes btrfs: move btrfs_space_info_add_*_bytes to space-info.c btrfs: move the space info update macro to space-info.h ... commit 3eb514866f20c5eb74637279774b6d73b855480a Merge: c309b6f24222 24a20b0a443f Author: Linus Torvalds Date: Tue Jul 16 15:07:51 2019 -0700 Merge tag 'arc-5.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vgupta/arc Pull ARC updates from Vineet Gupta: - long due rewrite of do_page_fault - refactoring of entry/exit code to utilize the double load/store instructions - hsdk platform updates * tag 'arc-5.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vgupta/arc: ARC: [plat-hsdk]: Enable AXI DW DMAC in defconfig ARC: [plat-hsdk]: enable DW SPI controller ARC: hide unused function unw_hdr_alloc ARC: [haps] Add Virtio support ARCv2: entry: simplify return to Delay Slot via interrupt ARC: entry: EV_Trap expects r10 (vs. r9) to have exception cause ARCv2: entry: rewrite to enable use of double load/stores LDD/STD ARCv2: entry: avoid a branch ARCv2: entry: push out the Z flag unclobber from common EXCEPTION_PROLOGUE ARCv2: entry: comments about hardware auto-save on taken interrupts ARC: mm: do_page_fault refactor #8: release mmap_sem sooner ARC: mm: do_page_fault refactor #7: fold the various error handling ARC: mm: do_page_fault refactor #6: error handlers to use same pattern ARC: mm: do_page_fault refactor #5: scoot no_context to end ARC: mm: do_page_fault refactor #4: consolidate retry related logic ARC: mm: do_page_fault refactor #3: tidyup vma access permission code ARC: mm: do_page_fault refactor #2: remove short lived variable ARC: mm: do_page_fault refactor #1: remove label @good_area commit a5b647007e9d794956dbed9339a3354a9fc4d5c3 Author: Vedang Patel Date: Tue Jul 16 12:52:18 2019 -0700 fix: taprio: Change type of txtime-delay parameter to u32 During the review of the iproute2 patches for txtime-assist mode, it was pointed out that it does not make sense for the txtime-delay parameter to be negative. So, change the type of the parameter from s32 to u32. Fixes: 4cfd5779bd6e ("taprio: Add support for txtime-assist mode") Reported-by: Stephen Hemminger Signed-off-by: Vedang Patel Signed-off-by: David S. Miller commit f709f81483d652b4ae5bbda2204b95593ce07c8f Author: Yi Wang Date: Mon Jul 15 10:47:09 2019 +0800 x86/e820: Use proper booleans instead of 0/1 This fixes the following coccinelle warning: ./arch/x86/kernel/e820.c:89:9-10: WARNING: return of 0/1 in function '_e820__mapped_any' with return type bool Return type bool instead of 0/1. Signed-off-by: Yi Wang Signed-off-by: Thomas Gleixner Link: https://lkml.kernel.org/r/1563158829-44373-1-git-send-email-wang.yi59@zte.com.cn commit ec6335586953b0df32f83ef696002063090c7aef Author: Qian Cai Date: Mon Jul 8 17:36:45 2019 -0400 x86/apic: Silence -Wtype-limits compiler warnings There are many compiler warnings like this, In file included from ./arch/x86/include/asm/smp.h:13, from ./arch/x86/include/asm/mmzone_64.h:11, from ./arch/x86/include/asm/mmzone.h:5, from ./include/linux/mmzone.h:969, from ./include/linux/gfp.h:6, from ./include/linux/mm.h:10, from arch/x86/kernel/apic/io_apic.c:34: arch/x86/kernel/apic/io_apic.c: In function 'check_timer': ./arch/x86/include/asm/apic.h:37:11: warning: comparison of unsigned expression >= 0 is always true [-Wtype-limits] if ((v) <= apic_verbosity) \ ^~ arch/x86/kernel/apic/io_apic.c:2160:2: note: in expansion of macro 'apic_printk' apic_printk(APIC_QUIET, KERN_INFO "..TIMER: vector=0x%02X " ^~~~~~~~~~~ ./arch/x86/include/asm/apic.h:37:11: warning: comparison of unsigned expression >= 0 is always true [-Wtype-limits] if ((v) <= apic_verbosity) \ ^~ arch/x86/kernel/apic/io_apic.c:2207:4: note: in expansion of macro 'apic_printk' apic_printk(APIC_QUIET, KERN_ERR "..MP-BIOS bug: " ^~~~~~~~~~~ APIC_QUIET is 0, so silence them by making apic_verbosity type int. Signed-off-by: Qian Cai Signed-off-by: Thomas Gleixner Link: https://lkml.kernel.org/r/1562621805-24789-1-git-send-email-cai@lca.pw commit ffdb07f31252625b7bcbf1f424d7beccff02ba97 Author: David Rientjes Date: Wed Jul 10 13:19:35 2019 -0700 x86/mm: Free sme_early_buffer after init The contents of sme_early_buffer should be cleared after __sme_early_enc_dec() because it is used to move encrypted and decrypted data, but since __sme_early_enc_dec() is __init this buffer simply can be freed after init. This saves a page that is otherwise unreferenced after init. Reported-by: Cfir Cohen Signed-off-by: David Rientjes Signed-off-by: Thomas Gleixner Link: https://lkml.kernel.org/r/alpine.DEB.2.21.1907101318170.197432@chino.kir.corp.google.com commit e74bd96989dd42a51a73eddb4a5510a6f5e42ac3 Author: David Rientjes Date: Tue Jul 9 19:44:03 2019 -0700 x86/boot: Fix memory leak in default_get_smp_config() When default_get_smp_config() is called with early == 1 and mpf->feature1 is non-zero, mpf is leaked because the return path does not do early_memunmap(). Fix this and share a common exit routine. Fixes: 5997efb96756 ("x86/boot: Use memremap() to map the MPF and MPC data") Reported-by: Cfir Cohen Signed-off-by: David Rientjes Signed-off-by: Thomas Gleixner Cc: stable@vger.kernel.org Link: https://lkml.kernel.org/r/alpine.DEB.2.21.1907091942570.28240@chino.kir.corp.google.com commit db8051f30fbab7f579d691137f1e23f3bb1ac2eb Author: Qian Cai Date: Tue Jul 16 11:43:05 2019 -0400 skbuff: fix compilation warnings in skb_dump() The commit 6413139dfc64 ("skbuff: increase verbosity when dumping skb data") introduced a few compilation warnings. net/core/skbuff.c:766:32: warning: format specifies type 'unsigned short' but the argument has type 'unsigned int' [-Wformat] level, sk->sk_family, sk->sk_type, sk->sk_protocol); ^~~~~~~~~~~ net/core/skbuff.c:766:45: warning: format specifies type 'unsigned short' but the argument has type 'unsigned int' [-Wformat] level, sk->sk_family, sk->sk_type, sk->sk_protocol); ^~~~~~~~~~~~~~~ Fix them by using the proper types. Fixes: 6413139dfc64 ("skbuff: increase verbosity when dumping skb data") Signed-off-by: Qian Cai Reviewed-by: Nathan Chancellor Acked-by: Willem de Bruijn Signed-off-by: David S. Miller commit 4914da2fb0c89205790503f20dfdde854f3afdd8 Author: Takashi Iwai Date: Tue Jul 16 08:56:51 2019 +0200 ALSA: hda - Don't resume forcibly i915 HDMI/DP codec We apply the codec resume forcibly at system resume callback for updating and syncing the jack detection state that may have changed during sleeping. This is, however, superfluous for the codec like Intel HDMI/DP, where the jack detection is managed via the audio component notification; i.e. the jack state change shall be reported sooner or later from the graphics side at mode change. This patch changes the codec resume callback to avoid the forcible resume conditionally with a new flag, codec->relaxed_resume, for reducing the resume time. The flag is set in the codec probe. Although this doesn't fix the entire bug mentioned in the bugzilla entry below, it's still a good optimization and some improvements are seen. Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=201901 Cc: Signed-off-by: Takashi Iwai commit 9087c37584fb7d8315877bb55f85e4268cc0b4f4 Author: Tom Lendacky Date: Wed Jul 10 19:01:19 2019 +0000 dma-direct: Force unencrypted DMA under SME for certain DMA masks If a device doesn't support DMA to a physical address that includes the encryption bit (currently bit 47, so 48-bit DMA), then the DMA must occur to unencrypted memory. SWIOTLB is used to satisfy that requirement if an IOMMU is not active (enabled or configured in passthrough mode). However, commit fafadcd16595 ("swiotlb: don't dip into swiotlb pool for coherent allocations") modified the coherent allocation support in SWIOTLB to use the DMA direct coherent allocation support. When an IOMMU is not active, this resulted in dma_alloc_coherent() failing for devices that didn't support DMA addresses that included the encryption bit. Addressing this requires changes to the force_dma_unencrypted() function in kernel/dma/direct.c. Since the function is now non-trivial and SME/SEV specific, update the DMA direct support to add an arch override for the force_dma_unencrypted() function. The arch override is selected when CONFIG_AMD_MEM_ENCRYPT is set. The arch override function resides in the arch/x86/mm/mem_encrypt.c file and forces unencrypted DMA when either SEV is active or SME is active and the device does not support DMA to physical addresses that include the encryption bit. Fixes: fafadcd16595 ("swiotlb: don't dip into swiotlb pool for coherent allocations") Suggested-by: Christoph Hellwig Signed-off-by: Tom Lendacky Acked-by: Thomas Gleixner [hch: moved the force_dma_unencrypted declaration to dma-mapping.h, fold the s390 fix from Halil Pasic] Signed-off-by: Christoph Hellwig commit d72e04d97efdd518514018bf96169bf68922eed6 Author: Nathan Chancellor Date: Wed Jul 3 22:52:17 2019 -0700 drm/amd/powerplay: Use proper enums in vega20_print_clk_levels clang warns: drivers/gpu/drm/amd/amdgpu/../powerplay/vega20_ppt.c:995:39: warning: implicit conversion from enumeration type 'PPCLK_e' to different enumeration type 'enum smu_clk_type' [-Wenum-conversion] ret = smu_get_current_clk_freq(smu, PPCLK_SOCCLK, &now); ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^~~~~~~~~~~~~~~~~~~ drivers/gpu/drm/amd/amdgpu/../powerplay/vega20_ppt.c:1016:39: warning: implicit conversion from enumeration type 'PPCLK_e' to different enumeration type 'enum smu_clk_type' [-Wenum-conversion] ret = smu_get_current_clk_freq(smu, PPCLK_FCLK, &now); ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^~~~~~~~~~~~~~~~~ drivers/gpu/drm/amd/amdgpu/../powerplay/vega20_ppt.c:1031:39: warning: implicit conversion from enumeration type 'PPCLK_e' to different enumeration type 'enum smu_clk_type' [-Wenum-conversion] ret = smu_get_current_clk_freq(smu, PPCLK_DCEFCLK, &now); ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^~~~~~~~~~~~~~~~~~~~ The values are mapped one to one in vega20_get_smu_clk_index so just use the proper enums here. Fixes: 096761014227 ("drm/amd/powerplay: support sysfs to get socclk, fclk, dcefclk") Link: https://github.com/ClangBuiltLinux/linux/issues/587 Reviewed-by: Evan Quan Signed-off-by: Nathan Chancellor Signed-off-by: Alex Deucher commit 08473888e09b0136ceb4d65784b02b537d977a2a Author: Nicolai Hähnle Date: Tue Jul 16 13:11:22 2019 -0500 drm/amdgpu/gfx10: set SH_MEM_CONFIG.INITIAL_INST_PREFETCH Prefetch mode 0 is not supported and can lead to hangs with certain very specific code patterns. Set a sound prefetch mode for all VMIDs rather than forcing all shaders to set the prefetch mode at the beginning. Reduce code duplication a bit while we're at it. Note that the 64-bit address mode enum and the retry all enum are both 0, so the only functional change is in the INITIAL_INST_PREFETCH field. Signed-off-by: Nicolai Hähnle Reviewed-by: Marek Olšák Acked-by: Felix Kuehling Signed-off-by: Alex Deucher commit 597292eb73eefe4e48f9f72640955813d59b733a Author: Kenneth Feng Date: Tue Jul 16 15:01:31 2019 +0800 drm/amd/powerplay: enable fw ctf,apcc dfll and gfx ss enable fw ctf, apcc dfll and gfx ss on navi10. fw ctf: when the fw ctf is triggered, the gfx and soc power domain are shut down. fan speed is boosted to the maximum. gfx ss: hardware feature, sanity check has been done. apcc dfll: can check the scoreboard in smu fw to confirm if it's enabled. no need to do further check since the gfx hardware control the frequency once a pcc signal comes. Signed-off-by: Kenneth Feng Reviewed-by: Evan Quan Signed-off-by: Alex Deucher commit f216994613bc9f44202eac3a298e52124eb3e35e Author: Hawking Zhang Date: Tue Jul 16 13:48:19 2019 +0800 drm/amdgpu: check kdb_bin_size to exclude kdb loading sequence The legacy navi10 sos binary will not carry on kdb image. the kdb_start_addr is actually the start address of sys_drv image and shouldn't be sent to psp bootloader. Signed-off-by: Hawking Zhang Reviewed-by: John Clements Signed-off-by: Alex Deucher commit 9288b874c5006a22d1fbff303b812cb03241cdfb Author: Felix Kuehling Date: Sat Jul 13 02:35:37 2019 -0400 drm/amdgpu: Fix unaligned memory copies When starting a new mm_node, the page_offset becomes 0. Signed-off-by: Felix Kuehling Reviewed-by: Alex Deucher Reviewed-by: Christian König Signed-off-by: Alex Deucher commit 7429c6c0d9cb086d8e79f0d2a48ae14851d2115e Author: Benjamin Poirier Date: Tue Jul 16 17:16:55 2019 +0900 be2net: Signal that the device cannot transmit during reconfiguration While changing the number of interrupt channels, be2net stops adapter operation (including netif_tx_disable()) but it doesn't signal that it cannot transmit. This may lead dev_watchdog() to falsely trigger during that time. Add the missing call to netif_carrier_off(), following the pattern used in many other drivers. netif_carrier_on() is already taken care of in be_open(). Signed-off-by: Benjamin Poirier Signed-off-by: David S. Miller commit cf36dd2f7793e8b2723e3eca518fff1be840a297 Author: Nishka Dasgupta Date: Tue Jul 16 11:25:04 2019 +0530 net: ethernet: mediatek: mtk_eth_soc: Add of_node_put() before goto Each iteration of for_each_child_of_node puts the previous node, but in the case of a goto from the middle of the loop, there is no put, thus causing a memory leak. Hence add an of_node_put before the goto. Issue found with Coccinelle. Signed-off-by: Nishka Dasgupta Signed-off-by: David S. Miller commit 64fc973dee130019b86f2c4634a10d7a3158687e Author: Nishka Dasgupta Date: Tue Jul 16 11:22:19 2019 +0530 net: ethernet: mscc: ocelot_board: Add of_node_put() before return Each iteration of for_each_available_child_of_node puts the previous node, but in the case of a return from the middle of the loop, there is no put, thus causing a memory leak. Hence add an of_node_put before the return in two places. Issue found with Coccinelle. Signed-off-by: Nishka Dasgupta Signed-off-by: David S. Miller commit 3cd6e20f54d5003ea895717b67017397056749ce Author: Nishka Dasgupta Date: Tue Jul 16 11:18:43 2019 +0530 net: ethernet: ti: cpsw: Add of_node_put() before return and break Each iteration of for_each_available_child_of_node puts the previous node, but in the case of a return or break from the middle of the loop, there is no put, thus causing a memory leak. Hence, for function cpsw_probe_dt, create an extra label err_node_put that puts the last used node and returns ret; modify the return statements in the loop to save the return value in ret and goto this new label. For function cpsw_remove_dt, add an of_node_put before the break. Issue found with Coccinelle. Signed-off-by: Nishka Dasgupta Signed-off-by: David S. Miller commit c309b6f24222246c18a8b65d3950e6e755440865 Merge: 3e859477a1db 168869492e70 Author: Linus Torvalds Date: Tue Jul 16 12:21:41 2019 -0700 Merge tag 'docs/v5.3-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media Pull rst conversion of docs from Mauro Carvalho Chehab: "As agreed with Jon, I'm sending this big series directly to you, c/c him, as this series required a special care, in order to avoid conflicts with other trees" * tag 'docs/v5.3-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: (77 commits) docs: kbuild: fix build with pdf and fix some minor issues docs: block: fix pdf output docs: arm: fix a breakage with pdf output docs: don't use nested tables docs: gpio: add sysfs interface to the admin-guide docs: locking: add it to the main index docs: add some directories to the main documentation index docs: add SPDX tags to new index files docs: add a memory-devices subdir to driver-api docs: phy: place documentation under driver-api docs: serial: move it to the driver-api docs: driver-api: add remaining converted dirs to it docs: driver-api: add xilinx driver API documentation docs: driver-api: add a series of orphaned documents docs: admin-guide: add a series of orphaned documents docs: cgroup-v1: add it to the admin-guide book docs: aoe: add it to the driver-api book docs: add some documentation dirs to the driver-api book docs: driver-model: move it to the driver-api book docs: lp855x-driver.rst: add it to the driver-api book ... commit 3e859477a1db52a0435d06a55fdb54f62d69c292 Merge: 1ec4013bab89 775f1f7eaced Author: Linus Torvalds Date: Tue Jul 16 12:17:07 2019 -0700 Merge tag 'xtensa-20190715' of git://github.com/jcmvbkbc/linux-xtensa Pull Xtensa updates from Max Filippov: - clean up PCI support code - add defconfig and DTS for the 'virt' board - abstract 'entry' and 'retw' uses in xtensa assembly in preparation for XEA3/NX pipeline support - random small cleanups * tag 'xtensa-20190715' of git://github.com/jcmvbkbc/linux-xtensa: xtensa: virt: add defconfig and DTS xtensa: abstract 'entry' and 'retw' in assembly code xtensa: One function call less in bootmem_init() xtensa: remove arch/xtensa/include/asm/types.h xtensa: use generic pcibios_set_master and pcibios_enable_device xtensa: drop dead PCI support code xtensa/PCI: Remove unused variable commit 0aeb1def44169cbe7119f26cf10b974a2046142e Author: Cong Wang Date: Sat May 25 09:58:01 2019 -0700 tracing: Make trace_get_fields() global trace_get_fields() is the only way to read tracepoint fields at run time, as their fields are defined at compile-time with macros. Make this function visible to all users and it will be used by trace event injection code to calculate the size of a tracepoint entry. Link: http://lkml.kernel.org/r/20190525165802.25944-4-xiyou.wangcong@gmail.com Cc: Ingo Molnar Signed-off-by: Cong Wang Signed-off-by: Steven Rostedt (VMware) commit 5967bd5c4239be449744a1471daf60c866486c24 Author: Cong Wang Date: Sat May 25 09:58:00 2019 -0700 tracing: Let filter_assign_type() detect FILTER_PTR_STRING filter_assign_type() could detect dynamic string and static string, but not string pointers. Teach filter_assign_type() to detect string pointers, and this will be needed by trace event injection code. BTW, trace event hist uses FILTER_PTR_STRING too. Link: http://lkml.kernel.org/r/20190525165802.25944-3-xiyou.wangcong@gmail.com Cc: Ingo Molnar Signed-off-by: Cong Wang Signed-off-by: Steven Rostedt (VMware) commit 46710f3a34b592ac5c51a95f696b2d2a2a0d9419 Author: Cong Wang Date: Sat May 25 09:57:59 2019 -0700 tracing: Pass type into tracing_generic_entry_update() All callers of tracing_generic_entry_update() have to initialize entry->type, so let's just simply move it inside. Link: http://lkml.kernel.org/r/20190525165802.25944-2-xiyou.wangcong@gmail.com Cc: Ingo Molnar Signed-off-by: Cong Wang Signed-off-by: Steven Rostedt (VMware) commit 6e55f320f00e4db7144a4906dd8ac53701891e31 Author: Steven Rostedt (VMware) Date: Wed Jul 3 15:46:08 2019 -0400 ftrace/selftest: Test if set_event/ftrace_pid exists before writing While testing on a very old kernel (3.5), the tests failed because the write to set_event_pid in the setup code, did not exist. The tests themselves could pass, but the setup failed causing an error. Other files test for existance before writing to them. Do the same for set_event_pid and set_ftrace_pid. Acked-by: Masami Hiramatsu Signed-off-by: Steven Rostedt (VMware) commit cbd965bde74c3d0e53798404fd4b9829a68ccec8 Author: Steven Rostedt (VMware) Date: Wed Jul 3 14:40:42 2019 -0400 ftrace/selftests: Return the skip code when tracing directory not configured in kernel If the kernel is not configured with ftrace enabled, the ftracetest selftests should return the error code of "4" as that is the kselftests "skip" code, and not "1" which means an error. To determine if ftrace is enabled, first the newer "tracefs" is searched for in /proc/mounts. If it is not found, then "debugfs" is searched for (as old kernels do not have tracefs). If that is not found, an attempt to mount the tracefs or debugfs is performed. This is done by seeing first if the /sys/kernel/tracing directory exists. If it does than tracefs is configured in the kernel and an attempt to mount it is performed. If /sys/kernel/tracing does not exist, then /sys/kernel/debug is tested to see if that directory exists. If it does, then an attempt to mount debugfs on that directory is performed. If it does not exist, then debugfs is not configured in the running kernel and the test exits with the skip code. If either mount fails, then a normal error is returned as they do exist in the kernel but something went wrong to mount them. This changes the test to always try the tracefs file system first as it has been in the kernel for some time now and it is better to test it if it is available instead of always testing debugfs. Link: http://lkml.kernel.org/r/20190702062358.7330-1-po-hsu.lin@canonical.com Reported-by: Po-Hsu Lin Acked-by: Masami Hiramatsu Signed-off-by: Steven Rostedt (VMware) commit 715fa2fd4c6c3e9165659ac26a582b8a2e607b93 Author: Masami Hiramatsu Date: Sat Jun 1 00:18:07 2019 +0900 tracing/kprobe: Check registered state using kprobe Change registered check only by trace_kprobe and remove TP_FLAG_REGISTERED from trace_probe, since this feature is only used for trace_kprobe. Link: http://lkml.kernel.org/r/155931588704.28323.4952266828256245833.stgit@devnote2 Signed-off-by: Masami Hiramatsu Signed-off-by: Steven Rostedt (VMware) commit e3dc9f898ef9c6a1a96378517573ee2d04d0abcc Author: Masami Hiramatsu Date: Sat Jun 1 00:17:57 2019 +0900 tracing/probe: Add trace_event_call accesses APIs Add trace_event_call access APIs for trace_probe. Instead of accessing trace_probe.call directly, use those accesses by trace_probe_event_call() method. This hides the relationship of trace_event_call and trace_probe from trace_kprobe and trace_uprobe. Link: http://lkml.kernel.org/r/155931587711.28323.8335129014686133120.stgit@devnote2 Signed-off-by: Masami Hiramatsu Signed-off-by: Steven Rostedt (VMware) commit b55ce203a8f327b623688c8fb551ac3f9781edea Author: Masami Hiramatsu Date: Sat Jun 1 00:17:47 2019 +0900 tracing/probe: Add probe event name and group name accesses APIs Add trace_probe_name() and trace_probe_group_name() functions for accessing probe name and group name of trace_probe. Link: http://lkml.kernel.org/r/155931586717.28323.8738615064952254761.stgit@devnote2 Signed-off-by: Masami Hiramatsu Signed-off-by: Steven Rostedt (VMware) commit 747774d6b018ca02493fd3f321624dfce749da61 Author: Masami Hiramatsu Date: Sat Jun 1 00:17:37 2019 +0900 tracing/probe: Add trace flag access APIs for trace_probe Add trace_probe_test/set/clear_flag() functions for accessing trace_probe.flag field. This flags field should not be accessed directly. Link: http://lkml.kernel.org/r/155931585683.28323.314290023236905988.stgit@devnote2 Signed-off-by: Masami Hiramatsu Signed-off-by: Steven Rostedt (VMware) commit b5f935ee133911b3ed2d4429dd86d2bd5385519d Author: Masami Hiramatsu Date: Sat Jun 1 00:17:26 2019 +0900 tracing/probe: Add trace_event_file access APIs for trace_probe Add trace_event_file access APIs for trace_probe data structure. This simplifies enabling/disabling operations in uprobe and kprobe events so that those don't touch deep inside the trace_probe. This also removing a redundant synchronization when the kprobe event is used from perf, since the perf itself uses tracepoint_synchronize_unregister() after disabling (ftrace- defined) event, thus we don't have to synchronize in that path. Also we don't need to identify local trace_kprobe too anymore. Link: http://lkml.kernel.org/r/155931584587.28323.372301976283354629.stgit@devnote2 Signed-off-by: Masami Hiramatsu Signed-off-by: Steven Rostedt (VMware) commit 46e5376d404d14cb321f5d4e446fe3fb6d8a93ab Author: Masami Hiramatsu Date: Sat Jun 1 00:17:16 2019 +0900 tracing/probe: Add trace_event_call register API for trace_probe Since trace_event_call is a field of trace_probe, these operations should be done in trace_probe.c. trace_kprobe and trace_uprobe use new functions to register/unregister trace_event_call. Link: http://lkml.kernel.org/r/155931583643.28323.14828411185591538876.stgit@devnote2 Signed-off-by: Masami Hiramatsu Signed-off-by: Steven Rostedt (VMware) commit 455b289973f7df350ea179c7eb8bfed0c766ec40 Author: Masami Hiramatsu Date: Sat Jun 1 00:17:06 2019 +0900 tracing/probe: Add trace_probe init and free functions Add common trace_probe init and cleanup function in trace_probe.c, and use it from trace_kprobe.c and trace_uprobe.c Link: http://lkml.kernel.org/r/155931582664.28323.5934870189034740822.stgit@devnote2 Signed-off-by: Masami Hiramatsu Signed-off-by: Steven Rostedt (VMware) commit b4d4b96be89466049a0d383d019edc1403bf0ba9 Author: Masami Hiramatsu Date: Sat Jun 1 00:16:56 2019 +0900 tracing/uprobe: Set print format when parsing command Set event call's print format right after parsed command for simplifying (un)register_uprobe_event(). Link: http://lkml.kernel.org/r/155931581659.28323.5404667166417404076.stgit@devnote2 Signed-off-by: Masami Hiramatsu Signed-off-by: Steven Rostedt (VMware) commit f730e0f2da4d0035775ab3c85757fee37bb9cbbe Author: Masami Hiramatsu Date: Sat Jun 1 00:16:46 2019 +0900 tracing/kprobe: Set print format right after parsed command Set event call's print format right after parsed command for simplifying (un)register_kprobe_event(). Link: http://lkml.kernel.org/r/155931580625.28323.5158822928646225903.stgit@devnote2 Signed-off-by: Masami Hiramatsu Signed-off-by: Steven Rostedt (VMware) commit 65fc965c708c90b8c8b2cea980db0618333dd7fe Author: Masami Hiramatsu Date: Mon Jun 3 22:04:42 2019 +0900 kprobes: Fix to init kprobes in subsys_initcall Since arm64 kernel initializes breakpoint trap vector in arch_initcall(), initializing kprobe (and run smoke test) in postcore_initcall() causes a kernel panic. To fix this issue, move the kprobe initialization in subsys_initcall() (which is called right afer the arch_initcall). In-kernel kprobe users (ftrace and bpf) are using fs_initcall() which is called after subsys_initcall(), so this shouldn't cause more problem. Link: http://lkml.kernel.org/r/155956708268.12228.10363800793132214198.stgit@devnote2 Link: http://lkml.kernel.org/r/20190709153755.GB10123@lakrids.cambridge.arm.com Reported-by: Anders Roxell Fixes: b5f8b32c93b2 ("kprobes: Initialize kprobes at postcore_initcall") Tested-by: Anders Roxell Tested-by: Mark Rutland Signed-off-by: Masami Hiramatsu Signed-off-by: Steven Rostedt (VMware) commit 1ec4013bab89058dcc594dfe7b5a20f5d46bbc5f Merge: 3c69914b4c7b e10337daefec Author: Linus Torvalds Date: Tue Jul 16 11:49:58 2019 -0700 Merge tag 'safesetid-5.3' of git://github.com/micah-morton/linux Pull safesetid updates from Micah Morton: "These changes from Jann Horn fix a couple issues in the recently added SafeSetID LSM: - There was a simple logic bug in one of the hooks for the LSM where the code was incorrectly returning early in some cases before all security checks had been passed. - There was a more high level issue with how this LSM gets configured that could allow for a program to bypass the security restrictions by switching to an allowed UID and then again to any other UID on the system if the target UID of the first transition is unconstrained on the system. Luckily this is an easy fix that we now enforce at the time the LSM gets configured. There are also some changes from Jann that make policy updates for this LSM atomic. Kees Cook, Jann and myself have reviewed these changes and they look good from our point of view" * tag 'safesetid-5.3' of git://github.com/micah-morton/linux: LSM: SafeSetID: fix use of literal -1 in capable hook LSM: SafeSetID: verify transitive constrainedness LSM: SafeSetID: add read handler LSM: SafeSetID: rewrite userspace API to atomic updates LSM: SafeSetID: fix userns handling in securityfs LSM: SafeSetID: refactor policy parsing LSM: SafeSetID: refactor safesetid_security_capable() LSM: SafeSetID: refactor policy hash table LSM: SafeSetID: fix check for setresuid(new1, new2, new3) LSM: SafeSetID: fix pr_warn() to include newline commit 3c69914b4c7b0b72ff0275c14743778057ee8a6e Merge: 2954152298c3 69b53720e92c Author: Linus Torvalds Date: Tue Jul 16 11:30:07 2019 -0700 Merge tag 'for-linus-20190715' of git://git.kernel.org/pub/scm/linux/kernel/git/brauner/linux Pull pidfd and clone3 fixes from Christian Brauner: "This contains a bugfix for CLONE_PIDFD when used with the legacy clone syscall, two fixes to ensure that syscall numbering and clone3 entrypoint implementations will stay consistent, and an update for the maintainers file: - The addition of clone3 broke CLONE_PIDFD for legacy clone on all architectures that use do_fork() directly instead of calling the clone syscall itself. (Fwiw, cleaning do_fork() up is on my todo.) The reason this happened was that during conversion of _do_fork() to use struct kernel_clone_args we missed that do_fork() is called directly by various architectures. This is fixed by making sure that the pidfd argument in struct kernel_clone_args is correctly initialized with the parent_tidptr argument passed down from do_fork(). Additionally, do_fork() missed a check to make CLONE_PIDFD and CLONE_PARENT_SETTID mutually exclusive just a clone() does. This is now fixed too. - When clone3() was introduced we skipped architectures that require special handling for fork-like syscalls. Their syscall tables did not contain any mention of clone3(). To make sure that Arnd's work to make syscall numbers on all architectures identical (minus alpha) was not for naught we are placing a comment in all syscall tables that do not yet implement clone3(). The comment makes it clear that 435 is reserved for clone3 and should not be used. - Also, this contains a patch to make the clone3() syscall definition in asm-generic/unist.h conditional on __ARCH_WANT_SYS_CLONE3. This lets us catch new architectures that implicitly make use of clone3 without setting __ARCH_WANT_SYS_CLONE3 which is a good indicator that they did not check whether it needs special treatment or not. - Finally, this contains a patch to add me as maintainer for pidfd stuff so people can start blaming me (more)" * tag 'for-linus-20190715' of git://git.kernel.org/pub/scm/linux/kernel/git/brauner/linux: MAINTAINERS: add new entry for pidfd api unistd: protect clone3 via __ARCH_WANT_SYS_CLONE3 arch: mark syscall number 435 reserved for clone3 clone: fix CLONE_PIDFD support commit aa2ba991c4206d5b778dcaa7b4997396e79f8e90 Author: Hans de Goede Date: Fri Jul 12 13:27:08 2019 +0200 ASoC: Intel: bytcht_es8316: Add quirk for Irbis NB41 netbook The Irbis NB41 netbook has its internal mic on IN2, inverted jack-detect and stereo speakers, add a quirk for this. Cc: russianneuromancer@ya.ru Reported-and-tested-by: russianneuromancer@ya.ru Signed-off-by: Hans de Goede Link: https://lore.kernel.org/r/20190712112708.25327-1-hdegoede@redhat.com Signed-off-by: Mark Brown commit 2abee12c0ab1924a69993d2c063a39a952e7d836 Author: Wen Yang Date: Sat Jul 13 11:46:15 2019 +0800 ASoC: samsung: odroid: fix a double-free issue for cpu_dai The cpu_dai variable is still being used after the of_node_put() call, which may result in double-free: of_node_put(cpu_dai); ---> released here ret = devm_snd_soc_register_card(dev, card); if (ret < 0) { ... goto err_put_clk_i2s; --> jump to err_put_clk_i2s ... err_put_clk_i2s: clk_put(priv->clk_i2s_bus); err_put_sclk: clk_put(priv->sclk_i2s); err_put_cpu_dai: of_node_put(cpu_dai); --> double-free here Fixes: d832d2b246c5 ("ASoC: samsung: odroid: Fix of_node refcount unbalance") Signed-off-by: Wen Yang Cc: Krzysztof Kozlowski Cc: Sangbeom Kim Cc: Sylwester Nawrocki Cc: Liam Girdwood Cc: Mark Brown Cc: Jaroslav Kysela Cc: Takashi Iwai Cc: alsa-devel@alsa-project.org Cc: linux-kernel@vger.kernel.org Link: https://lore.kernel.org/r/1562989575-33785-3-git-send-email-wen.yang99@zte.com.cn Signed-off-by: Mark Brown commit 9b6d104a6b150bd4d3e5b039340e1f6b20c2e3c1 Author: Wen Yang Date: Sat Jul 13 11:46:14 2019 +0800 ASoC: samsung: odroid: fix an use-after-free issue for codec The codec variable is still being used after the of_node_put() call, which may result in use-after-free. Fixes: bc3cf17b575a ("ASoC: samsung: odroid: Add support for secondary CPU DAI") Signed-off-by: Wen Yang Cc: Krzysztof Kozlowski Cc: Sangbeom Kim Cc: Sylwester Nawrocki Cc: Liam Girdwood Cc: Mark Brown Cc: Jaroslav Kysela Cc: Takashi Iwai Cc: alsa-devel@alsa-project.org Cc: linux-kernel@vger.kernel.org Link: https://lore.kernel.org/r/1562989575-33785-2-git-send-email-wen.yang99@zte.com.cn Signed-off-by: Mark Brown commit 8f46e22b5ac692b48d04bb722547ca17b66dda02 Author: Jernej Skrabec Date: Sat Jul 13 11:07:17 2019 +0200 regulator: axp20x: fix DCDC5 and DCDC6 for AXP803 Refactoring of axp20x driver introduced a bug in AXP803's DCDC6 regulator definition. AXP803_DCDC6_1120mV_STEPS was obtained by subtracting 0x47 and 0x33. This should be 0x14 (hex) and not 14 (dec). Refactoring also carried over a bug in DCDC5 regulator definition. Number of possible voltages must be for 1 bigger than maximum valid voltage index, because 0 is also valid and it means lowest voltage. Fixes: 1dbe0ccb0631 ("regulator: axp20x-regulator: add support for AXP803") Fixes: db4a555f7c4c ("regulator: axp20x: use defines for masks") Signed-off-by: Jernej Skrabec Link: https://lore.kernel.org/r/20190713090717.347-3-jernej.skrabec@siol.net Signed-off-by: Mark Brown commit 1ef55fed9219963359a7b3bc7edca8517c6e45ac Author: Jernej Skrabec Date: Sat Jul 13 11:07:16 2019 +0200 regulator: axp20x: fix DCDCA and DCDCD for AXP806 Refactoring of the driver introduced bugs in AXP806's DCDCA and DCDCD regulator definitions. In DCDCA case, AXP806_DCDCA_1120mV_STEPS was obtained by subtracting 0x47 and 0x33. This should be 0x14 (hex) and not 14 (dec). In DCDCD case, axp806_dcdcd_ranges[] contains two ranges with same start and end macros, which is clearly wrong. Second range starts at 1.6V so it should use AXP806_DCDCD_1600mV_[START|END] macros. They are already defined but unused. Fixes: db4a555f7c4c ("regulator: axp20x: use defines for masks") Signed-off-by: Jernej Skrabec Link: https://lore.kernel.org/r/20190713090717.347-2-jernej.skrabec@siol.net Signed-off-by: Mark Brown commit 3bd532692d93a9c72f4f11e38437b30c0e13007f Author: Wang Xiayang Date: Mon Jul 15 16:53:01 2019 +0800 drm/amdgpu: replace simple_strtol() by kstrtou32() The simple_strtol() function is deprecated. kstrto[l,u32]() is the correct replacement as it can properly handle overflows. This patch replaces the deprecated simple_strtol() use introduced recently. As clk is of type uint32_t, we are safe to use kstrtou32(). It is also safe to return zero on string parsing error, similar to the case of returning zero if buf is empty in parse_clk(). Fixes: bb5a2bdf36a8 ("drm/amdgpu: support dpm level modification under virtualization v3") Signed-off-by: Wang Xiayang Signed-off-by: Alex Deucher commit 5db7b0d29086b621e294d5c52bb3ff25283cff60 Author: Fuqian Huang Date: Mon Jul 15 11:17:31 2019 +0800 drm/amdgpu: remove memset after kzalloc kzalloc has already zeroed the memory during the allocation. So memset is unneeded. Reviewed-by: Emil Velikov Signed-off-by: Fuqian Huang Signed-off-by: Alex Deucher commit b5203d16aef462f52df47242178718768038319a Author: Arnd Bergmann Date: Fri Jul 12 11:40:49 2019 +0200 drm/amd/amdgpu: hide #warning for missing DC config It is annoying to have #warnings that trigger in randconfig builds like drivers/gpu/drm/amd/amdgpu/soc15.c:653:3: error: "Enable CONFIG_DRM_AMD_DC for display support on SOC15." drivers/gpu/drm/amd/amdgpu/nv.c:400:3: error: "Enable CONFIG_DRM_AMD_DC for display support on navi." Remove these and rely on the users to turn these on. Signed-off-by: Arnd Bergmann Signed-off-by: Alex Deucher commit 9417f703afe3bf4e9c87342fb191d113ee83a818 Author: Kent Russell Date: Mon Jul 15 08:53:06 2019 -0400 drm/amdgpu: Fix Vega20 Perf counter for pcie_bw The perf counter for Vega20 is 108, instead of 104 which it was on all previous GPUs, so add a check to use the appropriate value. Signed-off-by: Kent Russell Acked-by: Alex Deucher Signed-off-by: Alex Deucher commit ca9db7d1e07237db81c81518d52241d33d72298f Author: Tom St Denis Date: Fri Jul 12 09:41:32 2019 -0400 drm/amd/amdgpu: Add missing select_me_pipe_q() for gfx10 The ability to select GFX GRBM me/pipe/queue/vmid was missing from the gfx10 driver. This patch adds it. Used by the debugfs register interface to select GFX resources when read/writing registers. Signed-off-by: Tom St Denis Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher commit 0fa4246e8ebfb389142034ffcdf6e70de32dddf4 Author: Tom St Denis Date: Fri Jul 12 09:27:06 2019 -0400 drm/amd/amdgpu: Add VMID to SRBM debugfs bank selection Add 5 bits to the offset for SRBM selection to handle VMIDs. Also update the select_me_pipe_q() callback to also select VMID. Signed-off-by: Tom St Denis Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher commit cf034477321e8c88d667514923763b93a0892f49 Author: Emil Velikov Date: Fri Jun 14 18:33:35 2019 +0100 drm/amdgpu: extend AMDGPU_CTX_PRIORITY_NORMAL comment Currently the AMDGPU_CTX_PRIORITY_* defines are used in both drm_amdgpu_ctx_in::priority and drm_amdgpu_sched_in::priority. Extend the comment to mention the CAP_SYS_NICE or DRM_MASTER requirement is only applicable with the former. Cc: Bas Nieuwenhuizen Cc: Christian König Cc: Alex Deucher Signed-off-by: Emil Velikov Reviewed-by: Christian König Signed-off-by: Alex Deucher commit 54728170e00cecfac0394c6ee7ea4043778a512b Author: Kevin Wang Date: Fri Jul 12 15:22:40 2019 +0800 drm/amd/powerplay: add helper of smu_clk_dpm_is_enabled for smu v2: change function name to smu_clk_dpm_is_enabled. add this helper function to check dpm clk feature is enabled. Signed-off-by: Kevin Wang Reviewed-by: Evan Quan Signed-off-by: Alex Deucher commit 8e33376b7649b353ffd55f2b40fe129ead3880f7 Author: Kevin Wang Date: Fri Jul 12 17:05:52 2019 +0800 drm/amd/powerplay: fix save dpm level error for smu the save dpm level should be save previous dpm profile level, should not modified by get dpm level function. eg: default auto 1. auto -> standard ==> dpm_level = standard, save_dpm = auto. 2. standard -> auto ==> dpm_level = auto, save_dpm = standard. Signed-off-by: Kevin Wang Reviewed-by: Evan Quan Signed-off-by: Alex Deucher commit 42b3aa9a5bafef922de78f0b4d54435bf774d1c1 Author: Kevin Wang Date: Tue Jul 16 13:07:23 2019 -0500 drm/amd/powerplay: avoid double check feature enabled the unforce_dpm_levels doesn't need to check feature enablement. because the smu_get_dpm_freq_range function has check feature logic. Signed-off-by: Kevin Wang Reviewed-by: Evan Quan Signed-off-by: Alex Deucher commit 75728f512e1f6cc37da9c173b7a7690b10b1c3f5 Author: Kevin Wang Date: Fri Jul 12 14:42:12 2019 +0800 drm/amd/powerplay: add standard profile dpm support for smu 1. the standard dpm is not support before. 2. use auto profile to adapt standard profile. Signed-off-by: Kevin Wang Reviewed-by: Evan Quan Signed-off-by: Alex Deucher commit eaf963b5c17e611ca35850f65db7ebe929bef774 Author: Kevin Wang Date: Fri Jul 12 14:40:12 2019 +0800 drm/amd/powerplay: add socclk profile dpm support. 1.miss socclk profile support when bringup. 2.add feature check for socclk. Signed-off-by: Kevin Wang Reviewed-by: Evan Quan Signed-off-by: Alex Deucher commit 75ee64875e758b2f10d319a50dc787516c52d3de Author: Felix Kuehling Date: Fri Jun 21 19:50:03 2019 -0400 drm/amdkfd: Consistently apply noretry setting Apply the same setting to SH_MEM_CONFIG and VM_CONTEXT1_CNTL. This makes the noretry param no longer KFD-specific. On GFX10 I'm not changing SH_MEM_CONFIG in this commit because GFX10 has different retry behaviour in the SQ and I don't have a way to test it at the moment. Suggested-by: Christian König CC: Philip Yang Signed-off-by: Felix Kuehling Reviewed-by : Shaoyun.liu < Shaoyun.liu@amd.com> Signed-off-by: Alex Deucher commit 7a17c8ce3321bb0738283706d3b46b047a9cbcfb Author: Arnd Bergmann Date: Fri Jul 12 11:39:52 2019 +0200 drm/amd/display: return 'NULL' instead of 'false' from dcn20_acquire_idle_pipe_for_layer clang complains that 'false' is a not a pointer: drivers/gpu/drm/amd/amdgpu/../display/dc/dcn20/dcn20_resource.c:2428:10: error: expression which evaluates to zero treated as a null pointer constant of type 'struct pipe_ctx *' [-Werror,-Wnon-literal-null-conversion] return false; Changing it to 'NULL' looks like the right thing that will shut up the warning and make it easier to read, while not changing behavior. Fixes: 7ed4e6352c16 ("drm/amd/display: Add DCN2 HW Sequencer and Resource") Reviewed-by: Nathan Chancellor Signed-off-by: Arnd Bergmann Signed-off-by: Alex Deucher commit 7e446b3c76b4ef0d3808305c0a51f895236b37bf Author: Arnd Bergmann Date: Fri Jul 12 11:37:00 2019 +0200 drm/amd/display: Support clang option for stack alignment As previously fixed for dml in commit 4769278e5c7f ("amdgpu/dc/dml: Support clang option for stack alignment") and calcs in commit cc32ad8f559c ("amdgpu/dc/calcs: Support clang option for stack alignment"), dcn20 uses an option that is not available with clang: clang: error: unknown argument: '-mpreferred-stack-boundary=4' scripts/Makefile.build:281: recipe for target 'drivers/gpu/drm/amd/amdgpu/../display/dc/dcn20/dcn20_resource.o' failed Use the same trick that we have in the other two files. Fixes: 7ed4e6352c16 ("drm/amd/display: Add DCN2 HW Sequencer and Resource") Signed-off-by: Arnd Bergmann Signed-off-by: Alex Deucher commit 2954152298c37804dab49d630aa959625b50cf64 Merge: 50950626414a d26d0cd97c88 Author: Linus Torvalds Date: Tue Jul 16 10:37:27 2019 -0700 Merge branch 'proc-cmdline' (/proc//cmdline fixes) This fixes two problems reported with the cmdline simplification and cleanup last year: - the setproctitle() special cases didn't quite match the original semantics, and it can be noticeable: https://lore.kernel.org/lkml/alpine.LNX.2.21.1904052326230.3249@kich.toxcorp.com/ - it could leak an uninitialized byte from the temporary buffer under the right (wrong) circustances: https://lore.kernel.org/lkml/20190712160913.17727-1-izbyshev@ispras.ru/ It rewrites the logic entirely, splitting it into two separate commits (and two separate functions) for the two different cases ("unedited cmdline" vs "setproctitle() has been used to change the command line"). * proc-cmdline: /proc//cmdline: add back the setproctitle() special case /proc//cmdline: remove all the special cases commit 763ff0e7d9c72e7094b31e7fb84a859be9325635 Author: Andrii Nakryiko Date: Mon Jul 15 20:57:03 2019 -0700 libbpf: fix another GCC8 warning for strncpy Similar issue was fixed in cdfc7f888c2a ("libbpf: fix GCC8 warning for strncpy") already. This one was missed. Fixing now. Cc: Magnus Karlsson Signed-off-by: Andrii Nakryiko Acked-by: Magnus Karlsson Signed-off-by: Alexei Starovoitov commit d26d0cd97c88eb1a5704b42e41ab443406807810 Author: Linus Torvalds Date: Sat Jul 13 14:27:14 2019 -0700 /proc//cmdline: add back the setproctitle() special case This makes the setproctitle() special case very explicit indeed, and handles it with a separate helper function entirely. In the process, it re-instates the original semantics of simply stopping at the first NUL character when the original last NUL character is no longer there. [ The original semantics can still be seen in mm/util.c: get_cmdline() that is limited to a fixed-size buffer ] This makes the logic about when we use the string lengths etc much more obvious, and makes it easier to see what we do and what the two very different cases are. Note that even when we allow walking past the end of the argument array (because the setproctitle() might have overwritten and overflowed the original argv[] strings), we only allow it when it overflows into the environment region if it is immediately adjacent. [ Fixed for missing 'count' checks noted by Alexey Izbyshev ] Link: https://lore.kernel.org/lkml/alpine.LNX.2.21.1904052326230.3249@kich.toxcorp.com/ Fixes: 5ab827189965 ("fs/proc: simplify and clarify get_mm_cmdline() function") Cc: Jakub Jankowski Cc: Alexey Dobriyan Cc: Alexey Izbyshev Signed-off-by: Linus Torvalds commit 3d712546d8ba9f25cdf080d79f90482aa4231ed4 Author: Linus Torvalds Date: Sat Jul 13 13:40:13 2019 -0700 /proc//cmdline: remove all the special cases Start off with a clean slate that only reads exactly from arg_start to arg_end, without any oddities. This simplifies the code and in the process removes the case that caused us to potentially leak an uninitialized byte from the temporary kernel buffer. Note that in order to start from scratch with an understandable base, this simplifies things _too_ much, and removes all the legacy logic to handle setproctitle() having changed the argument strings. We'll add back those special cases very differently in the next commit. Link: https://lore.kernel.org/lkml/20190712160913.17727-1-izbyshev@ispras.ru/ Fixes: f5b65348fd77 ("proc: fix missing final NUL in get_mm_cmdline() rewrite") Cc: Alexey Izbyshev Cc: Alexey Dobriyan Signed-off-by: Linus Torvalds commit 50950626414a982c8ed539128c7f69a3d328a970 Merge: 9637d517347e 73fbfc499448 Author: Linus Torvalds Date: Tue Jul 16 09:25:04 2019 -0700 Merge tag 'backlight-next-5.3' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/backlight Pull backlight updates from Lee Jones: "New Functionality: - Provide support for ACPI enumeration; gpio_backlight Fix-ups: - SPDX fixups; pwm_bl - Fix linear brightness levels to include number available; pwm_bl" * tag 'backlight-next-5.3' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/backlight: backlight: pwm_bl: Fix heuristic to determine number of brightness levels backlight: gpio_backlight: Enable ACPI enumeration backlight: pwm_bl: Convert to use SPDX identifier commit 4e59afbbed9638f95adfac8d2f222aca3b2b1bc0 Author: Ilya Leoshkevich Date: Tue Jul 16 12:56:34 2019 +0200 selftests/bpf: skip nmi test when perf hw events are disabled Some setups (e.g. virtual machines) might run with hardware perf events disabled. If this is the case, skip the test_send_signal_nmi test. Add a separate test involving a software perf event. This allows testing the perf event path regardless of hardware perf event support. Signed-off-by: Ilya Leoshkevich Acked-by: Andrii Nakryiko Signed-off-by: Alexei Starovoitov commit 3461a0a02141b2612f2916e9250a430de41b0290 Author: Ilya Leoshkevich Date: Tue Jul 16 12:53:53 2019 +0200 selftests/bpf: fix "alu with different scalars 1" on s390 BPF_LDX_MEM is used to load the least significant byte of the retrieved test_val.index, however, on big-endian machines it ends up retrieving the most significant byte. Change the test to load the whole int in order to make it endianness-independent. Signed-off-by: Ilya Leoshkevich Signed-off-by: Alexei Starovoitov commit 1624b0b200399bd6cd2b46ab3494738d1aef6b75 Author: Akinobu Mita Date: Tue Jul 16 21:59:35 2019 +0900 block: fix sysfs module parameters directory path in comment The runtime configurable module parameter files are located under /sys/module/MODULENAME/parameters, not /sys/module/MODULENAME. Cc: Jens Axboe Signed-off-by: Akinobu Mita Signed-off-by: Jens Axboe commit 07b0fdecb2477396bcb69609019aade2b22124a1 Author: Tejun Heo Date: Tue Jul 16 07:58:31 2019 -0700 blkcg: allow blkcg_policy->pd_stat() to print non-debug info too Currently, ->pd_stat() is called only when moduleparam blkcg_debug_stats is set which prevents it from printing non-debug policy-specific statistics. Let's move debug testing down so that ->pd_stat() can print non-debug stat too. This patch doesn't cause any visible behavior change. Signed-off-by: Tejun Heo Cc: Josef Bacik Signed-off-by: Jens Axboe commit f7b76ac9d17e16e44feebb6d2749fec92bfd6dd4 Author: Zhengyuan Liu Date: Tue Jul 16 23:26:14 2019 +0800 io_uring: fix counter inc/dec mismatch in async_list We could queue a work for each req in defer and link list without increasing async_list->cnt, so we shouldn't decrease it while exiting from workqueue as well if we didn't process the req in async list. Thanks to Jens Axboe for his guidance. Fixes: 31b515106428 ("io_uring: allow workqueue item to handle multiple buffered requests") Signed-off-by: Zhengyuan Liu Signed-off-by: Jens Axboe commit 4f7f96453b462b3de0fa18d18fe983960bb5ee7f Author: Hans de Goede Date: Fri Jul 12 12:00:33 2019 +0200 ACPI: video: Add new hw_changes_brightness quirk, set it on PB Easynote MZ35 Some machines change the brightness themselves when a brightness hotkey gets pressed, despite us telling them not to. This causes the brightness to go two steps up / down when the hotkey is pressed. This is esp. a problem on older machines with only a few brightness levels. This commit adds a new hw_changes_brightness quirk which makes acpi_video_device_notify() only call backlight_force_update(..., BACKLIGHT_UPDATE_HOTKEY) and not do anything else, notifying userspace that the brightness was changed and leaving it at that fixing the dual step problem. BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=204077 Reported-by: Kacper Piwiński Tested-by: Kacper Piwiński Signed-off-by: Hans de Goede Signed-off-by: Rafael J. Wysocki commit 3140aafb22edeab0cc41f15f53b12a118c0ac215 Author: Takashi Iwai Date: Mon Jul 15 23:14:53 2019 +0200 ALSA: hda/hdmi - Fix i915 reverse port/pin mapping The recent fix for Icelake HDMI codec introduced the mapping from pin NID to the i915 gfx port number. However, it forgot the reverse mapping from the port number to the pin NID that is used in the ELD notifier callback. As a result, it's processed to a wrong widget and gives a warning like snd_hda_codec_hdmi hdaudioC0D2: HDMI: pin nid 5 not registered This patch corrects it with a proper reverse mapping function. Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=204133 Fixes: b0d8bc50b9f2 ("ALSA: hda: hdmi - add Icelake support") Reviewed-by: Kai Vehmanen Cc: Signed-off-by: Takashi Iwai commit c56cbfae62b7d572c7994c927202d337633cc7d9 Author: Ding Xiang Date: Tue Jul 16 17:54:08 2019 +0800 ata: libahci_platform: remove redundant dev_err message devm_ioremap_resource already contains error message, so remove the redundant dev_err message Signed-off-by: Ding Xiang Signed-off-by: Jens Axboe commit dbd0f6d6c2a11eb9c31ca9cd454f95bb5713e92e Author: Zhengyuan Liu Date: Sat Jul 13 11:58:26 2019 +0800 io_uring: fix the sequence comparison in io_sequence_defer sq->cached_sq_head and cq->cached_cq_tail are both unsigned int. If cached_sq_head overflows before cached_cq_tail, then we may miss a barrier req. As cached_cq_tail always follows cached_sq_head, the NQ should be enough. Cc: stable@vger.kernel.org Fixes: de0617e46717 ("io_uring: add support for marking commands as draining") Signed-off-by: Zhengyuan Liu Signed-off-by: Jens Axboe commit e5793cd1b5fedb39337cfa62251a25030f526e56 Author: Stephen Rothwell Date: Tue Jul 16 12:40:16 2019 +0100 MIPS: fix some more fall through errors in arch/mips Fix these errors: arch/mips/cavium-octeon/executive/cvmx-pko.c:489:7: error: this statement may fall through [-Werror=implicit-fallthrough=] arch/mips/bcm63xx/dev-flash.c:89:3: error: this statement may fall through [-Werror=implicit-fallthrough=] arch/mips/ath79/setup.c:155:17: error: this statement may fall through [-Werror=implicit-fallthrough=] arch/mips/ar7/setup.c:50:3: error: this statement may fall through [-Werror=implicit-fallthrough=] Cc: Florian Fainelli Cc: Thomas Gleixner Cc: John Crispin Cc: Matthias Schiffer Cc: "Petr Štetiar" Signed-off-by: Stephen Rothwell Signed-off-by: Paul Burton commit 28b1d6ef53e3303b90ca8924bb78f31fa527cafb Author: Laura Garcia Liebana Date: Mon Jul 15 13:23:37 2019 +0200 netfilter: nft_hash: fix symhash with modulus one The rule below doesn't work as the kernel raises -ERANGE. nft add rule netdev nftlb lb01 ip daddr set \ symhash mod 1 map { 0 : 192.168.0.10 } fwd to "eth0" This patch allows to use the symhash modulus with one element, in the same way that the other types of hashes and algorithms that uses the modulus parameter. Signed-off-by: Laura Garcia Liebana Signed-off-by: Pablo Neira Ayuso commit b717273ddb66a0c576d8c9884a6cfa70a5f49f6b Author: Florian Westphal Date: Sat Jul 13 23:59:21 2019 +0200 netfilter: nf_tables: don't fail when updating base chain policy The following nftables test case fails on nf-next: tests/shell/run-tests.sh tests/shell/testcases/transactions/0011chain_0 The test case contains: add chain x y { type filter hook input priority 0; } add chain x y { policy drop; }" The new test if (chain->flags ^ flags) return -EOPNOTSUPP; triggers here, because chain->flags has NFT_BASE_CHAIN set, but flags is 0 because no flag attribute was present in the policy update. Just fetch the current flag settings of a pre-existing chain in case userspace did not provide any. Fixes: c9626a2cbdb20 ("netfilter: nf_tables: add hardware offload support") Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit 959b69ef57db00cb33e9c4777400ae7183ebddd3 Author: Florian Westphal Date: Fri Jul 12 00:29:05 2019 +0200 netfilter: conntrack: always store window size un-scaled Jakub Jankowski reported following oddity: After 3 way handshake completes, timeout of new connection is set to max_retrans (300s) instead of established (5 days). shortened excerpt from pcap provided: 25.070622 IP (flags [DF], proto TCP (6), length 52) 10.8.5.4.1025 > 10.8.1.2.80: Flags [S], seq 11, win 64240, [wscale 8] 26.070462 IP (flags [DF], proto TCP (6), length 48) 10.8.1.2.80 > 10.8.5.4.1025: Flags [S.], seq 82, ack 12, win 65535, [wscale 3] 27.070449 IP (flags [DF], proto TCP (6), length 40) 10.8.5.4.1025 > 10.8.1.2.80: Flags [.], ack 83, win 512, length 0 Turns out the last_win is of u16 type, but we store the scaled value: 512 << 8 (== 0x20000) becomes 0 window. The Fixes tag is not correct, as the bug has existed forever, but without that change all that this causes might cause is to mistake a window update (to-nonzero-from-zero) for a retransmit. Fixes: fbcd253d2448b8 ("netfilter: conntrack: lower timeout to RETRANS seconds if window is 0") Reported-by: Jakub Jankowski Tested-by: Jakub Jankowski Signed-off-by: Florian Westphal Acked-by: Jozsef Kadlecsik Signed-off-by: Pablo Neira Ayuso commit b83329fb473f29d34d85d642e3a3313bb2871fa9 Author: Fernando Fernandez Mancera Date: Wed Jul 10 12:05:57 2019 +0200 netfilter: synproxy: fix erroneous tcp mss option Now synproxy sends the mss value set by the user on client syn-ack packet instead of the mss value that client announced. Fixes: 48b1de4c110a ("netfilter: add SYNPROXY core/target") Signed-off-by: Fernando Fernandez Mancera Signed-off-by: Pablo Neira Ayuso commit f41828ee10b36644bb2b2bfa9dd1d02f55aa0516 Author: Christian Hesse Date: Thu Jul 11 01:31:12 2019 +0200 netfilter: nf_tables: fix module autoload for redir Fix expression for autoloading. Fixes: 5142967ab524 ("netfilter: nf_tables: fix module autoload with inet family") Signed-off-by: Christian Hesse Signed-off-by: Pablo Neira Ayuso commit 05ba4c895363db795f3d54f2da0de56d6520e52d Author: Yonatan Goldschmidt Date: Mon Jul 8 15:57:09 2019 -0700 netfilter: Update obsolete comments referring to ip_conntrack In 9fb9cbb1082d ("[NETFILTER]: Add nf_conntrack subsystem.") the new generic nf_conntrack was introduced, and it came to supersede the old ip_conntrack. This change updates (some) of the obsolete comments referring to old file/function names of the ip_conntrack mechanism, as well as removes a few self-referencing comments that we shouldn't maintain anymore. I did not update any comments referring to historical actions (e.g, comments like "this file was derived from ..." were left untouched, even if the referenced file is no longer here). Signed-off-by: Yonatan Goldschmidt Signed-off-by: Pablo Neira Ayuso commit 3c00fb0bf0e0f061715c04ad609de93ddc046aa1 Author: xiao ruizhu Date: Thu Jul 4 11:31:13 2019 +0800 netfilter: nf_conntrack_sip: fix expectation clash When conntracks change during a dialog, SDP messages may be sent from different conntracks to establish expects with identical tuples. In this case expects conflict may be detected for the 2nd SDP message and end up with a process failure. The fixing here is to reuse an existing expect who has the same tuple for a different conntrack if any. Here are two scenarios for the case. 1) SERVER CPE | INVITE SDP | 5060 |<----------------------|5060 | 100 Trying | 5060 |---------------------->|5060 | 183 SDP | 5060 |---------------------->|5060 ===> Conntrack 1 | PRACK | 50601 |<----------------------|5060 | 200 OK (PRACK) | 50601 |---------------------->|5060 | 200 OK (INVITE) | 5060 |---------------------->|5060 | ACK | 50601 |<----------------------|5060 | | |<--- RTP stream ------>| | | | INVITE SDP (t38) | 50601 |---------------------->|5060 ===> Conntrack 2 With a certain configuration in the CPE, SIP messages "183 with SDP" and "re-INVITE with SDP t38" will go through the sip helper to create expects for RTP and RTCP. It is okay to create RTP and RTCP expects for "183", whose master connection source port is 5060, and destination port is 5060. In the "183" message, port in Contact header changes to 50601 (from the original 5060). So the following requests e.g. PRACK and ACK are sent to port 50601. It is a different conntrack (let call Conntrack 2) from the original INVITE (let call Conntrack 1) due to the port difference. In this example, after the call is established, there is RTP stream but no RTCP stream for Conntrack 1, so the RTP expect created upon "183" is cleared, and RTCP expect created for Conntrack 1 retains. When "re-INVITE with SDP t38" arrives to create RTP&RTCP expects, current ALG implementation will call nf_ct_expect_related() for RTP and RTCP. The expects tuples are identical to those for Conntrack 1. RTP expect for Conntrack 2 succeeds in creation as the one for Conntrack 1 has been removed. RTCP expect for Conntrack 2 fails in creation because it has idential tuples and 'conflict' with the one retained for Conntrack 1. And then result in a failure in processing of the re-INVITE. 2) SERVER A CPE | REGISTER | 5060 |<------------------| 5060 ==> CT1 | 200 | 5060 |------------------>| 5060 | | | INVITE SDP(1) | 5060 |<------------------| 5060 | 300(multi choice) | 5060 |------------------>| 5060 SERVER B | ACK | 5060 |<------------------| 5060 | INVITE SDP(2) | 5060 |-------------------->| 5060 ==> CT2 | 100 | 5060 |<--------------------| 5060 | 200(contact changes)| 5060 |<--------------------| 5060 | ACK | 5060 |-------------------->| 50601 ==> CT3 | | |<--- RTP stream ---->| | | | BYE | 5060 |<--------------------| 50601 | 200 | 5060 |-------------------->| 50601 | INVITE SDP(3) | 5060 |<------------------| 5060 ==> CT1 CPE sends an INVITE request(1) to Server A, and creates a RTP&RTCP expect pair for this Conntrack 1 (CT1). Server A responds 300 to redirect to Server B. The RTP&RTCP expect pairs created on CT1 are removed upon 300 response. CPE sends the INVITE request(2) to Server B, and creates an expect pair for the new conntrack (due to destination address difference), let call CT2. Server B changes the port to 50601 in 200 OK response, and the following requests ACK and BYE from CPE are sent to 50601. The call is established. There is RTP stream and no RTCP stream. So RTP expect is removed and RTCP expect for CT2 retains. As BYE request is sent from port 50601, it is another conntrack, let call CT3, different from CT2 due to the port difference. So the BYE request will not remove the RTCP expect for CT2. Then another outgoing call is made, with the same RTP port being used (not definitely but possibly). CPE firstly sends the INVITE request(3) to Server A, and tries to create a RTP&RTCP expect pairs for this CT1. In current ALG implementation, the RTCP expect for CT1 fails in creation because it 'conflicts' with the residual one for CT2. As a result the INVITE request fails to send. Signed-off-by: xiao ruizhu Signed-off-by: Pablo Neira Ayuso commit b575b24b8eee37f10484e951b62ce2a31c579775 Author: Miaohe Lin Date: Tue Jul 2 03:59:36 2019 +0000 netfilter: Fix rpfilter dropping vrf packets by mistake When firewalld is enabled with ipv4/ipv6 rpfilter, vrf ipv4/ipv6 packets will be dropped. Vrf device will pass through netfilter hook twice. One with enslaved device and another one with l3 master device. So in device may dismatch witch out device because out device is always enslaved device.So failed with the check of the rpfilter and drop the packets by mistake. Signed-off-by: Miaohe Lin Signed-off-by: Pablo Neira Ayuso commit 163f88211c147d96b46e376337190a02203ace02 Author: Trond Myklebust Date: Tue Jul 16 07:07:28 2019 -0400 SUNRPC: Skip zero-refcount transports When looking for the next transport to use for an RPC call, skip those that are in the process of being destroyed and that have a zero refcount. Signed-off-by: Trond Myklebust commit 3cf7292280d5e484747a5f0ee4b62327b037344c Author: Trond Myklebust Date: Mon Jul 15 15:12:08 2019 -0400 SUNRPC: Replace division by multiplication in calculation of queue length When checking whether or not a particular xprt queue length is shorter than the average queue length for all xprts, prefer to use multiplication rather than division for performance reasons. Signed-off-by: Trond Myklebust commit 88785b7fa74ae2dc52f879140b976984b5374c79 Merge: da7f134972f4 19ec11a2233d Author: Linus Walleij Date: Tue Jul 16 11:12:14 2019 +0200 Merge tag 'gpio-v5.3-rc1-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux into fixes GPIO fixes for v5.3-rc1 - silence error messages on probe deferral in gpio-davinci - fix a memory leak in gpiolib-of - fix a potential use-after-free error in gpio-em commit da7f134972f473053ea9d721a1d8397546476dc4 Author: Linus Walleij Date: Mon Jul 15 22:45:29 2019 +0200 Revert "gpio/spi: Fix spi-gpio regression on active high CS" This reverts commit fbbf145a0e0a0177e089c52275fbfa55763e7d1d. It seems I was misguided in my fixup, which was working at the time but did not work on the final v5.2. The patch tried to avoid a quirk the gpiolib code not to treat "spi-gpio" CS gpios "special" by enforcing them to be active low, in the belief that since the "spi-gpio" driver was parsing the device tree on its own, it did not care to inspect the "spi-cs-high" attribute on the device nodes. That's wrong. The SPI core was inspecting them inside the of_spi_parse_dt() funtion and setting SPI_CS_HIGH on the nodes, and the driver inspected this flag when driving the line. As of now, the core handles the GPIO and it will consistently set the GPIO descriptor to 1 to enable CS, strictly requireing the gpiolib to invert it. And the gpiolib should indeed enforce active low on the CS line. Device trees should of course put the right flag on the GPIO handles, but it used to not matter. If we don't enforce active low on "gpio-gpio" we may run into ABI backward compatibility issues, so revert this. Cc: linux-spi@vger.kernel.org Cc: stable@vger.kernel.org Signed-off-by: Linus Walleij Link: https://lore.kernel.org/r/20190715204529.9539-1-linus.walleij@linaro.org commit 7aaddd96d5febcf5b24357a326b3038d49a20532 Author: Dmitry Osipenko Date: Thu Jul 11 05:13:13 2019 +0300 drm/modes: Don't apply cmdline's rotation if it wasn't specified The rotation mode from cmdline shouldn't be taken into account if it wasn't specified in the cmdline. This fixes ignored default display orientation when display mode is given using cmdline without the rotation being specified. Fixes: 1bf4e09227c3 ("drm/modes: Allow to specify rotation and reflection on the commandline") Signed-off-by: Dmitry Osipenko Signed-off-by: Maxime Ripard Link: https://patchwork.freedesktop.org/patch/msgid/20190711021313.29445-1-digetx@gmail.com commit c4dcc8a162784c1f827c7f6d8409598f19708fe6 Author: Viresh Kumar Date: Tue Jul 16 09:36:08 2019 +0530 cpufreq: Make cpufreq_generic_init() return void It always returns 0 (success) and its return type should really be void. Over that, many drivers have added error handling code based on its return value, which is not required at all. Change its return type to void and update all the callers. Signed-off-by: Viresh Kumar Signed-off-by: Rafael J. Wysocki commit eb4177116bf568a413c544eca3f4446cb4064be9 Author: Takashi Iwai Date: Mon Jul 15 23:12:13 2019 +0200 ALSA: hda/hdmi - Remove duplicated define INTEL_GET_VENDOR_VERB is defined twice identically. Let's remove a superfluous line. Fixes: b0d8bc50b9f2 ("ALSA: hda: hdmi - add Icelake support") Cc: Signed-off-by: Takashi Iwai commit ede34f397ddb063b145b9e7d79c6026f819ded13 Author: Takashi Iwai Date: Mon Jul 15 22:50:27 2019 +0200 ALSA: seq: Break too long mutex context in the write loop The fix for the racy writes and ioctls to sequencer widened the application of client->ioctl_mutex to the whole write loop. Although it does unlock/relock for the lengthy operation like the event dup, the loop keeps the ioctl_mutex for the whole time in other situations. This may take quite long time if the user-space would give a huge buffer, and this is a likely cause of some weird behavior spotted by syzcaller fuzzer. This patch puts a simple workaround, just adding a mutex break in the loop when a large number of events have been processed. This shouldn't hit any performance drop because the threshold is set high enough for usual operations. Fixes: 7bd800915677 ("ALSA: seq: More protection for concurrent write and ioctl races") Reported-by: syzbot+97aae04ce27e39cbfca9@syzkaller.appspotmail.com Reported-by: syzbot+4c595632b98bb8ffcc66@syzkaller.appspotmail.com Cc: Signed-off-by: Takashi Iwai commit 4b4e0e32e4b09274dbc9d173016c1a026f44608c Author: Hui Wang Date: Tue Jul 16 15:21:34 2019 +0800 ALSA: hda/realtek: apply ALC891 headset fixup to one Dell machine Without this patch, the headset-mic and headphone-mic don't work. Cc: Signed-off-by: Hui Wang Signed-off-by: Takashi Iwai commit 9637d517347e80ee2fe1c5d8ce45ba1b88d8b5cd Merge: 273cbf61c3dd 787c79d6393f Author: Linus Torvalds Date: Mon Jul 15 21:20:52 2019 -0700 Merge tag 'for-linus-20190715' of git://git.kernel.dk/linux-block Pull more block updates from Jens Axboe: "A later pull request with some followup items. I had some vacation coming up to the merge window, so certain things items were delayed a bit. This pull request also contains fixes that came in within the last few days of the merge window, which I didn't want to push right before sending you a pull request. This contains: - NVMe pull request, mostly fixes, but also a few minor items on the feature side that were timing constrained (Christoph et al) - Report zones fixes (Damien) - Removal of dead code (Damien) - Turn on cgroup psi memstall (Josef) - block cgroup MAINTAINERS entry (Konstantin) - Flush init fix (Josef) - blk-throttle low iops timing fix (Konstantin) - nbd resize fixes (Mike) - nbd 0 blocksize crash fix (Xiubo) - block integrity error leak fix (Wenwen) - blk-cgroup writeback and priority inheritance fixes (Tejun)" * tag 'for-linus-20190715' of git://git.kernel.dk/linux-block: (42 commits) MAINTAINERS: add entry for block io cgroup null_blk: fixup ->report_zones() for !CONFIG_BLK_DEV_ZONED block: Limit zone array allocation size sd_zbc: Fix report zones buffer allocation block: Kill gfp_t argument of blkdev_report_zones() block: Allow mapping of vmalloc-ed buffers block/bio-integrity: fix a memory leak bug nvme: fix NULL deref for fabrics options nbd: add netlink reconfigure resize support nbd: fix crash when the blksize is zero block: Disable write plugging for zoned block devices block: Fix elevator name declaration block: Remove unused definitions nvme: fix regression upon hot device removal and insertion blk-throttle: fix zero wait time for iops throttled group block: Fix potential overflow in blk_report_zones() blkcg: implement REQ_CGROUP_PUNT blkcg, writeback: Implement wbc_blkcg_css() blkcg, writeback: Add wbc->no_cgroup_owner blkcg, writeback: Rename wbc_account_io() to wbc_account_cgroup_owner() ... commit 273cbf61c3ddee9574ef1f4959b9bc6db5b24271 Merge: 5fe7b600a116 cc6b9dfb2c57 Author: Linus Torvalds Date: Mon Jul 15 21:10:39 2019 -0700 Merge branch 'i2c/for-5.3' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux Pull i2c updates from Wolfram Sang: "New stuff from the I2C world: - in the core, getting irqs from ACPI is now similar to OF - new driver for MediaTek MT7621/7628/7688 SoCs - bcm2835, i801, and tegra drivers got some more attention - GPIO API cleanups - cleanups in the core headers - lots of usual driver updates" * 'i2c/for-5.3' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux: (74 commits) i2c: mt7621: Fix platform_no_drv_owner.cocci warnings i2c: cpm: remove casting dma_alloc dt-bindings: i2c: sun6i-p2wi: Fix the binding example dt-bindings: i2c: mv64xxx: Fix the example compatible i2c: i801: Documentation update i2c: i801: Add support for Intel Tiger Lake i2c: i801: Fix PCI ID sorting dt-bindings: i2c-stm32: document optional dmas i2c: i2c-stm32f7: Add I2C_SMBUS_I2C_BLOCK_DATA support i2c: core: Tidy up handling of init_irq i2c: core: Move ACPI gpio IRQ handling into i2c_acpi_get_irq i2c: core: Move ACPI IRQ handling to probe time i2c: acpi: Factor out getting the IRQ from ACPI i2c: acpi: Use available IRQ helper functions i2c: core: Allow whole core to use i2c_dev_irq_from_resources eeprom: at24: modify a comment referring to platform data dt-bindings: i2c: omap: Add new compatible for J721E SoCs dt-bindings: i2c: mv64xxx: Add YAML schemas dt-bindings: i2c: sun6i-p2wi: Add YAML schemas i2c: mt7621: Add MediaTek MT7621/7628/7688 I2C driver ... commit 5fe7b600a116187e10317d83fb56922c4ef6b76d Merge: fb4da215ed92 caa2b557841c Author: Linus Torvalds Date: Mon Jul 15 21:06:15 2019 -0700 Merge tag 'for-v5.3' of git://git.kernel.org/pub/scm/linux/kernel/git/sre/linux-power-supply Pull power supply and reset updates from Sebastian Reichel: "Core: - add HWMON compat layer - new properties: - input power limit - input voltage limit Drivers: - qcom-pon: add gen2 support - new driver for storing reboot move in NVMEM - new driver for Wilco EC charger configuration - simplify getting the adapter of a client" * tag 'for-v5.3' of git://git.kernel.org/pub/scm/linux/kernel/git/sre/linux-power-supply: power: reset: nvmem-reboot-mode: add CONFIG_OF dependency power_supply: wilco_ec: Add charging config driver power: supply: cros: allow to set input voltage and current limit power: supply: add input power and voltage limit properties power: supply: fix semicolon.cocci warnings power: reset: nvmem-reboot-mode: use NVMEM as reboot mode write interface dt-bindings: power: reset: add document for NVMEM based reboot-mode reset: qcom-pon: Add support for gen2 pon dt-bindings: power: reset: qcom: Add qcom,pm8998-pon compatibility line power: supply: Add HWMON compatibility layer power: supply: sbs-manager: simplify getting the adapter of a client power: supply: rt9455_charger: simplify getting the adapter of a client power: supply: rt5033_battery: simplify getting the adapter of a client power: supply: max17042_battery: simplify getting the adapter of a client power: supply: max17040_battery: simplify getting the adapter of a client power: supply: max14656_charger_detector: simplify getting the adapter of a client power: supply: bq25890_charger: simplify getting the adapter of a client power: supply: bq24257_charger: simplify getting the adapter of a client power: supply: bq24190_charger: simplify getting the adapter of a client commit fb4da215ed92f564f7ca090bb81a199b0d6cab8a Merge: 2a3c389a0fde 7b4b0f6b34d8 Author: Linus Torvalds Date: Mon Jul 15 20:44:49 2019 -0700 Merge tag 'pci-v5.3-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci Pull PCI updates from Bjorn Helgaas: "Enumeration changes: - Evaluate PCI Boot Configuration _DSM to learn if firmware wants us to preserve its resource assignments (Benjamin Herrenschmidt) - Simplify resource distribution (Nicholas Johnson) - Decode 32 GT/s link speed (Gustavo Pimentel) Virtualization: - Fix incorrect caching of VF config space size (Alex Williamson) - Fix VF driver probing sysfs knobs (Alex Williamson) Peer-to-peer DMA: - Fix dma_virt_ops check (Logan Gunthorpe) Altera host bridge driver: - Allow building as module (Ley Foon Tan) Armada 8K host bridge driver: - add PHYs support (Miquel Raynal) DesignWare host bridge driver: - Export APIs to support removable loadable module (Vidya Sagar) - Enable Relaxed Ordering erratum workaround only on Tegra20 & Tegra30 (Vidya Sagar) Hyper-V host bridge driver: - Fix use-after-free in eject (Dexuan Cui) Mobiveil host bridge driver: - Clean up and fix many issues, including non-identify mapped windows, 64-bit windows, multi-MSI, class code, INTx clearing (Hou Zhiqiang) Qualcomm host bridge driver: - Use clk bulk API for 2.4.0 controllers (Bjorn Andersson) - Add QCS404 support (Bjorn Andersson) - Assert PERST for at least 100ms (Niklas Cassel) R-Car host bridge driver: - Add r8a774a1 DT support (Biju Das) Tegra host bridge driver: - Add support for Gen2, opportunistic UpdateFC and ACK (PCIe protocol details) AER, GPIO-based PERST# (Manikanta Maddireddy) - Fix many issues, including power-on failure cases, interrupt masking in suspend, UPHY settings, AFI dynamic clock gating, pending DLL transactions (Manikanta Maddireddy) Xilinx host bridge driver: - Fix NWL Multi-MSI programming (Bharat Kumar Gogada) Endpoint support: - Fix 64bit BAR support (Alan Mikhak) - Fix pcitest build issues (Alan Mikhak, Andy Shevchenko) Bug fixes: - Fix NVIDIA GPU multi-function power dependencies (Abhishek Sahu) - Fix NVIDIA GPU HDA enablement issue (Lukas Wunner) - Ignore lockdep for sysfs "remove" (Marek Vasut) Misc: - Convert docs to reST (Changbin Du, Mauro Carvalho Chehab)" * tag 'pci-v5.3-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci: (107 commits) PCI: Enable NVIDIA HDA controllers tools: PCI: Fix installation when `make tools/pci_install` PCI: dwc: pci-dra7xx: Fix compilation when !CONFIG_GPIOLIB PCI: Fix typos and whitespace errors PCI: mobiveil: Fix INTx interrupt clearing in mobiveil_pcie_isr() PCI: mobiveil: Fix infinite-loop in the INTx handling function PCI: mobiveil: Move PCIe PIO enablement out of inbound window routine PCI: mobiveil: Add upper 32-bit PCI base address setup in inbound window PCI: mobiveil: Add upper 32-bit CPU base address setup in outbound window PCI: mobiveil: Mask out hardcoded bits in inbound/outbound windows setup PCI: mobiveil: Clear the control fields before updating it PCI: mobiveil: Add configured inbound windows counter PCI: mobiveil: Fix the valid check for inbound and outbound windows PCI: mobiveil: Clean-up program_{ib/ob}_windows() PCI: mobiveil: Remove an unnecessary return value check PCI: mobiveil: Fix error return values PCI: mobiveil: Refactor the MEM/IO outbound window initialization PCI: mobiveil: Make some register updates more readable PCI: mobiveil: Reformat the code for readability dt-bindings: PCI: mobiveil: Change gpio_slave and apb_csr to optional ... commit 2a3c389a0fde49b241430df806a34276568cfb29 Merge: 8de262531f5f 0b043644c0ca Author: Linus Torvalds Date: Mon Jul 15 20:38:15 2019 -0700 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma Pull rdma updates from Jason Gunthorpe: "A smaller cycle this time. Notably we see another new driver, 'Soft iWarp', and the deletion of an ancient unused driver for nes. - Revise and simplify the signature offload RDMA MR APIs - More progress on hoisting object allocation boiler plate code out of the drivers - Driver bug fixes and revisions for hns, hfi1, efa, cxgb4, qib, i40iw - Tree wide cleanups: struct_size, put_user_page, xarray, rst doc conversion - Removal of obsolete ib_ucm chardev and nes driver - netlink based discovery of chardevs and autoloading of the modules providing them - Move more of the rdamvt/hfi1 uapi to include/uapi/rdma - New driver 'siw' for software based iWarp running on top of netdev, much like rxe's software RoCE. - mlx5 feature to report events in their raw devx format to userspace - Expose per-object counters through rdma tool - Adaptive interrupt moderation for RDMA (DIM), sharing the DIM core from netdev" * tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma: (194 commits) RMDA/siw: Require a 64 bit arch RDMA/siw: Mark expected switch fall-throughs RDMA/core: Fix -Wunused-const-variable warnings rdma/siw: Remove set but not used variable 's' rdma/siw: Add missing dependencies on LIBCRC32C and DMA_VIRT_OPS RDMA/siw: Add missing rtnl_lock around access to ifa rdma/siw: Use proper enumerated type in map_cqe_status RDMA/siw: Remove unnecessary kthread create/destroy printouts IB/rdmavt: Fix variable shadowing issue in rvt_create_cq RDMA/core: Fix race when resolving IP address RDMA/core: Make rdma_counter.h compile stand alone IB/core: Work on the caller socket net namespace in nldev_newlink() RDMA/rxe: Fill in wc byte_len with IB_WC_RECV_RDMA_WITH_IMM RDMA/mlx5: Set RDMA DIM to be enabled by default RDMA/nldev: Added configuration of RDMA dynamic interrupt moderation to netlink RDMA/core: Provide RDMA DIM support for ULPs linux/dim: Implement RDMA adaptive moderation (DIM) IB/mlx5: Report correctly tag matching rendezvous capability docs: infiniband: add it to the driver-api bookset IB/mlx5: Implement VHCA tunnel mechanism in DEVX ... commit e9630660bd9253b3ed3926e18278b740cf218365 Author: Steve French Date: Mon Jul 15 21:59:41 2019 -0500 smb3: smbdirect no longer experimental clarify Kconfig to indicate that smb direct (SMB3 over RDMA) is no longer experimental. Over the last three releases Long Li has fixed various problems uncovered by xfstesting. Signed-off-by: Steve French Acked-by: Ronnie Sahlberg commit 8de262531f5fbb7458463224a7587429800c24bf Merge: be8454afc50f 7efd105c27fd Author: Linus Torvalds Date: Mon Jul 15 20:18:40 2019 -0700 Merge tag 'mfd-next-5.3' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/mfd Pull MFD updates from Lee Jones: "Core Frameworks: - Set 'struct device' fwnode when registering a new device New Drivers: - Add support for ROHM BD70528 PMIC New Device Support: - Add support for LP87561 4-Phase Regulator to TI LP87565 PMIC - Add support for RK809 and RK817 to Rockchip RK808 - Add support for Lid Angle to ChromeOS core - Add support for CS47L15 CODEC to Madera core - Add support for CS47L92 CODEC to Madera core - Add support for ChromeOS (legacy) Accelerometers in ChromeOS core - Add support for Add Intel Elkhart Lake PCH to Intel LPSS New Functionality: - Provide regulator supply information when registering; madera-core - Additional Device Tree support; lp87565, madera, cros-ec, rohm,bd71837-pmic - Allow over-riding power button press via Device Tree; rohm-bd718x7 - Differentiate between running processors; cros_ec_dev Fix-ups: - Big header file update; cros_ec_commands.h - Split header per-subsystem; rohm-bd718x7 - Remove superfluous code; menelaus, cs5535-mfd, cs47lXX-tables - Trivial; sorting, coding style; intel-lpss-pci - Only remove Power Off functionality if set locally; rk808 - Make use for Power Off Prepare(); rk808 - Fix spelling mistake in header guards; stmfx - Properly free IDA resources - SPDX fixups; cs47lXX-tables, madera - Error path fixups; hi655x-pmic Bug Fixes: - Add missing break in case() statement - Repair undefined behaviour when not initialising variables; arizona-core, madera-core - Fix reference to Device Tree documentation; madera" * tag 'mfd-next-5.3' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/mfd: (45 commits) mfd: hi655x-pmic: Fix missing return value check for devm_regmap_init_mmio_clk mfd: madera: Fixup SPDX headers mfd: madera: Remove some unused registers and fix some defaults mfd: intel-lpss: Release IDA resources mfd: intel-lpss: Add Intel Elkhart Lake PCH PCI IDs mfd: cs5535-mfd: Remove ifdef OLPC noise mfd: stmfx: Fix macro definition spelling dt-bindings: mfd: Add link to ROHM BD71847 Datasheet MAINAINERS: Swap words in INTEL PMIC MULTIFUNCTION DEVICE DRIVERS mfd: cros_ec_dev: Register cros_ec_accel_legacy driver as a subdevice mfd: rk808: Prepare rk805 for poweroff mfd: rk808: Check pm_power_off pointer mfd: cros_ec: differentiate SCP from EC by feature bit dt-bindings: Add binding for cros-ec-rpmsg mfd: madera: Add Madera core support for CS47L92 mfd: madera: Add Madera core support for CS47L15 mfd: madera: Update DT bindings to add additional CODECs mfd: madera: Add supply mapping for MICVDD mfd: madera: Fix potential uninitialised use of variable mfd: madera: Fix bad reference to pinctrl.txt file ... commit 88a92c913cef09e70b1744a8877d177aa6cb2189 Author: Ronnie Sahlberg Date: Tue Jul 16 10:41:46 2019 +1000 cifs: fix crash in smb2_compound_op()/smb2_set_next_command() RHBZ: 1722704 In low memory situations the various SMB2_*_init() functions can fail to allocate a request PDU and thus leave the request iovector as NULL. If we don't check the return code for failure we end up calling smb2_set_next_command() with a NULL iovector causing a crash when it tries to dereference it. CC: Stable Signed-off-by: Ronnie Sahlberg Signed-off-by: Steve French commit be8454afc50f43016ca8b6130d9673bdd0bd56ec Merge: fec88ab0af97 3729fe2bc2a0 Author: Linus Torvalds Date: Mon Jul 15 19:04:27 2019 -0700 Merge tag 'drm-next-2019-07-16' of git://anongit.freedesktop.org/drm/drm Pull drm updates from Dave Airlie: "The biggest thing in this is the AMD Navi GPU support, this again contains a bunch of header files that are large. These are the new AMD RX5700 GPUs that just recently became available. New drivers: - ST-Ericsson MCDE driver - Ingenic JZ47xx SoC UAPI change: - HDR source metadata property Core: - HDR inforframes and EDID parsing - drm hdmi infoframe unpacking - remove prime sg_table caching into dma-buf - New gem vram helpers to reduce driver code - Lots of drmP.h removal - reservation fencing fix - documentation updates - drm_fb_helper_connector removed - mode name command handler rewrite fbcon: - Remove the fbcon notifiers ttm: - forward progress fixes dma-buf: - make mmap call optional - debugfs refcount fixes - dma-fence free with pending signals fix - each dma-buf gets an inode Panels: - Lots of additional panel bindings amdgpu: - initial navi10 support - avoid hw reset - HDR metadata support - new thermal sensors for vega asics - RAS fixes - use HMM rather than MMU notifier - xgmi topology via kfd - SR-IOV fixes - driver reload fixes - DC use a core bpc attribute - Aux fixes for DC - Bandwidth calc updates for DC - Clock handling refactor - kfd VEGAM support vmwgfx: - Coherent memory support changes i915: - HDR Support - HDMI i2c link - Icelake multi-segmented gamma support - GuC firmware update - Mule Creek Canyon PCH support for EHL - EHL platform updtes - move i915.alpha_support to i915.force_probe - runtime PM refactoring - VBT parsing refactoring - DSI fixes - struct mutex dependency reduction - GEM code reorg mali-dp: - Komeda driver features msm: - dsi vs EPROBE_DEFER fixes - msm8998 snapdragon 835 support - a540 gpu support - mdp5 and dpu interconnect support exynos: - drmP.h removal tegra: - misc fixes tda998x: - audio support improvements - pixel repeated mode support - quantisation range handling corrections - HDMI vendor info fix armada: - interlace support fix - overlay/video plane register handling refactor - add gamma support rockchip: - RX3328 support panfrost: - expose perf counters via hidden ioctls vkms: - enumerate CRC sources list ast: - rework BO handling mgag200: - rework BO handling dw-hdmi: - suspend/resume support rcar-du: - R8A774A1 Soc Support - LVDS dual-link mode support - Additional formats - Misc fixes omapdrm: - DSI command mode display support stm - fb modifier support - runtime PM support sun4i: - use vmap ops vc4: - binner bo binding rework v3d: - compute shader support - resync/sync fixes - job management refactoring lima: - NULL pointer in irq handler fix - scheduler default timeout virtio: - fence seqno support - trace events bochs: - misc fixes tc458767: - IRQ/HDP handling sii902x: - HDMI audio support atmel-hlcdc: - misc fixes meson: - zpos support" * tag 'drm-next-2019-07-16' of git://anongit.freedesktop.org/drm/drm: (1815 commits) Revert "Merge branch 'vmwgfx-next' of git://people.freedesktop.org/~thomash/linux into drm-next" Revert "mm: adjust apply_to_pfn_range interface for dropped token." mm: adjust apply_to_pfn_range interface for dropped token. drm/amdgpu/navi10: add uclk activity sensor drm/amdgpu: properly guard the generic discovery code drm/amdgpu: add missing documentation on new module parameters drm/amdgpu: don't invalidate caches in RELEASE_MEM, only do the writeback drm/amd/display: avoid 64-bit division drm/amdgpu/psp11: simplify the ucode register logic drm/amdgpu: properly guard DC support in navi code drm/amd/powerplay: vega20: fix uninitialized variable use drm/amd/display: dcn20: include linux/delay.h amdgpu: make pmu support optional drm/amd/powerplay: Zero initialize current_rpm in vega20_get_fan_speed_percent drm/amd/powerplay: Zero initialize freq in smu_v11_0_get_current_clk_freq drm/amd/powerplay: Use memset to initialize metrics structs drm/amdgpu/mes10.1: Fix header guard drm/amd/powerplay: add temperature sensor support for navi10 drm/amdgpu: fix scheduler timeout calc drm/amdgpu: Prepare for hmm_range_register API change (v2) ... commit f90b8fda3a9d72a9422ea80ae95843697f94ea4a Author: Linus Walleij Date: Mon Jul 15 22:21:01 2019 +0200 ARM: dts: gemini: Set DIR-685 SPI CS as active low The SPI to the display on the DIR-685 is active low, we were just saved by the SPI library enforcing active low on everything before, so set it as active low to avoid ambiguity. Link: https://lore.kernel.org/r/20190715202101.16060-1-linus.walleij@linaro.org Cc: stable@vger.kernel.org Signed-off-by: Linus Walleij Signed-off-by: Olof Johansson commit 7e8a0f10899075ac2665c78c4e49dbaf32bf3346 Author: Masahiro Yamada Date: Wed Jul 10 14:13:20 2019 +0900 ARM: stm32: use "depends on" instead of "if" after prompt This appeared after the global fixups by commit e32465429490 ("ARM: use "depends on" for SoC configs instead of "if" after prompt"). Fix it now. Link: https://lore.kernel.org/r/20190710051320.8738-1-yamada.masahiro@socionext.com Fixes: e32465429490 ("ARM: use "depends on" for SoC configs instead of "if" after prompt") Signed-off-by: Masahiro Yamada Signed-off-by: Olof Johansson commit 7cba7caceebc0c17acd4165db313575f8c0f5387 Merge: da4d0b289142 1f6db18fbd76 Author: Olof Johansson Date: Mon Jul 15 17:29:45 2019 -0700 Merge branch 'for-arm-soc' of git://git.armlinux.org.uk/~rmk/linux-arm into arm/soc * 'for-arm-soc' of git://git.armlinux.org.uk/~rmk/linux-arm: (21 commits) ARM: sa1100: convert to common clock framework ARM: riscpc: enable chained scatterlist support ARM: riscpc: reduce IRQ handling code ARM: riscpc: move RiscPC assembly files from arch/arm/lib to mach-rpc ARM: riscpc: parse video information from tagged list ARM: riscpc: add ecard quirk for Atomwide 3port serial card ARM: sa1100/neponset: convert serial to use gpiod APIs ARM: sa1100/hackkit: remove empty serial mctrl functions ARM: sa1100/badge4: remove commented out modem control initialisers ARM: sa1100/h3xxx: convert serial to gpiod APIs ARM: sa1100/assabet: convert serial to gpiod APIs serial: sa1100: add note about modem control signals serial: sa1100: add support for mctrl gpios ARM: riscpc: dma: use __iomem pointers for writing DMA ARM: riscpc: dma: improve address/length writing ARM: riscpc: dma: make state a local variable ARM: riscpc: dma: eliminate "cur_sg" scatterlist usage ARM: riscpc: fix DMA ARM: riscpc: fix ecard printing ARM: riscpc: fix lack of keyboard interrupts after irq conversion ... Signed-off-by: Olof Johansson commit 1d43d5e469d92601ed5b606998bdc7d450276636 Merge: f384e62a82ba 3d144578c91a Author: David S. Miller Date: Mon Jul 15 17:18:15 2019 -0700 Merge tag 'mlx5-fixes-2019-07-15' of git://git.kernel.org/pub/scm/linux/kernel/git/saeed/linux Saeed Mameed says: ==================== Mellanox, mlx5 fixes 2019-07-15 This pull request provides mlx5 TC flower and tunnel fixes for kernel 5.2 from Eli and Vlad. ==================== Signed-off-by: David S. Miller commit d5e1db990fcce571a4af2434d6fc2b312d94b45e Author: Andrii Nakryiko Date: Fri Jul 12 10:44:41 2019 -0700 selftests/bpf: remove logic duplication in test_verifier test_verifier tests can specify single- and multi-runs tests. Internally logic of handling them is duplicated. Get rid of it by making single run retval/data specification to be a first run spec. Signed-off-by: Andrii Nakryiko Cc: Krzesimir Nowak Signed-off-by: Daniel Borkmann commit 6da193569cbe2127faa7a934a3c18fffe32c6041 Merge: 81f522f96f78 073a4834a813 Author: Daniel Borkmann Date: Mon Jul 15 23:15:53 2019 +0200 Merge branch 'bpf-fix-wide-loads-sockaddr' Stanislav Fomichev says: ==================== When fixing selftests by adding support for wide stores, Yonghong reported that he had seen some examples where clang generates single u64 loads for two adjacent u32s as well: http://lore.kernel.org/netdev/a66c937f-94c0-eaf8-5b37-8587d66c0c62@fb.com Fix this to support aligned u64 reads for some bpf_sock_addr fields as well. ==================== Acked-by: Andrii Narkyiko Acked-by: Yonghong Song Signed-off-by: Daniel Borkmann commit 073a4834a81368c8af9cc9e99ff83245600a8f6b Author: Stanislav Fomichev Date: Mon Jul 15 09:39:56 2019 -0700 bpf: sync bpf.h to tools/ Update bpf_sock_addr comments to indicate support for 8-byte reads from user_ip6 and msg_src_ip6. Cc: Yonghong Song Signed-off-by: Stanislav Fomichev Signed-off-by: Daniel Borkmann commit 7dd8d6119d481da1c4619eb7d8cfef33edfbee81 Author: Stanislav Fomichev Date: Mon Jul 15 09:39:55 2019 -0700 selftests/bpf: add selftests for wide loads Mirror existing wide store tests with wide loads. The only significant difference is expected error string. Cc: Yonghong Song Signed-off-by: Stanislav Fomichev Signed-off-by: Daniel Borkmann commit 8b45063c8584b3e6caff0b109dd0f47b35487aba Author: Stanislav Fomichev Date: Mon Jul 15 09:39:54 2019 -0700 selftests/bpf: rename verifier/wide_store.c to verifier/wide_access.c Move the file and rename internal BPF_SOCK_ADDR define to BPF_SOCK_ADDR_STORE. This selftest will be extended in the next commit with the wide loads. Cc: Yonghong Song Signed-off-by: Stanislav Fomichev Signed-off-by: Daniel Borkmann commit d4ecfeb15494ec261fef2d25d96eecba66f0b182 Author: Stanislav Fomichev Date: Mon Jul 15 09:39:53 2019 -0700 bpf: allow wide aligned loads for bpf_sock_addr user_ip6 and msg_src_ip6 Add explicit check for u64 loads of user_ip6 and msg_src_ip6 and update the comment. Cc: Yonghong Song Signed-off-by: Stanislav Fomichev Signed-off-by: Daniel Borkmann commit b43995469e5804636a55372e9bbb17ccb22441c5 Author: Stanislav Fomichev Date: Mon Jul 15 09:39:52 2019 -0700 bpf: rename bpf_ctx_wide_store_ok to bpf_ctx_wide_access_ok Rename bpf_ctx_wide_store_ok to bpf_ctx_wide_access_ok to indicate that it can be used for both loads and stores. Cc: Yonghong Song Signed-off-by: Stanislav Fomichev Signed-off-by: Daniel Borkmann commit 81f522f96f788ba978f505d5a03a039f75360b8b Author: Ilya Leoshkevich Date: Mon Jul 15 11:11:03 2019 +0200 samples/bpf: build with -D__TARGET_ARCH_$(SRCARCH) While $ARCH can be relatively flexible (see Makefile and tools/scripts/Makefile.arch), $SRCARCH always corresponds to a directory name under arch/. Therefore, build samples with -D__TARGET_ARCH_$(SRCARCH), since that matches the expectations of bpf_helpers.h. Signed-off-by: Ilya Leoshkevich Acked-by: Vasily Gorbik Acked-by: Andrii Nakryiko Signed-off-by: Daniel Borkmann commit f83a46d4711e789642033eb00fed8e017e34fe7d Author: Ilya Leoshkevich Date: Fri Jul 12 15:59:50 2019 +0200 selftests/bpf: put test_stub.o into $(OUTPUT) Add a rule to put test_stub.o in $(OUTPUT) and change the references to it accordingly. This prevents test_stub.o from being created in the source directory. Signed-off-by: Ilya Leoshkevich Acked-by: Andrii Nakryiko Signed-off-by: Daniel Borkmann commit e46fc22e60a410d896448835adca95aa3332d25d Author: Ilya Leoshkevich Date: Fri Jul 12 15:56:31 2019 +0200 selftests/bpf: make directory prerequisites order-only When directories are used as prerequisites in Makefiles, they can cause a lot of unnecessary rebuilds, because a directory is considered changed whenever a file in this directory is added, removed or modified. If the only thing a target is interested in is the existence of the directory it depends on, which is the case for selftests/bpf, this directory should be specified as an order-only prerequisite: it would still be created in case it does not exist, but it would not trigger a rebuild of a target in case it's considered changed. Signed-off-by: Ilya Leoshkevich Acked-by: Andrii Nakryiko Signed-off-by: Daniel Borkmann commit 025c0c0917b78f21e3aaffecda75968d54172095 Author: Ilya Leoshkevich Date: Fri Jul 12 15:41:42 2019 +0200 selftests/bpf: fix attach_probe on s390 attach_probe test fails, because it cannot install a kprobe on a non-existent sys_nanosleep symbol. Use the correct symbol name for the nanosleep syscall on 64-bit s390. Don't bother adding one for 31-bit mode, since tests are compiled only in 64-bit mode. Fixes: 1e8611bbdfc9 ("selftests/bpf: add kprobe/uprobe selftests") Signed-off-by: Ilya Leoshkevich Acked-by: Vasily Gorbik Acked-by: Andrii Nakryiko Signed-off-by: Daniel Borkmann commit 896bcc908a2f422acf604ad0717aee593f3e823f Merge: af3c24e0e2ed 8981e56fa172 Author: Daniel Borkmann Date: Mon Jul 15 23:02:17 2019 +0200 Merge branch 'bpf-btf-size-verification-fix' Andrii Nakryiko says: ==================== BTF size resolution logic isn't always resolving type size correctly, leading to erroneous map creation failures due to value size mismatch. This patch set: 1. fixes the issue (patch #1); 2. adds tests for trickier cases (patch #2); 3. and converts few test cases utilizing BTF-defined maps, that previously couldn't use typedef'ed arrays due to kernel bug (patch #3). ==================== Acked-by: Yonghong Song Signed-off-by: Daniel Borkmann commit 8981e56fa17282598571958ae6a29cbc3209a6cb Author: Andrii Nakryiko Date: Fri Jul 12 10:25:57 2019 -0700 selftests/bpf: use typedef'ed arrays as map values Convert few tests that couldn't use typedef'ed arrays due to kernel bug. Signed-off-by: Andrii Nakryiko Signed-off-by: Daniel Borkmann commit dd13f3ca642986b59a1863101e58cd694e81f888 Author: Andrii Nakryiko Date: Fri Jul 12 10:25:56 2019 -0700 selftests/bpf: add trickier size resolution tests Add more BTF tests, validating that size resolution logic is correct in few trickier cases. Signed-off-by: Andrii Nakryiko Signed-off-by: Daniel Borkmann commit 1acc5d5c5832da9a98b22374a8fae08ffe31b3f8 Author: Andrii Nakryiko Date: Fri Jul 12 10:25:55 2019 -0700 bpf: fix BTF verifier size resolution logic BTF verifier has a size resolution bug which in some circumstances leads to invalid size resolution for, e.g., TYPEDEF modifier. This happens if we have [1] PTR -> [2] TYPEDEF -> [3] ARRAY, in which case due to being in pointer context ARRAY size won't be resolved (because for pointer it doesn't matter, so it's a sink in pointer context), but it will be permanently remembered as zero for TYPEDEF and TYPEDEF will be marked as RESOLVED. Eventually ARRAY size will be resolved correctly, but TYPEDEF resolved_size won't be updated anymore. This, subsequently, will lead to erroneous map creation failure, if that TYPEDEF is specified as either key or value, as key_size/value_size won't correspond to resolved size of TYPEDEF (kernel will believe it's zero). Note, that if BTF was ordered as [1] ARRAY <- [2] TYPEDEF <- [3] PTR, this won't be a problem, as by the time we get to TYPEDEF, ARRAY's size is already calculated and stored. This bug manifests itself in rejecting BTF-defined maps that use array typedef as a value type: typedef int array_t[16]; struct { __uint(type, BPF_MAP_TYPE_ARRAY); __type(value, array_t); /* i.e., array_t *value; */ } test_map SEC(".maps"); The fix consists on not relying on modifier's resolved_size and instead using modifier's resolved_id (type ID for "concrete" type to which modifier eventually resolves) and doing size determination for that resolved type. This allow to preserve existing "early DFS termination" logic for PTR or STRUCT_OR_ARRAY contexts, but still do correct size determination for modifier types. Fixes: eb3f595dab40 ("bpf: btf: Validate type reference") Cc: Martin KaFai Lau Signed-off-by: Andrii Nakryiko Acked-by: Martin KaFai Lau Signed-off-by: Daniel Borkmann commit 3d144578c91a2db417923ba905ce7a84ce0c274b Author: Vlad Buslov Date: Thu Jul 11 13:03:48 2019 +0300 net/mlx5e: Allow dissector meta key in tc flower Recently, fl_flow_key->indev_ifindex int field was refactored into flow_dissector_key_meta field. With this, flower classifier also sets FLOW_DISSECTOR_KEY_META flow dissector key. However, mlx5 flower dissector validation code rejects filters that use flow dissector keys that are not supported. Add FLOW_DISSECTOR_KEY_META to the list of allowed dissector keys in __parse_cls_flower() to prevent following error when offloading flower classifier to mlx5: Error: mlx5_core: Unsupported key. Fixes: 8212ed777f40 ("net: sched: cls_flower: use flow_dissector for ingress ifindex") Signed-off-by: Vlad Buslov Reviewed-by: Roi Dayan Signed-off-by: Saeed Mahameed commit 075973c7d7bb866a5bb37f96027ef99bf7244c83 Author: Vlad Buslov Date: Mon Jul 8 17:02:36 2019 +0300 net/mlx5e: Rely on filter_dev instead of dissector keys for tunnels Currently, tunnel attributes are parsed and inner header matching is used only when flow dissector specifies match on some of the supported encapsulation fields. When user tries to offload tc filter that doesn't match any encapsulation fields on tunnel device, mlx5 tc layer incorrectly sets to match packet header keys on encap header (outer header) and firmware rejects the rule with syndrome 0x7e1579 when creating new flow group. Change __parse_cls_flower() to determine whether tunnel is used based on fitler_dev tunnel info, instead of determining it indirectly by checking flow dissector enc keys. Fixes: bbd00f7e2349 ("net/mlx5e: Add TC tunnel release action for SRIOV offloads") Signed-off-by: Vlad Buslov Reviewed-by: Roi Dayan Signed-off-by: Saeed Mahameed commit d71f895c31952cfd3277f82ebed60fc3f2350b52 Author: Eli Cohen Date: Thu Jun 27 08:34:41 2019 +0300 net/mlx5e: Verify encapsulation is supported When mlx5e_attach_encap() calls mlx5e_get_tc_tun() to get the tunnel info data struct, check that returned value is not NULL, as would be in the case of unsupported encapsulation. Fixes: d386939a327d2 ("net/mlx5e: Rearrange tc tunnel code in a modular way") Signed-off-by: Eli Cohen Reviewed-by: Roi Dayan Signed-off-by: Saeed Mahameed commit 6694e48012826351036fd10fc506ca880023e25f Author: Liran Alon Date: Mon Jul 15 18:47:44 2019 +0300 KVM: nVMX: Ignore segment base for VMX memory operand when segment not FS or GS As reported by Maxime at https://bugzilla.kernel.org/show_bug.cgi?id=204175: In vmx/nested.c::get_vmx_mem_address(), when the guest runs in long mode, the base address of the memory operand is computed with a simple: *ret = s.base + off; This is incorrect, the base applies only to FS and GS, not to the others. Because of that, if the guest uses a VMX instruction based on DS and has a DS.base that is non-zero, KVM wrongfully adds the base to the resulting address. Reported-by: Maxime Villard Reviewed-by: Joao Martins Signed-off-by: Liran Alon Signed-off-by: Paolo Bonzini commit 0d88800d547211ce07be3551c812d404cf2be3a8 Author: Yi Wang Date: Sat Jul 6 01:08:48 2019 +0800 kvm: x86: ioapic and apic debug macros cleanup The ioapic_debug and apic_debug have been not used for years, and kvm tracepoints are enough for debugging, so remove them as Paolo suggested. However, there may be something wrong when pv evi get/put user, so it's better to retain some log there. Signed-off-by: Yi Wang Signed-off-by: Paolo Bonzini commit f384e62a82ba5d85408405fdd6aeff89354deaa9 Author: Phong Tran Date: Mon Jul 15 22:08:14 2019 +0700 ISDN: hfcsusb: checking idx of ep configuration The syzbot test with random endpoint address which made the idx is overflow in the table of endpoint configuations. this adds the checking for fixing the error report from syzbot KASAN: stack-out-of-bounds Read in hfcsusb_probe [1] The patch tested by syzbot [2] Reported-by: syzbot+8750abbc3a46ef47d509@syzkaller.appspotmail.com [1]: https://syzkaller.appspot.com/bug?id=30a04378dac680c5d521304a00a86156bb913522 [2]: https://groups.google.com/d/msg/syzkaller-bugs/_6HBdge8F3E/OJn7wVNpBAAJ Signed-off-by: Phong Tran Signed-off-by: David S. Miller commit 3729fe2bc2a01f4cc1aa88be8f64af06084c87d6 Author: Dave Airlie Date: Tue Jul 16 04:07:13 2019 +1000 Revert "Merge branch 'vmwgfx-next' of git://people.freedesktop.org/~thomash/linux into drm-next" This reverts commit 031e610a6a21448a63dff7a0416e5e206724caac, reversing changes made to 52d2d44eee8091e740d0d275df1311fb8373c9a9. The mm changes in there we premature and not fully ack or reviewed by core mm folks, I dropped the ball by merging them via this tree, so lets take em all back out. Signed-off-by: Dave Airlie commit 7e4b4dfc98d54bc79f7ca29c8bc6307ed2948014 Author: Dave Airlie Date: Tue Jul 16 04:06:29 2019 +1000 Revert "mm: adjust apply_to_pfn_range interface for dropped token." This reverts commit 6dfc43d3a19174faead54575c204aee106225f43. Going to revert the whole vmwwgfx pull. Signed-off-by: Dave Airlie commit c5ec23bb190267f8b6cb287b761c1f6630c4b694 Author: Fuqian Huang Date: Mon Jul 15 11:21:18 2019 +0800 vmxnet3: Remove call to memset after dma_alloc_coherent In commit 518a2f1925c3 ("dma-mapping: zero memory returned from dma_alloc_*"), dma_alloc_coherent has already zeroed the memory. So memset is not needed. Signed-off-by: Fuqian Huang Signed-off-by: David S. Miller commit 6a24c8fb0d889b39079215970210f88255b81c80 Author: Fuqian Huang Date: Mon Jul 15 11:19:21 2019 +0800 hippi: Remove call to memset after pci_alloc_consistent pci_alloc_consistent calls dma_alloc_coherent directly. In commit 518a2f1925c3 ("dma-mapping: zero memory returned from dma_alloc_*"), dma_alloc_coherent has already zeroed the memory. So memset is not needed. Signed-off-by: Fuqian Huang Signed-off-by: David S. Miller commit 3a5ee3b30126bd7dc5d6299f3a985d4fefcf42c9 Author: Fuqian Huang Date: Mon Jul 15 11:19:11 2019 +0800 ethernet: remove redundant memset kvzalloc already zeroes the memory during the allocation. pci_alloc_consistent calls dma_alloc_coherent directly. In commit 518a2f1925c3 ("dma-mapping: zero memory returned from dma_alloc_*"), dma_alloc_coherent has already zeroed the memory. So the memset after these function is not needed. Signed-off-by: Fuqian Huang Signed-off-by: David S. Miller commit cef86f1536b02e61e699f53b5f8782067481580d Author: Fuqian Huang Date: Mon Jul 15 11:17:09 2019 +0800 atm: idt77252: Remove call to memset after dma_alloc_coherent In commit 518a2f1925c3 ("dma-mapping: zero memory returned from dma_alloc_*"), dma_alloc_coherent has already zeroed the memory. So memset is not needed. Signed-off-by: Fuqian Huang Signed-off-by: David S. Miller commit 071c37983d99da07797294ea78e9da1a6e287144 Author: Lorenzo Bianconi Date: Sun Jul 14 23:36:11 2019 +0200 net: neigh: fix multiple neigh timer scheduling Neigh timer can be scheduled multiple times from userspace adding multiple neigh entries and forcing the neigh timer scheduling passing NTF_USE in the netlink requests. This will result in a refcount leak and in the following dump stack: [ 32.465295] NEIGH: BUG, double timer add, state is 8 [ 32.465308] CPU: 0 PID: 416 Comm: double_timer_ad Not tainted 5.2.0+ #65 [ 32.465311] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.12.0-2.fc30 04/01/2014 [ 32.465313] Call Trace: [ 32.465318] dump_stack+0x7c/0xc0 [ 32.465323] __neigh_event_send+0x20c/0x880 [ 32.465326] ? ___neigh_create+0x846/0xfb0 [ 32.465329] ? neigh_lookup+0x2a9/0x410 [ 32.465332] ? neightbl_fill_info.constprop.0+0x800/0x800 [ 32.465334] neigh_add+0x4f8/0x5e0 [ 32.465337] ? neigh_xmit+0x620/0x620 [ 32.465341] ? find_held_lock+0x85/0xa0 [ 32.465345] rtnetlink_rcv_msg+0x204/0x570 [ 32.465348] ? rtnl_dellink+0x450/0x450 [ 32.465351] ? mark_held_locks+0x90/0x90 [ 32.465354] ? match_held_lock+0x1b/0x230 [ 32.465357] netlink_rcv_skb+0xc4/0x1d0 [ 32.465360] ? rtnl_dellink+0x450/0x450 [ 32.465363] ? netlink_ack+0x420/0x420 [ 32.465366] ? netlink_deliver_tap+0x115/0x560 [ 32.465369] ? __alloc_skb+0xc9/0x2f0 [ 32.465372] netlink_unicast+0x270/0x330 [ 32.465375] ? netlink_attachskb+0x2f0/0x2f0 [ 32.465378] netlink_sendmsg+0x34f/0x5a0 [ 32.465381] ? netlink_unicast+0x330/0x330 [ 32.465385] ? move_addr_to_kernel.part.0+0x20/0x20 [ 32.465388] ? netlink_unicast+0x330/0x330 [ 32.465391] sock_sendmsg+0x91/0xa0 [ 32.465394] ___sys_sendmsg+0x407/0x480 [ 32.465397] ? copy_msghdr_from_user+0x200/0x200 [ 32.465401] ? _raw_spin_unlock_irqrestore+0x37/0x40 [ 32.465404] ? lockdep_hardirqs_on+0x17d/0x250 [ 32.465407] ? __wake_up_common_lock+0xcb/0x110 [ 32.465410] ? __wake_up_common+0x230/0x230 [ 32.465413] ? netlink_bind+0x3e1/0x490 [ 32.465416] ? netlink_setsockopt+0x540/0x540 [ 32.465420] ? __fget_light+0x9c/0xf0 [ 32.465423] ? sockfd_lookup_light+0x8c/0xb0 [ 32.465426] __sys_sendmsg+0xa5/0x110 [ 32.465429] ? __ia32_sys_shutdown+0x30/0x30 [ 32.465432] ? __fd_install+0xe1/0x2c0 [ 32.465435] ? lockdep_hardirqs_off+0xb5/0x100 [ 32.465438] ? mark_held_locks+0x24/0x90 [ 32.465441] ? do_syscall_64+0xf/0x270 [ 32.465444] do_syscall_64+0x63/0x270 [ 32.465448] entry_SYSCALL_64_after_hwframe+0x49/0xbe Fix the issue unscheduling neigh_timer if selected entry is in 'IN_TIMER' receiving a netlink request with NTF_USE flag set Reported-by: Marek Majkowski Fixes: 0c5c2d308906 ("neigh: Allow for user space users of the neighbour table") Signed-off-by: Lorenzo Bianconi Reviewed-by: David Ahern Signed-off-by: David S. Miller commit 41a531ffa4c5aeb062f892227c00fabb3b4a9c91 Author: Soeren Moch Date: Mon Jul 1 12:53:13 2019 +0200 rt2x00usb: fix rx queue hang Since commit ed194d136769 ("usb: core: remove local_irq_save() around ->complete() handler") the handler rt2x00usb_interrupt_rxdone() is not running with interrupts disabled anymore. So this completion handler is not guaranteed to run completely before workqueue processing starts for the same queue entry. Be sure to set all other flags in the entry correctly before marking this entry ready for workqueue processing. This way we cannot miss error conditions that need to be signalled from the completion handler to the worker thread. Note that rt2x00usb_work_rxdone() processes all available entries, not only such for which queue_work() was called. This patch is similar to what commit df71c9cfceea ("rt2x00: fix order of entry flags modification") did for TX processing. This fixes a regression on a RT5370 based wifi stick in AP mode, which suddenly stopped data transmission after some period of heavy load. Also stopping the hanging hostapd resulted in the error message "ieee80211 phy0: rt2x00queue_flush_queue: Warning - Queue 14 failed to flush". Other operation modes are probably affected as well, this just was the used testcase. Fixes: ed194d136769 ("usb: core: remove local_irq_save() around ->complete() handler") Cc: stable@vger.kernel.org # 4.20+ Signed-off-by: Soeren Moch Acked-by: Stanislaw Gruszka Signed-off-by: Kalle Valo commit ff414f31ce3750d259549c3b9eac8e855b5348f0 Author: Arnd Bergmann Date: Mon Jul 8 14:50:06 2019 +0200 ath10k: work around uninitialized vht_pfr variable As clang points out, the vht_pfr is assigned to a struct member without being initialized in one case: drivers/net/wireless/ath/ath10k/mac.c:7528:7: error: variable 'vht_pfr' is used uninitialized whenever 'if' condition is false [-Werror,-Wsometimes-uninitialized] if (!ath10k_mac_can_set_bitrate_mask(ar, band, mask, ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/wireless/ath/ath10k/mac.c:7551:20: note: uninitialized use occurs here arvif->vht_pfr = vht_pfr; ^~~~~~~ drivers/net/wireless/ath/ath10k/mac.c:7528:3: note: remove the 'if' if its condition is always true if (!ath10k_mac_can_set_bitrate_mask(ar, band, mask, ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/wireless/ath/ath10k/mac.c:7483:12: note: initialize the variable 'vht_pfr' to silence this warning u8 vht_pfr; Add an explicit but probably incorrect initialization here. I suspect we want a better fix here, but chose this approach to illustrate the issue. Fixes: 8b97b055dc9d ("ath10k: fix failure to set multiple fixed rate") Signed-off-by: Arnd Bergmann Reviewed-by: Nathan Chancellor Signed-off-by: Kalle Valo commit a7d544d63120061f89459585f06ca44d30842a22 Author: Luca Coelho Date: Mon Jul 8 18:55:34 2019 +0300 iwlwifi: pcie: add support for qu c-step devices Add support for C-step devices. Currently we don't have a nice way of matching the step and choosing the proper configuration, so we need to switch the config structs one by one. Cc: stable@vger.kernel.org Signed-off-by: Luca Coelho Signed-off-by: Kalle Valo commit ffcb60a54f245528e1d49f957ca2d20d6079577c Author: Ihab Zhaika Date: Mon Jul 8 18:55:33 2019 +0300 iwlwifi: add new cards for 9000 and 20000 series add two new PCI ID's for 9000 and 20000 series Cc: stable@vger.kernel.org Signed-off-by: Ihab Zhaika Signed-off-by: Luca Coelho Signed-off-by: Kalle Valo commit 7e4935ccc3236751e5fe4bd6846f86e46bb2e427 Author: Hui Wang Date: Mon Jul 15 10:00:58 2019 -0700 Input: alps - don't handle ALPS cs19 trackpoint-only device On a latest Lenovo laptop, the trackpoint and 3 buttons below it don't work at all, when we move the trackpoint or press those 3 buttons, the kernel will print out: "Rejected trackstick packet from non DualPoint device" This device is identified as an alps touchpad but the packet has trackpoint format, so the alps.c drops the packet and prints out the message above. According to XiaoXiao's explanation, this device is named cs19 and is trackpoint-only device, its firmware is only for trackpoint, it is independent of touchpad and is a device completely different from DualPoint ones. To drive this device with mininal changes to the existing driver, we just let the alps driver not handle this device, then the trackpoint.c will be the driver of this device if the trackpoint driver is enabled. (if not, this device will fallback to a bare PS/2 device) With the trackpoint.c, this trackpoint and 3 buttons all work well, they have all features that the trackpoint should have, like scrolling-screen, drag-and-drop and frame-selection. Signed-off-by: XiaoXiao Liu Signed-off-by: Hui Wang Reviewed-by: Pali Rohár Cc: stable@vger.kernel.org Signed-off-by: Dmitry Torokhov commit 88f28e95e72eebecce5ba6944adffdf3654f626c Author: Maya Nakamura Date: Sun Jul 14 16:27:18 2019 -0700 Input: hyperv-keyboard - remove dependencies on PAGE_SIZE for ring buffer Define the ring buffer size as a constant expression because it should not depend on the guest page size. Signed-off-by: Maya Nakamura Reviewed-by: Michael Kelley Signed-off-by: Dmitry Torokhov commit b8374b85529d9fb974be80c0809c070398aa8cb2 Author: Lars-Peter Clausen Date: Sun Jul 14 14:30:36 2019 -0700 Input: adp5589 - initialize GPIO controller parent device While not strictly required for normal operation setting the GPIO parent device allows the GPIO framework to generate more verbose debug output for the GPIO chip. Signed-off-by: Lars-Peter Clausen Signed-off-by: Alexandru Ardelean Signed-off-by: Dmitry Torokhov commit 6d45d3e08b7460d8ae4199a71a5ad271b0d98f83 Author: Tim Schumacher Date: Sun Jul 14 14:25:59 2019 -0700 Input: iforce - remove empty multiline comments Those are remnants of the SPDX identifier migration, which haven't been removed properly. Signed-off-by: Tim Schumacher Signed-off-by: Dmitry Torokhov commit ecb41832bd2a7a3f8ac93527cec5e51e3827daed Merge: d38b6cf50a6b 0ecfebd2b524 Author: Dmitry Torokhov Date: Mon Jul 15 09:42:32 2019 -0700 Merge tag 'v5.2' into next Sync up with mainline to resolve conflicts in iforce driver. commit d38b6cf50a6b911ee46683330f3af17fcceca509 Author: Joe Perches Date: Sun Jul 14 11:27:51 2019 -0700 Input: synaptics - fix misuse of strlcpy Probable cut&paste typo - use the correct field size. Signed-off-by: Joe Perches Signed-off-by: Dmitry Torokhov commit 89b408a68b9dd163b2705b6f73d8e3cc3579b457 Author: Sheriff Esseson Date: Mon Jul 15 09:15:09 2019 -0700 Documentation: filesystem: Convert xfs.txt to ReST Move xfs.txt to admin-guide, convert xfs.txt to ReST and broken references Signed-off-by: Sheriff Esseson Reviewed-by: Matthew Wilcox (Oracle) Reviewed-by: Darrick J. Wong Signed-off-by: Darrick J. Wong commit 1c230208f53de479352cdb7fa2f851005df7cdc9 Author: Darrick J. Wong Date: Mon Jul 15 08:50:57 2019 -0700 iomap: start moving code to fs/iomap/ Create the build infrastructure we need to start migrating iomap code to fs/iomap/ from fs/iomap.c. Signed-off-by: Darrick J. Wong Reviewed-by: Christoph Hellwig commit c7ca0b614513afba57824cae68447f9c32b1ee61 Author: Andy Lutomirski Date: Mon Jul 15 07:21:44 2019 -0700 Revert "x86/ptrace: Prevent ptrace from clearing the FS/GS selector" and fix the test This reverts commit 48f5e52e916b55fb73754833efbacc7f8081a159. The ptrace ABI change was a prerequisite to the proposed design for FSGSBASE. Since FSGSBASE support has been reverted, and since I'm not convinced that the ABI was ever adequately tested, revert the ABI change as well. This also modifies the test case so that it tests the preexisting behavior. Signed-off-by: Andy Lutomirski Signed-off-by: Thomas Gleixner Link: https://lkml.kernel.org/r/fca39c478ea7fb15bc76fe8a36bd180810a067f6.1563200250.git.luto@kernel.org commit 79ba2a2185432e8ea40e35eb261f10076d205ea3 Author: Eric Sandeen Date: Fri Jul 12 15:07:05 2019 -0700 xfs: sync up xfs_trans_inode with userspace Add an XFS_ICHGTIME_CREATE case to xfs_trans_ichgtime() to keep in sync with userspace. (Currently no kernel caller sends this flag.) Signed-off-by: Eric Sandeen Reviewed-by: Brian Foster Reviewed-by: Darrick J. Wong Signed-off-by: Darrick J. Wong commit 3f6d70e88555d2513b0199c0c383602bf8aec059 Author: Eric Sandeen Date: Fri Jul 12 15:07:05 2019 -0700 xfs: move xfs_trans_inode.c to libxfs/ Userspace now has an identical xfs_trans_inode.c which it has already moved to libxfs/ so do the same move for kernelspace. Signed-off-by: Eric Sandeen Reviewed-by: Brian Foster Reviewed-by: Darrick J. Wong Signed-off-by: Darrick J. Wong commit e10337daefecb47209fd2af5f4fab0d1a370737f Author: Jann Horn Date: Wed Apr 10 09:56:27 2019 -0700 LSM: SafeSetID: fix use of literal -1 in capable hook The capable() hook returns an error number. -EPERM is actually the same as -1, so this doesn't make a difference in behavior. Signed-off-by: Jann Horn Signed-off-by: Micah Morton commit 4f72123da579655855301b591535a1415224f123 Author: Jann Horn Date: Thu Apr 11 13:12:43 2019 -0700 LSM: SafeSetID: verify transitive constrainedness Someone might write a ruleset like the following, expecting that it securely constrains UID 1 to UIDs 1, 2 and 3: 1:2 1:3 However, because no constraints are applied to UIDs 2 and 3, an attacker with UID 1 can simply first switch to UID 2, then switch to any UID from there. The secure way to write this ruleset would be: 1:2 1:3 2:2 3:3 , which uses "transition to self" as a way to inhibit the default-allow policy without allowing anything specific. This is somewhat unintuitive. To make sure that policy authors don't accidentally write insecure policies because of this, let the kernel verify that a new ruleset does not contain any entries that are constrained, but transitively unconstrained. Signed-off-by: Jann Horn Signed-off-by: Micah Morton commit fbd9acb2dc2aa55902c48a83f157082849209fba Author: Jann Horn Date: Thu Apr 11 13:11:54 2019 -0700 LSM: SafeSetID: add read handler For debugging a running system, it is very helpful to be able to see what policy the system is using. Add a read handler that can dump out a copy of the loaded policy. Signed-off-by: Jann Horn Signed-off-by: Micah Morton commit 03638e62f55f27e7a96d6b1175e75b7a81e562b3 Author: Jann Horn Date: Wed Apr 10 09:56:05 2019 -0700 LSM: SafeSetID: rewrite userspace API to atomic updates The current API of the SafeSetID LSM uses one write() per rule, and applies each written rule instantly. This has several downsides: - While a policy is being loaded, once a single parent-child pair has been loaded, the parent is restricted to that specific child, even if subsequent rules would allow transitions to other child UIDs. This means that during policy loading, set*uid() can randomly fail. - To replace the policy without rebooting, it is necessary to first flush all old rules. This creates a time window in which no constraints are placed on the use of CAP_SETUID. - If we want to perform sanity checks on the final policy, this requires that the policy isn't constructed in a piecemeal fashion without telling the kernel when it's done. Other kernel APIs - including things like the userns code and netfilter - avoid this problem by performing updates atomically. Luckily, SafeSetID hasn't landed in a stable (upstream) release yet, so maybe it's not too late to completely change the API. The new API for SafeSetID is: If you want to change the policy, open "safesetid/whitelist_policy" and write the entire policy, newline-delimited, in there. Signed-off-by: Jann Horn Signed-off-by: Micah Morton commit 71a98971b932174e121bc19056475c601598132f Author: Jann Horn Date: Wed Apr 10 09:55:58 2019 -0700 LSM: SafeSetID: fix userns handling in securityfs Looking at current_cred() in write handlers is bad form, stop doing that. Also, let's just require that the write is coming from the initial user namespace. Especially SAFESETID_WHITELIST_FLUSH requires privilege over all namespaces, and SAFESETID_WHITELIST_ADD should probably require it as well. Signed-off-by: Jann Horn Signed-off-by: Micah Morton commit 78ae7df96d647627ceae0b65eea9e4f83a0a4b66 Author: Jann Horn Date: Wed Apr 10 09:55:48 2019 -0700 LSM: SafeSetID: refactor policy parsing In preparation for changing the policy parsing logic, refactor the line parsing logic to be less verbose and move it into a separate function. Signed-off-by: Jann Horn Signed-off-by: Micah Morton commit 8068866c4af124345e2a129be921278aada7830f Author: Jann Horn Date: Wed Apr 10 09:55:41 2019 -0700 LSM: SafeSetID: refactor safesetid_security_capable() At the moment, safesetid_security_capable() has two nested conditional blocks, and one big comment for all the logic. Chop it up and reduce the amount of indentation. Signed-off-by: Jann Horn Signed-off-by: Micah Morton commit 1cd02a27a9473fed0294561137cfb7dcc9b3aaa0 Author: Jann Horn Date: Wed Apr 10 09:55:34 2019 -0700 LSM: SafeSetID: refactor policy hash table parent_kuid and child_kuid are kuids, there is no reason to make them uint64_t. (And anyway, in the kernel, the normal name for that would be u64, not uint64_t.) check_setuid_policy_hashtable_key() and check_setuid_policy_hashtable_key_value() are basically the same thing, merge them. Also fix the comment that claimed that (1<<8)==128. Signed-off-by: Jann Horn Signed-off-by: Micah Morton commit 7ef6b3062fb9f0b9dbaaec182495189459100807 Author: Jann Horn Date: Wed Apr 10 09:55:19 2019 -0700 LSM: SafeSetID: fix check for setresuid(new1, new2, new3) With the old code, when a process with the (real,effective,saved) UID set (1,1,1) calls setresuid(2,3,4), safesetid_task_fix_setuid() only checks whether the transition 1->2 is permitted; the transitions 1->3 and 1->4 are not checked. Fix this. This is also a good opportunity to refactor safesetid_task_fix_setuid() to be less verbose - having one branch per set*uid() syscall is unnecessary. Note that this slightly changes semantics: The UID transition check for UIDs that were not in the old cred struct is now always performed against the policy of the RUID. I think that's more consistent anyway, since the RUID is also the one that decides whether any policy is enforced at all. Signed-off-by: Jann Horn Signed-off-by: Micah Morton commit c783d525f9e7e1fd6a5dc3379f3c1fb041495b76 Author: Jann Horn Date: Wed Apr 10 09:54:34 2019 -0700 LSM: SafeSetID: fix pr_warn() to include newline Fix the pr_warn() calls in the SafeSetID LSM to have newlines at the end. Without this, denial messages will be buffered as incomplete lines in log_output(), and will then only show up once something else prints into dmesg. Signed-off-by: Jann Horn Signed-off-by: Micah Morton commit 50c8000744463aa8534de0d739b50ed4f06f8275 Author: Trond Myklebust Date: Thu Jul 11 19:02:18 2019 -0400 NFSv4: Validate the stateid before applying it to state recovery If the stateid is the zero or invalid stateid, then it is pointless to attempt to use it for recovery. In that case, try to fall back to using the open state stateid, or just doing a general recovery of all state on a given inode. Signed-off-by: Trond Myklebust commit 168869492e7009b6861b615f1d030c99bc805e83 Author: Mauro Carvalho Chehab Date: Tue Jul 9 13:25:51 2019 -0300 docs: kbuild: fix build with pdf and fix some minor issues The tag ".. include" should be replaced by ".. literalinclude" at issues.rst, otherwise it causes TeX to crash due to excessive usage of stack with Sphinx 2.0. While here, solve a few minor issues at the kbuild book output by adding extra blank lines. Signed-off-by: Mauro Carvalho Chehab commit 8bb0776b8b27d548c7e65828ec3a02cb31fe3eed Author: Mauro Carvalho Chehab Date: Tue Jul 9 12:36:09 2019 -0300 docs: block: fix pdf output Add an extra blank line and use a markup for the enumberated list, in order to make it possible to build the block book on pdf format. Signed-off-by: Mauro Carvalho Chehab commit 38cbfed28b3178dd9004064b1a72a992a3b31969 Author: Mauro Carvalho Chehab Date: Tue Jul 9 12:22:41 2019 -0300 docs: arm: fix a breakage with pdf output Add an extra blank line, as otherwise XeLaTex will complain with: ! LaTeX Error: Too deeply nested. Signed-off-by: Mauro Carvalho Chehab commit eddeed127b06ea2542dc18f2fe37d383b6369fec Author: Mauro Carvalho Chehab Date: Sat Jul 6 13:38:56 2019 -0300 docs: don't use nested tables Nested tables aren't supported for pdf output on Sphinx 1.7.9: admin-guide/laptops/sonypi:: nested tables are not yet implemented. admin-guide/laptops/toshiba_haps:: nested tables are not yet implemented. driver-api/nvdimm/btt:: nested tables are not yet implemented. s390/debugging390:: nested tables are not yet implemented. Signed-off-by: Mauro Carvalho Chehab Acked-by: Andy Shevchenko # laptops commit c2746a1eb741759590e8766958232d06a71840d5 Author: Mauro Carvalho Chehab Date: Fri Jun 28 08:14:42 2019 -0300 docs: gpio: add sysfs interface to the admin-guide While this is stated as obsoleted, the sysfs interface described there is still valid, and belongs to the admin-guide. Signed-off-by: Mauro Carvalho Chehab Acked-by: Linus Walleij commit 4c68060bf6d3eac6e86b995a200eb21b847236da Author: Mauro Carvalho Chehab Date: Fri Jun 28 07:29:15 2019 -0300 docs: locking: add it to the main index The locking directory is part of the Kernel API bookset. Add it to the index file. Signed-off-by: Mauro Carvalho Chehab commit 113094f743fc97559c068ad20fd2808b64f6989d Author: Mauro Carvalho Chehab Date: Fri Jun 28 08:36:50 2019 -0300 docs: add some directories to the main documentation index The contents of those directories were orphaned at the documentation body. While those directories could likely be moved to be inside some guide, I'm opting to just adding their indexes to the main one, removing the :orphan: and adding the SPDX header. For the drivers, the rationale is that the documentation contains a mix of Kernelspace, uAPI and admin-guide. So, better to keep them on separate directories, as we've be doing with similar subsystem-specific docs that were not split yet. For the others, well... I'm too lazy to do the move. Also, it seems to make sense to keep at least some of those at the main dir (like kbuild, for example). In any case, a latter patch could do the move. Signed-off-by: Mauro Carvalho Chehab Acked-by: Bartlomiej Zolnierkiewicz commit 7e042736faab9457dd754668b9db2a1113cd322b Author: Mauro Carvalho Chehab Date: Fri Jun 28 07:13:34 2019 -0300 docs: add SPDX tags to new index files All those new files I added are under GPL v2.0 license. Add the corresponding SPDX headers to them. Signed-off-by: Mauro Carvalho Chehab commit 652a49bc68ce3cf0355bde357b3998bd63e73915 Author: Mauro Carvalho Chehab Date: Tue Jun 18 15:03:13 2019 -0300 docs: add a memory-devices subdir to driver-api There are two docs describing memory device drivers. Add both to this new chapter of the driver-api. Signed-off-by: Mauro Carvalho Chehab commit 4745dc8abb0a0a9851c07265eea01d844886d5c8 Author: Mauro Carvalho Chehab Date: Thu Jun 27 16:36:04 2019 -0300 docs: phy: place documentation under driver-api This subsystem-specific documentation belongs to the driver-api. Signed-off-by: Mauro Carvalho Chehab commit 65388dad1bbb51a4eb6cc91b9fa865b57646fb67 Author: Mauro Carvalho Chehab Date: Thu Jun 27 16:31:35 2019 -0300 docs: serial: move it to the driver-api The contents of this directory is mostly driver-api stuff. Signed-off-by: Mauro Carvalho Chehab commit c92992fc609fe99d926855eb1945f38ef4ad8e6c Author: Mauro Carvalho Chehab Date: Mon Apr 22 16:49:11 2019 -0300 docs: driver-api: add remaining converted dirs to it There are a number of driver-specific descriptions that contain a mix of userspace and kernelspace documentation. Just like we did with other similar subsystems, add them at the driver-api groupset, but don't move the directories. Signed-off-by: Mauro Carvalho Chehab commit fb8c5327b3c6c78b74a27a3c42e4f32b2cc30a04 Author: Mauro Carvalho Chehab Date: Thu Jun 13 14:40:42 2019 -0300 docs: driver-api: add xilinx driver API documentation The current file there (emmi) provides a description of the driver uAPI and kAPI. Signed-off-by: Mauro Carvalho Chehab commit baa293e9544bea71361950d071579f0e4d5713ed Author: Mauro Carvalho Chehab Date: Thu Jun 27 15:39:22 2019 -0300 docs: driver-api: add a series of orphaned documents There are lots of documents under Documentation/*.txt and a few other orphan documents elsehwere that belong to the driver-API book. Move them to their right place. Reviewed-by: Cornelia Huck # vfio-related parts Acked-by: Logan Gunthorpe # switchtec Signed-off-by: Mauro Carvalho Chehab commit 4f4cfa6c560c93ba180c30675cf845e1597de44c Author: Mauro Carvalho Chehab Date: Thu Jun 27 14:56:51 2019 -0300 docs: admin-guide: add a series of orphaned documents There are lots of documents that belong to the admin-guide but are on random places (most under Documentation root dir). Move them to the admin guide. Signed-off-by: Mauro Carvalho Chehab Acked-by: Alexandre Belloni Acked-by: Bartlomiej Zolnierkiewicz commit da82c92f1150f66afabf78d2c85ef9ac18dc6d38 Author: Mauro Carvalho Chehab Date: Thu Jun 27 13:08:35 2019 -0300 docs: cgroup-v1: add it to the admin-guide book Those files belong to the admin guide, so add them. Signed-off-by: Mauro Carvalho Chehab commit 83bbf6e103544d65f17f4b2ccea1c6a51c0b0769 Author: Mauro Carvalho Chehab Date: Thu Jun 27 12:59:40 2019 -0300 docs: aoe: add it to the driver-api book Those files belong to the admin guide, so add them. Signed-off-by: Mauro Carvalho Chehab Acked-by: Justin Sanders commit df1b7ce784c220373d202ea9f8bc0c424f2c9f7c Author: Mauro Carvalho Chehab Date: Tue Jun 18 17:16:23 2019 -0300 docs: add some documentation dirs to the driver-api book Those are subsystem docs, with a mix of kABI and user-faced docs. While they're not split, keep the dirs where they are, adding just a pointer to the main index. Signed-off-by: Mauro Carvalho Chehab commit fe34c89d25429e079ba67416529514120dd715f8 Author: Mauro Carvalho Chehab Date: Tue Jun 18 12:34:59 2019 -0300 docs: driver-model: move it to the driver-api book The audience for the Kernel driver-model is clearly Kernel hackers. Signed-off-by: Mauro Carvalho Chehab Acked-by: Jeff Kirsher # ice driver changes commit 56198359b64125dd0f9fa991972b61e4bc4fc6b5 Author: Mauro Carvalho Chehab Date: Tue Jun 18 11:44:24 2019 -0300 docs: lp855x-driver.rst: add it to the driver-api book The content of this file is intended for backlight Kernel developers. Signed-off-by: Mauro Carvalho Chehab commit 2dbc0838bcf24ca59cabc3130cf3b1d6809cdcd4 Author: Mauro Carvalho Chehab Date: Tue Jun 18 11:39:21 2019 -0300 docs: ocxl.rst: add it to the uAPI book The content of this file is user-faced. Signed-off-by: Mauro Carvalho Chehab Acked-by: Andrew Donnellan commit e8d776f20f92b9c679bcdcbdf3aee5026d5265f5 Author: Mauro Carvalho Chehab Date: Sat Apr 20 09:20:52 2019 -0300 docs: x86: move two x86-specific files to x86 arch dir Those two docs belong to the x86 architecture: Documentation/Intel-IOMMU.txt -> Documentation/x86/intel-iommu.rst Documentation/intel_txt.txt -> Documentation/x86/intel_txt.rst Signed-off-by: Mauro Carvalho Chehab commit 4d3beaa06d3536aa8968d1828a66bd5ccb5036ac Author: Mauro Carvalho Chehab Date: Fri Apr 19 21:39:29 2019 -0300 docs: security: move some books to it and update The following files belong to security: Documentation/security/LSM.rst -> Documentation/security/lsm-development.rst Documentation/lsm.txt -> Documentation/security/lsm.rst Documentation/SAK.txt -> Documentation/security/sak.rst Documentation/siphash.txt -> Documentation/security/siphash.rst Signed-off-by: Mauro Carvalho Chehab commit e7751617dd0599ceadf4221cb08e04307b00aa1f Author: Mauro Carvalho Chehab Date: Tue Jun 18 11:47:10 2019 -0300 docs: blockdev: add it to the admin-guide The blockdev book basically contains user-faced documentation. Signed-off-by: Mauro Carvalho Chehab commit 330d48105245abfb8c9ca491dc53ea500657217a Author: Mauro Carvalho Chehab Date: Thu Jun 13 15:21:39 2019 -0300 docs: admin-guide: add kdump documentation into it The Kdump documentation describes procedures with admins use in order to solve issues on their systems. Signed-off-by: Mauro Carvalho Chehab commit 9e1cbede267916e737c4a755059418da3ac4de95 Author: Mauro Carvalho Chehab Date: Thu Jun 13 15:07:43 2019 -0300 docs: admin-guide: add laptops documentation The docs under Documentation/laptops contain users specific information. Signed-off-by: Mauro Carvalho Chehab Acked-by: Andy Shevchenko commit 570432470275c3da15b85362bc1461945b9c1919 Author: Mauro Carvalho Chehab Date: Mon Apr 22 16:48:00 2019 -0300 docs: admin-guide: move sysctl directory to it The stuff under sysctl describes /sys interface from userspace point of view. So, add it to the admin-guide and remove the :orphan: from its index file. Signed-off-by: Mauro Carvalho Chehab commit ec4b78a0e7dd4751423089b7cfd32168f9052377 Author: Mauro Carvalho Chehab Date: Tue Jun 18 15:00:25 2019 -0300 docs: early-userspace: move to driver-api guide Those documents describe a kAPI. So, add to the driver-api book. Signed-off-by: Mauro Carvalho Chehab commit 6cf2a73cb2bc422a03984b285a63632c27f8c4e4 Author: Mauro Carvalho Chehab Date: Tue Jun 18 12:40:23 2019 -0300 docs: device-mapper: move it to the admin-guide The DM support describes lots of aspects related to mapped disk partitions from the userspace PoV. Signed-off-by: Mauro Carvalho Chehab commit 159a5e78bdcabb1f87ee5536182a99a307ae0bac Author: Mauro Carvalho Chehab Date: Mon Apr 22 16:10:26 2019 -0300 docs: add arch doc directories to the index Now that several arch documents were converted to ReST, add their indexes to Documentation/index.rst and remove the :orphan: from them. Signed-off-by: Mauro Carvalho Chehab commit 127e62174041496b383f82d696e1592ce6838604 Author: Farhan Ali Date: Thu Jul 11 10:28:55 2019 -0400 vfio-ccw: Update documentation for csch/hsch We now support CLEAR SUBCHANNEL and HALT SUBCHANNEL via ccw_cmd_region. Fixes: d5afd5d135c8 ("vfio-ccw: add handling for async channel instructions") Signed-off-by: Farhan Ali Message-Id: <7d977612c3f3152ffb950d77ae11b4b25c1e20c4.1562854091.git.alifm@linux.ibm.com> [CH: properly mark region as literal block] Reviewed-by: Cornelia Huck Reviewed-by: Eric Farman Signed-off-by: Cornelia Huck commit 9b1f44028ff2e051816517781153e10a2d748dc3 Author: Mauro Carvalho Chehab Date: Tue Jun 18 17:15:10 2019 -0300 docs: interconnect.rst: add it to the driver-api guide This is intended for Kernel hackers audience. Signed-off-by: Mauro Carvalho Chehab Reviewed-by: Georgi Djakov commit 616b81db2fa757f48895242ea6aaf3c1a1ad22f4 Author: Mauro Carvalho Chehab Date: Tue Jun 18 17:13:24 2019 -0300 docs: ioctl: add it to the uAPI guide While 100% of its contents is userspace, let's keep the dir at the same place, as this is a well-known location. Signed-off-by: Mauro Carvalho Chehab commit 09fdc957ad0d0ee83c00cd1e0c3a605047f63bf7 Author: Mauro Carvalho Chehab Date: Tue Jun 18 16:51:34 2019 -0300 docs: leds: add it to the driver-api book The contents of leds driver docs is messy: it has lots of admin-guide stuff and kernel internal ones, just like other driver subsystems. I'm opting to keep the dir at the same place and just add a link to it. This makes clearer that this require changes. Signed-off-by: Mauro Carvalho Chehab commit c0b11a50aee643ac40ded5dbcd48189ee0926ee4 Author: Mauro Carvalho Chehab Date: Tue Jun 18 16:50:07 2019 -0300 docs: md: move it to the driver-api book The docs there were meant to be read by a Kernel developer. Signed-off-by: Mauro Carvalho Chehab commit 19024c09c243c5107f738286459a0dd85697b089 Author: Mauro Carvalho Chehab Date: Tue Jun 18 16:48:15 2019 -0300 docs: mmc: move it to the driver-api Most of the stuff here is related to the kAPI. Signed-off-by: Mauro Carvalho Chehab commit e253d2c551ce876a374d533fbcc9e8f31142dcad Author: Mauro Carvalho Chehab Date: Tue Jun 18 16:46:30 2019 -0300 docs: nfc: add it to the driver-api book Most of the descriptions here are oriented to a Kernel developer. Signed-off-by: Mauro Carvalho Chehab commit 43f6c0787c1781b951d686e8302377fcf85ccb8a Author: Mauro Carvalho Chehab Date: Tue Jun 18 16:40:16 2019 -0300 docs: mtd: move it to the driver-api book While I was tempted to move it to admin-guide, as some docs there are more userspace-faced, there are some very technical discussions about memory error correction code from the Kernel implementer's PoV. So, let's place it inside the driver-api book. Signed-off-by: Mauro Carvalho Chehab commit bf6b7a742e3f82b3132e149fb17761e84207f9f1 Author: Mauro Carvalho Chehab Date: Tue Jun 18 16:33:50 2019 -0300 docs: namespace: move it to the admin-guide As stated at the documentation, this is meant to be for users to better understand namespaces. Signed-off-by: Mauro Carvalho Chehab commit ae4a05027e2f883fb5f822e48d67cacc26bf60e1 Author: Mauro Carvalho Chehab Date: Tue Jun 18 16:32:31 2019 -0300 docs: nvdimm: add it to the driver-api book The descriptions here are from Kernel driver's PoV. Signed-off-by: Mauro Carvalho Chehab Acked-by: Dan Williams commit 59809fe88224db24432ad50e62fd8d5f0df738a1 Author: Mauro Carvalho Chehab Date: Tue Jun 18 16:06:08 2019 -0300 docs: perf: move to the admin-guide The perf infrastructure is used for userspace to track issues. At least a good part of what's described here is related to it. So, add it to the admin-guide. Signed-off-by: Mauro Carvalho Chehab commit d2bdd48a652bd0f7a5c78f3e418b4529fc469e1f Author: Mauro Carvalho Chehab Date: Tue Jun 18 16:03:23 2019 -0300 docs: rapidio: add it to the driver API This is actually a subsystem description, with contains both kAPI and uAPI. While it should ideally be slplit, let's place it at driver-api, as most things are related to kAPI and driver-specific info. Signed-off-by: Mauro Carvalho Chehab commit 74684f8ff44e8b9cf85542762ec347b96bd92559 Author: Mauro Carvalho Chehab Date: Wed Jun 26 12:24:01 2019 -0300 docs: logo.txt: rename it to COPYING-logo This file has nothing to do with the Kernel documentation. It contains the copyright permissions for Tux at Documentation/logo.gif. So, rename it accordingly. Signed-off-by: Mauro Carvalho Chehab commit d5ccd65ab6272f21f442695b0022a4f553d818e5 Author: Mauro Carvalho Chehab Date: Fri Apr 19 19:01:18 2019 -0300 docs: move gcc_plugins.txt to core-api and rename to .rst The gcc_plugins.txt file is already a ReST file. Move it to the core-api book while renaming it. Signed-off-by: Mauro Carvalho Chehab Acked-by: Kees Cook commit 898bd37a92063e46bc8d7b870781cecd66234f92 Author: Mauro Carvalho Chehab Date: Thu Apr 18 19:45:00 2019 -0300 docs: block: convert to ReST Rename the block documentation files to ReST, add an index for them and adjust in order to produce a nice html output via the Sphinx build system. At its new index.rst, let's add a :orphan: while this is not linked to the main index.rst file, in order to avoid build warnings. Signed-off-by: Mauro Carvalho Chehab commit 53b9537509654a6267c3f56b4d2e7409b9089686 Author: Mauro Carvalho Chehab Date: Thu Apr 18 18:35:54 2019 -0300 docs: sysctl: convert to ReST Rename the /proc/sys/ documentation files to ReST, using the README file as a template for an index.rst, adding the other files there via TOC markup. Despite being written on different times with different styles, try to make them somewhat coherent with a similar look and feel, ensuring that they'll look nice as both raw text file and as via the html output produced by the Sphinx build system. At its new index.rst, let's add a :orphan: while this is not linked to the main index.rst file, in order to avoid build warnings. Signed-off-by: Mauro Carvalho Chehab commit 6baec31591cee0f2f6d446abb81c828499a6ed23 Author: Mauro Carvalho Chehab Date: Thu Apr 18 17:35:40 2019 -0300 docs: perf: convert to ReST Rename the perf documentation files to ReST, add an index for them and adjust in order to produce a nice html output via the Sphinx build system. At its new index.rst, let's add a :orphan: while this is not linked to the main index.rst file, in order to avoid build warnings. Signed-off-by: Mauro Carvalho Chehab commit 39443104c7d3f2b05a4a330fbcef6da68f80d60b Author: Mauro Carvalho Chehab Date: Thu Apr 18 17:29:24 2019 -0300 docs: blockdev: convert to ReST Rename the blockdev documentation files to ReST, add an index for them and adjust in order to produce a nice html output via the Sphinx build system. The drbd sub-directory contains some graphs and data flows. Add those too to the documentation. At its new index.rst, let's add a :orphan: while this is not linked to the main index.rst file, in order to avoid build warnings. Signed-off-by: Mauro Carvalho Chehab commit e0ae154404c33477473244f286b1193364144289 Author: Mauro Carvalho Chehab Date: Thu Apr 18 16:49:39 2019 -0300 docs: rapidio: convert to ReST Rename the rapidio documentation files to ReST, add an index for them and adjust in order to produce a nice html output via the Sphinx build system. At its new index.rst, let's add a :orphan: while this is not linked to the main index.rst file, in order to avoid build warnings. Signed-off-by: Mauro Carvalho Chehab commit 5c04dceaa152d9dd9fe94dec6594965069e19e9e Author: Mauro Carvalho Chehab Date: Thu Apr 18 11:38:26 2019 -0300 docs: ioctl: convert to ReST Rename the iio documentation files to ReST, add an index for them and adjust in order to produce a nice html output via the Sphinx build system. The cdrom.txt and hdio.txt have their own particular syntax. In order to speedup the conversion, I used a small ancillary perl script: my $d; $d .= $_ while(<>); $d =~ s/(\nCDROM\S+)\s+(\w[^\n]*)/$1\n\t$2\n/g; $d =~ s/(\nHDIO\S+)\s+(\w[^\n]*)/$1\n\t$2\n/g; $d =~ s/(\n\s*usage:)[\s\n]*(\w[^\n]*)/$1:\n\n\t $2\n/g; $d =~ s/(\n\s*)(E\w+[\s\n]*\w[^\n]*)/$1- $2/g; $d =~ s/(\n\s*)(inputs|outputs|notes):\s*(\w[^\n]*)/$1$2:\n\t\t$3\n/g; print $d; It basically add blank lines on a few interesting places. The script is not perfect: still several things require manual work, but it saved quite some time doing some obvious stuff. At its new index.rst, let's add a :orphan: while this is not linked to the main index.rst file, in order to avoid build warnings. Signed-off-by: Mauro Carvalho Chehab commit 08536105d93fe371743709b85350db141bafc51f Author: Mauro Carvalho Chehab Date: Thu Apr 18 11:21:26 2019 -0300 docs: ioctl-number.txt: convert it to ReST format The conversion itself is simple: add a markup for the title of this file and add markups for both tables. Yet, the big table here with IOCTL numbers is badly formatted: on several lines, the "Include File" column has some values that are bigger than the reserved space there. Also, on several places, a comment was misplaced at the "Include File" space. So, most of the work here is to actually ensure that each field will be properly fixed. Also worth to mention that some URLs have the asterisk character on it. Well, Sphinx has an issue with asterisks in the middle of an string. As this is URL, use the alternate format: %2A. As a side effect of this patch, it is now a lot easier to see that some reserved ioctl numbers are missing the include files where it is supposed to be used. PS.: While this is part of a subdir, I opted to convert this single file alone, as this file has a potential of conflicts, as most subsystem maintainers touch it. Signed-off-by: Mauro Carvalho Chehab commit f408510c4ff38965289bb53e8462861ad05dfada Author: Mauro Carvalho Chehab Date: Thu Apr 18 14:44:06 2019 -0300 docs: mmc: convert to ReST Rename the mmc documentation files to ReST, add an index for them and adjust in order to produce a nice html output via the Sphinx build system. At its new index.rst, let's add a :orphan: while this is not linked to the main index.rst file, in order to avoid build warnings. Signed-off-by: Mauro Carvalho Chehab commit 8ea0afa3b801e9fe3ff676c3e60e74afa1a0848a Author: Mauro Carvalho Chehab Date: Thu Apr 18 14:34:34 2019 -0300 docs: xtensa: convert to ReST Rename the xtensa documentation files to ReST, add an index for them and adjust in order to produce a nice html output via the Sphinx build system. At its new index.rst, let's add a :orphan: while this is not linked to the main index.rst file, in order to avoid build warnings. Signed-off-by: Mauro Carvalho Chehab commit b0a4aa950c68b5010831ecfc450510c64e4d80ba Author: Mauro Carvalho Chehab Date: Thu Apr 18 14:21:14 2019 -0300 docs: nvdimm: convert to ReST Rename the nvdimm documentation files to ReST, add an index for them and adjust in order to produce a nice html output via the Sphinx build system. At its new index.rst, let's add a :orphan: while this is not linked to the main index.rst file, in order to avoid build warnings. Signed-off-by: Mauro Carvalho Chehab Acked-by: Dan Williams commit 6e58e2d81367308ffd891bd0b34d47e9104e7ae4 Author: Mauro Carvalho Chehab Date: Thu Apr 18 13:44:38 2019 -0300 docs: mtd: convert to ReST Rename the mtd documentation files to ReST, add an index for them and adjust in order to produce a nice html output via the Sphinx build system. It should be noticed that Sphinx doesn't handle very well URLs with dots in the middle. Thankfully, internally, the '.' char is translated to %2E, so we can jus use %2E instead of dots, and this will work fine on both text and processed files. At its new index.rst, let's add a :orphan: while this is not linked to the main index.rst file, in order to avoid build warnings. Signed-off-by: Mauro Carvalho Chehab commit 7ed44d59f1959942b8d882e6eeea51616b72e2ec Author: Mauro Carvalho Chehab Date: Thu Apr 18 13:31:33 2019 -0300 docs: md: convert to ReST Rename the md documentation files to ReST, add an index for them and adjust in order to produce a nice html output via the Sphinx build system. At its new index.rst, let's add a :orphan: while this is not linked to the main index.rst file, in order to avoid build warnings. Signed-off-by: Mauro Carvalho Chehab commit 9e678dd886c11fad6511ffad4d400e3abde81d64 Author: Mauro Carvalho Chehab Date: Thu Apr 18 13:02:23 2019 -0300 docs: nfc: convert to ReST Rename the nfc documentation files to ReST, add an index for them and adjust in order to produce a nice html output via the Sphinx build system. At its new index.rst, let's add a :orphan: while this is not linked to the main index.rst file, in order to avoid build warnings. Signed-off-by: Mauro Carvalho Chehab commit 20a78ae9ed297f217537211e3304f525326ee517 Author: Mauro Carvalho Chehab Date: Thu Apr 18 12:43:16 2019 -0300 docs: namespaces: convert to ReST Rename the namespaces documentation files to ReST, add an index for them and adjust in order to produce a nice html output via the Sphinx build system. There are two upper case file names. Rename them to lower case, as we're working to avoid upper case file names at Documentation. At its new index.rst, let's add a :orphan: while this is not linked to the main index.rst file, in order to avoid build warnings. Signed-off-by: Mauro Carvalho Chehab commit b02f1651ff7758c4db0d759ab765d39986a79f5a Author: Mauro Carvalho Chehab Date: Thu Apr 18 11:12:57 2019 -0300 docs: laptops: convert to ReST Rename the laptops documentation files to ReST, add an index for them and adjust in order to produce a nice html output via the Sphinx build system. At its new index.rst, let's add a :orphan: while this is not linked to the main index.rst file, in order to avoid build warnings. Signed-off-by: Mauro Carvalho Chehab Acked-by: Andy Shevchenko commit db9a0975a20c1f21c108b9d44545792d790593e4 Author: Mauro Carvalho Chehab Date: Thu Apr 18 10:10:33 2019 -0300 docs: ia64: convert to ReST Rename the ia64 documentation files to ReST, add an index for them and adjust in order to produce a nice html output via the Sphinx build system. There are two upper case file names. Rename them to lower case, as we're working to avoid upper case file names at Documentation. At its new index.rst, let's add a :orphan: while this is not linked to the main index.rst file, in order to avoid build warnings. Signed-off-by: Mauro Carvalho Chehab commit c3123552aad3ffd7a35e16d4402231225165e343 Author: Mauro Carvalho Chehab Date: Wed Apr 17 05:46:08 2019 -0300 docs: accounting: convert to ReST Rename the accounting documentation files to ReST, add an index for them and adjust in order to produce a nice html output via the Sphinx build system. At its new index.rst, let's add a :orphan: while this is not linked to the main index.rst file, in order to avoid build warnings. Signed-off-by: Mauro Carvalho Chehab commit a36d053863a1b6cd6e79a632af01be014517f9ac Author: Mauro Carvalho Chehab Date: Mon May 27 15:59:13 2019 -0300 docs: DMA-API-HOWTO.txt: fix an unmarked code block When building with Sphinx, it would produce this warning: docs/Documentation/DMA-API-HOWTO.rst:222: WARNING: Definition list ends without a blank line; unexpected unindent. Signed-off-by: Mauro Carvalho Chehab commit eaf5211d8c00060a3b41a031a762c906d3603098 Author: Mauro Carvalho Chehab Date: Mon Apr 15 23:00:35 2019 -0300 docs: rbtree.txt: fix Sphinx build warnings Ths file is already at ReST format. Yet, some recent changes made it to produce a few warnings when building it with Sphinx. Those are trivially fixed by marking some literal blocks. Fix them before adding it to the docs building system. Signed-off-by: Mauro Carvalho Chehab commit 1945a035540e2cef0362a2e7e828f8cf547e86b8 Author: Mauro Carvalho Chehab Date: Mon Apr 15 19:27:55 2019 -0300 docs: phy: convert samsung-usb2.txt to ReST format In order to merge it into a Sphinx book, we need first to convert to ReST. While this is not part of any book, mark it as :orphan:, in order to avoid build warnings. Signed-off-by: Mauro Carvalho Chehab commit a278295ccc2ddd1dc0ac8423a12ff6dd74f0d502 Author: Mauro Carvalho Chehab Date: Mon Apr 15 19:25:27 2019 -0300 docs: nvmem: convert docs to ReST and rename to *.rst In order to be able to add it into a doc book, we need first convert it to ReST. The conversion is actually: - add blank lines and identation in order to identify paragraphs; - mark literal blocks; - adjust title markups. While this is not part of any book, mark it as :orphan:, in order to avoid build warnings. Signed-off-by: Mauro Carvalho Chehab commit 619ba4516771bdfb96658e7a5f57e6551232549a Author: Mauro Carvalho Chehab Date: Fri Apr 19 18:49:49 2019 -0300 docs: bus-devices: ti-gpmc.rst: convert it to ReST In order to be able to add this file to a book, it needs first to be converted to ReST and renamed. While this is not part of any book, mark it as :orphan:, in order to avoid build warnings. Signed-off-by: Mauro Carvalho Chehab commit 675aaf05d8982d3d304d4652d1555714be8b4af2 Author: Mauro Carvalho Chehab Date: Mon Apr 15 18:46:48 2019 -0300 docs: xen-tpmfront.txt: convert it to .rst In order to be able to add this file to the security book, we need first to convert it to reST. While this is not part of any book, mark it as :orphan:, in order to avoid build warnings. Signed-off-by: Mauro Carvalho Chehab commit 2bbbf827d339032dbeda62f0a5f20d2fde07b0f5 Author: Mauro Carvalho Chehab Date: Mon Apr 15 18:39:27 2019 -0300 docs: memory-devices: convert ti-emif.txt to ReST Prepare this file to be moved to a kernel book by converting it to ReST format and renaming it to ti-emif.rst. While this is not part of any book, mark it as :orphan:, in order to avoid build warnings. Signed-off-by: Mauro Carvalho Chehab commit dc7a12bdfccd94c31f79e294f16f7549bd411b49 Author: Mauro Carvalho Chehab Date: Sun Apr 14 15:51:10 2019 -0300 docs: arm: convert docs to ReST and rename to *.rst Converts ARM the text files to ReST, preparing them to be an architecture book. The conversion is actually: - add blank lines and identation in order to identify paragraphs; - fix tables markups; - add some lists markups; - mark literal blocks; - adjust title markups. At its new index.rst, let's add a :orphan: while this is not linked to the main index.rst file, in order to avoid build warnings. Signed-off-by: Mauro Carvalho Chehab Reviewed-by Corentin Labbe # For sun4i-ss commit 0d07cf5e53a21e35289adc3ab99b6804ff0c3833 Author: Mauro Carvalho Chehab Date: Sun Apr 14 08:58:05 2019 -0300 docs: early-userspace: convert docs to ReST and rename to *.rst The two files there describes a Kernel API feature, used to support early userspace stuff. Prepare for moving them to the kernel API book by converting to ReST format. The conversion itself was quite trivial: just add/mark a few titles as such, add a literal block markup, add a table markup and a few blank lines, in order to make Sphinx to properly parse it. At its new index.rst, let's add a :orphan: while this is not linked to the main index.rst file, in order to avoid build warnings. Signed-off-by: Mauro Carvalho Chehab commit 93d2c159673325624ef3f2d14ededfcdf76f948b Author: Mauro Carvalho Chehab Date: Sun Apr 14 08:50:59 2019 -0300 docs: pti_intel_mid.txt: convert it to pti_intel_mid.rst Convert this small file to ReST format and rename it. Most of the conversion were related to adjusting whitespaces in order for each section to be properly parsed. While this is not part of any book, mark it as :orphan:, in order to avoid build warnings. Signed-off-by: Mauro Carvalho Chehab commit 8db8acee4b326bfd5bc9a164a7f9ef844ec0fd2e Author: Mauro Carvalho Chehab Date: Sun Apr 14 08:44:17 2019 -0300 docs: console.txt: convert docs to ReST and rename to *.rst Convert this small file to ReST in preparation for adding it to the driver-api book. While this is not part of the driver-api book, mark it as :orphan:, in order to avoid build warnings. Signed-off-by: Mauro Carvalho Chehab Acked-by: Greg Kroah-Hartman Acked-by: Bartlomiej Zolnierkiewicz commit 01c0aa794305ae08eb977d0719e43577e93f9ef5 Author: Mauro Carvalho Chehab Date: Sun Apr 14 08:37:58 2019 -0300 docs: cma/debugfs.txt: convert docs to ReST and rename to *.rst The debugfs interface for CMA should be there together with other mm-related documents. Convert this small file to ReST and move it to its rightful place. The conversion is actually quite simple: just add a title for the document. In order to make it to look better for the audience, also mark the "echo" command as a literal block. While this is not part of any book, mark it as :orphan:, in order to avoid build warnings. Signed-off-by: Mauro Carvalho Chehab commit 23e02422877b7fac868d8610a4265003da4ac0f4 Author: Mauro Carvalho Chehab Date: Sun Apr 14 08:27:15 2019 -0300 docs: m68k: convert docs to ReST and rename to *.rst Convert the m68k kernel-options.txt file to ReST. The conversion is trivial, as the document is already on a format close enough to ReST. Just some small adjustments were needed in order to make it both good for being parsed while keeping it on a good txt shape. At its new index.rst, let's add a :orphan: while this is not linked to the main index.rst file, in order to avoid build warnings. Signed-off-by: Mauro Carvalho Chehab commit 6f2846cc2ebae4a8c875389e3aedb0cda3c4f462 Author: Mauro Carvalho Chehab Date: Sun Apr 14 08:03:23 2019 -0300 docs: lp855x-driver.txt: convert to ReST and move to kernel-api This small file seems to be an attempt to start documenting backlight drivers. It contains descriptions of the controls for the driver with could sound as an somewhat user-faced description, but it's main focus is to describe, instead, the data that should be passed via platform data and some driver-specific stuff. While this is not part of the driver-api book, mark it as :orphan:, in order to avoid build warnings. Signed-off-by: Mauro Carvalho Chehab commit 065504d5b45bc780b8da221162145a4c9ec67ffc Author: Mauro Carvalho Chehab Date: Sun Apr 14 07:59:32 2019 -0300 docs: lcd-panel-cgram.txt: convert docs to ReST and rename to *.rst This small text file describes the usage of parallel port LCD displays from userspace PoV. So, a good candidate for the admin guide. While this is not part of the admin-guide book, mark it as :orphan:, in order to avoid build warnings. Signed-off-by: Mauro Carvalho Chehab commit 720594f691e5c8fb0624f3653b20b24ba8e57742 Author: Mauro Carvalho Chehab Date: Sat Apr 13 22:54:53 2019 -0300 docs: connector: convert to ReST and rename to connector.rst As it has some function definitions, move them to connector.h. The remaining conversion is actually: - add blank lines and identation in order to identify paragraphs; - fix tables markups; - add some lists markups; - mark literal blocks; - adjust title markups. At its new index.rst, let's add a :orphan: while this is not linked to the main index.rst file, in order to avoid build warnings. Signed-off-by: Mauro Carvalho Chehab commit f4c9939433bd396d0b08e803b2b880a9d02682b9 Author: Farhan Ali Date: Thu Jul 11 10:28:54 2019 -0400 vfio-ccw: Don't call cp_free if we are processing a channel program There is a small window where it's possible that we could be working on an interrupt (queued in the workqueue) and setting up a channel program (i.e allocating memory, pinning pages, translating address). This can lead to allocating and freeing the channel program at the same time and can cause memory corruption. Let's not call cp_free if we are currently processing a channel program. The only way we know for sure that we don't have a thread setting up a channel program is when the state is set to VFIO_CCW_STATE_CP_PENDING. Fixes: d5afd5d135c8 ("vfio-ccw: add handling for async channel instructions") Signed-off-by: Farhan Ali Reviewed-by: Cornelia Huck Message-Id: <62e87bf67b38dc8d5760586e7c96d400db854ebe.1562854091.git.alifm@linux.ibm.com> Reviewed-by: Eric Farman Signed-off-by: Cornelia Huck commit c1ab69268d124ebdbb3864580808188ccd3ea355 Author: Farhan Ali Date: Thu Jul 11 10:28:53 2019 -0400 vfio-ccw: Set pa_nr to 0 if memory allocation fails for pa_iova_pfn So we don't call try to call vfio_unpin_pages() incorrectly. Fixes: 0a19e61e6d4c ("vfio: ccw: introduce channel program interfaces") Signed-off-by: Farhan Ali Reviewed-by: Eric Farman Reviewed-by: Cornelia Huck Message-Id: <33a89467ad6369196ae6edf820cbcb1e2d8d050c.1562854091.git.alifm@linux.ibm.com> Signed-off-by: Cornelia Huck commit 8b515be512a2435bb8aedc6390cbe140167f9eb9 Author: Farhan Ali Date: Thu Jul 11 10:28:52 2019 -0400 vfio-ccw: Fix memory leak and don't call cp_free in cp_init We don't set cp->initialized to true so calling cp_free will just return and not do anything. Also fix a memory leak where we fail to free a ccwchain on an error. Fixes: 812271b910 ("s390/cio: Squash cp_free() and cp_unpin_free()") Signed-off-by: Farhan Ali Message-Id: <3173c4216f4555d9765eb6e4922534982bc820e4.1562854091.git.alifm@linux.ibm.com> Reviewed-by: Cornelia Huck Reviewed-by: Eric Farman Signed-off-by: Cornelia Huck commit c9f597a4d6d7a01590571291f659a2f146111e34 Author: Farhan Ali Date: Thu Jul 11 10:28:51 2019 -0400 vfio-ccw: Fix misleading comment when setting orb.cmd.c64 The comment is misleading because it tells us that we should set orb.cmd.c64 before calling ccwchain_calc_length, otherwise the function ccwchain_calc_length would return an error. This is not completely accurate. We want to allow an orb without cmd.c64, and this is fine as long as the channel program does not use IDALs. But we do want to reject any channel program that uses IDALs and does not set the flag, which is what we do in ccwchain_calc_length. After we have done the ccw processing, we need to set cmd.c64, as we use IDALs for all translated channel programs. Also for better code readability let's move the setting of cmd.c64 within the non error path. Fixes: fb9e7880af35 ("vfio: ccw: push down unsupported IDA check") Signed-off-by: Farhan Ali Reviewed-by: Cornelia Huck Message-Id: Reviewed-by: Eric Farman Signed-off-by: Cornelia Huck commit 9a5611af5edb5fa5fed11b4c5e96906524f8c323 Author: Yi Wang Date: Sat Jul 6 01:10:22 2019 +0800 kvm: x86: some tsc debug cleanup There are some pr_debug in TSC code, which may have been no use, so remove them as Paolo suggested. Signed-off-by: Yi Wang Signed-off-by: Paolo Bonzini commit 9481b7f10c5a7f149048310c25510f0386eb6631 Author: Yi Wang Date: Mon Jul 15 12:35:17 2019 +0800 kvm: vmx: fix coccinelle warnings This fixes the following coccinelle warning: WARNING: return of 0/1 in function 'vmx_need_emulation_on_page_fault' with return type bool Return false instead of 0. Signed-off-by: Yi Wang Signed-off-by: Paolo Bonzini commit 387b14684f94483cbbb72843db406ec9a8d0d6d2 Author: Mauro Carvalho Chehab Date: Wed Apr 10 08:32:41 2019 -0300 docs: locking: convert docs to ReST and rename to *.rst Convert the locking documents to ReST and add them to the kernel development book where it belongs. Most of the stuff here is just to make Sphinx to properly parse the text file, as they're already in good shape, not requiring massive changes in order to be parsed. The conversion is actually: - add blank lines and identation in order to identify paragraphs; - fix tables markups; - add some lists markups; - mark literal blocks; - adjust title markups. At its new index.rst, let's add a :orphan: while this is not linked to the main index.rst file, in order to avoid build warnings. Signed-off-by: Mauro Carvalho Chehab Acked-by: Federico Vaga commit fd4198bf17ca9321fb8043e846b780cfd2889dac Merge: a6a6d3b1f867 8343ba2d4820 Author: Paolo Bonzini Date: Mon Jul 15 12:50:46 2019 +0200 Merge tag 'kvm-s390-next-5.3-1' of git://git.kernel.org/pub/scm/linux/kernel/git/kvms390/linux into HEAD KVM: s390: add kselftests This is the initial implementation for KVM selftests on s390. commit 03bcba73cb3c223ea8ab8d7f33bd85545e47fc75 Author: Stephen Rothwell Date: Mon Jul 15 11:55:04 2019 +0100 MIPS: perf events: handle switch statement falling through warnings Now that we build with -Wimplicit-fallthrough=3, some warnings are produced in the arch/mips perf events code that are promoted to errors: arch/mips/kernel/perf_event_mipsxx.c:792:3: error: this statement may fall through [-Werror=implicit-fallthrough=] arch/mips/kernel/perf_event_mipsxx.c:795:3: error: this statement may fall through [-Werror=implicit-fallthrough=] arch/mips/kernel/perf_event_mipsxx.c:798:3: error: this statement may fall through [-Werror=implicit-fallthrough=] arch/mips/kernel/perf_event_mipsxx.c:1407:6: error: this statement may fall through [-Werror=implicit-fallthrough=] Assume the fall throughs are deliberate amd annotate/eliminate them. Cc: Peter Zijlstra Cc: Ingo Molnar Cc: Arnaldo Carvalho de Melo Cc: Alexander Shishkin Cc: Jiri Olsa Cc: Namhyung Kim Cc: Gustavo A. R. Silva Cc: Kees Cook Signed-off-by: Stephen Rothwell [paul.burton@mips.com: - Make n signed to fix the loop condition. - Simplify the initialization of n, which should never have a value greater than 4. - Invert conditions in the loop to decrease indentation.] Signed-off-by: Paul Burton commit 69b53720e92c1bdea854a2fc204477ddabfa902b Author: Christian Brauner Date: Mon Jul 15 02:30:21 2019 +0200 MAINTAINERS: add new entry for pidfd api Add me as a maintainer for pidfd stuff so people know who to yell at and to easily keep track of incoming changes. Signed-off-by: Christian Brauner Link: https://lore.kernel.org/r/20190715003021.25040-1-christian@brauner.io commit 916c31fff946fae0e05862f9b2435fdb29fd5090 Author: Ravi Bangoria Date: Tue Jun 11 08:31:09 2019 +0530 perf version: Fix segfault due to missing OPT_END() 'perf version' on powerpc segfaults when used with non-supported option: # perf version -a Segmentation fault (core dumped) Fix this. Signed-off-by: Ravi Bangoria Reviewed-by: Kamalesh Babulal Tested-by: Mamatha Inamdar Cc: Jiri Olsa Cc: Kamalesh Babulal Link: http://lkml.kernel.org/r/20190611030109.20228-1-ravi.bangoria@linux.ibm.com Signed-off-by: Arnaldo Carvalho de Melo commit a6a6d3b1f867d34ba5bd61aa7bb056b48ca67cff Author: Arnd Bergmann Date: Fri Jul 12 11:12:30 2019 +0200 x86: kvm: avoid constant-conversion warning clang finds a contruct suspicious that converts an unsigned character to a signed integer and back, causing an overflow: arch/x86/kvm/mmu.c:4605:39: error: implicit conversion from 'int' to 'u8' (aka 'unsigned char') changes value from -205 to 51 [-Werror,-Wconstant-conversion] u8 wf = (pfec & PFERR_WRITE_MASK) ? ~w : 0; ~~ ^~ arch/x86/kvm/mmu.c:4607:38: error: implicit conversion from 'int' to 'u8' (aka 'unsigned char') changes value from -241 to 15 [-Werror,-Wconstant-conversion] u8 uf = (pfec & PFERR_USER_MASK) ? ~u : 0; ~~ ^~ arch/x86/kvm/mmu.c:4609:39: error: implicit conversion from 'int' to 'u8' (aka 'unsigned char') changes value from -171 to 85 [-Werror,-Wconstant-conversion] u8 ff = (pfec & PFERR_FETCH_MASK) ? ~x : 0; ~~ ^~ Add an explicit cast to tell clang that everything works as intended here. Signed-off-by: Arnd Bergmann Link: https://github.com/ClangBuiltLinux/linux/issues/95 Signed-off-by: Paolo Bonzini commit f4e4805e4bf7a06235d2aa216e1d00cb1f3bd0c1 Author: Arnd Bergmann Date: Fri Jul 12 16:13:09 2019 +0200 x86: kvm: avoid -Wsometimes-uninitized warning Clang notices a code path in which some variables are never initialized, but fails to figure out that this can never happen on i386 because is_64_bit_mode() always returns false. arch/x86/kvm/hyperv.c:1610:6: error: variable 'ingpa' is used uninitialized whenever 'if' condition is false [-Werror,-Wsometimes-uninitialized] if (!longmode) { ^~~~~~~~~ arch/x86/kvm/hyperv.c:1632:55: note: uninitialized use occurs here trace_kvm_hv_hypercall(code, fast, rep_cnt, rep_idx, ingpa, outgpa); ^~~~~ arch/x86/kvm/hyperv.c:1610:2: note: remove the 'if' if its condition is always true if (!longmode) { ^~~~~~~~~~~~~~~ arch/x86/kvm/hyperv.c:1595:18: note: initialize the variable 'ingpa' to silence this warning u64 param, ingpa, outgpa, ret = HV_STATUS_SUCCESS; ^ = 0 arch/x86/kvm/hyperv.c:1610:6: error: variable 'outgpa' is used uninitialized whenever 'if' condition is false [-Werror,-Wsometimes-uninitialized] arch/x86/kvm/hyperv.c:1610:6: error: variable 'param' is used uninitialized whenever 'if' condition is false [-Werror,-Wsometimes-uninitialized] Flip the condition around to avoid the conditional execution on i386. Signed-off-by: Arnd Bergmann Signed-off-by: Paolo Bonzini commit 0b774629512057b4becc705e2495220844e6e795 Author: Jing Liu Date: Thu Jul 11 13:49:57 2019 +0800 KVM: x86: expose AVX512_BF16 feature to guest AVX512 BFLOAT16 instructions support 16-bit BFLOAT16 floating-point format (BF16) for deep learning optimization. Intel adds AVX512 BFLOAT16 feature in CooperLake, which is CPUID.7.1.EAX[5]. Detailed information of the CPUID bit can be found here, https://software.intel.com/sites/default/files/managed/c5/15/\ architecture-instruction-set-extensions-programming-reference.pdf. Signed-off-by: Jing Liu [Fix type mismatch in min, changing constant "1" to "1u". - Paolo] Signed-off-by: Paolo Bonzini commit 19ec11a2233d24a7811836fa735203aaccf95a23 Author: Bartosz Golaszewski Date: Thu Jul 11 10:29:35 2019 +0200 gpio: em: remove the gpiochip before removing the irq domain In commit 8764c4ca5049 ("gpio: em: use the managed version of gpiochip_add_data()") we implicitly altered the ordering of resource freeing: since gpiochip_remove() calls gpiochip_irqchip_remove() internally, we now can potentially use the irq_domain after it was destroyed in the remove() callback (as devm resources are freed after remove() has returned). Use devm_add_action_or_reset() to keep the ordering right and entirely kill the remove() callback in the driver. Reported-by: Geert Uytterhoeven Fixes: 8764c4ca5049 ("gpio: em: use the managed version of gpiochip_add_data()") Cc: stable@vger.kernel.org Signed-off-by: Bartosz Golaszewski Reviewed-by: Geert Uytterhoeven commit 89fea04c85e85f21ef4937611055abce82330d48 Author: Nishka Dasgupta Date: Sat Jul 6 19:04:22 2019 +0530 gpiolib: of: fix a memory leak in of_gpio_flags_quirks() Each iteration of for_each_child_of_node puts the previous node, but in the case of a break from the middle of the loop, there is no put, thus causing a memory leak. Hence add an of_node_put before the break. Issue found with Coccinelle. Cc: Signed-off-by: Nishka Dasgupta [Bartosz: tweaked the commit message] Signed-off-by: Bartosz Golaszewski commit 541e4095f388c196685685633c950cb9b97f8039 Author: Keerthy Date: Mon Jul 8 14:19:04 2019 +0530 gpio: davinci: silence error prints in case of EPROBE_DEFER Silence error prints in case of EPROBE_DEFER. This avoids multiple/duplicate defer prints during boot. Cc: Signed-off-by: Keerthy Signed-off-by: Bartosz Golaszewski commit 8da04e05cdfc715d414a1c5f8318c03030eb68fb Author: Stephen Rothwell Date: Mon Jul 15 09:56:30 2019 +1000 intel_rapl: need linux/cpuhotplug.h for enum cpuhp_state Fixes: 7ebf8eff63b4 ("intel_rapl: introduce struct rapl_if_private") Signed-off-by: Stephen Rothwell Signed-off-by: Rafael J. Wysocki commit dfd6f9ad36368b8dbd5f5a2b2f0a4705ae69a323 Author: Arnd Bergmann Date: Fri Jul 12 11:01:21 2019 +0200 ACPI: fix false-positive -Wuninitialized warning clang gets confused by an uninitialized variable in what looks to it like a never executed code path: arch/x86/kernel/acpi/boot.c:618:13: error: variable 'polarity' is uninitialized when used here [-Werror,-Wuninitialized] polarity = polarity ? ACPI_ACTIVE_LOW : ACPI_ACTIVE_HIGH; ^~~~~~~~ arch/x86/kernel/acpi/boot.c:606:32: note: initialize the variable 'polarity' to silence this warning int rc, irq, trigger, polarity; ^ = 0 arch/x86/kernel/acpi/boot.c:617:12: error: variable 'trigger' is uninitialized when used here [-Werror,-Wuninitialized] trigger = trigger ? ACPI_LEVEL_SENSITIVE : ACPI_EDGE_SENSITIVE; ^~~~~~~ arch/x86/kernel/acpi/boot.c:606:22: note: initialize the variable 'trigger' to silence this warning int rc, irq, trigger, polarity; ^ = 0 This is unfortunately a design decision in clang and won't be fixed. Changing the acpi_get_override_irq() macro to an inline function reliably avoids the issue. Signed-off-by: Arnd Bergmann Reviewed-by: Andy Shevchenko Reviewed-by: Nathan Chancellor Signed-off-by: Rafael J. Wysocki commit 2f235d92ac225361a9c653cb76c7ca8ef99621de Author: Hariprasad Kelam Date: Thu Jul 11 22:51:07 2019 +0530 ALSA: rme9652: Unneeded variable: "result". This patch fixes below issue reported by coccicheck sound/pci/rme9652/rme9652.c:2161:5-11: Unneeded variable: "result". Return "0" on line 2167 Signed-off-by: Hariprasad Kelam Signed-off-by: Takashi Iwai commit b7cad26d150b05955b5e35b30a82c3eb66761cdc Author: Hariprasad Kelam Date: Thu Jul 11 22:47:26 2019 +0530 ALSA: emu10k1: Remove unneeded variable "change" fix below issue reported by coccicheck sound/pci/emu10k1/emu10k1x.c:1077:5-11: Unneeded variable: "change". Return "0" on line 1092 Signed-off-by: Hariprasad Kelam Signed-off-by: Takashi Iwai commit 5e19cad550a0b01b778fbfde23e036c9759c4f53 Author: Hariprasad Kelam Date: Thu Jul 11 22:43:02 2019 +0530 ALSA: au88x0: Remove unneeded variable: "changed" Fix below issues reported by coccicheck sound/pci/au88x0/au88x0_a3d.c:821:8-15: Unneeded variable: "changed". Return "1" on line 834 sound/pci/au88x0/au88x0_a3d.c:768:5-12: Unneeded variable: "changed". Return "1" on line 777 sound/pci/au88x0/au88x0_a3d.c:804:5-12: Unneeded variable: "changed". Return "1" on line 813 sound/pci/au88x0/au88x0_a3d.c:786:8-15: Unneeded variable: "changed". Return "1" on line 796 Signed-off-by: Hariprasad Kelam Signed-off-by: Takashi Iwai commit fbc571290d9f7bfe089c50f4ac4028dd98ebfe98 Author: Kailang Yang Date: Mon Jul 15 10:41:50 2019 +0800 ALSA: hda/realtek - Fixed Headphone Mic can't record on Dell platform It assigned to wrong model. So, The headphone Mic can't work. Fixes: 3f640970a414 ("ALSA: hda - Fix headset mic detection problem for several Dell laptops") Signed-off-by: Kailang Yang Cc: Signed-off-by: Takashi Iwai commit 7fb832ae72949c883da52d6316ff08f03c75d300 Author: Nathan Chancellor Date: Tue Jul 9 13:34:09 2019 -0700 watchdog: digicolor_wdt: Remove unused variable in dc_wdt_probe clang warns: drivers/watchdog/digicolor_wdt.c:121:6: warning: unused variable 'ret' [-Wunused-variable] int ret; ^ 1 warning generated. It's unused now, remove it. Fixes: cdad26977e3f ("watchdog: digicolor_wdt: drop warning after registering device") Link: https://github.com/ClangBuiltLinux/linux/issues/591 Reported-by: kernelci.org bot Signed-off-by: Nathan Chancellor Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20190709203409.117123-1-natechancellor@gmail.com Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 1b0890cd60829bd51455dc5ad689ed58c4408227 Author: Florian Westphal Date: Tue Jul 2 21:41:40 2019 +0200 netfilter: nfnetlink: avoid deadlock due to synchronous request_module Thomas and Juliana report a deadlock when running: (rmmod nf_conntrack_netlink/xfrm_user) conntrack -e NEW -E & modprobe -v xfrm_user They provided following analysis: conntrack -e NEW -E netlink_bind() netlink_lock_table() -> increases "nl_table_users" nfnetlink_bind() # does not unlock the table as it's locked by netlink_bind() __request_module() call_usermodehelper_exec() This triggers "modprobe nf_conntrack_netlink" from kernel, netlink_bind() won't return until modprobe process is done. "modprobe xfrm_user": xfrm_user_init() register_pernet_subsys() -> grab pernet_ops_rwsem .. netlink_table_grab() calls schedule() as "nl_table_users" is non-zero so modprobe is blocked because netlink_bind() increased nl_table_users while also holding pernet_ops_rwsem. "modprobe nf_conntrack_netlink" runs and inits nf_conntrack_netlink: ctnetlink_init() register_pernet_subsys() -> blocks on "pernet_ops_rwsem" thanks to xfrm_user module both modprobe processes wait on one another -- neither can make progress. Switch netlink_bind() to "nowait" modprobe -- this releases the netlink table lock, which then allows both modprobe instances to complete. Reported-by: Thomas Jarosch Reported-by: Juliana Rodrigueiro Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit 6dfc43d3a19174faead54575c204aee106225f43 Author: Dave Airlie Date: Mon Jul 15 15:16:20 2019 +1000 mm: adjust apply_to_pfn_range interface for dropped token. mm/pgtable: drop pgtable_t variable from pte_fn_t functions drops the token came in via the hmm tree, this caused lots of conflicts, but applying this cleanup patch should reduce it to something easier to handle. Just accept the token is unused at this point. Signed-off-by: Dave Airlie commit 03800e0526ee25ed7c843ca1e57b69ac2a5af642 Author: Andrea Arcangeli Date: Tue Jun 25 10:17:27 2019 -0400 powerpc: fix off by one in max_zone_pfn initialization for ZONE_DMA 25078dc1f74be16b858e914f52cc8f4d03c2271a first introduced an off by one error in the ZONE_DMA initialization of PPC_BOOK3E_64=y and since 9739ab7eda459f0669ec9807e0d9be5020bab88c the off by one applies to PPC32=y too. This simply corrects the off by one and should resolve crashes like below: [ 65.179101] page 0x7fff outside node 0 zone DMA [ 0x0 - 0x7fff ] Unfortunately in various MM places "max" means a non inclusive end of range. free_area_init_nodes max_zone_pfn parameter is one case and MAX_ORDER is another one (unrelated) that comes by memory. Reported-by: Zorro Lang Fixes: 25078dc1f74b ("powerpc: use mm zones more sensibly") Fixes: 9739ab7eda45 ("powerpc: enable a 30-bit ZONE_DMA for 32-bit pmac") Signed-off-by: Andrea Arcangeli Reviewed-by: Christoph Hellwig Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20190625141727.2883-1-aarcange@redhat.com commit c8b4083db915dfe5a3b4a755ad2317e0509b43f1 Author: Suraj Jitindar Singh Date: Wed Jul 3 11:20:22 2019 +1000 KVM: PPC: Book3S HV: Save and restore guest visible PSSCR bits on pseries The Performance Stop Status and Control Register (PSSCR) is used to control the power saving facilities of the processor. This register has various fields, some of which can be modified only in hypervisor state, and others which can be modified in both hypervisor and privileged non-hypervisor state. The bits which can be modified in privileged non-hypervisor state are referred to as guest visible. Currently the L0 hypervisor saves and restores both it's own host value as well as the guest value of the PSSCR when context switching between the hypervisor and guest. However a nested hypervisor running it's own nested guests (as indicated by kvmhv_on_pseries()) doesn't context switch the PSSCR register. That means if a nested (L2) guest modifies the PSSCR then the L1 guest hypervisor will run with that modified value, and if the L1 guest hypervisor modifies the PSSCR and then goes to run the nested (L2) guest again then the L2 PSSCR value will be lost. Fix this by having the (L1) nested hypervisor save and restore both its host and the guest PSSCR value when entering and exiting a nested (L2) guest. Note that only the guest visible parts of the PSSCR are context switched since this is all the L1 nested hypervisor can access, this is fine however as these are the only fields the L0 hypervisor provides guest control of anyway and so all other fields are ignored. This could also have been implemented by adding the PSSCR register to the hv_regs passed to the L0 hypervisor as input to the H_ENTER_NESTED hcall, however this would have meant updating the structure layout and thus required modifications to both the L0 and L1 kernels. Whereas the approach used doesn't require L0 kernel modifications while achieving the same result. Fixes: 95a6432ce903 ("KVM: PPC: Book3S HV: Streamlined guest entry/exit path on P9 for radix guests") Cc: stable@vger.kernel.org # v4.20+ Signed-off-by: Suraj Jitindar Singh Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20190703012022.15644-3-sjitindarsingh@gmail.com commit fec88ab0af9706b2201e5daf377c5031c62d11f7 Merge: fa6e951a2a44 cc5dfd59e375 Author: Linus Torvalds Date: Sun Jul 14 19:42:11 2019 -0700 Merge tag 'for-linus-hmm' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma Pull HMM updates from Jason Gunthorpe: "Improvements and bug fixes for the hmm interface in the kernel: - Improve clarity, locking and APIs related to the 'hmm mirror' feature merged last cycle. In linux-next we now see AMDGPU and nouveau to be using this API. - Remove old or transitional hmm APIs. These are hold overs from the past with no users, or APIs that existed only to manage cross tree conflicts. There are still a few more of these cleanups that didn't make the merge window cut off. - Improve some core mm APIs: - export alloc_pages_vma() for driver use - refactor into devm_request_free_mem_region() to manage DEVICE_PRIVATE resource reservations - refactor duplicative driver code into the core dev_pagemap struct - Remove hmm wrappers of improved core mm APIs, instead have drivers use the simplified API directly - Remove DEVICE_PUBLIC - Simplify the kconfig flow for the hmm users and core code" * tag 'for-linus-hmm' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma: (42 commits) mm: don't select MIGRATE_VMA_HELPER from HMM_MIRROR mm: remove the HMM config option mm: sort out the DEVICE_PRIVATE Kconfig mess mm: simplify ZONE_DEVICE page private data mm: remove hmm_devmem_add mm: remove hmm_vma_alloc_locked_page nouveau: use devm_memremap_pages directly nouveau: use alloc_page_vma directly PCI/P2PDMA: use the dev_pagemap internal refcount device-dax: use the dev_pagemap internal refcount memremap: provide an optional internal refcount in struct dev_pagemap memremap: replace the altmap_valid field with a PGMAP_ALTMAP_VALID flag memremap: remove the data field in struct dev_pagemap memremap: add a migrate_to_ram method to struct dev_pagemap_ops memremap: lift the devmap_enable manipulation into devm_memremap_pages memremap: pass a struct dev_pagemap to ->kill and ->cleanup memremap: move dev_pagemap callbacks into a separate structure memremap: validate the pagemap type passed to devm_memremap_pages mm: factor out a devm_request_free_mem_region helper mm: export alloc_pages_vma ... commit 28d2a6e6684d9851905f379816d8a4d03587ed94 Author: Suraj Jitindar Singh Date: Wed Jul 3 11:20:21 2019 +1000 powerpc/pmu: Set pmcregs_in_use in paca when running as LPAR The ability to run nested guests under KVM means that a guest can also act as a hypervisor for it's own nested guest. Currently ppc_set_pmu_inuse() assumes that either FW_FEATURE_LPAR is set, indicating a guest environment, and so sets the pmcregs_in_use flag in the lppaca, or that it isn't set, indicating a hypervisor environment, and so sets the pmcregs_in_use flag in the paca. The pmcregs_in_use flag in the lppaca is used to communicate this information to a hypervisor and so must be set in a guest environment. The pmcregs_in_use flag in the paca is used by KVM code to determine whether the host state of the performance monitoring unit (PMU) must be saved and restored when running a guest. Thus when a guest also acts as a hypervisor it must set this bit in both places since it needs to ensure both that the real hypervisor saves it's PMU registers when it runs (requires pmcregs_in_use flag in lppaca), and that it saves it's own PMU registers when running a nested guest (requires pmcregs_in_use flag in paca). Modify ppc_set_pmu_inuse() so that the pmcregs_in_use bit is set in both the lppaca and the paca when a guest (LPAR) is running with the capability of running it's own guests (CONFIG_KVM_BOOK3S_HV_POSSIBLE). Fixes: 95a6432ce903 ("KVM: PPC: Book3S HV: Streamlined guest entry/exit path on P9 for radix guests") Cc: stable@vger.kernel.org # v4.20+ Signed-off-by: Suraj Jitindar Singh Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20190703012022.15644-2-sjitindarsingh@gmail.com commit 63279eeb7f93abb1692573c26f1e038e1a87358b Author: Suraj Jitindar Singh Date: Wed Jul 3 11:20:20 2019 +1000 KVM: PPC: Book3S HV: Always save guest pmu for guest capable of nesting The performance monitoring unit (PMU) registers are saved on guest exit when the guest has set the pmcregs_in_use flag in its lppaca, if it exists, or unconditionally if it doesn't. If a nested guest is being run then the hypervisor doesn't, and in most cases can't, know if the PMU registers are in use since it doesn't know the location of the lppaca for the nested guest, although it may have one for its immediate guest. This results in the values of these registers being lost across nested guest entry and exit in the case where the nested guest was making use of the performance monitoring facility while it's nested guest hypervisor wasn't. Further more the hypervisor could interrupt a guest hypervisor between when it has loaded up the PMU registers and it calling H_ENTER_NESTED or between returning from the nested guest to the guest hypervisor and the guest hypervisor reading the PMU registers, in kvmhv_p9_guest_entry(). This means that it isn't sufficient to just save the PMU registers when entering or exiting a nested guest, but that it is necessary to always save the PMU registers whenever a guest is capable of running nested guests to ensure the register values aren't lost in the context switch. Ensure the PMU register values are preserved by always saving their value into the vcpu struct when a guest is capable of running nested guests. This should have minimal performance impact however any impact can be avoided by booting a guest with "-machine pseries,cap-nested-hv=false" on the qemu commandline. Fixes: 95a6432ce903 ("KVM: PPC: Book3S HV: Streamlined guest entry/exit path on P9 for radix guests") Cc: stable@vger.kernel.org # v4.20+ Signed-off-by: Suraj Jitindar Singh Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20190703012022.15644-1-sjitindarsingh@gmail.com commit da0ef93310e67ae6902efded60b6724dab27a5d1 Author: Suraj Jitindar Singh Date: Wed Jul 10 15:20:18 2019 +1000 powerpc/mm: Limit rma_size to 1TB when running without HV mode The virtual real mode addressing (VRMA) mechanism is used when a partition is using HPT (Hash Page Table) translation and performs real mode accesses (MSR[IR|DR] = 0) in non-hypervisor mode. In this mode effective address bits 0:23 are treated as zero (i.e. the access is aliased to 0) and the access is performed using an implicit 1TB SLB entry. The size of the RMA (Real Memory Area) is communicated to the guest as the size of the first memory region in the device tree. And because of the mechanism described above can be expected to not exceed 1TB. In the event that the host erroneously represents the RMA as being larger than 1TB, guest accesses in real mode to memory addresses above 1TB will be aliased down to below 1TB. This means that a memory access performed in real mode may differ to one performed in virtual mode for the same memory address, which would likely have unintended consequences. To avoid this outcome have the guest explicitly limit the size of the RMA to the current maximum, which is 1TB. This means that even if the first memory block is larger than 1TB, only the first 1TB should be accessed in real mode. Fixes: c610d65c0ad0 ("powerpc/pseries: lift RTAS limit for hash") Cc: stable@vger.kernel.org # v4.16+ Signed-off-by: Suraj Jitindar Singh Tested-by: Satheesh Rajendran Reviewed-by: David Gibson Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20190710052018.14628-1-sjitindarsingh@gmail.com commit fa6e951a2a440babd7a7310d0f4713e618061767 Merge: a318423b61e8 7451c54abc91 Author: Linus Torvalds Date: Sun Jul 14 19:29:04 2019 -0700 Merge tag 'ecryptfs-5.3-rc1-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tyhicks/ecryptfs Pull eCryptfs updates from Tyler Hicks: - Fix error handling when ecryptfs_read_lower() encounters an error - Fix read-only file creation when the eCryptfs mount is configured to store metadata in xattrs - Minor code cleanups * tag 'ecryptfs-5.3-rc1-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tyhicks/ecryptfs: ecryptfs: Change return type of ecryptfs_process_flags ecryptfs: Make ecryptfs_xattr_handler static ecryptfs: remove unnessesary null check in ecryptfs_keyring_auth_tok_for_sig ecryptfs: use print_hex_dump_bytes for hexdump eCryptfs: fix permission denied with ecryptfs_xattr mount option when create readonly file ecryptfs: re-order a condition for static checkers eCryptfs: fix a couple type promotion bugs commit a318423b61e8c67aa5c0a428540c58439a20baac Merge: f2772a0e4833 8009ce956c3d Author: Linus Torvalds Date: Sun Jul 14 17:24:12 2019 -0700 Merge tag 'upstream-5.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rw/ubifs Pull UBIFS updates from Richard Weinberger: - Support for zstd compression - Support for offline signed filesystems - Various fixes for regressions * tag 'upstream-5.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rw/ubifs: ubifs: Don't leak orphans on memory during commit ubifs: Check link count of inodes when killing orphans. ubifs: Add support for zstd compression. ubifs: support offline signed images ubifs: remove unnecessary check in ubifs_log_start_commit ubifs: Fix typo of output in get_cs_sqnum ubifs: Simplify redundant code ubifs: Correctly use tnc_next() in search_dh_cookie() commit f2772a0e4833d1af1901b6f1a38136fb71d1350c Merge: fcd98147ac71 b482e48d29f1 Author: Linus Torvalds Date: Sun Jul 14 17:17:34 2019 -0700 Merge tag 'for-linus-5.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rw/uml Pull UML updates from Richard Weinberger: - A new timer mode, time travel, for testing with UML - Many bugixes/improvements for the serial line driver - Various bugfixes * tag 'for-linus-5.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rw/uml: um: fix build without CONFIG_UML_TIME_TRAVEL_SUPPORT um: Fix kcov crash during startup um: configs: Remove useless UEVENT_HELPER_PATH um: Support time travel mode um: Pass nsecs to os timer functions um: Remove drivers/ssl.h um: Don't garbage collect in deactivate_all_fds() um: Silence lockdep complaint about mmap_sem um: Remove locking in deactivate_all_fds() um: Timer code cleanup um: fix os_timer_one_shot() um: Fix IRQ controller regression on console read commit fcd98147ac71f35b69e2f50b5fddc5524dd2dfa8 Merge: 55167453111d 3975b097e577 Author: Linus Torvalds Date: Sun Jul 14 17:08:08 2019 -0700 Merge tag 'stream_open-5.3' of https://lab.nexedi.com/kirr/linux Pull stream_open() updates from Kirill Smelkov: "This time on stream_open front it is only two small changes: - the first one converts stream_open.cocci to treat all functions that start with wait_.* as blocking. Previously it was only wait_event_.* functions that were considered as blocking, but this was falsely reporting several deadlock cases as only warning. This was picked by linux-kbuild and entered mainline as commit 0c4ab18fc33b ("coccinelle: api/stream_open: treat all wait_.*() calls as blocking"), and already merged earlier. - the second one teaches stream_open.cocci to consider files as being stream-like even if they use noop_llseek. It results in two more drivers being converted to stream_open() (mousedev.c and hid-sensor-custom.c)" * tag 'stream_open-5.3' of https://lab.nexedi.com/kirr/linux: *: convert stream-like files -> stream_open, even if they use noop_llseek commit 55167453111d3a1e600e29ba6c8e63906bb4821b Merge: fde7dc63b1ca 7d67c8ac25fb Author: Linus Torvalds Date: Sun Jul 14 16:51:47 2019 -0700 Merge tag 'platform-drivers-x86-v5.3-1' of git://git.infradead.org/linux-platform-drivers-x86 Pull x86 platform driver updates from Andy Shevchenko: "Gathered a bunch of x86 platform driver changes. It's rather big, since includes two big refactors and completely new driver: - ASUS WMI driver got a big refactoring in order to support the TUF Gaming laptops. Besides that, the regression with backlight being permanently off on various EeePC laptops has been fixed. - Accelerometer on HP ProBook 450 G0 shows wrong measurements due to X axis being inverted. This has been fixed. - Intel PMC core driver has been extended to be ACPI enumerated if the DSDT provides device with _HID "INT33A1". This allows to convert the driver to be pure platform and support new hardware purely based on ACPI DSDT. - From now on the Intel Speed Select Technology is supported thru a corresponding driver. This driver provides an access to the features of the ISST, such as Performance Profile, Core Power, Base frequency and Turbo Frequency. - Mellanox platform drivers has been refactored and now extended to support more systems, including new coming ones. - The OLPC XO-1.75 platform is now supported. - CB4063 Beckhoff Automation board is using PMC clocks, provided via pmc_atom driver, for ethernet controllers in a way that they can't be managed by the clock driver. The quirk has been extended to cover this case. - Touchscreen on Chuwi Hi10 Plus tablet has been enabled. Meanwhile the information of Chuwi Hi10 Air has been fixed to cover more models based on the same platform. - Xiaomi notebooks have WMI interface enabled. Thus, the driver to support it has been provided. It required some extension of the generic WMI library, which allows to propagate opaque context to the ->probe() of the individual drivers. This release includes debugfs clean up from Greg KH for several drivers that drop return code check and make debugfs absence or failure non-fatal. Also miscellaneous fixes here and there, mostly for Acer WMI and various Intel drivers" * tag 'platform-drivers-x86-v5.3-1' of git://git.infradead.org/linux-platform-drivers-x86: (74 commits) platform/x86: Fix PCENGINES_APU2 Kconfig warning tools/power/x86/intel-speed-select: Add .gitignore file platform/x86: mlx-platform: Fix error handling in mlxplat_init() platform/x86: intel_pmc_core: Attach using APCI HID "INT33A1" platform/x86: intel_pmc_core: transform Pkg C-state residency from TSC ticks into microseconds platform/x86: asus-wmi: Use dev_get_drvdata() Documentation/ABI: Add new attribute for mlxreg-io sysfs interfaces platform/x86: mlx-platform: Add more reset cause attributes platform/x86: mlx-platform: Modify DMI matching order platform/x86: mlx-platform: Add regmap structure for the next generation systems platform/x86: mlx-platform: Change API for i2c-mlxcpld driver activation platform/x86: mlx-platform: Move regmap initialization before all drivers activation MAINTAINERS: Update for Intel Speed Select Technology tools/power/x86: A tool to validate Intel Speed Select commands platform/x86: ISST: Restore state on resume platform/x86: ISST: Add Intel Speed Select PUNIT MSR interface platform/x86: ISST: Add Intel Speed Select mailbox interface via MSRs platform/x86: ISST: Add Intel Speed Select mailbox interface via PCI platform/x86: ISST: Add Intel Speed Select mmio interface platform/x86: ISST: Add IOCTL to Translate Linux logical CPU to PUNIT CPU number ... commit fde7dc63b1caa6dedf9af7cbf79895589629bc95 Merge: a1240cf74e82 25777e5784a7 Author: Linus Torvalds Date: Sun Jul 14 16:36:51 2019 -0700 Merge tag 'mailbox-v5.3' of git://git.linaro.org/landing-teams/working/fujitsu/integration Pull mailbox updates from Jassi Brar: - stm32: race fix by adding a spinlock - mhu: trim included headers - omap: add support for K3 SoCs - imx: Irq disable fix - bcm: tidy up extracting driver data - tegra: make resume 'noirq' - api: fix error handling * tag 'mailbox-v5.3' of git://git.linaro.org/landing-teams/working/fujitsu/integration: mailbox: handle failed named mailbox channel request mailbox: tegra: avoid resume NULL mailboxes mailbox: tegra: hsp: add noirq resume mailbox: bcm-flexrm-mailbox: using dev_get_drvdata directly mailbox: imx: Clear GIEn bit at shutdown mailbox: omap: Add support for TI K3 SoCs dt-bindings: mailbox: omap: Update bindings for TI K3 SoCs mailbox: arm_mhu: reorder header inclusion and drop unneeded ones mailbox: stm32_ipcc: add spinlock to fix channels concurrent access commit a1240cf74e8228f7c80d44af17914c0ffc5633fb Merge: 1d039859330b 7d9ab9b6adff Author: Linus Torvalds Date: Sun Jul 14 16:17:18 2019 -0700 Merge branch 'for-5.3' of git://git.kernel.org/pub/scm/linux/kernel/git/dennis/percpu Pull percpu updates from Dennis Zhou: "This includes changes to let percpu_ref release the backing percpu memory earlier after it has been switched to atomic in cases where the percpu ref is not revived. This will help recycle percpu memory earlier in cases where the refcounts are pinned for prolonged periods of time" * 'for-5.3' of git://git.kernel.org/pub/scm/linux/kernel/git/dennis/percpu: percpu_ref: release percpu memory early without PERCPU_REF_ALLOW_REINIT md: initialize percpu refcounters using PERCU_REF_ALLOW_REINIT io_uring: initialize percpu refcounters using PERCU_REF_ALLOW_REINIT percpu_ref: introduce PERCPU_REF_ALLOW_REINIT flag commit 05a70a8ec287c4381ee1441ca779deab7bae124d Author: Christian Brauner Date: Sun Jul 14 21:22:05 2019 +0200 unistd: protect clone3 via __ARCH_WANT_SYS_CLONE3 This lets us catch new architectures that implicitly make use of clone3 without setting __ARCH_WANT_SYS_CLONE3. Failing on missing __ARCH_WANT_SYS_CLONE3 is a good indicator that they either did not really want this syscall or haven't really thought about whether it needs special treatment and just accidently included it in their entrypoints by e.g. generating their syscall table automatically via asm-generic/unistd.h This patch has been compile-tested for the h8300 architecture which is one of the architectures that does not yet implement clone3 and generates its syscall table via asm-generic/unistd.h. Signed-off-by: Christian Brauner Suggested-by: Arnd Bergmann Link: https://lore.kernel.org/r/20190714192205.27190-3-christian@brauner.io Reviewed-by: Arnd Bergmann Signed-off-by: Christian Brauner commit 1a271a68e030f3e134de12087117574a883e20f0 Author: Christian Brauner Date: Sun Jul 14 21:22:04 2019 +0200 arch: mark syscall number 435 reserved for clone3 A while ago Arnd made it possible to give new system calls the same syscall number on all architectures (except alpha). To not break this nice new feature let's mark 435 for clone3 as reserved on all architectures that do not yet implement it. Even if an architecture does not plan to implement it this ensures that new system calls coming after clone3 will have the same number on all architectures. Signed-off-by: Christian Brauner Cc: linux-arch@vger.kernel.org Cc: linux-alpha@vger.kernel.org Cc: linux-kernel@vger.kernel.org Cc: linux-ia64@vger.kernel.org Cc: linux-m68k@lists.linux-m68k.org Cc: linux-mips@vger.kernel.org Cc: linux-parisc@vger.kernel.org Cc: linuxppc-dev@lists.ozlabs.org Cc: linux-s390@vger.kernel.org Cc: linux-sh@vger.kernel.org Cc: sparclinux@vger.kernel.org Link: https://lore.kernel.org/r/20190714192205.27190-2-christian@brauner.io Reviewed-by: Arnd Bergmann Signed-off-by: Christian Brauner commit 76104862cccaeaa84fdd23e39f2610a96296291c Author: Tasos Sahanidis Date: Sun Jul 14 13:31:11 2019 +0300 sky2: Disable MSI on P5W DH Deluxe The onboard sky2 NICs send IRQs after S3, resulting in ethernet not working after resume. Maskable MSI and MSI-X are also not supported, so fall back to INTx. Signed-off-by: Tasos Sahanidis Signed-off-by: David S. Miller commit 79f5943a87d21a902d5248466acd152f766981ad Author: Sergej Benilov Date: Sun Jul 14 18:56:27 2019 +0200 sis900: correct a few typos Correct a few typos in comments and debug text. Signed-off-by: Sergej Benilov Signed-off-by: David S. Miller commit 6e3d1bbbba55265d327e44a2d14de70462232853 Author: Haishuang Yan Date: Sun Jul 14 21:31:22 2019 +0800 sit: use dst_cache in ipip6_tunnel_xmit Same as other ip tunnel, use dst_cache in xmit action to avoid unnecessary fib lookups. Signed-off-by: Haishuang Yan Signed-off-by: David S. Miller commit 14b4c48bb1ce6ff429a9288c9579cc984193ebaf Author: Denis Efremov Date: Sun Jul 14 15:02:25 2019 +0300 gve: Remove the exporting of gve_probe The function gve_probe is declared static and marked EXPORT_SYMBOL, which is at best an odd combination. Because the function is not used outside of the drivers/net/ethernet/google/gve/gve_main.c file it is defined in, this commit removes the EXPORT_SYMBOL() marking. Signed-off-by: Denis Efremov Signed-off-by: David S. Miller commit 1d039859330b874d48080885eb31f4f129c246f1 Merge: 0c85ce135456 e4557c1a46b0 Author: Linus Torvalds Date: Sun Jul 14 11:40:33 2019 -0700 Merge branch 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull perf fixes from Ingo Molnar: "A number of PMU driver corner case fixes, a race fix, an event grouping fix, plus a bunch of tooling fixes/updates" * 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (30 commits) perf/x86/intel: Fix spurious NMI on fixed counter perf/core: Fix exclusive events' grouping perf/x86/amd/uncore: Set the thread mask for F17h L3 PMCs perf/x86/amd/uncore: Do not set 'ThreadMask' and 'SliceMask' for non-L3 PMCs perf/core: Fix race between close() and fork() perf intel-pt: Fix potential NULL pointer dereference found by the smatch tool perf intel-bts: Fix potential NULL pointer dereference found by the smatch tool perf script: Assume native_arch for pipe mode perf scripts python: export-to-sqlite.py: Fix DROP VIEW power_events_view perf scripts python: export-to-postgresql.py: Fix DROP VIEW power_events_view perf hists browser: Fix potential NULL pointer dereference found by the smatch tool perf cs-etm: Fix potential NULL pointer dereference found by the smatch tool perf parse-events: Remove unused variable: error perf parse-events: Remove unused variable 'i' perf metricgroup: Add missing list_del_init() when flushing egroups list perf tools: Use list_del_init() more thorougly perf tools: Use zfree() where applicable tools lib: Adopt zalloc()/zfree() from tools/perf perf tools: Move get_current_dir_name() cond prototype out of util.h perf namespaces: Move the conditional setns() prototype to namespaces.h ... commit 0c85ce135456a3927f552e738f730c47ac905ac3 Merge: 577d9460d3d0 68d41d8c94a3 Author: Linus Torvalds Date: Sun Jul 14 11:39:21 2019 -0700 Merge branch 'locking-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull locking fix from Ingo Molnar: "A single fix for a locking statistics bug" * 'locking-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: locking/lockdep: Fix lock used or unused stats error commit 577d9460d3d0a69b96f749f974642441ae186a7f Merge: 50ec18819cad e9a1379f9219 Author: Linus Torvalds Date: Sun Jul 14 11:36:44 2019 -0700 Merge branch 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 fix from Ingo Molnar: "A single build system bugfix" * 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/vdso: Fix flip/flop vdso build bug commit 028b6e8a89de9133a869bb4cd1bc72445b1ec8ca Author: Dmitry V. Levin Date: Sun Jul 14 19:20:47 2019 +0300 clone: fix CLONE_PIDFD support The introduction of clone3 syscall accidentally broke CLONE_PIDFD support in traditional clone syscall on compat x86 and those architectures that use do_fork to implement clone syscall. This bug was found by strace test suite. Link: https://strace.io/logs/strace/2019-07-12 Fixes: 7f192e3cd316 ("fork: add clone3") Bisected-and-tested-by: Anatoly Pugachev Signed-off-by: Dmitry V. Levin Link: https://lore.kernel.org/r/20190714162047.GB10389@altlinux.org Signed-off-by: Christian Brauner commit 50ec18819cade37cccc914ffc71a8b0a2783c345 Merge: 192f0f8e9db7 e3d85487fba4 Author: Linus Torvalds Date: Sun Jul 14 11:34:05 2019 -0700 Merge branch 'sched-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull scheduler fix from Ingo Molnar: "Fix a sched statistics related bug that would trigger a kernel warning on certain configs" * 'sched-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: sched/core: Fix preempt warning in ttwu commit 1244a720572fd1680ac8d6b8a4235f2e8557b810 Author: Jean-Baptiste Maneyrol Date: Thu Jun 27 13:19:53 2019 +0000 iio: imu: mpu6050: add missing available scan masks Driver only supports 3-axis gyro and/or 3-axis accel. For icm20602, temp data is mandatory for all configurations. Fix all single and double axis configurations (almost never used) and more importantly fix 3-axis gyro and 6-axis accel+gyro buffer on icm20602 when temp data is not enabled. Signed-off-by: Jean-Baptiste Maneyrol Fixes: 1615fe41a195 ("iio: imu: mpu6050: Fix FIFO layout for ICM20602") Cc: Signed-off-by: Jonathan Cameron commit 6cdff99c9f7d7d28b87cf05dd464f7c7736332ae Author: Gwendal Grignou Date: Fri Jun 28 12:17:09 2019 -0700 iio: cros_ec_accel_legacy: Fix incorrect channel setting INFO_SCALE is set both for each channel and all channels. iio is using all channel setting, so the error was not user visible. Signed-off-by: Gwendal Grignou Cc: Signed-off-by: Jonathan Cameron commit 5a304e1a4ea000177cf25f5ecf26e786dda25b98 Author: Maarten ter Huurne Date: Thu Jul 4 19:36:56 2019 +0200 IIO: Ingenic JZ47xx: Set clock divider on probe The SADC component can run at up to 8 MHz on JZ4725B, but is fed a 12 MHz input clock (EXT). Divide it by two to get 6 MHz, then set up another divider to match, to produce a 10us clock. If the clock dividers are left on their power-on defaults (a divider of 1), the SADC mostly works, but will occasionally produce erroneous readings. This led to button presses being detected out of nowhere on the RS90 every few minutes. With this change, no ghost button presses were logged in almost a day worth of testing. The ADCLK register for configuring clock dividers doesn't exist on JZ4740, so avoid writing it there. A function has been introduced rather than a flag because there is a lot of variation between the ADCLK registers on JZ47xx SoCs, both in the internal layout of the register and in the frequency range supported by the SADC. So this solution should make it easier to add support for other JZ47xx SoCs later. Fixes: 1a78daea107d ("iio: adc: probe should set clock divider") Signed-off-by: Maarten ter Huurne Signed-off-by: Artur Rojek Cc: Signed-off-by: Jonathan Cameron commit 3975b097e577bac77267ed8df0f525e3ad3499ec Author: Kirill Smelkov Date: Wed Jun 19 20:26:56 2019 +0300 *: convert stream-like files -> stream_open, even if they use noop_llseek This patch continues 10dce8af3422 (fs: stream_open - opener for stream-like files so that read and write can run simultaneously without deadlock) and c5bf68fe0c86 (*: convert stream-like files from nonseekable_open -> stream_open) and teaches steam_open.cocci to consider files as being stream-like not only if they have .llseek=no_llseek, but also if they have .llseek=noop_llseek. This is safe to do: the comment about noop_llseek says This is an implementation of ->llseek useable for the rare special case when userspace expects the seek to succeed but the (device) file is actually not able to perform the seek. In this case you use noop_llseek() instead of falling back to the default implementation of ->llseek. and in general noop_llseek was massively added to drivers in 6038f373a3dc (llseek: automatically add .llseek fop) when changing default for NULL .llseek from NOP to no_llseek with the idea to avoid breaking compatibility, if maybe some user-space program was using lseek on a device without caring about the result, but caring if it was an error or not. Amended semantic patch produces two changes when applied tree-wide: drivers/hid/hid-sensor-custom.c:690:8-24: WARNING: hid_sensor_custom_fops: .read() has stream semantic; safe to change nonseekable_open -> stream_open. drivers/input/mousedev.c:564:1-17: ERROR: mousedev_fops: .read() can deadlock .write(); change nonseekable_open -> stream_open to fix. Cc: Julia Lawall Cc: Jan Blunck Cc: Arnd Bergmann Cc: Jiri Kosina Cc: Jonathan Cameron Cc: Srinivas Pandruvada Cc: Benjamin Tissoires Cc: Dmitry Torokhov Signed-off-by: Kirill Smelkov commit ae8cc91a7d85e018c0c267f580820b2bb558cd48 Author: Joe Perches Date: Tue Jul 9 22:04:17 2019 -0700 iio: adc: max9611: Fix misuse of GENMASK macro Arguments are supposed to be ordered high then low. Signed-off-by: Joe Perches Fixes: 69780a3bbc0b ("iio: adc: Add Maxim max9611 ADC driver") Cc: Signed-off-by: Jonathan Cameron commit 0307d589c4d6f84349afb7a53717baa2392f6a38 Author: Vincent Bernat Date: Sat Jul 13 16:35:27 2019 +0200 bonding: add documentation for peer_notif_delay Ability to tweak the interval between peer notifications has been added in 07a4ddec3ce9 ("bonding: add an option to specify a delay between peer notifications") but the documentation was not updated. Signed-off-by: Vincent Bernat Signed-off-by: David S. Miller commit fe4e8db0392a6c2e795eb89ef5fcd86522e66248 Author: Heiner Kallweit Date: Sat Jul 13 13:45:47 2019 +0200 r8169: fix issue with confused RX unit after PHY power-down on RTL8411b On RTL8411b the RX unit gets confused if the PHY is powered-down. This was reported in [0] and confirmed by Realtek. Realtek provided a sequence to fix the RX unit after PHY wakeup. The issue itself seems to have been there longer, the Fixes tag refers to where the fix applies properly. [0] https://bugzilla.redhat.com/show_bug.cgi?id=1692075 Fixes: a99790bf5c7f ("r8169: Reinstate ASPM Support") Tested-by: Ionut Radu Signed-off-by: Heiner Kallweit Signed-off-by: David S. Miller commit 192f0f8e9db7efe4ac98d47f5fa4334e43c1204d Merge: ec9249752465 f5a9e488d623 Author: Linus Torvalds Date: Sat Jul 13 16:08:36 2019 -0700 Merge tag 'powerpc-5.3-1' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux Pull powerpc updates from Michael Ellerman: "Notable changes: - Removal of the NPU DMA code, used by the out-of-tree Nvidia driver, as well as some other functions only used by drivers that haven't (yet?) made it upstream. - A fix for a bug in our handling of hardware watchpoints (eg. perf record -e mem: ...) which could lead to register corruption and kernel crashes. - Enable HAVE_ARCH_HUGE_VMAP, which allows us to use large pages for vmalloc when using the Radix MMU. - A large but incremental rewrite of our exception handling code to use gas macros rather than multiple levels of nested CPP macros. And the usual small fixes, cleanups and improvements. Thanks to: Alastair D'Silva, Alexey Kardashevskiy, Andreas Schwab, Aneesh Kumar K.V, Anju T Sudhakar, Anton Blanchard, Arnd Bergmann, Athira Rajeev, Cédric Le Goater, Christian Lamparter, Christophe Leroy, Christophe Lombard, Christoph Hellwig, Daniel Axtens, Denis Efremov, Enrico Weigelt, Frederic Barrat, Gautham R. Shenoy, Geert Uytterhoeven, Geliang Tang, Gen Zhang, Greg Kroah-Hartman, Greg Kurz, Gustavo Romero, Krzysztof Kozlowski, Madhavan Srinivasan, Masahiro Yamada, Mathieu Malaterre, Michael Neuling, Nathan Lynch, Naveen N. Rao, Nicholas Piggin, Nishad Kamdar, Oliver O'Halloran, Qian Cai, Ravi Bangoria, Sachin Sant, Sam Bobroff, Satheesh Rajendran, Segher Boessenkool, Shaokun Zhang, Shawn Anastasio, Stewart Smith, Suraj Jitindar Singh, Thiago Jung Bauermann, YueHaibing" * tag 'powerpc-5.3-1' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux: (163 commits) powerpc/powernv/idle: Fix restore of SPRN_LDBAR for POWER9 stop state. powerpc/eeh: Handle hugepages in ioremap space ocxl: Update for AFU descriptor template version 1.1 powerpc/boot: pass CONFIG options in a simpler and more robust way powerpc/boot: add {get, put}_unaligned_be32 to xz_config.h powerpc/irq: Don't WARN continuously in arch_local_irq_restore() powerpc/module64: Use symbolic instructions names. powerpc/module32: Use symbolic instructions names. powerpc: Move PPC_HA() PPC_HI() and PPC_LO() to ppc-opcode.h powerpc/module64: Fix comment in R_PPC64_ENTRY handling powerpc/boot: Add lzo support for uImage powerpc/boot: Add lzma support for uImage powerpc/boot: don't force gzipped uImage powerpc/8xx: Add microcode patch to move SMC parameter RAM. powerpc/8xx: Use IO accessors in microcode programming. powerpc/8xx: replace #ifdefs by IS_ENABLED() in microcode.c powerpc/8xx: refactor programming of microcode CPM params. powerpc/8xx: refactor printing of microcode patch name. powerpc/8xx: Refactor microcode write powerpc/8xx: refactor writing of CPM microcode arrays ... commit ec9249752465b87b5b26d03f476eebaf872ebd12 Merge: d12109291ccb 61daf52c4ddd Author: Linus Torvalds Date: Sat Jul 13 16:04:19 2019 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc Pull sparc updates from David Miller: "Just a few small changes: - Fix console naming inconsistency with hypervisor consoles, from John Paul Adrian Glaubitz - Fix userland compilation due to use of u_int, from Masahiro Yamada" * git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc: sparc64: Add missing newline at end of file sparc: fix unknown type name u_int in uapi header sparc: configs: Remove useless UEVENT_HELPER_PATH sparc: Remove redundant copy of the LGPL-2.0 sunhv: Fix device naming inconsistency between sunhv_console and sunhv_reg commit d12109291ccbef7e879cc0d0733f31685cd80854 Merge: 1fa91854dcdf 25a09ce79639 Author: Linus Torvalds Date: Sat Jul 13 15:57:37 2019 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net Pull networking fixes from David Miller: 1) Fix excessive stack usage in cxgb4, from Arnd Bergmann. 2) Missing skb queue lock init in tipc, from Chris Packham. 3) Fix some regressions in ipv6 flow label handling, from Eric Dumazet. 4) Elide flow dissection of local packets in FIB rules, from Petar Penkov. 5) Fix TLS support build failure in mlx5, from Tariq Toukab. * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (36 commits) ppp: mppe: Revert "ppp: mppe: Add softdep to arc4" net: dsa: qca8k: replace legacy gpio include net: hisilicon: Use devm_platform_ioremap_resource cxgb4: reduce kernel stack usage in cudbg_collect_mem_region() tipc: ensure head->lock is initialised tc-tests: updated skbedit tests nfp: flower: ensure ip protocol is specified for L4 matches nfp: flower: fix ethernet check on match fields net/mlx5e: Provide cb_list pointer when setting up tc block on rep net: phy: make exported variables non-static net: sched: Fix NULL-pointer dereference in tc_indr_block_ing_cmd() davinci_cpdma: don't cast dma_addr_t to pointer net: openvswitch: do not update max_headroom if new headroom is equal to old headroom net/mlx5e: Convert single case statement switch statements into if statements net/mlx5: E-Switch, Reduce ingress acl modify metadata stack usage net/mlx5e: Fix unused variable warning when CONFIG_MLX5_ESWITCH is off net/mlx5e: Fix compilation error in TLS code ipv6: fix static key imbalance in fl_create() ipv6: fix potential crash in ip6_datagram_dst_update() ipv6: tcp: fix flowlabels reflection for RST packets ... commit 1fa91854dcdf7829e2694873b19f96b65947112d Merge: 3f06962273e7 13990cf8a180 Author: Linus Torvalds Date: Sat Jul 13 15:51:06 2019 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/ide Pull IDE update from David Miller: "Small cleanup" * git://git.kernel.org/pub/scm/linux/kernel/git/davem/ide: ide: use BIT() macro for defining bit-flags commit 3f06962273e73c5f7a651726b191d531cadef788 Merge: 2260840592fb 46ce10df799f Author: Linus Torvalds Date: Sat Jul 13 15:42:44 2019 -0700 Merge tag 'mtd/for-5.3' of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux Pull MTD updates from Miquel Raynal: "This contains the following changes for MTD: MTD core changes: - New Hyperbus framework - New _is_locked (concat) implementation - Various cleanups NAND core changes: - use longest matching pattern in ->exec_op() default parser - export NAND operation tracer - add flag to indicate panic_write in MTD - use kzalloc() instead of kmalloc() and memset() Raw NAND controller drivers changes: - brcmnand: - fix BCH ECC layout for large page NAND parts - fallback to detected ecc-strength, ecc-step-size - when oops in progress use pio and interrupt polling - code refactor code to introduce helper functions - add support for v7.3 controller - FSMC: - use nand_op_trace for operation tracing - GPMI: - move all driver code into single file - various cleanups (including dmaengine changes) - use runtime PM to manage clocks - implement exec_op - MTK: - correct low level time calculation of r/w cycle - improve data sampling timing for read cycle - add validity check for CE# pin setting - fix wrongly assigned OOB buffer pointer issue - re-license MTK NAND driver as Dual MIT/GPL - STM32: - manage the get_irq error case - increase DMA completion timeouts Raw NAND chips drivers changes: - Macronix: add read-retry support Onenand driver changes: - add support for 8Gb datasize chips - avoid fall-through warnings SPI-NAND changes: - define macros for page-read ops with three-byte addresses - add support for two-byte device IDs and then for GigaDevice GD5F1GQ4UFxxG - add initial support for Paragon PN26G0xA - handle the case where the last page read has bitflips SPI-NOR core changes: - add support for the mt25ql02g and w25q16jv flashes - print error in case of jedec read id fails - is25lp256: add post BFPT fix to correct the addr_width SPI NOR controller drivers changes: - intel-spi: Add support for Intel Elkhart Lake SPI serial flash - smt32: remove the driver as the driver was replaced by spi-stm32-qspi.c - cadence-quadspi: add reset control" * tag 'mtd/for-5.3' of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux: (60 commits) mtd: concat: implement _is_locked mtd operation mtd: concat: refactor concat_lock/concat_unlock mtd: abi: do not use C++ style comments in uapi header mtd: afs: remove unneeded NULL check mtd: rawnand: stm32_fmc2: increase DMA completion timeouts mtd: rawnand: Use kzalloc() instead of kmalloc() and memset() mtd: hyperbus: Add driver for TI's HyperBus memory controller mtd: spinand: read returns badly if the last page has bitflips mtd: spinand: Add initial support for Paragon PN26G0xA mtd: rawnand: mtk: Re-license MTK NAND driver as Dual MIT/GPL mtd: rawnand: gpmi: remove double assignment to block_size dt-bindings: mtd: brcmnand: Add brcmnand, brcmnand-v7.3 support mtd: rawnand: brcmnand: Add support for v7.3 controller mtd: rawnand: brcmnand: Refactored code to introduce helper functions mtd: rawnand: brcmnand: When oops in progress use pio and interrupt polling mtd: Add flag to indicate panic_write mtd: rawnand: Add Macronix NAND read retry support mtd: onenand: Avoid fall-through warnings mtd: spinand: Add support for GigaDevice GD5F1GQ4UFxxG mtd: spinand: Add support for two-byte device IDs ... commit 2260840592fbed5be98ca03c97eb8172941f27ac Merge: 92adeb616c91 bd293d071ffe Author: Linus Torvalds Date: Sat Jul 13 15:24:31 2019 -0700 Merge tag 'for-5.3/dm-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm Pull device mapper updates from Mike Snitzer: - Add encrypted byte-offset initialization vector (eboiv) to DM crypt. - Add optional discard features to DM snapshot which allow freeing space from a DM device whose free space was exhausted. - Various small improvements to use struct_size() and kzalloc(). - Fix to check if DM thin metadata is in fail_io mode before attempting to update the superblock to set the needs_check flag. Otherwise the DM thin-pool can hang. - Fix DM bufio shrinker's potential for ABBA recursion deadlock with DM thin provisioning on loop usecase. * tag 'for-5.3/dm-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm: dm bufio: fix deadlock with loop device dm snapshot: add optional discard support features dm crypt: implement eboiv - encrypted byte-offset initialization vector dm crypt: remove obsolete comment about plumb IV dm crypt: wipe private IV struct after key invalid flag is set dm integrity: use kzalloc() instead of kmalloc() + memset() dm: update stale comment in end_clone_bio() dm log writes: fix incorrect comment about the logged sequence example dm log writes: use struct_size() to calculate size of pending_block dm crypt: use struct_size() when allocating encryption context dm integrity: always set version on superblock update dm thin metadata: check if in fail_io mode when setting needs_check commit 92adeb616c9172dea9678f53ea6e5501fc4f4338 Merge: 43c95d3694cc ac499fba98c3 Author: Linus Torvalds Date: Sat Jul 13 15:07:02 2019 -0700 Merge tag 'for-linus-5.3' of git://github.com/cminyard/linux-ipmi Pull IPMI updates from Corey Minyard: "Some small fixes for various things, nothing huge, mostly found by automated tools. Plus add a driver that allows Linux to act as an IPMB slave device, so it can be a satellite MC in an IPMI network" * tag 'for-linus-5.3' of git://github.com/cminyard/linux-ipmi: docs: ipmb: place it at driver-api and convert to ReST fix platform_no_drv_owner.cocci warnings ipmi: ipmb: don't allocate i2c_client on stack ipmi: ipmb: Fix build error while CONFIG_I2C is set to m Add support for IPMB driver drivers: ipmi: Drop device reference ipmi_ssif: fix unexpected driver unregister warning ipmi_si: use bool type for initialized variable ipmi_si: fix unexpected driver unregister warning commit 43c95d3694cc448fdf50bd53b7ff3a5bb4655883 Merge: 073c916bc005 4c105769bf6d Author: Linus Torvalds Date: Sat Jul 13 15:02:27 2019 -0700 Merge tag 'pinctrl-v5.3-1' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl Pull pin control updates from Linus Walleij: "This is the bulk of pin control changes for the v5.3 kernel cycle: Core changes: - Device links can optionally be added between a pin control producer and its consumers. This will affect how the system power management is handled: a pin controller will not suspend before all of its consumers have been suspended. This was necessary for the ST Microelectronics STMFX expander and need to be tested on other systems as well: it makes sense to make this default in the long run. Right now it is opt-in per driver. - Drive strength can be specified in microamps. With decreases in silicon technology, milliamps isn't granular enough, let's make it possible to select drive strengths in microamps. Right now the Meson (AMlogic) driver needs this. New drivers: - New subdriver for the Tegra 194 SoC. - New subdriver for the Qualcomm SDM845. - New subdriver for the Qualcomm SM8150. - New subdriver for the Freescale i.MX8MN (Freescale is now a product line of NXP). - New subdriver for Marvell MV98DX1135. Driver improvements: - The Bitmain BM1880 driver now supports pin config in addition to muxing. - The Qualcomm drivers can now reserve some GPIOs as taken aside and not usable for users. This is used in ACPI systems to take out some GPIO lines used by the BIOS so that noone else (neither kernel nor userspace) will play with them by mistake and crash the machine. - A slew of refurbishing around the Aspeed drivers (board management controllers for servers) in preparation for the new Aspeed AST2600 SoC. - A slew of improvements over the SH PFC drivers as usual. - Misc cleanups and fixes" * tag 'pinctrl-v5.3-1' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl: (106 commits) pinctrl: aspeed: Strip moved macros and structs from private header pinctrl: aspeed: Fix missed include pinctrl: baytrail: Use GENMASK() consistently pinctrl: baytrail: Re-use data structures from pinctrl-intel.h pinctrl: baytrail: Use defined macro instead of magic in byt_get_gpio_mux() pinctrl: qcom: Add SM8150 pinctrl driver dt-bindings: pinctrl: qcom: Add SM8150 pinctrl binding dt-bindings: pinctrl: qcom: Document missing gpio nodes pinctrl: aspeed: Add implementation-related documentation pinctrl: aspeed: Split out pinmux from general pinctrl pinctrl: aspeed: Clarify comment about strapping W1C pinctrl: aspeed: Correct comment that is no longer true MAINTAINERS: Add entry for ASPEED pinctrl drivers dt-bindings: pinctrl: aspeed: Convert AST2500 bindings to json-schema dt-bindings: pinctrl: aspeed: Convert AST2400 bindings to json-schema dt-bindings: pinctrl: aspeed: Split bindings document in two pinctrl: qcom: Add irq_enable callback for msm gpio pinctrl: madera: Fixup SPDX headers pinctrl: qcom: sdm845: Fix CONFIG preprocessor guard pinctrl: tegra: Add bitmask support for parked bits ... commit 073c916bc00571d8662b89a294eba265481b6fbb Merge: a2d79c7174ae 597473720f4d Author: Linus Torvalds Date: Sat Jul 13 14:40:42 2019 -0700 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input Pull input updates from Dmitry Torokhov: - an update to Elan touchpad SMBus driver to fetch device parameters (size, resolution) while it is still in PS/2 mode, before switching over to SMBus, as in that mode some devices return garbage dimensions - update to iforce joystick driver - miscellaneous driver fixes * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: (48 commits) Input: gpio_keys_polled - allow specifying name of input device Input: edt-ft5x06 - simplify event reporting code Input: max77650-onkey - add MODULE_ALIAS() Input: atmel_mxt_ts - fix leak in mxt_update_cfg() Input: synaptics - enable SMBUS on T480 thinkpad trackpad Input: atmel_mxt_ts - fix -Wunused-const-variable Input: joydev - extend absolute mouse detection HID: quirks: Refactor ELAN 400 and 401 handling Input: elan_i2c - export the device id whitelist Input: edt-ft5x06 - use get_unaligned_be16() Input: iforce - add the Saitek R440 Force Wheel Input: iforce - use unaligned accessors, where appropriate Input: iforce - drop couple of temps from transport code Input: iforce - drop bus type from iforce structure Input: iforce - use DMA-safe buffores for USB transfers Input: iforce - allow callers supply data buffer when fetching device IDs Input: iforce - only call iforce_process_packet() if initialized Input: iforce - signal command completion from transport code Input: iforce - do not combine arguments for iforce_process_packet() Input: iforce - factor out hat handling when parsing packets ... commit f0162d21cc8025c828fafe56ee25801f770f41da Author: Hariprasad Kelam Date: Thu Jul 11 23:26:15 2019 +0530 rtc: wm831x: Add IRQF_ONESHOT flag fix below issue reported by coccicheck drivers/rtc/rtc-wm831x.c:436:7-32: ERROR: Threaded IRQ with no primary handler requested without IRQF_ONESHOT Signed-off-by: Hariprasad Kelam Acked-by: Charles Keepax Link: https://lore.kernel.org/r/20190711175615.GA13651@hari-Inspiron-1545 Signed-off-by: Alexandre Belloni commit fe63604c630acfc51797d5896ff01cd59c684572 Author: Markus Elfring Date: Mon Jul 8 10:26:47 2019 +0200 rtc: stm32: remove one condition check in stm32_rtc_set_alarm() A condition check was repeated in this function implementation despite of a corresponding check in the stm32_rtc_alarm_irq_enable() function. Thus delete redundant source code here. This issue was detected by using the Coccinelle software. Suggested-by: Russell King Signed-off-by: Markus Elfring Reviewed-by: Amelie Delaunay Link: https://lore.kernel.org/r/4da614a4-83c6-548c-a112-033b846c561b@web.de Signed-off-by: Alexandre Belloni commit f2f5cb6a73b9f056ae3f8e6b4c61f57d6f3ab1ec Author: YueHaibing Date: Thu Jul 4 16:55:42 2019 +0800 rtc: pcf2123: Fix build error If REGMAP_SPI is m and RTC_DRV_PCF2123 is y, drivers/rtc/rtc-pcf2123.o: In function `pcf2123_probe': rtc-pcf2123.c:(.text+0xb2b): undefined reference to `__devm_regmap_init_spi' Select REGMAP_SPI as RTC_DRV_DS1347 driver does. Reported-by: Hulk Robot Fixes: 790d033933b8 ("rtc: pcf2123: port to regmap") Signed-off-by: YueHaibing Link: https://lore.kernel.org/r/20190704085542.48180-1-yuehaibing@huawei.com Signed-off-by: Alexandre Belloni commit a2d79c7174aeb43b13020dd53d85a7aefdd9f3e5 Merge: 964a4eacef67 a4c0b3decb33 Author: Linus Torvalds Date: Sat Jul 13 10:36:53 2019 -0700 Merge tag 'for-5.3/io_uring-20190711' of git://git.kernel.dk/linux-block Pull io_uring updates from Jens Axboe: "This contains: - Support for recvmsg/sendmsg as first class opcodes. I don't envision going much further down this path, as there are plans in progress to support potentially any system call in an async fashion through io_uring. But I think it does make sense to have certain core ops available directly, especially those that can support a "try this non-blocking" flag/mode. (me) - Handle generic short reads automatically. This can happen fairly easily if parts of the buffered read is cached. Since the application needs to issue another request for the remainder, just do this internally and save kernel/user roundtrip while providing a nicer more robust API. (me) - Support for linked SQEs. This allows SQEs to depend on each other, enabling an application to eg queue a read-from-this-file,write-to-that-file pair. (me) - Fix race in stopping SQ thread (Jackie)" * tag 'for-5.3/io_uring-20190711' of git://git.kernel.dk/linux-block: io_uring: fix io_sq_thread_stop running in front of io_sq_thread io_uring: add support for recvmsg() io_uring: add support for sendmsg() io_uring: add support for sqe links io_uring: punt short reads to async context uio: make import_iovec()/compat_import_iovec() return bytes on success commit ce465bf94b70f03136171a62b607864f00093b19 Author: Ronnie Sahlberg Date: Thu Jul 11 13:46:58 2019 +1000 cifs: fix crash in cifs_dfs_do_automount RHBZ: 1649907 Fix a crash that happens while attempting to mount a DFS referral from the same server on the root of a filesystem. Signed-off-by: Ronnie Sahlberg Signed-off-by: Steve French commit 5b596830d9710e3554354f717dc56f8640841c82 Author: Donald Buczek Date: Sun Jul 7 21:26:10 2019 +0200 nfs4.0: Refetch lease_time after clientid update RFC 7530 requires us to refetch the lease time attribute once a new clientID is established. This is already implemented for the nfs4.1(+) clients by nfs41_init_clientid, which calls nfs41_finish_session_reset, which calls nfs4_setup_state_renewal. To make nfs4_setup_state_renewal available for nfs4.0, move it further to the top of the source file to include it regardles of CONFIG_NFS_V4_1 and to save a forward declaration. Call nfs4_setup_state_renewal from nfs4_init_clientid. Signed-off-by: Donald Buczek Signed-off-by: Trond Myklebust commit ea51efaa9617ee011f53bcd29752c51cda540e06 Author: Donald Buczek Date: Sun Jul 7 21:26:09 2019 +0200 nfs4: Rename nfs41_setup_state_renewal The function nfs41_setup_state_renewal is useful to the nfs 4.0 client as well, so rename the function to nfs4_setup_state_renewal. Signed-off-by: Donald Buczek Signed-off-by: Trond Myklebust commit 0efb01b2ac07976b350b1899333a961fd51d1fdc Author: Donald Buczek Date: Sun Jul 7 21:26:08 2019 +0200 nfs4: Make nfs4_proc_get_lease_time available for nfs4.0 Compile nfs4_proc_get_lease_time, enc_get_lease_time and dec_get_lease_time for nfs4.0. Use nfs4_sequence_done instead of nfs41_sequence_done in nfs4_proc_get_lease_time, Signed-off-by: Donald Buczek Signed-off-by: Trond Myklebust commit 2eaf426debdce566df9302b218307483903ac534 Author: Donald Buczek Date: Sun Jul 7 21:26:07 2019 +0200 nfs: Fix copy-and-paste error in debug message The debug message of decode_attr_lease_time incorrectly says "file size". Fix it to "lease time". Signed-off-by: Donald Buczek Signed-off-by: Trond Myklebust commit 1c316e39a03af7b3e397f45d65fe00653996c467 Author: Markus Elfring Date: Wed Jul 3 15:50:37 2019 +0200 NFS: Replace 16 seq_printf() calls by seq_puts() Some strings should be put into a sequence. Thus use the corresponding function “seq_puts”. This issue was detected by using the Coccinelle software. Signed-off-by: Markus Elfring Signed-off-by: Trond Myklebust commit 9bcaa35c686d65091e833f6c97a20baa31d0e870 Author: Markus Elfring Date: Wed Jul 3 15:33:09 2019 +0200 NFS: Use seq_putc() in nfs_show_stats() A single character (line break) should be put into a sequence. Thus use the corresponding function “seq_putc”. This issue was detected by using the Coccinelle software. Signed-off-by: Markus Elfring Signed-off-by: Trond Myklebust commit 3126790d1fd3f0dff11240c1bdb04a6f020a5a03 Author: Puranjay Mohan Date: Tue Jun 18 09:53:51 2019 +0530 rtc: interface: Change type of 'count' from int to u64 Callers of hrtimer_forward_now() should save the return value in u64. function rtc_pie_update_irq() stores it in variable 'count' of type int change type of count from unsigned long to u64 to solve the issue. Signed-off-by: Puranjay Mohan Link: https://lore.kernel.org/r/20190618042351.9692-1-puranjay12@gmail.com Signed-off-by: Alexandre Belloni commit 68d41d8c94a31dfb8233ab90b9baf41a2ed2da68 Author: Yuyang Du Date: Tue Jul 9 18:15:22 2019 +0800 locking/lockdep: Fix lock used or unused stats error The stats variable nr_unused_locks is incremented every time a new lock class is register and decremented when the lock is first used in __lock_acquire(). And after all, it is shown and checked in lockdep_stats. However, under configurations that either CONFIG_TRACE_IRQFLAGS or CONFIG_PROVE_LOCKING is not defined: The commit: 091806515124b20 ("locking/lockdep: Consolidate lock usage bit initialization") missed marking the LOCK_USED flag at IRQ usage initialization because as mark_usage() is not called. And the commit: 886532aee3cd42d ("locking/lockdep: Move mark_lock() inside CONFIG_TRACE_IRQFLAGS && CONFIG_PROVE_LOCKING") further made mark_lock() not defined such that the LOCK_USED cannot be marked at all when the lock is first acquired. As a result, we fix this by not showing and checking the stats under such configurations for lockdep_stats. Reported-by: Qian Cai Signed-off-by: Yuyang Du Signed-off-by: Peter Zijlstra (Intel) Cc: Andrew Morton Cc: Linus Torvalds Cc: Paul E. McKenney Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: Will Deacon Cc: arnd@arndb.de Cc: frederic@kernel.org Link: https://lkml.kernel.org/r/20190709101522.9117-1-duyuyang@gmail.com Signed-off-by: Ingo Molnar commit e3d85487fba42206024bc3ed32e4b581c7cb46db Author: Peter Zijlstra Date: Wed Jul 10 12:57:36 2019 +0200 sched/core: Fix preempt warning in ttwu John reported a DEBUG_PREEMPT warning caused by commit: aacedf26fb76 ("sched/core: Optimize try_to_wake_up() for local wakeups") I overlooked that ttwu_stat() requires preemption disabled. Reported-by: John Stultz Tested-by: John Stultz Signed-off-by: Peter Zijlstra (Intel) Cc: Andrew Morton Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Thomas Gleixner Fixes: aacedf26fb76 ("sched/core: Optimize try_to_wake_up() for local wakeups") Link: https://lkml.kernel.org/r/20190710105736.GK3402@hirez.programming.kicks-ass.net Signed-off-by: Ingo Molnar commit e4557c1a46b0d32746bd309e1941914b5a6912b4 Author: Kan Liang Date: Tue Jun 25 07:21:35 2019 -0700 perf/x86/intel: Fix spurious NMI on fixed counter If a user first sample a PEBS event on a fixed counter, then sample a non-PEBS event on the same fixed counter on Icelake, it will trigger spurious NMI. For example: perf record -e 'cycles:p' -a perf record -e 'cycles' -a The error message for spurious NMI: [June 21 15:38] Uhhuh. NMI received for unknown reason 30 on CPU 2. [ +0.000000] Do you have a strange power saving mode enabled? [ +0.000000] Dazed and confused, but trying to continue The bug was introduced by the following commit: commit 6f55967ad9d9 ("perf/x86/intel: Fix race in intel_pmu_disable_event()") The commit moves the intel_pmu_pebs_disable() after intel_pmu_disable_fixed(), which returns immediately. The related bit of PEBS_ENABLE MSR will never be cleared for the fixed counter. Then a non-PEBS event runs on the fixed counter, but the bit on PEBS_ENABLE is still set, which triggers spurious NMIs. Check and disable PEBS for fixed counters after intel_pmu_disable_fixed(). Reported-by: Yi, Ammy Signed-off-by: Kan Liang Signed-off-by: Peter Zijlstra (Intel) Acked-by: Jiri Olsa Cc: Cc: Alexander Shishkin Cc: Arnaldo Carvalho de Melo Cc: Jiri Olsa Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Stephane Eranian Cc: Thomas Gleixner Cc: Vince Weaver Fixes: 6f55967ad9d9 ("perf/x86/intel: Fix race in intel_pmu_disable_event()") Link: https://lkml.kernel.org/r/20190625142135.22112-1-kan.liang@linux.intel.com Signed-off-by: Ingo Molnar commit 8a58ddae23796c733c5dfbd717538d89d036c5bd Author: Alexander Shishkin Date: Mon Jul 1 14:07:55 2019 +0300 perf/core: Fix exclusive events' grouping So far, we tried to disallow grouping exclusive events for the fear of complications they would cause with moving between contexts. Specifically, moving a software group to a hardware context would violate the exclusivity rules if both groups contain matching exclusive events. This attempt was, however, unsuccessful: the check that we have in the perf_event_open() syscall is both wrong (looks at wrong PMU) and insufficient (group leader may still be exclusive), as can be illustrated by running: $ perf record -e '{intel_pt//,cycles}' uname $ perf record -e '{cycles,intel_pt//}' uname ultimately successfully. Furthermore, we are completely free to trigger the exclusivity violation by: perf -e '{cycles,intel_pt//}' -e '{intel_pt//,instructions}' even though the helpful perf record will not allow that, the ABI will. The warning later in the perf_event_open() path will also not trigger, because it's also wrong. Fix all this by validating the original group before moving, getting rid of broken safeguards and placing a useful one to perf_install_in_context(). Signed-off-by: Alexander Shishkin Signed-off-by: Peter Zijlstra (Intel) Cc: Cc: Arnaldo Carvalho de Melo Cc: Jiri Olsa Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Stephane Eranian Cc: Thomas Gleixner Cc: Vince Weaver Cc: mathieu.poirier@linaro.org Cc: will.deacon@arm.com Fixes: bed5b25ad9c8a ("perf: Add a pmu capability for "exclusive" events") Link: https://lkml.kernel.org/r/20190701110755.24646-1-alexander.shishkin@linux.intel.com Signed-off-by: Ingo Molnar commit 2f217d58a8a086d3399fecce39fb358848e799c4 Author: Kim Phillips Date: Fri Jun 28 21:59:33 2019 +0000 perf/x86/amd/uncore: Set the thread mask for F17h L3 PMCs Fill in the L3 performance event select register ThreadMask bitfield, to enable per hardware thread accounting. Signed-off-by: Kim Phillips Signed-off-by: Peter Zijlstra (Intel) Cc: Cc: Alexander Shishkin Cc: Arnaldo Carvalho de Melo Cc: Borislav Petkov Cc: Gary Hook Cc: H. Peter Anvin Cc: Janakarajan Natarajan Cc: Jiri Olsa Cc: Linus Torvalds Cc: Martin Liska Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Pu Wen Cc: Stephane Eranian Cc: Suravee Suthikulpanit Cc: Thomas Gleixner Cc: Vince Weaver Link: https://lkml.kernel.org/r/20190628215906.4276-2-kim.phillips@amd.com Signed-off-by: Ingo Molnar commit 16f4641166b10e199f0d7b68c2c5f004fef0bda3 Author: Kim Phillips Date: Fri Jun 28 21:59:20 2019 +0000 perf/x86/amd/uncore: Do not set 'ThreadMask' and 'SliceMask' for non-L3 PMCs The following commit: d7cbbe49a930 ("perf/x86/amd/uncore: Set ThreadMask and SliceMask for L3 Cache perf events") enables L3 PMC events for all threads and slices by writing 1's in 'ChL3PmcCfg' (L3 PMC PERF_CTL) register fields. Those bitfields overlap with high order event select bits in the Data Fabric PMC control register, however. So when a user requests raw Data Fabric events (-e amd_df/event=0xYYY/), the two highest order bits get inadvertently set, changing the counter select to events that don't exist, and for which no counts are read. This patch changes the logic to write the L3 masks only when dealing with L3 PMC counters. AMD Family 16h and below Northbridge (NB) counters were not affected. Signed-off-by: Kim Phillips Signed-off-by: Peter Zijlstra (Intel) Cc: Cc: Alexander Shishkin Cc: Arnaldo Carvalho de Melo Cc: Borislav Petkov Cc: Gary Hook Cc: H. Peter Anvin Cc: Janakarajan Natarajan Cc: Jiri Olsa Cc: Linus Torvalds Cc: Martin Liska Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Pu Wen Cc: Stephane Eranian Cc: Suravee Suthikulpanit Cc: Thomas Gleixner Cc: Vince Weaver Fixes: d7cbbe49a930 ("perf/x86/amd/uncore: Set ThreadMask and SliceMask for L3 Cache perf events") Link: https://lkml.kernel.org/r/20190628215906.4276-1-kim.phillips@amd.com Signed-off-by: Ingo Molnar commit 1cf8dfe8a661f0462925df943140e9f6d1ea5233 Author: Peter Zijlstra Date: Sat Jul 13 11:21:25 2019 +0200 perf/core: Fix race between close() and fork() Syzcaller reported the following Use-after-Free bug: close() clone() copy_process() perf_event_init_task() perf_event_init_context() mutex_lock(parent_ctx->mutex) inherit_task_group() inherit_group() inherit_event() mutex_lock(event->child_mutex) // expose event on child list list_add_tail() mutex_unlock(event->child_mutex) mutex_unlock(parent_ctx->mutex) ... goto bad_fork_* bad_fork_cleanup_perf: perf_event_free_task() perf_release() perf_event_release_kernel() list_for_each_entry() mutex_lock(ctx->mutex) mutex_lock(event->child_mutex) // event is from the failing inherit // on the other CPU perf_remove_from_context() list_move() mutex_unlock(event->child_mutex) mutex_unlock(ctx->mutex) mutex_lock(ctx->mutex) list_for_each_entry_safe() // event already stolen mutex_unlock(ctx->mutex) delayed_free_task() free_task() list_for_each_entry_safe() list_del() free_event() _free_event() // and so event->hw.target // is the already freed failed clone() if (event->hw.target) put_task_struct(event->hw.target) // WHOOPSIE, already quite dead Which puts the lie to the the comment on perf_event_free_task(): 'unexposed, unused context' not so much. Which is a 'fun' confluence of fail; copy_process() doing an unconditional free_task() and not respecting refcounts, and perf having creative locking. In particular: 82d94856fa22 ("perf/core: Fix lock inversion between perf,trace,cpuhp") seems to have overlooked this 'fun' parade. Solve it by using the fact that detached events still have a reference count on their (previous) context. With this perf_event_free_task() can detect when events have escaped and wait for their destruction. Debugged-by: Alexander Shishkin Reported-by: syzbot+a24c397a29ad22d86c98@syzkaller.appspotmail.com Signed-off-by: Peter Zijlstra (Intel) Acked-by: Mark Rutland Cc: Cc: Alexander Shishkin Cc: Arnaldo Carvalho de Melo Cc: Jiri Olsa Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Stephane Eranian Cc: Thomas Gleixner Cc: Vince Weaver Fixes: 82d94856fa22 ("perf/core: Fix lock inversion between perf,trace,cpuhp") Signed-off-by: Ingo Molnar commit e5eb08ac81d237e19fc68888bbba2cf88891bbe9 Merge: f632a8170a6b 323fd749821d Author: Ingo Molnar Date: Sat Jul 13 11:12:47 2019 +0200 Merge tag 'perf-core-for-mingo-5.3-20190709' of git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux into perf/urgent Pull perf/core improvements and fixes: Intel PT: Adrian Hunter: - Fix DROP VIEW power_events_view in the postgresql and sqlite export-db python scripts. perf script: Song Liu: - Assume native_arch for pipe mode, fixing a segfault. perf inject: Arnaldo Carvalho de Melo: - The tool->read() call may pass a NULL evsel, handle it. core: Arnaldo Carvalho de Melo: - Move zalloc/zfree.c to tools/lib, further eroding tools/perf/util.[ch] - Use zfree() where applicable instead of open coded equivalent. - Add stdlib.h and some other headers to places where its needed and were getting via util.h, that doesn't need that anymore. - Use list_del_init() more thoroughly. Miscellaneous: Leo Yan: - Fix use after free and potential NULL pointer derefs detected by the smatch tool in various places. Luke Mujica: - Remove a couple unused variables in the parse-events code. Numfor Mbiziwo-Tiapo: - Initialize variable to suppress memory sanitizer warning in the mmap-thread-lookup 'perf test' entry. Signed-off-by: Arnaldo Carvalho de Melo Signed-off-by: Ingo Molnar commit e2c063c8970044033dac9cedc686db27008e4bb1 Author: Fuqian Huang Date: Sat Jul 13 01:05:19 2019 -0700 Input: auo-pixcir-ts - switch to using devm_add_action_or_reset() devm_add_action_or_reset() is introduced as a helper function which internally calls devm_add_action(). If devm_add_action() fails then it will execute the action mentioned and return the error code. This reduce source code size (avoid writing the action twice) and reduce the likelyhood of bugs. Signed-off-by: Fuqian Huang Signed-off-by: Dmitry Torokhov commit 2a017fd82c5402b3c8df5e3d6e5165d9e6147dc1 Author: Grant Hernandez Date: Sat Jul 13 01:00:12 2019 -0700 Input: gtco - bounds check collection indent level The GTCO tablet input driver configures itself from an HID report sent via USB during the initial enumeration process. Some debugging messages are generated during the parsing. A debugging message indentation counter is not bounds checked, leading to the ability for a specially crafted HID report to cause '-' and null bytes be written past the end of the indentation array. As long as the kernel has CONFIG_DYNAMIC_DEBUG enabled, this code will not be optimized out. This was discovered during code review after a previous syzkaller bug was found in this driver. Signed-off-by: Grant Hernandez Cc: stable@vger.kernel.org Signed-off-by: Dmitry Torokhov commit 25a09ce79639a8775244808c17282c491cff89cf Author: Eric Biggers Date: Fri Jul 12 16:39:31 2019 -0700 ppp: mppe: Revert "ppp: mppe: Add softdep to arc4" Commit 0e5a610b5ca5 ("ppp: mppe: switch to RC4 library interface"), which was merged through the crypto tree for v5.3, changed ppp_mppe.c to use the new arc4_crypt() library function rather than access RC4 through the dynamic crypto_skcipher API. Meanwhile commit aad1dcc4f011 ("ppp: mppe: Add softdep to arc4") was merged through the net tree and added a module soft-dependency on "arc4". The latter commit no longer makes sense because the code now uses the "libarc4" module rather than "arc4", and also due to the direct use of arc4_crypt(), no module soft-dependency is required. So revert the latter commit. Cc: Takashi Iwai Cc: Ard Biesheuvel Signed-off-by: Eric Biggers Signed-off-by: David S. Miller commit d5e5efa250cd644896f541551610fe7f0de35e0a Author: Eric Biggers Date: Mon Jul 1 13:26:30 2019 -0700 f2fs: remove redundant check from f2fs_setflags_common() Now that f2fs_ioc_setflags() and f2fs_ioc_fssetxattr() call the VFS helper functions which check for permission to change the immutable and append-only flags, it's no longer needed to do this check in f2fs_setflags_common() too. So remove it. This is based on a patch from Darrick Wong, but reworked to apply after commit 360985573b55 ("f2fs: separate f2fs i_flags from fs_flags and ext4 i_flags"). Originally-from: Darrick J. Wong Signed-off-by: Eric Biggers Reviewed-by: Chao Yu Reviewed-by: Darrick J. Wong Signed-off-by: Jaegeuk Kim commit 6fc93c4e0ad12e34475755315749143013c702ab Author: Eric Biggers Date: Mon Jul 1 13:26:29 2019 -0700 f2fs: use generic checking function for FS_IOC_FSSETXATTR Make the f2fs implementation of FS_IOC_FSSETXATTR use the new VFS helper function vfs_ioc_fssetxattr_check(), and remove the project quota check since it's now done by the helper function. This is based on a patch from Darrick Wong, but reworked to apply after commit 360985573b55 ("f2fs: separate f2fs i_flags from fs_flags and ext4 i_flags"). Originally-from: Darrick J. Wong Signed-off-by: Eric Biggers Reviewed-by: Chao Yu Reviewed-by: Darrick J. Wong Signed-off-by: Jaegeuk Kim commit a1f32eeca60e74f6f103ce74f586570deddaef7a Author: Eric Biggers Date: Mon Jul 1 13:26:28 2019 -0700 f2fs: use generic checking and prep function for FS_IOC_SETFLAGS Make the f2fs implementation of FS_IOC_SETFLAGS use the new VFS helper function vfs_ioc_setflags_prepare(). This is based on a patch from Darrick Wong, but reworked to apply after commit 360985573b55 ("f2fs: separate f2fs i_flags from fs_flags and ext4 i_flags"). Originally-from: Darrick J. Wong Signed-off-by: Eric Biggers Reviewed-by: Chao Yu Reviewed-by: Darrick J. Wong Signed-off-by: Jaegeuk Kim commit 964a4eacef67503a1154f7e0a75f52fbdce52022 Merge: 23bbbf5c1fb3 a48f9721e6db Author: Linus Torvalds Date: Fri Jul 12 17:37:53 2019 -0700 Merge tag 'dlm-5.3' of git://git.kernel.org/pub/scm/linux/kernel/git/teigland/linux-dlm Pull dlm updates from David Teigland: "This set removes some unnecessary debugfs error handling, and checks that lowcomms workqueues are not NULL before destroying" * tag 'dlm-5.3' of git://git.kernel.org/pub/scm/linux/kernel/git/teigland/linux-dlm: dlm: no need to check return value of debugfs_create functions dlm: check if workqueues are NULL before flushing/destroying commit 23bbbf5c1fb3ddf104c2ddbda4cc24ebe53a3453 Merge: a641a88e5d68 80a316ff1627 Author: Linus Torvalds Date: Fri Jul 12 17:31:19 2019 -0700 Merge tag '9p-for-5.3' of git://github.com/martinetd/linux Pull 9p updates from Dominique Martinet: "Two small fixes to properly cleanup the 9p transports list if virtio/xen module initialization fail. 9p might otherwise try to access memory from a module that failed to register got freed" * tag '9p-for-5.3' of git://github.com/martinetd/linux: 9p/xen: Add cleanup path in p9_trans_xen_init 9p/virtio: Add cleanup path in p9_virtio_init commit a641a88e5d6864f20b2608cb01165c756794e645 Merge: 4ce9d181ebe5 2d008835ec2f Author: Linus Torvalds Date: Fri Jul 12 17:28:24 2019 -0700 Merge tag 'f2fs-for-5.3' of git://git.kernel.org/pub/scm/linux/kernel/git/jaegeuk/f2fs Pull f2fs updates from Jaegeuk Kim: "In this round, we've introduced native swap file support which can exploit DIO, enhanced existing checkpoint=disable feature with additional mount option to tune the triggering condition, and allowed user to preallocate physical blocks in a pinned file which will be useful to avoid f2fs fragmentation in append-only workloads. In addition, we've fixed subtle quota corruption issue. Enhancements: - add swap file support which uses DIO - allocate blocks for pinned file - allow SSR and mount option to enhance checkpoint=disable - enhance IPU IOs - add more sanity checks such as memory boundary access Bug fixes: - quota corruption in very corner case of error-injected SPO case - fix root_reserved on remount and some wrong counts - add missing fsck flag Some patches were also introduced to clean up ambiguous i_flags and debugging messages codes" * tag 'f2fs-for-5.3' of git://git.kernel.org/pub/scm/linux/kernel/git/jaegeuk/f2fs: (33 commits) f2fs: improve print log in f2fs_sanity_check_ckpt() f2fs: avoid out-of-range memory access f2fs: fix to avoid long latency during umount f2fs: allow all the users to pin a file f2fs: support swap file w/ DIO f2fs: allocate blocks for pinned file f2fs: fix is_idle() check for discard type f2fs: add a rw_sem to cover quota flag changes f2fs: set SBI_NEED_FSCK for xattr corruption case f2fs: use generic EFSBADCRC/EFSCORRUPTED f2fs: Use DIV_ROUND_UP() instead of open-coding f2fs: print kernel message if filesystem is inconsistent f2fs: introduce f2fs_ macros to wrap f2fs_printk() f2fs: avoid get_valid_blocks() for cleanup f2fs: ioctl for removing a range from F2FS f2fs: only set project inherit bit for directory f2fs: separate f2fs i_flags from fs_flags and ext4 i_flags f2fs: replace ktype default_attrs with default_groups f2fs: Add option to limit required GC for checkpoint=disable f2fs: Fix accounting for unusable blocks ... commit 4ce9d181ebe53abbca5f450b8a2984b8c3a38f26 Merge: 5010fe9f0954 488ca3d8d088 Author: Linus Torvalds Date: Fri Jul 12 17:17:51 2019 -0700 Merge tag 'xfs-5.3-merge-12' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux Pull xfs updates from Darrick Wong: "In this release there are a significant amounts of consolidations and cleanups in the log code; restructuring of the log to issue struct bios directly; new bulkstat ioctls to return v5 fs inode information (and fix all the padding problems of the old ioctl); the beginnings of multithreaded inode walks (e.g. quotacheck); and a reduction in memory usage in the online scrub code leading to reduced runtimes. - Refactor inode geometry calculation into a single structure instead of open-coding pieces everywhere. - Add online repair to build options. - Remove unnecessary function call flags and functions. - Claim maintainership of various loose xfs documentation and header files. - Use struct bio directly for log buffer IOs instead of struct xfs_buf. - Reduce log item boilerplate code requirements. - Merge log item code spread across too many files. - Further distinguish between log item commits and cancellations. - Various small cleanups to the ag small allocator. - Support cgroup-aware writeback - libxfs refactoring for mkfs cleanup - Remove unneeded #includes - Fix a memory allocation miscalculation in the new log bio code - Fix bisection problems - Fix a crash in ioend processing caused by tripping over freeing of preallocated transactions - Split out a generic inode walk mechanism from the bulkstat code, hook up all the internal users to use the walking code, then clean up bulkstat to serve only the bulkstat ioctls. - Add a multithreaded iwalk implementation to speed up quotacheck on fast storage with many CPUs. - Remove unnecessary return values in logging teardown functions. - Supplement the bstat and inogrp structures with new bulkstat and inumbers structures that have all the fields we need for v5 filesystem features and none of the padding problems of their predecessors. - Wire up new ioctls that use the new structures with a much simpler bulk_ireq structure at the head instead of the pointerhappy mess we had before. - Enable userspace to constrain bulkstat returns to a single AG or a single special inode so that we can phase out a lot of geometry guesswork in userspace. - Reduce memory consumption and zeroing overhead in extended attribute scrub code. - Fix some behavioral regressions in the new bulkstat backend code. - Fix some behavioral regressions in the new log bio code" * tag 'xfs-5.3-merge-12' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux: (100 commits) xfs: chain bios the right way around in xfs_rw_bdev xfs: bump INUMBERS cursor correctly in xfs_inumbers_walk xfs: don't update lastino for FSBULKSTAT_SINGLE xfs: online scrub needn't bother zeroing its temporary buffer xfs: only allocate memory for scrubbing attributes when we need it xfs: refactor attr scrub memory allocation function xfs: refactor extended attribute buffer pointer functions xfs: attribute scrub should use seen_enough to pass error values xfs: allow single bulkstat of special inodes xfs: specify AG in bulk req xfs: wire up the v5 inumbers ioctl xfs: wire up new v5 bulkstat ioctls xfs: introduce v5 inode group structure xfs: introduce new v5 bulkstat structure xfs: rename bulkstat functions xfs: remove various bulk request typedef usage fs: xfs: xfs_log: Change return type from int to void xfs: poll waiting for quotacheck xfs: multithreaded iwalk implementation xfs: refactor INUMBERS to use iwalk functions ... commit 5010fe9f095414b959fd6fda63986dc90fd0c419 Merge: 8487d8229990 dbc77f31e58b Author: Linus Torvalds Date: Fri Jul 12 16:54:37 2019 -0700 Merge tag 'vfs-fix-ioctl-checking-3' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux Pull common SETFLAGS/FSSETXATTR parameter checking from Darrick Wong: "Here's a patch series that sets up common parameter checking functions for the FS_IOC_SETFLAGS and FS_IOC_FSSETXATTR ioctl implementations. The goal here is to reduce the amount of behaviorial variance between the filesystems where those ioctls originated (ext2 and XFS, respectively) and everybody else. - Standardize parameter checking for the SETFLAGS and FSSETXATTR ioctls (which were the file attribute setters for ext4 and xfs and have now been hoisted to the vfs) - Only allow the DAX flag to be set on files and directories" * tag 'vfs-fix-ioctl-checking-3' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux: vfs: only allow FSSETXATTR to set DAX flag on files and dirs vfs: teach vfs_ioc_fssetxattr_check to check extent size hints vfs: teach vfs_ioc_fssetxattr_check to check project id info vfs: create a generic checking function for FS_IOC_FSSETXATTR vfs: create a generic checking and prep function for FS_IOC_SETFLAGS commit 8487d8229990e6eacaf1c854a113c9d16b7b596c Merge: 106f1466e7e7 ee8a84c60bcc Author: Linus Torvalds Date: Fri Jul 12 16:08:21 2019 -0700 Merge tag 'linux-kselftest-5.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest Pull Kselftest updates from Shuah Khan: "This Kselftest update for Linux 5.3-rc1 consists of build failure fixes and minor code cleaning patch to remove duplicate headers" * tag 'linux-kselftest-5.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest: rseq/selftests: Fix Thumb mode build failure on arm32 kselftests: cgroup: remove duplicated include from test_freezer.c selftests: timestamping: Fix SIOCGSTAMP undeclared build failure selftests: dma-buf: Adding kernel config fragment CONFIG_UDMABUF=y commit 106f1466e7e7057ec6f4dc9516c13ea8cb9dffa0 Merge: 39ceda5ce1b0 e3cd5136a4ec Author: Linus Torvalds Date: Fri Jul 12 16:06:27 2019 -0700 Merge tag 'kconfig-v5.3' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild Pull Kconfig updates from Masahiro Yamada: - always require argument for --defconfig and remove the hard-coded arch/$(ARCH)/defconfig path - make arch/$(SRCARCH)/configs/defconfig the new default of defconfig - some code cleanups * tag 'kconfig-v5.3' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild: kconfig: remove meaningless if-conditional in conf_read() kconfig: Fix spelling of sym_is_changable unicore32: rename unicore32_defconfig to defconfig kconfig: make arch/*/configs/defconfig the default of KBUILD_DEFCONFIG kconfig: add static qualifier to expand_string() kconfig: require the argument of --defconfig kconfig: remove always false ifeq ($(KBUILD_DEFCONFIG,) conditional commit 39ceda5ce1b002e30563fcb8ad1bb5ac8e4d59ee Merge: 5f26f1143678 d4a74bbfee03 Author: Linus Torvalds Date: Fri Jul 12 16:03:16 2019 -0700 Merge tag 'kbuild-v5.3' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild Pull Kbuild updates from Masahiro Yamada: - remove headers_{install,check}_all targets - remove unreasonable 'depends on !UML' from CONFIG_SAMPLES - re-implement 'make headers_install' more cleanly - add new header-test-y syntax to compile-test headers - compile-test exported headers to ensure they are compilable in user-space - compile-test headers under include/ to ensure they are self-contained - remove -Waggregate-return, -Wno-uninitialized, -Wno-unused-value flags - add -Werror=unknown-warning-option for Clang - add 128-bit built-in types support to genksyms - fix missed rebuild of modules.builtin - propagate 'No space left on device' error in fixdep to Make - allow Clang to use its integrated assembler - improve some coccinelle scripts - add a new flag KBUILD_ABS_SRCTREE to request Kbuild to use absolute path for $(srctree). - do not ignore errors when compression utility is missing - misc cleanups * tag 'kbuild-v5.3' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild: (49 commits) kbuild: use -- separater intead of $(filter-out ...) for cc-cross-prefix kbuild: Inform user to pass ARCH= for make mrproper kbuild: fix compression errors getting ignored kbuild: add a flag to force absolute path for srctree kbuild: replace KBUILD_SRCTREE with boolean building_out_of_srctree kbuild: remove src and obj from the top Makefile scripts/tags.sh: remove unused environment variables from comments scripts/tags.sh: drop SUBARCH support for ARM kbuild: compile-test kernel headers to ensure they are self-contained kheaders: include only headers into kheaders_data.tar.xz kheaders: remove meaningless -R option of 'ls' kbuild: support header-test-pattern-y kbuild: do not create wrappers for header-test-y kbuild: compile-test exported headers to ensure they are self-contained init/Kconfig: add CONFIG_CC_CAN_LINK kallsyms: exclude kasan local symbols on s390 kbuild: add more hints about SUBDIRS replacement coccinelle: api/stream_open: treat all wait_.*() calls as blocking coccinelle: put_device: Add a cast to an expression for an assignment coccinelle: put_device: Adjust a message construction ... commit 5f26f1143678d0fed8115afdcc0de99ee7cc9675 Merge: aabfea8dc91c 7f3a8dff1219 Author: Linus Torvalds Date: Fri Jul 12 15:41:33 2019 -0700 Merge tag 'asm-generic-5.3' of git://git.kernel.org/pub/scm/linux/kernel/git/arnd/asm-generic Pull asm-generic updates from Arnd Bergmann: "The asm-generic changes for 5.3 consist of a cleanup series to remove ptrace.h from Christoph Hellwig, who explains: 'asm-generic/ptrace.h is a little weird in that it doesn't actually implement any functionality, but it provided multiple layers of macros that just implement trivial inline functions. We implement those directly in the few architectures and be off with a much simpler design.' at https://lore.kernel.org/lkml/20190624054728.30966-1-hch@lst.de/" * tag 'asm-generic-5.3' of git://git.kernel.org/pub/scm/linux/kernel/git/arnd/asm-generic: asm-generic: remove ptrace.h x86: don't use asm-generic/ptrace.h sh: don't use asm-generic/ptrace.h powerpc: don't use asm-generic/ptrace.h arm64: don't use asm-generic/ptrace.h commit aabfea8dc91cf5b220d2ed85e8f6395a9b140371 Merge: 7181feb9b783 9a159190414d Author: Linus Torvalds Date: Fri Jul 12 15:39:22 2019 -0700 Merge tag 's390-5.3-2' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux Pull more s390 updates from Vasily Gorbik: - Fix integer overflow during stack frame unwind with invalid backchain. - Cleanup unused symbol export in zcrypt code. - Fix MIO addressing control activation in PCI code and expose its usage via sysfs. - Fix kernel image signature verification report presence detection. - Fix irq registration in vfio-ap code. - Add CPU measurement counters for newer machines. - Add base DASD thin provisioning support and code cleanups. * tag 's390-5.3-2' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux: (21 commits) s390/unwind: avoid int overflow in outside_of_stack s390/zcrypt: remove the exporting of ap_query_configuration s390/pci: add mio_enabled attribute s390: fix setting of mio addressing control s390/ipl: Fix detection of has_secure attribute s390: vfio-ap: fix irq registration s390/cpumf: Add extended counter set definitions for model 8561 and 8562 s390/dasd: Handle out-of-space constraint s390/dasd: Add discard support for ESE volumes s390/dasd: Use ALIGN_DOWN macro s390/dasd: Make dasd_setup_queue() a discipline function s390/dasd: Add new ioctl to release space s390/dasd: Add dasd_sleep_on_queue_interruptible() s390/dasd: Add missing intensity definition s390/dasd: Fix whitespace s390/dasd: Add dynamic formatting support for ESE volumes s390/dasd: Recognise data for ESE volumes s390/dasd: Put sub-order definitions in a separate section s390/dasd: Make layout analysis ESE compatible s390/dasd: Remove old defines and function ... commit f32ae8a5f131a92cd8179adf55cd8405c60e0c20 Author: Christian Lamparter Date: Fri Jul 12 17:33:36 2019 +0200 net: dsa: qca8k: replace legacy gpio include This patch replaces the legacy bulk gpio.h include with the proper gpio/consumer.h variant. This was caught by the kbuild test robot that was running into an error because of this. For more information why linux/gpio.h is bad can be found in: commit 56a46b6144e7 ("gpio: Clarify that is legacy") Reported-by: kbuild test robot Link: https://www.spinics.net/lists/netdev/msg584447.html Fixes: a653f2f538f9 ("net: dsa: qca8k: introduce reset via gpio feature") Signed-off-by: Christian Lamparter Reviewed-by: Vivien Didelot Reviewed-by: Florian Fainelli Signed-off-by: David S. Miller commit 7181feb9b7837a1e107123cc16552d42d922def6 Merge: 39d7530d7494 f017da5c7077 Author: Linus Torvalds Date: Fri Jul 12 15:38:05 2019 -0700 Merge tag 'nios2-v5.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/lftan/nios2 Pull arch/nios2 updates from Ley Foon Tan. * tag 'nios2-v5.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/lftan/nios2: nios2: configs: Remove useless UEVENT_HELPER_PATH nios2: remove pointless second entry for CONFIG_TRACE_IRQFLAGS_SUPPORT commit 56170ba3bd90986e44f96ada9573dfe583621fca Author: Jiangfeng Xiao Date: Fri Jul 12 21:16:24 2019 +0800 net: hisilicon: Use devm_platform_ioremap_resource Use devm_platform_ioremap_resource instead of devm_ioremap_resource. Make the code simpler. Signed-off-by: Jiangfeng Xiao Signed-off-by: David S. Miller commit 752c2ea2d8e7c23b0f64e2e7d4337f3604d44c9f Author: Arnd Bergmann Date: Fri Jul 12 11:06:33 2019 +0200 cxgb4: reduce kernel stack usage in cudbg_collect_mem_region() The cudbg_collect_mem_region() and cudbg_read_fw_mem() both use several hundred kilobytes of kernel stack space. One gets inlined into the other, which causes the stack usage to be combined beyond the warning limit when building with clang: drivers/net/ethernet/chelsio/cxgb4/cudbg_lib.c:1057:12: error: stack frame size of 1244 bytes in function 'cudbg_collect_mem_region' [-Werror,-Wframe-larger-than=] Restructuring cudbg_collect_mem_region() lets clang do the same optimization that gcc does and reuse the stack slots as it can see that the large variables are never used together. A better fix might be to avoid using cudbg_meminfo on the stack altogether, but that requires a larger rewrite. Fixes: a1c69520f785 ("cxgb4: collect MC memory dump") Signed-off-by: Arnd Bergmann Signed-off-by: David S. Miller commit 39d7530d7494b4e47ba1856e741f513dafd17e3d Merge: 16c97650a56a a45ff5994c9c Author: Linus Torvalds Date: Fri Jul 12 15:35:14 2019 -0700 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm Pull KVM updates from Paolo Bonzini: "ARM: - support for chained PMU counters in guests - improved SError handling - handle Neoverse N1 erratum #1349291 - allow side-channel mitigation status to be migrated - standardise most AArch64 system register accesses to msr_s/mrs_s - fix host MPIDR corruption on 32bit - selftests ckleanups x86: - PMU event {white,black}listing - ability for the guest to disable host-side interrupt polling - fixes for enlightened VMCS (Hyper-V pv nested virtualization), - new hypercall to yield to IPI target - support for passing cstate MSRs through to the guest - lots of cleanups and optimizations Generic: - Some txt->rST conversions for the documentation" * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: (128 commits) Documentation: virtual: Add toctree hooks Documentation: kvm: Convert cpuid.txt to .rst Documentation: virtual: Convert paravirt_ops.txt to .rst KVM: x86: Unconditionally enable irqs in guest context KVM: x86: PMU Event Filter kvm: x86: Fix -Wmissing-prototypes warnings KVM: Properly check if "page" is valid in kvm_vcpu_unmap KVM: arm/arm64: Initialise host's MPIDRs by reading the actual register KVM: LAPIC: Retry tune per-vCPU timer_advance_ns if adaptive tuning goes insane kvm: LAPIC: write down valid APIC registers KVM: arm64: Migrate _elx sysreg accessors to msr_s/mrs_s KVM: doc: Add API documentation on the KVM_REG_ARM_WORKAROUNDS register KVM: arm/arm64: Add save/restore support for firmware workaround state arm64: KVM: Propagate full Spectre v2 workaround state to KVM guests KVM: arm/arm64: Support chained PMU counters KVM: arm/arm64: Remove pmc->bitmask KVM: arm/arm64: Re-create event when setting counter value KVM: arm/arm64: Extract duplicated code to own function KVM: arm/arm64: Rename kvm_pmu_{enable/disable}_counter functions KVM: LAPIC: ARBPRI is a reserved register for x2APIC ... commit d12cffe9329fd278555d0f9bb89af1259a2fd933 Author: Chris Packham Date: Fri Jul 12 10:41:15 2019 +1200 tipc: ensure head->lock is initialised tipc_named_node_up() creates a skb list. It passes the list to tipc_node_xmit() which has some code paths that can call skb_queue_purge() which relies on the list->lock being initialised. The spin_lock is only needed if the messages end up on the receive path but when the list is created in tipc_named_node_up() we don't necessarily know if it is going to end up there. Once all the skb list users are updated in tipc it will then be possible to update them to use the unlocked variants of the skb list functions and initialise the lock when we know the message will follow the receive path. Signed-off-by: Chris Packham Acked-by: Jon Maloy Signed-off-by: David S. Miller commit 100c4043b808739d808bb5c9f6868d3808f062ea Author: Roman Mashak Date: Thu Jul 11 12:29:00 2019 -0400 tc-tests: updated skbedit tests - Added mask upper bound test case - Added mask validation test case - Added mask replacement case Signed-off-by: Roman Mashak Signed-off-by: David S. Miller commit be4d2a5b07780428db42dbf860f16735e1aff23c Merge: 3929502b957e 103b7c25f5a2 Author: David S. Miller Date: Fri Jul 12 15:31:55 2019 -0700 Merge branch 'nfp-flower-bugs' John Hurley says: ==================== Fix bugs in NFP flower match offload This patchset contains bug fixes for corner cases in the match fields of flower offloads. The patches ensure that flows that should not be supported are not (incorrectly) offloaded. These include rules that match on layer 3 and/or 4 data without specified ethernet or ip protocol fields. ==================== Signed-off-by: David S. Miller commit 103b7c25f5a2509ddccec830df924a78354232c4 Author: John Hurley Date: Wed Jul 10 19:30:30 2019 +0100 nfp: flower: ensure ip protocol is specified for L4 matches Flower rules on the NFP firmware are able to match on an IP protocol field. When parsing rules in the driver, unknown IP protocols are only rejected when further matches are to be carried out on layer 4 fields, as the firmware will not be able to extract such fields from packets. L4 protocol dissectors such as FLOW_DISSECTOR_KEY_PORTS are only parsed if an IP protocol is specified. This leaves a loophole whereby a rule that attempts to match on transport layer information such as port numbers but does not explicitly give an IP protocol type can be incorrectly offloaded (in this case with wildcard port numbers matches). Fix this by rejecting the offload of flows that attempt to match on L4 information, not only when matching on an unknown IP protocol type, but also when the protocol is wildcarded. Fixes: 2a04784594f6 ("nfp: flower: check L4 matches on unknown IP protocols") Signed-off-by: John Hurley Reviewed-by: Jakub Kicinski Signed-off-by: David S. Miller commit fd262a6d8a5d8d504e6a0b0183a05deda6bef7a3 Author: John Hurley Date: Wed Jul 10 19:30:29 2019 +0100 nfp: flower: fix ethernet check on match fields NFP firmware does not explicitly match on an ethernet type field. Rather, each rule has a bitmask of match fields that can be used to infer the ethernet type. Currently, if a flower rule contains an unknown ethernet type, a check is carried out for matches on other fields of the packet. If matches on layer 3 or 4 are found, then the offload is rejected as firmware will not be able to extract these fields from a packet with an ethernet type it does not currently understand. However, if a rule contains an unknown ethernet type without any L3 (or above) matches then this will effectively be offloaded as a rule with a wildcarded ethertype. This can lead to misclassifications on the firmware. Fix this issue by rejecting all flower rules that specify a match on an unknown ethernet type. Further ensure correct offloads by moving the 'L3 and above' check to any rule that does not specify an ethernet type and rejecting rules with further matches. This means that we can still offload rules with a wildcarded ethertype if they only match on L2 fields but will prevent rules which match on further fields that we cannot be sure if the firmware will be able to extract. Fixes: af9d842c1354 ("nfp: extend flower add flow offload") Signed-off-by: John Hurley Reviewed-by: Jakub Kicinski Signed-off-by: David S. Miller commit 16c97650a56abdd067f7da079007b7e00b307083 Merge: 9e3a25dc992d 765e33f5211a Author: Linus Torvalds Date: Fri Jul 12 15:28:38 2019 -0700 Merge tag 'hyperv-next-signed' of git://git.kernel.org/pub/scm/linux/kernel/git/hyperv/linux Pull hyper-v updates from Sasha Levin: - Add a module description to the Hyper-V vmbus module. - Rework some vmbus code to separate architecture specifics out to arch/x86/. This is part of the work of adding arm64 support to Hyper-V. * tag 'hyperv-next-signed' of git://git.kernel.org/pub/scm/linux/kernel/git/hyperv/linux: Drivers: hv: vmbus: Break out ISA independent parts of mshyperv.h drivers: hv: Add a module description line to the hv_vmbus driver commit 3929502b957ed05575e74134a817f26c42d13e2c Author: Vlad Buslov Date: Wed Jul 10 21:25:54 2019 +0300 net/mlx5e: Provide cb_list pointer when setting up tc block on rep Recent refactoring of tc block offloads infrastructure introduced new flow_block_cb_setup_simple() method intended to be used as unified way for all drivers to register offload callbacks. However, commit that actually extended all users (drivers) with block cb list and provided it to flow_block infra missed mlx5 en_rep. This leads to following NULL-pointer dereference when creating Qdisc: [ 278.385175] BUG: kernel NULL pointer dereference, address: 0000000000000000 [ 278.393233] #PF: supervisor read access in kernel mode [ 278.399446] #PF: error_code(0x0000) - not-present page [ 278.405847] PGD 8000000850e73067 P4D 8000000850e73067 PUD 8620cd067 PMD 0 [ 278.414141] Oops: 0000 [#1] SMP PTI [ 278.419019] CPU: 7 PID: 3369 Comm: tc Not tainted 5.2.0-rc6+ #492 [ 278.426580] Hardware name: Supermicro SYS-2028TP-DECR/X10DRT-P, BIOS 2.0b 03/30/2017 [ 278.435853] RIP: 0010:flow_block_cb_setup_simple+0xc4/0x190 [ 278.442953] Code: 10 48 89 42 08 48 89 10 48 b8 00 01 00 00 00 00 ad de 49 89 00 48 05 00 01 00 00 49 89 40 08 31 c0 c3 b8 a1 ff ff ff c3 f3 c3 <48> 8b 06 48 39 c6 75 0a eb 1a 48 8b 00 48 39 c6 74 12 48 3b 50 28 [ 278.464829] RSP: 0018:ffffaf07c3f97990 EFLAGS: 00010246 [ 278.471648] RAX: 0000000000000000 RBX: ffff9b43ed4c7680 RCX: ffff9b43d5f80840 [ 278.480408] RDX: ffffffffc0491650 RSI: 0000000000000000 RDI: ffffaf07c3f97998 [ 278.489110] RBP: ffff9b43ddff9000 R08: ffff9b43d5f80840 R09: 0000000000000001 [ 278.497838] R10: 0000000000000009 R11: 00000000000003ad R12: ffffaf07c3f97c08 [ 278.506595] R13: ffff9b43d5f80000 R14: ffff9b43ed4c7680 R15: ffff9b43dfa20b40 [ 278.515374] FS: 00007f796be1b400(0000) GS:ffff9b43ef840000(0000) knlGS:0000000000000000 [ 278.525099] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 278.532453] CR2: 0000000000000000 CR3: 0000000840398002 CR4: 00000000001606e0 [ 278.541197] Call Trace: [ 278.545252] tcf_block_offload_cmd.isra.52+0x7e/0xb0 [ 278.551871] tcf_block_get_ext+0x365/0x3e0 [ 278.557569] qdisc_create+0x15c/0x4e0 [ 278.562859] ? kmem_cache_alloc_trace+0x1a2/0x1c0 [ 278.569235] tc_modify_qdisc+0x1c8/0x780 [ 278.574761] rtnetlink_rcv_msg+0x291/0x340 [ 278.580518] ? _cond_resched+0x15/0x40 [ 278.585856] ? rtnl_calcit.isra.29+0x120/0x120 [ 278.591868] netlink_rcv_skb+0x4a/0x110 [ 278.597198] netlink_unicast+0x1a0/0x250 [ 278.602601] netlink_sendmsg+0x2c1/0x3c0 [ 278.608022] sock_sendmsg+0x5b/0x60 [ 278.612969] ___sys_sendmsg+0x289/0x310 [ 278.618231] ? do_wp_page+0x99/0x730 [ 278.623216] ? page_add_new_anon_rmap+0xbe/0x140 [ 278.629298] ? __handle_mm_fault+0xc84/0x1360 [ 278.635113] ? __sys_sendmsg+0x5e/0xa0 [ 278.640285] __sys_sendmsg+0x5e/0xa0 [ 278.645239] do_syscall_64+0x5b/0x1b0 [ 278.650274] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 278.656697] RIP: 0033:0x7f796abdeb87 [ 278.661628] Code: 64 89 02 48 c7 c0 ff ff ff ff eb b9 0f 1f 80 00 00 00 00 8b 05 6a 2b 2c 00 48 63 d2 48 63 ff 85 c0 75 18 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 59 f3 c3 0f 1f 80 00 00 00 00 53 48 89 f3 48 [ 278.683248] RSP: 002b:00007ffde213ba48 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 278.692245] RAX: ffffffffffffffda RBX: 000000005d261e6f RCX: 00007f796abdeb87 [ 278.700862] RDX: 0000000000000000 RSI: 00007ffde213bab0 RDI: 0000000000000003 [ 278.709527] RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000006 [ 278.718167] R10: 000000000000000c R11: 0000000000000246 R12: 0000000000000001 [ 278.726743] R13: 000000000067b580 R14: 0000000000000000 R15: 0000000000000000 [ 278.735302] Modules linked in: dummy vxlan ip6_udp_tunnel udp_tunnel sch_ingress nfsv3 nfs_acl nfs lockd grace fscache bridge stp llc sunrpc mlx5_ib ib_uverbs intel_rapl ib_core sb_edac x86_pkg_temp_ thermal intel_powerclamp coretemp kvm_intel kvm mlx5_core irqbypass crct10dif_pclmul crc32_pclmul crc32c_intel igb ghash_clmulni_intel ses mei_me enclosure mlxfw ipmi_ssif intel_cstate iTCO_wdt ptp mei pps_core iTCO_vendor_support pcspkr joydev intel_uncore i2c_i801 ipmi_si lpc_ich intel_rapl_perf ioatdma wmi dca pcc_cpufreq ipmi_devintf ipmi_msghandler acpi_power_meter acpi_pad ast i2c_algo_bit drm_k ms_helper ttm drm mpt3sas raid_class scsi_transport_sas [ 278.802263] CR2: 0000000000000000 [ 278.807170] ---[ end trace b1f0a442a279e66f ]--- Extend en_rep with new static mlx5e_rep_block_cb_list list and pass it to flow_block_cb_setup_simple() function instead of hardcoded NULL pointer. Fixes: 955bcb6ea0df ("drivers: net: use flow block API") Signed-off-by: Vlad Buslov Acked-by: Pablo Neira Ayuso Signed-off-by: David S. Miller commit 54638c6eaf445ecf901128599cfeb4620be47d2f Author: Denis Efremov Date: Wed Jul 10 21:03:24 2019 +0300 net: phy: make exported variables non-static The variables phy_basic_ports_array, phy_fibre_port_array and phy_all_ports_features_array are declared static and marked EXPORT_SYMBOL_GPL(), which is at best an odd combination. Because the variables were decided to be a part of API, this commit removes the static attributes and adds the declarations to the header. Fixes: 3c1bcc8614db ("net: ethernet: Convert phydev advertize and supported from u32 to link mode") Signed-off-by: Denis Efremov Signed-off-by: David S. Miller commit c1a970d06f8cf390354a4a426976ed7f960b71f1 Author: Vlad Buslov Date: Wed Jul 10 20:12:29 2019 +0300 net: sched: Fix NULL-pointer dereference in tc_indr_block_ing_cmd() After recent refactoring of block offlads infrastructure, indr_dev->block pointer is dereferenced before it is verified to be non-NULL. Example stack trace where this behavior leads to NULL-pointer dereference error when creating vxlan dev on system with mlx5 NIC with offloads enabled: [ 1157.852938] ================================================================== [ 1157.866877] BUG: KASAN: null-ptr-deref in tc_indr_block_ing_cmd.isra.41+0x9c/0x160 [ 1157.880877] Read of size 4 at addr 0000000000000090 by task ip/3829 [ 1157.901637] CPU: 22 PID: 3829 Comm: ip Not tainted 5.2.0-rc6+ #488 [ 1157.914438] Hardware name: Supermicro SYS-2028TP-DECR/X10DRT-P, BIOS 2.0b 03/30/2017 [ 1157.929031] Call Trace: [ 1157.938318] dump_stack+0x9a/0xeb [ 1157.948362] ? tc_indr_block_ing_cmd.isra.41+0x9c/0x160 [ 1157.960262] ? tc_indr_block_ing_cmd.isra.41+0x9c/0x160 [ 1157.972082] __kasan_report+0x176/0x192 [ 1157.982513] ? tc_indr_block_ing_cmd.isra.41+0x9c/0x160 [ 1157.994348] kasan_report+0xe/0x20 [ 1158.004324] tc_indr_block_ing_cmd.isra.41+0x9c/0x160 [ 1158.015950] ? tcf_block_setup+0x430/0x430 [ 1158.026558] ? kasan_unpoison_shadow+0x30/0x40 [ 1158.037464] __tc_indr_block_cb_register+0x5f5/0xf20 [ 1158.049288] ? mlx5e_rep_indr_tc_block_unbind+0xa0/0xa0 [mlx5_core] [ 1158.062344] ? tc_indr_block_dev_put.part.47+0x5c0/0x5c0 [ 1158.074498] ? rdma_roce_rescan_device+0x20/0x20 [ib_core] [ 1158.086580] ? br_device_event+0x98/0x480 [bridge] [ 1158.097870] ? strcmp+0x30/0x50 [ 1158.107578] mlx5e_nic_rep_netdevice_event+0xdd/0x180 [mlx5_core] [ 1158.120212] notifier_call_chain+0x6d/0xa0 [ 1158.130753] register_netdevice+0x6fc/0x7e0 [ 1158.141322] ? netdev_change_features+0xa0/0xa0 [ 1158.152218] ? vxlan_config_apply+0x210/0x310 [vxlan] [ 1158.163593] __vxlan_dev_create+0x2ad/0x520 [vxlan] [ 1158.174770] ? vxlan_changelink+0x490/0x490 [vxlan] [ 1158.185870] ? rcu_read_unlock+0x60/0x60 [vxlan] [ 1158.196798] vxlan_newlink+0x99/0xf0 [vxlan] [ 1158.207303] ? __vxlan_dev_create+0x520/0x520 [vxlan] [ 1158.218601] ? rtnl_create_link+0x3d0/0x450 [ 1158.228900] __rtnl_newlink+0x8a7/0xb00 [ 1158.238701] ? stack_access_ok+0x35/0x80 [ 1158.248450] ? rtnl_link_unregister+0x1a0/0x1a0 [ 1158.258735] ? find_held_lock+0x6d/0xd0 [ 1158.268379] ? is_bpf_text_address+0x67/0xf0 [ 1158.278330] ? lock_acquire+0xc1/0x1f0 [ 1158.287686] ? is_bpf_text_address+0x5/0xf0 [ 1158.297449] ? is_bpf_text_address+0x86/0xf0 [ 1158.307310] ? kernel_text_address+0xec/0x100 [ 1158.317155] ? arch_stack_walk+0x92/0xe0 [ 1158.326497] ? __kernel_text_address+0xe/0x30 [ 1158.336213] ? unwind_get_return_address+0x2f/0x50 [ 1158.346267] ? create_prof_cpu_mask+0x20/0x20 [ 1158.355936] ? arch_stack_walk+0x92/0xe0 [ 1158.365117] ? stack_trace_save+0x8a/0xb0 [ 1158.374272] ? stack_trace_consume_entry+0x80/0x80 [ 1158.384226] ? match_held_lock+0x33/0x210 [ 1158.393216] ? kasan_unpoison_shadow+0x30/0x40 [ 1158.402593] rtnl_newlink+0x53/0x80 [ 1158.410925] rtnetlink_rcv_msg+0x3a5/0x600 [ 1158.419777] ? validate_linkmsg+0x400/0x400 [ 1158.428620] ? find_held_lock+0x6d/0xd0 [ 1158.437117] ? match_held_lock+0x1b/0x210 [ 1158.445760] ? validate_linkmsg+0x400/0x400 [ 1158.454642] netlink_rcv_skb+0xc7/0x1f0 [ 1158.463150] ? netlink_ack+0x470/0x470 [ 1158.471538] ? netlink_deliver_tap+0x1f3/0x5a0 [ 1158.480607] netlink_unicast+0x2ae/0x350 [ 1158.489099] ? netlink_attachskb+0x340/0x340 [ 1158.497935] ? _copy_from_iter_full+0xde/0x3b0 [ 1158.506945] ? __virt_addr_valid+0xb6/0xf0 [ 1158.515578] ? __check_object_size+0x159/0x240 [ 1158.524515] netlink_sendmsg+0x4d3/0x630 [ 1158.532879] ? netlink_unicast+0x350/0x350 [ 1158.541400] ? netlink_unicast+0x350/0x350 [ 1158.549805] sock_sendmsg+0x94/0xa0 [ 1158.557561] ___sys_sendmsg+0x49d/0x570 [ 1158.565625] ? copy_msghdr_from_user+0x210/0x210 [ 1158.574457] ? __fput+0x1e2/0x330 [ 1158.581948] ? __kasan_slab_free+0x130/0x180 [ 1158.590407] ? kmem_cache_free+0xb6/0x2d0 [ 1158.598574] ? mark_lock+0xc7/0x790 [ 1158.606177] ? task_work_run+0xcf/0x100 [ 1158.614165] ? exit_to_usermode_loop+0x102/0x110 [ 1158.622954] ? __lock_acquire+0x963/0x1ee0 [ 1158.631199] ? lockdep_hardirqs_on+0x260/0x260 [ 1158.639777] ? match_held_lock+0x1b/0x210 [ 1158.647918] ? lockdep_hardirqs_on+0x260/0x260 [ 1158.656501] ? match_held_lock+0x1b/0x210 [ 1158.664643] ? __fget_light+0xa6/0xe0 [ 1158.672423] ? __sys_sendmsg+0xd2/0x150 [ 1158.680334] __sys_sendmsg+0xd2/0x150 [ 1158.688063] ? __ia32_sys_shutdown+0x30/0x30 [ 1158.696435] ? lock_downgrade+0x2e0/0x2e0 [ 1158.704541] ? mark_held_locks+0x1a/0x90 [ 1158.712611] ? mark_held_locks+0x1a/0x90 [ 1158.720619] ? do_syscall_64+0x1e/0x2c0 [ 1158.728530] do_syscall_64+0x78/0x2c0 [ 1158.736254] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 1158.745414] RIP: 0033:0x7f62d505cb87 [ 1158.753070] Code: 64 89 02 48 c7 c0 ff ff ff ff eb b9 0f 1f 80 00 00 00 00 8b 05 6a 2b 2c 00 48 63 d2 48 63 ff 85 c0 75 18 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 59 f3 c3 0f 1f 80 00 00[87/1817] 48 89 f3 48 [ 1158.780924] RSP: 002b:00007fffd9832268 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1158.793204] RAX: ffffffffffffffda RBX: 000000005d26048f RCX: 00007f62d505cb87 [ 1158.805111] RDX: 0000000000000000 RSI: 00007fffd98322d0 RDI: 0000000000000003 [ 1158.817055] RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000006 [ 1158.828987] R10: 00007f62d50ce260 R11: 0000000000000246 R12: 0000000000000001 [ 1158.840909] R13: 000000000067e540 R14: 0000000000000000 R15: 000000000067ed20 [ 1158.852873] ================================================================== Introduce new function tcf_block_non_null_shared() that verifies block pointer before dereferencing it to obtain index. Use the function in tc_indr_block_ing_cmd() to prevent NULL pointer dereference. Fixes: 955bcb6ea0df ("drivers: net: use flow block API") Signed-off-by: Vlad Buslov Signed-off-by: David S. Miller commit c653f61a7f3ef05db173fe4132424db17edeee6b Author: Arnd Bergmann Date: Wed Jul 10 10:00:33 2019 +0200 davinci_cpdma: don't cast dma_addr_t to pointer dma_addr_t may be 64-bit wide on 32-bit architectures, so it is not valid to cast between it and a pointer: drivers/net/ethernet/ti/davinci_cpdma.c: In function 'cpdma_chan_submit_si': drivers/net/ethernet/ti/davinci_cpdma.c:1047:12: error: cast from pointer to integer of different size [-Werror=pointer-to-int-cast] drivers/net/ethernet/ti/davinci_cpdma.c: In function 'cpdma_chan_idle_submit_mapped': drivers/net/ethernet/ti/davinci_cpdma.c:1114:12: error: cast to pointer from integer of different size [-Werror=int-to-pointer-cast] drivers/net/ethernet/ti/davinci_cpdma.c: In function 'cpdma_chan_submit_mapped': drivers/net/ethernet/ti/davinci_cpdma.c:1164:12: error: cast to pointer from integer of different size [-Werror=int-to-pointer-cast] Solve this by using two separate members in 'struct submit_info'. Since this avoids the use of the 'flag' member, the structure does not even grow in typical configurations. Fixes: 6670acacd59e ("net: ethernet: ti: davinci_cpdma: add dma mapped submit") Signed-off-by: Arnd Bergmann Reviewed-by: Ivan Khoronzhuk Signed-off-by: David S. Miller commit 6b660c4177aaebdc73df7a3378f0e8b110aa4b51 Author: Taehee Yoo Date: Sat Jul 6 01:08:09 2019 +0900 net: openvswitch: do not update max_headroom if new headroom is equal to old headroom When a vport is deleted, the maximum headroom size would be changed. If the vport which has the largest headroom is deleted, the new max_headroom would be set. But, if the new headroom size is equal to the old headroom size, updating routine is unnecessary. Signed-off-by: Taehee Yoo Tested-by: Greg Rose Reviewed-by: Greg Rose Signed-off-by: David S. Miller commit 9e3a25dc992dd9f3170fb643bdd95da5ca9c5576 Merge: 9787aed57dd3 15ffe5e1acf5 Author: Linus Torvalds Date: Fri Jul 12 15:13:55 2019 -0700 Merge tag 'dma-mapping-5.3' of git://git.infradead.org/users/hch/dma-mapping Pull dma-mapping updates from Christoph Hellwig: - move the USB special case that bounced DMA through a device bar into the USB code instead of handling it in the common DMA code (Laurentiu Tudor and Fredrik Noring) - don't dip into the global CMA pool for single page allocations (Nicolin Chen) - fix a crash when allocating memory for the atomic pool failed during boot (Florian Fainelli) - move support for MIPS-style uncached segments to the common code and use that for MIPS and nios2 (me) - make support for DMA_ATTR_NON_CONSISTENT and DMA_ATTR_NO_KERNEL_MAPPING generic (me) - convert nds32 to the generic remapping allocator (me) * tag 'dma-mapping-5.3' of git://git.infradead.org/users/hch/dma-mapping: (29 commits) dma-mapping: mark dma_alloc_need_uncached as __always_inline MIPS: only select ARCH_HAS_UNCACHED_SEGMENT for non-coherent platforms usb: host: Fix excessive alignment restriction for local memory allocations lib/genalloc.c: Add algorithm, align and zeroed family of DMA allocators nios2: use the generic uncached segment support in dma-direct nds32: use the generic remapping allocator for coherent DMA allocations arc: use the generic remapping allocator for coherent DMA allocations dma-direct: handle DMA_ATTR_NO_KERNEL_MAPPING in common code dma-direct: handle DMA_ATTR_NON_CONSISTENT in common code dma-mapping: add a dma_alloc_need_uncached helper openrisc: remove the partial DMA_ATTR_NON_CONSISTENT support arc: remove the partial DMA_ATTR_NON_CONSISTENT support arm-nommu: remove the partial DMA_ATTR_NON_CONSISTENT support ARM: dma-mapping: allow larger DMA mask than supported dma-mapping: truncate dma masks to what dma_addr_t can hold iommu/dma: Apply dma_{alloc,free}_contiguous functions dma-remap: Avoid de-referencing NULL atomic_pool MIPS: use the generic uncached segment support in dma-direct dma-direct: provide generic support for uncached kernel segments au1100fb: fix DMA API abuse ... commit 7b4b0f6b34d893be569da81ffad865a9d3a7d014 Merge: 31d5a608b13b f6b6aefee70a Author: Bjorn Helgaas Date: Fri Jul 12 17:08:41 2019 -0500 Merge branch 'pci/trivial' - Fix typos and whitespace errors (Bjorn Helgaas) * pci/trivial: PCI: Fix typos and whitespace errors commit 31d5a608b13b7251286699860630d36b0eb1def4 Merge: 950cfbf0a52b af3366308ea4 Author: Bjorn Helgaas Date: Fri Jul 12 17:08:40 2019 -0500 Merge branch 'remotes/lorenzo/pci/misc' - Fix pcitest build issues (Alan Mikhak) - Fix pcitest installation issue (Andy Shevchenko) * remotes/lorenzo/pci/misc: tools: PCI: Fix installation when `make tools/pci_install` tools: PCI: Fix compiler warning in pcitest tools: PCI: Fix broken pcitest compilation commit 950cfbf0a52bd5720a7aa95eae70d73d2ec5d489 Merge: 916f12e494d7 dbb7bbcc8ad2 Author: Bjorn Helgaas Date: Fri Jul 12 17:08:39 2019 -0500 Merge branch 'remotes/lorenzo/pci/endpoint' - Complete PCI endpoint removal so a subsequent add doesn't fail with -EBUSY (Alan Mikhak) - Pay attention to PCI endpoint fixed-size BARs (Alan Mikhak) - Fix PCI endpoint handling of 64bit BARs (Alan Mikhak) - Clear PCI endpoint BARs before freeing space (Alan Mikhak) * remotes/lorenzo/pci/endpoint: PCI: endpoint: Clear BAR before freeing its space PCI: endpoint: Skip odd BAR when skipping 64bit BAR PCI: endpoint: Allocate enough space for fixed size BAR PCI: endpoint: Set endpoint controller pointer to NULL commit 916f12e494d7ff7c786144ac62807bd37755efb3 Merge: 6bfc0c07cdb7 181fa434d051 Author: Bjorn Helgaas Date: Fri Jul 12 17:08:38 2019 -0500 Merge branch 'remotes/lorenzo/pci/xilinx' - Fix Xilinx NWL multi-MSI vector aliasing issue (Bharat Kumar Gogada) * remotes/lorenzo/pci/xilinx: PCI: xilinx-nwl: Fix Multi MSI data programming commit 6bfc0c07cdb775ff5648df4afbe3ac7ce1c766ab Merge: e3a9d5696682 7be142caabc4 Author: Bjorn Helgaas Date: Fri Jul 12 17:08:37 2019 -0500 Merge branch 'remotes/lorenzo/pci/tegra' - Reorganize Tegra AFI/PHY/REFCLK/etc functions (Manikanta Maddireddy) - Mask Tegra AFI_INTR in runtime suspend (Manikanta Maddireddy) - Fix Tegra AFI/PCIe powerup sequence (Manikanta Maddireddy) - Add Tegra124, Tegra132, Tegra210, and Tegra186 support for Gen2 link speed (Manikanta Maddireddy) - Advertise Tegra AER support (Manikanta Maddireddy) - Program Tegra210 UPHY settings (Manikanta Maddireddy) - Enable Tegra opportunistic UpdateFC and ACK (Manikanta Maddireddy) - Disable Tegra AFI dynamic clock gating (Manikanta Maddireddy) - Process Tegra pending DLL transactions before entering L1 or L2 to prevent receiver errors (Manikanta Maddireddy) - Enable Tegra xclk clock clamping in L1 (Manikanta Maddireddy) - Increase Tegra deskew retry time (Manikanta Maddireddy) - Work around Tegra hardware RAW erratum (Manikanta Maddireddy) - Update Tegra210 flow control timer frequency (Manikanta Maddireddy) - Work around Tegra Gen1/Gen2 link number negotiation issue (Manikanta Maddireddy) - Work around Tegra PLLE power down issue (Manikanta Maddireddy) - Program Tegra20 to support cacheable upstream transactions (Manikanta Maddireddy) - Log Tegra PRSNT_SENSE_IRQ as debug, not err (Manikanta Maddireddy) - Add register offset for third Root Port on Tegra186 and Tegra30 (Manikanta Maddireddy) - Document Tegra PCIe DPD pinctrl property (Manikanta Maddireddy) - Put Tegra PEX CLK & BIAS pads in DPD mode to reduce power usage when powergated (Manikanta Maddireddy) - Add generic DT binding for "reset-gpios" property (Manikanta Maddireddy) - Add Tegra support for GPIO-based PERST# (Manikanta Maddireddy) - Enable Relaxed Ordering only for Tegra20 & Tegra30 (Vidya Sagar) * remotes/lorenzo/pci/tegra: PCI: tegra: Enable Relaxed Ordering only for Tegra20 & Tegra30 PCI: tegra: Change link retry log level to debug PCI: tegra: Add support for GPIO based PERST# PCI: Add DT binding for "reset-gpios" property PCI: tegra: Put PEX CLK & BIAS pads in DPD mode dt-bindings: pci: tegra: Document PCIe DPD pinctrl optional prop PCI: tegra: Add AFI_PEX2_CTRL reg offset as part of SoC struct PCI: tegra: Change PRSNT_SENSE IRQ log to debug PCI: tegra: Program AFI_CACHE_BAR_{0,1}_{ST,SZ} registers only for Tegra20 PCI: tegra: Fix PLLE power down issue due to CLKREQ# signal PCI: tegra: Set target speed as Gen1 before starting LTSSM PCI: tegra: Update flow control timer frequency in Tegra210 PCI: tegra: Add SW fixup for RAW violations PCI: tegra: Increase the deskew retry time PCI: tegra: Enable PCIe xclk clock clamping PCI: tegra: Process pending DLL transactions before entering L1 or L2 PCI: tegra: Disable AFI dynamic clock gating PCI: tegra: Enable opportunistic UpdateFC and ACK PCI: tegra: Program UPHY electrical settings for Tegra210 PCI: tegra: Advertise PCIe Advanced Error Reporting (AER) capability PCI: tegra: Add PCIe Gen2 link speed support PCI: tegra: Fix PCIe host power up sequence PCI: tegra: Mask AFI_INTR in runtime suspend PCI: tegra: Rearrange Tegra PCIe driver functions PCI: tegra: Handle failure cases in tegra_pcie_power_on() soc/tegra: pmc: Export tegra_powergate_power_on() commit e3a9d5696682971d52080111453ed23b4e5841f2 Merge: 757410bd97ca 69bc586518e0 Author: Bjorn Helgaas Date: Fri Jul 12 17:08:36 2019 -0500 Merge branch 'remotes/lorenzo/pci/rcar' - Add R-Car device tree support for r8a774a1 (Biju Das) * remotes/lorenzo/pci/rcar: dt-bindings: PCI: rcar: Add device tree support for r8a774a1 commit 757410bd97ca102cacf30ab9b686f3f5f0c58c6a Merge: 3d663fc0f2b0 64adde31c8e9 Author: Bjorn Helgaas Date: Fri Jul 12 17:08:35 2019 -0500 Merge branch 'remotes/lorenzo/pci/qcom' - Move qcom driver to bulk clock API (Bjorn Andersson) - Add Qualcomm QCS404 PCIe controller support (Bjorn Andersson) - Ensure Qualcomm PERST is asserted for at least 100ms (Niklas Cassel) * remotes/lorenzo/pci/qcom: PCI: qcom: Ensure that PERST is asserted for at least 100 ms PCI: qcom: Add QCS404 PCIe controller support dt-bindings: PCI: qcom: Add QCS404 to the binding PCI: qcom: Use clk bulk API for 2.4.0 controllers commit 3d663fc0f2b0edc2fb0967f36f035a5dcbcb03c5 Merge: caa98440ac53 8a4f9fea2697 Author: Bjorn Helgaas Date: Fri Jul 12 17:08:34 2019 -0500 Merge branch 'remotes/lorenzo/pci/mobiveil' - Unify mobiveil register accessors (Hou Zhiqiang) - Remove MSI_FLAG_MULTI_PCI_MSI since mobiveil hardware doesn't support Multiple MSI (Hou Zhiqiang) - Program outbound windows with base address from DT instead of assuming zero (Hou Zhiqiang) - Skip "safe" list traversal when it's unnecessary (Hou Zhiqiang) - Initialize WIN_NUM_0 explicitly for CFG outbound transactions (Hou Zhiqiang) - Use WIN_NUM_0 for MEM inbound transactions (Hou Zhiqiang) - Fix up mobiveil Class Code to PCI_CLASS_BRIDGE_PCI (Hou Zhiqiang) - Wait for link-up before enumerating devices, not while initializing host (Hou Zhiqiang) - Move IRQ chained handler setup out of DT code (Hou Zhiqiang) - Set primary/secondary/subordinate bus numbers (Hou Zhiqiang) - Fix "valid device" check to allow root bus device 0 to be multi-function (Hou Zhiqiang) - Make DT "gpio_slave" and "apb_csr" properties optional (Hou Zhiqiang) - Refactor MEM/IO outbound window initialization (Hou Zhiqiang) - Fix validity check for inbound/outbound window programming (Hou Zhiqiang) - Initialize and preserve window control bits (Hou Zhiqiang) - Fix 64-bit outbound window setup (both CPU and PCI addresses) (Hou Zhiqiang) - Move IO port setup to host init (Hou Zhiqiang) - Fix infinite loop in INTx ISR (Hou Zhiqiang) - Fix INTx interrupt clearing to avoid missed interrupts (Hou Zhiqiang) * remotes/lorenzo/pci/mobiveil: PCI: mobiveil: Fix INTx interrupt clearing in mobiveil_pcie_isr() PCI: mobiveil: Fix infinite-loop in the INTx handling function PCI: mobiveil: Move PCIe PIO enablement out of inbound window routine PCI: mobiveil: Add upper 32-bit PCI base address setup in inbound window PCI: mobiveil: Add upper 32-bit CPU base address setup in outbound window PCI: mobiveil: Mask out hardcoded bits in inbound/outbound windows setup PCI: mobiveil: Clear the control fields before updating it PCI: mobiveil: Add configured inbound windows counter PCI: mobiveil: Fix the valid check for inbound and outbound windows PCI: mobiveil: Clean-up program_{ib/ob}_windows() PCI: mobiveil: Remove an unnecessary return value check PCI: mobiveil: Fix error return values PCI: mobiveil: Refactor the MEM/IO outbound window initialization PCI: mobiveil: Make some register updates more readable PCI: mobiveil: Reformat the code for readability dt-bindings: PCI: mobiveil: Change gpio_slave and apb_csr to optional PCI: mobiveil: Fix devfn check in mobiveil_pcie_valid_device() PCI: mobiveil: Initialize Primary/Secondary/Subordinate bus numbers PCI: mobiveil: Move IRQ chained handler setup out of DT parse PCI: mobiveil: Move the link up waiting out of mobiveil_host_init() PCI: mobiveil: Fix the Class Code field PCI: mobiveil: Use the 1st inbound window for MEM inbound transactions PCI: mobiveil: Use WIN_NUM_0 explicitly for CFG outbound window PCI: mobiveil: Update the resource list traversal function PCI: mobiveil: Fix PCI base address in MEM/IO outbound windows PCI: mobiveil: Remove the flag MSI_FLAG_MULTI_PCI_MSI PCI: mobiveil: Unify register accessors commit caa98440ac537872f26792598471c658b5a2f599 Merge: 6c90132f0e5f 4df591b20b80 Author: Bjorn Helgaas Date: Fri Jul 12 17:08:33 2019 -0500 Merge branch 'remotes/lorenzo/pci/hv' - Fix Hyper-V use-after-free in eject path (Dexuan Cui) * remotes/lorenzo/pci/hv: PCI: hv: Fix a use-after-free bug in hv_eject_device_work() commit 6c90132f0e5f6c522ac3f6bd1f91961cb77fb9b6 Merge: 8e7bc41cdcfe 381ed79c8655 Author: Bjorn Helgaas Date: Fri Jul 12 17:08:32 2019 -0500 Merge branch 'remotes/lorenzo/pci/dwc' - Add dwc API support to de-initialize host (Vidya Sagar) - Clean up dwc DBI,ATU read and write APIs (Vidya Sagar) - Export dwc APIs to support .remove() so drivers can be modular (Vidya Sagar) - Simplify imx6 Kconfig dependencies (Leonard Crestez) - Fix dra7xx build error when !CONFIG_GPIOLIB (YueHaibing) * remotes/lorenzo/pci/dwc: PCI: dwc: pci-dra7xx: Fix compilation when !CONFIG_GPIOLIB PCI: imx6: Simplify Kconfig depends on PCI: dwc: Export APIs to support .remove() implementation PCI: dwc: Cleanup DBI,ATU read and write APIs PCI: dwc: Add API support to de-initialize host commit 8e7bc41cdcfe64f891a3e1b4913e1a4c107a3465 Merge: b32fb024027c c369b536f8e3 Author: Bjorn Helgaas Date: Fri Jul 12 17:08:31 2019 -0500 Merge branch 'remotes/lorenzo/pci/armada' - Add Armada8k PHYs support (Miquel Raynal) * remotes/lorenzo/pci/armada: PCI: armada8k: Add PHYs support commit b32fb024027c7952ab42b0f5467e8c43a16b75ad Merge: 55ab3ecb81d5 7a28db0a251e Author: Bjorn Helgaas Date: Fri Jul 12 17:08:30 2019 -0500 Merge branch 'remotes/lorenzo/pci/altera' - Allow building Altera host bridge driver as a module (Ley Foon Tan) - Fix Altera Stratix 10 Type 1 to Type 0 config access conversion (Ley Foon Tan) * remotes/lorenzo/pci/altera: PCI: altera: Fix configuration type based on secondary number PCI: altera-msi: Allow building as module PCI: altera: Allow building as module commit 55ab3ecb81d5c071287a17567f7573f16934a9e9 Merge: 8c6af6f04252 06013b647c70 Author: Bjorn Helgaas Date: Fri Jul 12 17:08:29 2019 -0500 Merge branch 'pci/virtualization' - Fix problem with caching VF config space size (Alex Williamson) * pci/virtualization: PCI/IOV: Assume SR-IOV VFs support extended config space. Revert "PCI/IOV: Use VF0 cached config space size for other VFs" commit 8c6af6f04252110b3e4c2ff1614a4518d5208383 Merge: 3306e99edf70 6a381ea694c9 Author: Bjorn Helgaas Date: Fri Jul 12 17:08:28 2019 -0500 Merge branch 'pci/resource' - Evaluate ACPI "PCI Boot Configuration"_DSM (Benjamin Herrenschmidt) - Don't auto-realloc if we're preserving firmware config (Benjamin Herrenschmidt) - Allow arm64 to reallocate resources if necessary (Benjamin Herrenschmidt) - Preserve firmware config on arm64 when desired (Benjamin Herrenschmidt) - Simplify resource distribution to hotplug bridges (Nicholas Johnson) * pci/resource: PCI: Skip resource distribution when no hotplug bridges PCI: Simplify pci_bus_distribute_available_resources() arm64: PCI: Preserve firmware configuration when desired arm64: PCI: Allow resource reallocation if necessary PCI: Don't auto-realloc if we're preserving firmware config PCI/ACPI: Evaluate PCI Boot Configuration _DSM commit 3306e99edf70e9f7f9839c0c680136f098ebb1ed Merge: e09977285c19 9c002bb66f5b Author: Bjorn Helgaas Date: Fri Jul 12 17:08:27 2019 -0500 Merge branch 'pci/peer-to-peer' - Prevent drivers that use dma_virt_ops from using peer-to-peer DMA (Logan Gunthorpe) * pci/peer-to-peer: PCI/P2PDMA: Fix missing check for dma_virt_ops commit e09977285c1929867c9f251d28bda9aed78fe331 Merge: 8cf80c5c14b4 b516ea586d71 Author: Bjorn Helgaas Date: Fri Jul 12 17:08:26 2019 -0500 Merge branch 'pci/misc' - Generalize multi-function power dependency device links (Abhishek Sahu) - Add NVIDIA GPU multi-function power dependencies (Abhishek Sahu) - Optimize /proc/bus/pci/devices by using seq_puts() instead of seq_printf() (Markus Elfring) - Enable NVIDIA HDA controllers if BIOS didn't (Lukas Wunner) * pci/misc: PCI: Enable NVIDIA HDA controllers PCI: Use seq_puts() instead of seq_printf() in show_device() PCI: Add NVIDIA GPU multi-function power dependencies PCI: Generalize multi-function power dependency device links commit 8cf80c5c14b4914b0eb03d4bcafebd07180edfb9 Merge: b6a001c0cb2d dc6b698a86fe Author: Bjorn Helgaas Date: Fri Jul 12 17:08:24 2019 -0500 Merge branch 'pci/enumeration' - If user prevents VF probing, return error instead of pretending a driver has claimed the VF (Alex Williamson) - Always allow probing with driver_override (Alex Williamson) - Decode PCIe 32 GT/s link speed (Gustavo Pimentel) - Ignore lockdep for sysfs remove to avoid lockdep false positive (Marek Vasut) * pci/enumeration: PCI: sysfs: Ignore lockdep for remove attribute PCI: Decode PCIe 32 GT/s link speed PCI: Always allow probing with driver_override PCI: Return error if cannot probe VF commit b6a001c0cb2d29b77596a142aad5249044a6c119 Merge: a188339ca5a3 151f4e2bdc7a Author: Bjorn Helgaas Date: Fri Jul 12 17:08:23 2019 -0500 Merge branch 'pci/docs' - Convert docs to reST (Changbin Du) - Convert PM docs to reST (Mauro Carvalho Chehab) * pci/docs: docs: power: convert docs to ReST and rename to *.rst Documentation: PCI: convert endpoint/pci-test-howto.txt to reST Documentation: PCI: convert endpoint/pci-test-function.txt to reST Documentation: PCI: convert endpoint/pci-endpoint-cfs.txt to reST Documentation: PCI: convert endpoint/pci-endpoint.txt to reST Documentation: PCI: convert pcieaer-howto.txt to reST Documentation: PCI: convert pci-error-recovery.txt to reST Documentation: PCI: convert acpi-info.txt to reST Documentation: PCI: convert MSI-HOWTO.txt to reST Documentation: PCI: convert pci-iov-howto.txt to reST Documentation: PCI: convert PCIEBUS-HOWTO.txt to reST Documentation: PCI: convert pci.txt to reST Documentation: add Linux PCI to Sphinx TOC tree commit 9787aed57dd33ba5c15a713c2c50e78baeb5052d Author: Nathan Chancellor Date: Mon Jul 1 11:28:08 2019 -0700 coresight: Make the coresight_device_fwnode_match declaration's fwnode parameter const Fix Linus' merge error in the parent commit, causing: drivers/hwtracing/coresight/coresight.c:1051:11: error: incompatible pointer types passing 'int (struct device *, void *)' to parameter of type 'int (*)(struct device *, const void *)' [-Werror,-Wincompatible-pointer-types] coresight_device_fwnode_match); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/device.h:173:17: note: passing argument to parameter 'match' here int (*match)(struct device *dev, const void *data)); ^ due to missed header file fixup. Fixes: f632a8170a6b ("Merge tag 'driver-core-5.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core") Signed-off-by: Nathan Chancellor [ Greg even sent this patch with his pull request, but I stupidly thought it was the merge resolution fix I had already done as part of the merge. But no, this was the extra fix for the header file that goes with the definition I _had_ caught - Linus ] Signed-off-by: Linus Torvalds commit 224d5fd43d250f850d64fb6d668114aff29d7022 Author: Marcus Folkesson Date: Tue Jul 9 09:54:36 2019 +0200 docs: driver-api: generic-counter: fix file path to ABI doc Fixes: 09e7d4ed8991 ("docs: Add Generic Counter interface documentation") Signed-off-by: Marcus Folkesson Acked-by: William Breathitt Gray Signed-off-by: Jonathan Corbet commit db531db951f950b86d274cc8ed7b21b9e2240036 Author: Max Kellermann Date: Fri Jul 12 16:18:06 2019 +0200 Revert "NFS: readdirplus optimization by cache mechanism" (memleak) This reverts commit be4c2d4723a4a637f0d1b4f7c66447141a4b3564. That commit caused a severe memory leak in nfs_readdir_make_qstr(). When listing a directory with more than 100 files (this is how many struct nfs_cache_array_entry elements fit in one 4kB page), all allocated file name strings past those 100 leak. The root of the leakage is that those string pointers are managed in pages which are never linked into the page cache. fs/nfs/dir.c puts pages into the page cache by calling read_cache_page(); the callback function nfs_readdir_filler() will then fill the given page struct which was passed to it, which is already linked in the page cache (by do_read_cache_page() calling add_to_page_cache_lru()). Commit be4c2d4723a4 added another (local) array of allocated pages, to be filled with more data, instead of discarding excess items received from the NFS server. Those additional pages can be used by the next nfs_readdir_filler() call (from within the same nfs_readdir() call). The leak happens when some of those additional pages are never used (copied to the page cache using copy_highpage()). The pages will be freed by nfs_readdir_free_pages(), but their contents will not. The commit did not invoke nfs_readdir_clear_array() (and doing so would have been dangerous, because it did not track which of those pages were already copied to the page cache, risking double free bugs). How to reproduce the leak: - Use a kernel with CONFIG_SLUB_DEBUG_ON. - Create a directory on a NFS mount with more than 100 files with names long enough to use the "kmalloc-32" slab (so we can easily look up the allocation counts): for i in `seq 110`; do touch ${i}_0123456789abcdef; done - Drop all caches: echo 3 >/proc/sys/vm/drop_caches - Check the allocation counter: grep nfs_readdir /sys/kernel/slab/kmalloc-32/alloc_calls 30564391 nfs_readdir_add_to_array+0x73/0xd0 age=534558/4791307/6540952 pid=370-1048386 cpus=0-47 nodes=0-1 - Request a directory listing and check the allocation counters again: ls [...] grep nfs_readdir /sys/kernel/slab/kmalloc-32/alloc_calls 30564511 nfs_readdir_add_to_array+0x73/0xd0 age=207/4792999/6542663 pid=370-1048386 cpus=0-47 nodes=0-1 There are now 120 new allocations. - Drop all caches and check the counters again: echo 3 >/proc/sys/vm/drop_caches grep nfs_readdir /sys/kernel/slab/kmalloc-32/alloc_calls 30564401 nfs_readdir_add_to_array+0x73/0xd0 age=735/4793524/6543176 pid=370-1048386 cpus=0-47 nodes=0-1 110 allocations are gone, but 10 have leaked and will never be freed. Unhelpfully, those allocations are explicitly excluded from KMEMLEAK, that's why my initial attempts with KMEMLEAK were not successful: /* * Avoid a kmemleak false positive. The pointer to the name is stored * in a page cache page which kmemleak does not scan. */ kmemleak_not_leak(string->name); It would be possible to solve this bug without reverting the whole commit: - keep track of which pages were not used, and call nfs_readdir_clear_array() on them, or - manually link those pages into the page cache But for now I have decided to just revert the commit, because the real fix would require complex considerations, risking more dangerous (crash) bugs, which may seem unsuitable for the stable branches. Signed-off-by: Max Kellermann Cc: stable@vger.kernel.org # v5.1+ Signed-off-by: Trond Myklebust commit f632a8170a6b667ee4e3f552087588f0fe13c4bb Merge: ef8f3d48afd6 c33d442328f5 Author: Linus Torvalds Date: Fri Jul 12 12:24:03 2019 -0700 Merge tag 'driver-core-5.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core Pull driver core and debugfs updates from Greg KH: "Here is the "big" driver core and debugfs changes for 5.3-rc1 It's a lot of different patches, all across the tree due to some api changes and lots of debugfs cleanups. Other than the debugfs cleanups, in this set of changes we have: - bus iteration function cleanups - scripts/get_abi.pl tool to display and parse Documentation/ABI entries in a simple way - cleanups to Documenatation/ABI/ entries to make them parse easier due to typos and other minor things - default_attrs use for some ktype users - driver model documentation file conversions to .rst - compressed firmware file loading - deferred probe fixes All of these have been in linux-next for a while, with a bunch of merge issues that Stephen has been patient with me for" * tag 'driver-core-5.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core: (102 commits) debugfs: make error message a bit more verbose orangefs: fix build warning from debugfs cleanup patch ubifs: fix build warning after debugfs cleanup patch driver: core: Allow subsystems to continue deferring probe drivers: base: cacheinfo: Ensure cpu hotplug work is done before Intel RDT arch_topology: Remove error messages on out-of-memory conditions lib: notifier-error-inject: no need to check return value of debugfs_create functions swiotlb: no need to check return value of debugfs_create functions ceph: no need to check return value of debugfs_create functions sunrpc: no need to check return value of debugfs_create functions ubifs: no need to check return value of debugfs_create functions orangefs: no need to check return value of debugfs_create functions nfsd: no need to check return value of debugfs_create functions lib: 842: no need to check return value of debugfs_create functions debugfs: provide pr_fmt() macro debugfs: log errors when something goes wrong drivers: s390/cio: Fix compilation warning about const qualifiers drivers: Add generic helper to match by of_node driver_find_device: Unify the match function with class_find_device() bus_find_device: Unify the match callback with class_find_device ... commit ef8f3d48afd6a17a0dae8c277c2f539c2f19fd16 Merge: d7d170a8e357 2c207985f354 Author: Linus Torvalds Date: Fri Jul 12 11:40:28 2019 -0700 Merge branch 'akpm' (patches from Andrew) Merge updates from Andrew Morton: "Am experimenting with splitting MM up into identifiable subsystems perhaps with a view to gitifying it in complex ways. Also with more verbose "incoming" emails. Most of MM is here and a few other trees. Subsystems affected by this patch series: - hotfixes - iommu - scripts - arch/sh - ocfs2 - mm:slab-generic - mm:slub - mm:kmemleak - mm:kasan - mm:cleanups - mm:debug - mm:pagecache - mm:swap - mm:memcg - mm:gup - mm:pagemap - mm:infrastructure - mm:vmalloc - mm:initialization - mm:pagealloc - mm:vmscan - mm:tools - mm:proc - mm:ras - mm:oom-kill hotfixes: mm: vmscan: scan anonymous pages on file refaults mm/nvdimm: add is_ioremap_addr and use that to check ioremap address mm/memcontrol: fix wrong statistics in memory.stat mm/z3fold.c: lock z3fold page before __SetPageMovable() nilfs2: do not use unexported cpu_to_le32()/le32_to_cpu() in uapi header MAINTAINERS: nilfs2: update email address iommu: include/linux/dmar.h: replace single-char identifiers in macros scripts: scripts/decode_stacktrace: match basepath using shell prefix operator, not regex scripts/decode_stacktrace: look for modules with .ko.debug extension scripts/spelling.txt: drop "sepc" from the misspelling list scripts/spelling.txt: add spelling fix for prohibited scripts/decode_stacktrace: Accept dash/underscore in modules scripts/spelling.txt: add more spellings to spelling.txt arch/sh: arch/sh/configs/sdk7786_defconfig: remove CONFIG_LOGFS sh: config: remove left-over BACKLIGHT_LCD_SUPPORT sh: prevent warnings when using iounmap ocfs2: fs: ocfs: fix spelling mistake "hearbeating" -> "heartbeat" ocfs2/dlm: use struct_size() helper ocfs2: add last unlock times in locking_state ocfs2: add locking filter debugfs file ocfs2: add first lock wait time in locking_state ocfs: no need to check return value of debugfs_create functions fs/ocfs2/dlmglue.c: unneeded variable: "status" ocfs2: use kmemdup rather than duplicating its implementation mm:slab-generic: Patch series "mm/slab: Improved sanity checking": mm/slab: validate cache membership under freelist hardening mm/slab: sanity-check page type when looking up cache lkdtm/heap: add tests for freelist hardening mm:slub: mm/slub.c: avoid double string traverse in kmem_cache_flags() slub: don't panic for memcg kmem cache creation failure mm:kmemleak: mm/kmemleak.c: fix check for softirq context mm/kmemleak.c: change error at _write when kmemleak is disabled docs: kmemleak: add more documentation details mm:kasan: mm/kasan: print frame description for stack bugs Patch series "Bitops instrumentation for KASAN", v5: lib/test_kasan: add bitops tests x86: use static_cpu_has in uaccess region to avoid instrumentation asm-generic, x86: add bitops instrumentation for KASAN Patch series "mm/kasan: Add object validation in ksize()", v3: mm/kasan: introduce __kasan_check_{read,write} mm/kasan: change kasan_check_{read,write} to return boolean lib/test_kasan: Add test for double-kzfree detection mm/slab: refactor common ksize KASAN logic into slab_common.c mm/kasan: add object validation in ksize() mm:cleanups: include/linux/pfn_t.h: remove pfn_t_to_virt() Patch series "remove ARCH_SELECT_MEMORY_MODEL where it has no effect": arm: remove ARCH_SELECT_MEMORY_MODEL s390: remove ARCH_SELECT_MEMORY_MODEL sparc: remove ARCH_SELECT_MEMORY_MODEL mm/gup.c: make follow_page_mask() static mm/memory.c: trivial clean up in insert_page() mm: make !CONFIG_HUGE_PAGE wrappers into static inlines include/linux/mm_types.h: ifdef struct vm_area_struct::swap_readahead_info mm: remove the account_page_dirtied export mm/page_isolation.c: change the prototype of undo_isolate_page_range() include/linux/vmpressure.h: use spinlock_t instead of struct spinlock mm: remove the exporting of totalram_pages include/linux/pagemap.h: document trylock_page() return value mm:debug: mm/failslab.c: by default, do not fail allocations with direct reclaim only Patch series "debug_pagealloc improvements": mm, debug_pagelloc: use static keys to enable debugging mm, page_alloc: more extensive free page checking with debug_pagealloc mm, debug_pagealloc: use a page type instead of page_ext flag mm:pagecache: Patch series "fix filler_t callback type mismatches", v2: mm/filemap.c: fix an overly long line in read_cache_page mm/filemap: don't cast ->readpage to filler_t for do_read_cache_page jffs2: pass the correct prototype to read_cache_page 9p: pass the correct prototype to read_cache_page mm/filemap.c: correct the comment about VM_FAULT_RETRY mm:swap: mm, swap: fix race between swapoff and some swap operations mm/swap_state.c: simplify total_swapcache_pages() with get_swap_device() mm, swap: use rbtree for swap_extent mm/mincore.c: fix race between swapoff and mincore mm:memcg: memcg, oom: no oom-kill for __GFP_RETRY_MAYFAIL memcg, fsnotify: no oom-kill for remote memcg charging mm, memcg: introduce memory.events.local mm: memcontrol: dump memory.stat during cgroup OOM Patch series "mm: reparent slab memory on cgroup removal", v7: mm: memcg/slab: postpone kmem_cache memcg pointer initialization to memcg_link_cache() mm: memcg/slab: rename slab delayed deactivation functions and fields mm: memcg/slab: generalize postponed non-root kmem_cache deactivation mm: memcg/slab: introduce __memcg_kmem_uncharge_memcg() mm: memcg/slab: unify SLAB and SLUB page accounting mm: memcg/slab: don't check the dying flag on kmem_cache creation mm: memcg/slab: synchronize access to kmem_cache dying flag using a spinlock mm: memcg/slab: rework non-root kmem_cache lifecycle management mm: memcg/slab: stop setting page->mem_cgroup pointer for slab pages mm: memcg/slab: reparent memcg kmem_caches on cgroup removal mm, memcg: add a memcg_slabinfo debugfs file mm:gup: Patch series "switch the remaining architectures to use generic GUP", v4: mm: use untagged_addr() for get_user_pages_fast addresses mm: simplify gup_fast_permitted mm: lift the x86_32 PAE version of gup_get_pte to common code MIPS: use the generic get_user_pages_fast code sh: add the missing pud_page definition sh: use the generic get_user_pages_fast code sparc64: add the missing pgd_page definition sparc64: define untagged_addr() sparc64: use the generic get_user_pages_fast code mm: rename CONFIG_HAVE_GENERIC_GUP to CONFIG_HAVE_FAST_GUP mm: reorder code blocks in gup.c mm: consolidate the get_user_pages* implementations mm: validate get_user_pages_fast flags mm: move the powerpc hugepd code to mm/gup.c mm: switch gup_hugepte to use try_get_compound_head mm: mark the page referenced in gup_hugepte mm/gup: speed up check_and_migrate_cma_pages() on huge page mm/gup.c: remove some BUG_ONs from get_gate_page() mm/gup.c: mark undo_dev_pagemap as __maybe_unused mm:pagemap: asm-generic, x86: introduce generic pte_{alloc,free}_one[_kernel] alpha: switch to generic version of pte allocation arm: switch to generic version of pte allocation arm64: switch to generic version of pte allocation csky: switch to generic version of pte allocation m68k: sun3: switch to generic version of pte allocation mips: switch to generic version of pte allocation nds32: switch to generic version of pte allocation nios2: switch to generic version of pte allocation parisc: switch to generic version of pte allocation riscv: switch to generic version of pte allocation um: switch to generic version of pte allocation unicore32: switch to generic version of pte allocation mm/pgtable: drop pgtable_t variable from pte_fn_t functions mm/memory.c: fail when offset == num in first check of __vm_map_pages() mm:infrastructure: mm/mmu_notifier: use hlist_add_head_rcu() mm:vmalloc: Patch series "Some cleanups for the KVA/vmalloc", v5: mm/vmalloc.c: remove "node" argument mm/vmalloc.c: preload a CPU with one object for split purpose mm/vmalloc.c: get rid of one single unlink_va() when merge mm/vmalloc.c: switch to WARN_ON() and move it under unlink_va() mm/vmalloc.c: spelling> s/informaion/information/ mm:initialization: mm/large system hash: use vmalloc for size > MAX_ORDER when !hashdist mm/large system hash: clear hashdist when only one node with memory is booted mm:pagealloc: arm64: move jump_label_init() before parse_early_param() Patch series "add init_on_alloc/init_on_free boot options", v10: mm: security: introduce init_on_alloc=1 and init_on_free=1 boot options mm: init: report memory auto-initialization features at boot time mm:vmscan: mm: vmscan: remove double slab pressure by inc'ing sc->nr_scanned mm: vmscan: correct some vmscan counters for THP swapout mm:tools: tools/vm/slabinfo: order command line options tools/vm/slabinfo: add partial slab listing to -X tools/vm/slabinfo: add option to sort by partial slabs tools/vm/slabinfo: add sorting info to help menu mm:proc: proc: use down_read_killable mmap_sem for /proc/pid/maps proc: use down_read_killable mmap_sem for /proc/pid/smaps_rollup proc: use down_read_killable mmap_sem for /proc/pid/pagemap proc: use down_read_killable mmap_sem for /proc/pid/clear_refs proc: use down_read_killable mmap_sem for /proc/pid/map_files mm: use down_read_killable for locking mmap_sem in access_remote_vm mm: smaps: split PSS into components mm: vmalloc: show number of vmalloc pages in /proc/meminfo mm:ras: mm/memory-failure.c: clarify error message mm:oom-kill: mm: memcontrol: use CSS_TASK_ITER_PROCS at mem_cgroup_scan_tasks() mm, oom: refactor dump_tasks for memcg OOMs mm, oom: remove redundant task_in_mem_cgroup() check oom: decouple mems_allowed from oom_unkillable_task mm/oom_kill.c: remove redundant OOM score normalization in select_bad_process()" * akpm: (147 commits) mm/oom_kill.c: remove redundant OOM score normalization in select_bad_process() oom: decouple mems_allowed from oom_unkillable_task mm, oom: remove redundant task_in_mem_cgroup() check mm, oom: refactor dump_tasks for memcg OOMs mm: memcontrol: use CSS_TASK_ITER_PROCS at mem_cgroup_scan_tasks() mm/memory-failure.c: clarify error message mm: vmalloc: show number of vmalloc pages in /proc/meminfo mm: smaps: split PSS into components mm: use down_read_killable for locking mmap_sem in access_remote_vm proc: use down_read_killable mmap_sem for /proc/pid/map_files proc: use down_read_killable mmap_sem for /proc/pid/clear_refs proc: use down_read_killable mmap_sem for /proc/pid/pagemap proc: use down_read_killable mmap_sem for /proc/pid/smaps_rollup proc: use down_read_killable mmap_sem for /proc/pid/maps tools/vm/slabinfo: add sorting info to help menu tools/vm/slabinfo: add option to sort by partial slabs tools/vm/slabinfo: add partial slab listing to -X tools/vm/slabinfo: order command line options mm: vmscan: correct some vmscan counters for THP swapout mm: vmscan: remove double slab pressure by inc'ing sc->nr_scanned ... commit 9db7e618fca34d0a7d61c149d726fd90644ecb1e Author: Nathan Chancellor Date: Tue Jul 9 23:06:15 2019 -0700 net/mlx5e: Convert single case statement switch statements into if statements During the review of commit 1ff2f0fa450e ("net/mlx5e: Return in default case statement in tx_post_resync_params"), Leon and Nick pointed out that the switch statements can be converted to single if statements that return early so that the code is easier to follow. Suggested-by: Leon Romanovsky Suggested-by: Nick Desaulniers Signed-off-by: Nathan Chancellor Reviewed-by: Leon Romanovsky Signed-off-by: David S. Miller commit b1511f7a48c3ab28ae10b7ea1e9eae1481525bbe Merge: 47c9e0cef014 1c099779c1e2 3044a860fd09 f9d3fb22ab27 55692cedf3af Author: Stephen Boyd Date: Fri Jul 12 11:11:51 2019 -0700 Merge branches 'clk-bcm63xx', 'clk-silabs', 'clk-lochnagar' and 'clk-rockchip' into clk-next - Support gated clk controller on MIPS based BCM63XX SoCs - Small frequency support for SiLabs Si544 chips - Support SiLabs Si5341 and Si5340 chips * clk-bcm63xx: clk: add BCM63XX gated clock controller driver devicetree: document the BCM63XX gated clock bindings * clk-silabs: clk: Add Si5341/Si5340 driver dt-bindings: clock: Add silabs,si5341 clk: clk-si544: Implement small frequency change support * clk-lochnagar: clk: lochnagar: Update DT binding doc to include the primary SPDIF MCLK clk: lochnagar: Use new parent_data approach to register clock parents * clk-rockchip: clk: rockchip: export HDMIPHY clock on rk3228 clk: rockchip: add watchdog pclk on rk3328 clk: rockchip: add clock id for hdmi_phy special clock on rk3228 clk: rockchip: add clock id for watchdog pclk on rk3328 clk: rockchip: convert pclk_wdt boilerplat to new SGRF_GATE macro clk: rockchip: add a type from SGRF-controlled gate clocks clk: rockchip: Remove 48 MHz PLL rate from rk3288 clk: rockchip: add 1.464GHz cpu-clock rate to rk3228 clk: rockchip: Slightly more accurate math in rockchip_mmc_get_phase() clk: rockchip: Don't yell about bad mmc phases when getting clk: rockchip: Use clk_hw_get_rate() in MMC phase calculation commit 47c9e0cef01494aa512e924b100160206295f45e Merge: a993be3724d0 e2bb18347c8e e3527dca15c8 1df379924304 c974c48deeb9 ecbcc2aa6557 Author: Stephen Boyd Date: Fri Jul 12 11:11:30 2019 -0700 Merge branches 'clk-rpi-cpufreq', 'clk-tegra', 'clk-simplify-provider.h', 'clk-sprd' and 'clk-at91' into clk-next - Support for CPU clks on Raspberry Pi devices - Slow clk support for AT91 SAM9X60 SoCs * clk-rpi-cpufreq: clk: raspberrypi: register platform device for raspberrypi-cpufreq firmware: raspberrypi: register clk device clk: bcm283x: add driver interfacing with Raspberry Pi's firmware clk: bcm2835: remove pllb * clk-tegra: clk: tegra: Do not enable PLL_RE_VCO on Tegra210 clk: tegra: Warn if an enabled PLL is in IDDQ clk: tegra: Do not warn unnecessarily clk: tegra210: fix PLLU and PLLU_OUT1 * clk-simplify-provider.h: clk: consoldiate the __clk_get_hw() declarations clk: Unexport __clk_of_table clk: Remove ifdef for COMMON_CLK in clk-provider.h * clk-sprd: clk: sprd: Add check for return value of sprd_clk_regmap_init() clk: sprd: Check error only for devm_regmap_init_mmio() clk: sprd: Switch from of_iomap() to devm_ioremap_resource() * clk-at91: clk: at91: sckc: use dedicated functions to unregister clock clk: at91: sckc: improve error path for sama5d4 sck registration clk: at91: sckc: remove unnecessary line clk: at91: sckc: improve error path for sam9x5 sck register clk: at91: sckc: add support to free slow clock osclillator clk: at91: sckc: add support to free slow rc oscillator clk: at91: sckc: add support to free slow oscillator clk: at91: sckc: add support for SAM9X60 dt-bindings: clk: at91: add bindings for SAM9X60's slow clock controller clk: at91: sckc: add support to specify registers bit offsets clk: at91: sckc: sama5d4 has no bypass support commit a993be3724d0eb25a905db2eefc77fab4c355f53 Merge: dfe1d3a2830d e5e89247a74b da642427bd77 df095f996b8f 78a5ba8f9126 Author: Stephen Boyd Date: Fri Jul 12 11:11:16 2019 -0700 Merge branches 'clk-debugfs', 'clk-unused', 'clk-refactor' and 'clk-qoriq' into clk-next - Add a 'clk_parent' file in clk debugfs - Remove dead code in various clk drivers * clk-debugfs: clk: Add clk_parent entry in debugfs * clk-unused: clk: qcom: Fix -Wunused-const-variable clk: mmp: frac: Remove set but not used variable 'prev_rate' clk: ti: Remove unused functions clk: mediatek: mt8516: Remove unused variable * clk-refactor: clk: clk-cdce706: simplify getting the adapter of a client clk: Simplify clk_core_can_round() * clk-qoriq: clk: qoriq: add support for lx2160a commit dfe1d3a2830d607bbd66bae8bb86ae7ffde04f38 Merge: e02cb1f59340 179175d389c7 88aa7af9c180 16e3c572cdc9 65e2218d1006 Author: Stephen Boyd Date: Fri Jul 12 11:11:06 2019 -0700 Merge branches 'clk-bulk-optional', 'clk-kirkwood', 'clk-socfpga' and 'clk-docs' into clk-next - Add a clk_bulk_get_optional() API (with devm too) - Support for Marvell 98DX1135 SoCs * clk-bulk-optional: clk: Document some devm_clk_bulk*() APIs clk: Add devm_clk_bulk_get_optional() function clk: Add clk_bulk_get_optional() function * clk-kirkwood: clk: kirkwood: Add support for MV98DX1135 dt-bindings: clock: mvebu: Add compatible string for 98dx1135 core clock * clk-socfpga: clk: socfpga: stratix10: fix divider entry for the emac clocks clk: socfpga: stratix10: add additional clocks needed for the NAND IP * clk-docs: clk: Grammar missing "and", Spelling s/statisfied/satisfied/ commit e02cb1f5934053acfa72b7def8bef9b20e7ab818 Merge: 1f5d580cabc6 0b88bc929251 c0bc660c9068 76b77f1dbb16 11f6c2307cae Author: Stephen Boyd Date: Fri Jul 12 11:10:59 2019 -0700 Merge branches 'clk-ti', 'clk-samsung', 'clk-imx' and 'clk-allwinner' into clk-next * clk-ti: clk: ti: Use int to check return value from of_property_count_elems_of_size() firmware: ti_sci: extend clock identifiers from u8 to u32 clk: keystone: sci-clk: extend clock IDs to 32 bits clk: keystone: sci-clk: probe clocks from DT instead of firmware clk: keystone: sci-clk: split out the fw clock parsing to own function clk: keystone: sci-clk: cut down the clock name length * clk-samsung: clk: samsung: Add bus clock for GPU/G3D on Exynos4412 clk: samsung: add new clocks for DMC for Exynos5422 SoC clk: samsung: add BPLL rate table for Exynos 5422 SoC clk: samsung: add needed IDs for DMC clocks in Exynos5420 clk: samsung: exynos5433: Use of_clk_get_parent_count() * clk-imx: (38 commits) clk: imx8mq: Keep uart clocks on during system boot clk: imx: Remove __init for imx_register_uart_clocks() API clk: imx6q: fix section mismatch warning clk: imx8mq: Use devm_platform_ioremap_resource() instead of of_iomap() clk: imx8mq: Use imx_check_clocks() API directly clk: imx: Remove __init for imx_check_clocks() API clk: imx6sll: Switch to clk_hw based API clk: imx7d: Switch to clk_hw based API clk: imx6ul: Switch to clk_hw based API clk: imx6sx: Switch to clk_hw based API clk: imx6q: Switch to clk_hw based API clk: imx6sl: Switch to clk_hw based API clk: imx: Switch wrappers to clk_hw based API clk: imx: clk-fixup-mux: Switch to clk_hw based API clk: imx: clk-fixup-div: Switch to clk_hw based API clk: imx: clk-gate-exclusive: Switch to clk_hw based API clk: imx: clk-pfd: Switch to clk_hw based API clk: imx: clk-pllv3: Switch to clk_hw based API clk: imx: clk-gate2: Switch to clk_hw based API clk: imx: clk-cpu: Switch to clk_hw based API ... * clk-allwinner: (29 commits) clk: Simplify debugfs printing and add a newline clk: sunxi-ng: sun8i-r: Use local parent references for SUNXI_CCU_GATE clk: sunxi-ng: a80-usb: Use local parent references for SUNXI_CCU_GATE clk: sunxi-ng: gate: Add macros for referencing local clock parents clk: sunxi-ng: h6-r: Use local parent references for CLK_FIXED_FACTOR clk: sunxi-ng: h6: Use local parent references for CLK_FIXED_FACTOR clk: sunxi-ng: a64: Use local parent references for CLK_FIXED_FACTOR clk: sunxi-ng: f1c100s: Use local parent references for CLK_FIXED_FACTOR clk: sunxi-ng: sun8i-r: Use local parent references for CLK_FIXED_FACTOR clk: sunxi-ng: v3s: Use local parent references for CLK_FIXED_FACTOR clk: sunxi-ng: r40: Use local parent references for CLK_FIXED_FACTOR clk: sunxi-ng: h3: Use local parent references for CLK_FIXED_FACTOR clk: sunxi-ng: a33: Use local parent references for CLK_FIXED_FACTOR clk: sunxi-ng: a23: Use local parent references for CLK_FIXED_FACTOR clk: sunxi-ng: a31: Use local parent references for CLK_FIXED_FACTOR clk: sunxi-ng: sun5i: Use local parent references for CLK_FIXED_FACTOR clk: sunxi-ng: a10: Use local parent references for CLK_FIXED_FACTOR clk: sunxi-ng: sun8i-r: Use local parent references for CLK_HW_INIT_* clk: sunxi-ng: switch to of_clk_hw_register() for registering clks clk: fixed-factor: Add CLK_FIXED_FACTOR_FW_NAME for DT clock-names parent ... commit 1f5d580cabc6bdc595116f4ca16cfb226f2b8b5c Merge: b6bb2bc2fd15 f02fba3aa8fe 4abf9adc12c6 e5bbbff5b7d7 ce9a1046434c afa88bdbf193 Author: Stephen Boyd Date: Fri Jul 12 11:10:52 2019 -0700 Merge branches 'clk-qcom-gdsc-warn', 'clk-ingenic', 'clk-qcom-qcs404-reset', 'clk-xgene-limit' and 'clk-meson' into clk-next * clk-qcom-gdsc-warn: clk: qcom: gdsc: WARN when failing to toggle * clk-ingenic: MIPS: Remove dead code clk: ingenic: Remove unused functions MIPS: jz4740: PM: Let CGU driver suspend clocks and set sleep mode clk: ingenic: Handle setting the Low-Power Mode bit clk: ingenic: Add missing header in cgu.h clk: ingenic/jz4725b: Fix "pll half" divider not read/written properly clk: ingenic/jz4725b: Fix incorrect dividers for main clocks clk: ingenic/jz4770: Fix incorrect dividers for main clocks clk: ingenic/jz4740: Fix incorrect dividers for main clocks clk: ingenic: Add support for divider tables * clk-qcom-qcs404-reset: clk: gcc-qcs404: Add PCIe resets * clk-xgene-limit: clk: xgene: Don't build COMMON_CLK_XGENE by default * clk-meson: clk: meson: g12a: mark fclk_div3 as critical clk: meson: g12a: Add support for G12B CPUB clocks dt-bindings: clk: meson: add g12b periph clock controller bindings clk: meson-g12a: add temperature sensor clocks dt-bindings: clk: g12a-clkc: add Temperature Sensor clock IDs clk: meson: meson8b: add the cts_i958 clock clk: meson: meson8b: add the cts_mclk_i958 clocks clk: meson: meson8b: add the cts_amclk clocks dt-bindings: clock: meson8b: add the audio clocks clk: meson: g12a: add controller register init clk: meson: eeclk: add init regs clk: meson: g12a: add mpll register init sequences clk: meson: mpll: add init callback and regs clk: meson: axg: spread spectrum is on mpll2 clk: meson: gxbb: no spread spectrum on mpll0 clk: meson: mpll: properly handle spread spectrum clk: meson: meson8b: fix a typo in the VPU parent names array variable clk: meson: fix MPLL 50M binding id typo commit b6bb2bc2fd15fefabc7c82d3542e6537a5d9e7db Merge: 4c34282fb7d7 789bc177f828 860690a93ef2 072a551fd5cf 5b68f22c3e13 Author: Stephen Boyd Date: Fri Jul 12 11:10:43 2019 -0700 Merge branches 'clk-pwm-duty', 'clk-bcm', 'clk-mtk', 'clk-qcom-msm8998-gpu' and 'clk-renesas' into clk-next - Add support to get duty cycle of generic pwm clks * clk-pwm-duty: clk: pwm: implement the .get_duty_cycle callback * clk-bcm: clk: bcm: Allow CLK_BCM2835 for ARCH_BRCMSTB clk: bcm: Make BCM2835 clock drivers selectable * clk-mtk: clk: mediatek: Remove MT8183 unused clock clk: mediatek: add audsys clock driver for MT8516 dt-bindings: mediatek: audsys: add support for MT8516 * clk-qcom-msm8998-gpu: dt-bindings: clock: Document gpucc for msm8998 * clk-renesas: clk: renesas: cpg-mssr: Use [] to denote a flexible array member clk: renesas: cpg-mssr: Combine driver-private and clock array allocation clk: renesas: mstp: Combine group-private and clock array allocation clk: renesas: div6: Combine clock-private and parent array allocation clk: renesas: cpg-mssr: Update kerneldoc for struct cpg_mssr_priv clk: renesas: r8a774a1: Add TMU clock clk: renesas: r8a77995: Add CMM clocks clk: renesas: r8a77990: Add CMM clocks clk: renesas: r8a77965: Add CMM clocks clk: renesas: r8a7795: Add CMM clocks clk: renesas: r9a06g032: Add clock domain support dt-bindings: clock: renesas: r9a06g032-sysctrl: Document power Domains clk: renesas: mstp: Remove error messages on out-of-memory conditions clk: renesas: cpg-mssr: Remove error messages on out-of-memory conditions clk: renesas: cpg-mssr: Use genpd of_node instead of local copy clk: renesas: r8a7796: Add CMM clocks clk: renesas: r8a779{5|6|65}: Add TPU clock commit 55692cedf3af29039381e3dbf1b598ab21709d1e Merge: a188339ca5a3 794e94ca8345 Author: Stephen Boyd Date: Fri Jul 12 11:07:23 2019 -0700 Merge tag 'v5.3-rockchip-clk1' of git://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip into clk-rockchip Pull Rockchip clk driver updates from Heiko Stuebner: - New clock-ids+exports for two clocks - Cleanup for some boilerplate code for clocks we cannot really control from the kernel, but want to define separately to match the hardware-description (watchdog in secure-grf) - Improvement in mmc phase calculation and cleanup of some rate defintions * tag 'v5.3-rockchip-clk1' of git://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip: clk: rockchip: export HDMIPHY clock on rk3228 clk: rockchip: add watchdog pclk on rk3328 clk: rockchip: add clock id for hdmi_phy special clock on rk3228 clk: rockchip: add clock id for watchdog pclk on rk3328 clk: rockchip: convert pclk_wdt boilerplat to new SGRF_GATE macro clk: rockchip: add a type from SGRF-controlled gate clocks clk: rockchip: Remove 48 MHz PLL rate from rk3288 clk: rockchip: add 1.464GHz cpu-clock rate to rk3228 clk: rockchip: Slightly more accurate math in rockchip_mmc_get_phase() clk: rockchip: Don't yell about bad mmc phases when getting clk: rockchip: Use clk_hw_get_rate() in MMC phase calculation commit 2c207985f354dfb549e5a543102a3e084eea81f6 Author: Tetsuo Handa Date: Thu Jul 11 21:00:34 2019 -0700 mm/oom_kill.c: remove redundant OOM score normalization in select_bad_process() Since commit bbbe48029720 ("mm, oom: remove 'prefer children over parent' heuristic") removed the "%s: Kill process %d (%s) score %u or sacrifice child\n" line, oc->chosen_points is no longer used after select_bad_process(). Link: http://lkml.kernel.org/r/1560853435-15575-1-git-send-email-penguin-kernel@I-love.SAKURA.ne.jp Signed-off-by: Tetsuo Handa Acked-by: Michal Hocko Cc: Shakeel Butt Cc: Roman Gushchin Cc: Johannes Weiner Cc: David Rientjes Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit ac311a14c682dcd8a120a6244d0542ec654e3d93 Author: Shakeel Butt Date: Thu Jul 11 21:00:31 2019 -0700 oom: decouple mems_allowed from oom_unkillable_task Commit ef08e3b4981a ("[PATCH] cpusets: confine oom_killer to mem_exclusive cpuset") introduces a heuristic where a potential oom-killer victim is skipped if the intersection of the potential victim and the current (the process triggered the oom) is empty based on the reason that killing such victim most probably will not help the current allocating process. However the commit 7887a3da753e ("[PATCH] oom: cpuset hint") changed the heuristic to just decrease the oom_badness scores of such potential victim based on the reason that the cpuset of such processes might have changed and previously they may have allocated memory on mems where the current allocating process can allocate from. Unintentionally 7887a3da753e ("[PATCH] oom: cpuset hint") introduced a side effect as the oom_badness is also exposed to the user space through /proc/[pid]/oom_score, so, readers with different cpusets can read different oom_score of the same process. Later, commit 6cf86ac6f36b ("oom: filter tasks not sharing the same cpuset") fixed the side effect introduced by 7887a3da753e by moving the cpuset intersection back to only oom-killer context and out of oom_badness. However the combination of ab290adbaf8f ("oom: make oom_unkillable_task() helper function") and 26ebc984913b ("oom: /proc//oom_score treat kernel thread honestly") unintentionally brought back the cpuset intersection check into the oom_badness calculation function. Other than doing cpuset/mempolicy intersection from oom_badness, the memcg oom context is also doing cpuset/mempolicy intersection which is quite wrong and is caught by syzcaller with the following report: kasan: CONFIG_KASAN_INLINE enabled kasan: GPF could be caused by NULL-ptr deref or user memory access general protection fault: 0000 [#1] PREEMPT SMP KASAN CPU: 0 PID: 28426 Comm: syz-executor.5 Not tainted 5.2.0-rc3-next-20190607 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:__read_once_size include/linux/compiler.h:194 [inline] RIP: 0010:has_intersects_mems_allowed mm/oom_kill.c:84 [inline] RIP: 0010:oom_unkillable_task mm/oom_kill.c:168 [inline] RIP: 0010:oom_unkillable_task+0x180/0x400 mm/oom_kill.c:155 Code: c1 ea 03 80 3c 02 00 0f 85 80 02 00 00 4c 8b a3 10 07 00 00 48 b8 00 00 00 00 00 fc ff df 4d 8d 74 24 10 4c 89 f2 48 c1 ea 03 <80> 3c 02 00 0f 85 67 02 00 00 49 8b 44 24 10 4c 8d a0 68 fa ff ff RSP: 0018:ffff888000127490 EFLAGS: 00010a03 RAX: dffffc0000000000 RBX: ffff8880a4cd5438 RCX: ffffffff818dae9c RDX: 100000000c3cc602 RSI: ffffffff818dac8d RDI: 0000000000000001 RBP: ffff8880001274d0 R08: ffff888000086180 R09: ffffed1015d26be0 R10: ffffed1015d26bdf R11: ffff8880ae935efb R12: 8000000061e63007 R13: 0000000000000000 R14: 8000000061e63017 R15: 1ffff11000024ea6 FS: 00005555561f5940(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000607304 CR3: 000000009237e000 CR4: 00000000001426f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600 Call Trace: oom_evaluate_task+0x49/0x520 mm/oom_kill.c:321 mem_cgroup_scan_tasks+0xcc/0x180 mm/memcontrol.c:1169 select_bad_process mm/oom_kill.c:374 [inline] out_of_memory mm/oom_kill.c:1088 [inline] out_of_memory+0x6b2/0x1280 mm/oom_kill.c:1035 mem_cgroup_out_of_memory+0x1ca/0x230 mm/memcontrol.c:1573 mem_cgroup_oom mm/memcontrol.c:1905 [inline] try_charge+0xfbe/0x1480 mm/memcontrol.c:2468 mem_cgroup_try_charge+0x24d/0x5e0 mm/memcontrol.c:6073 mem_cgroup_try_charge_delay+0x1f/0xa0 mm/memcontrol.c:6088 do_huge_pmd_wp_page_fallback+0x24f/0x1680 mm/huge_memory.c:1201 do_huge_pmd_wp_page+0x7fc/0x2160 mm/huge_memory.c:1359 wp_huge_pmd mm/memory.c:3793 [inline] __handle_mm_fault+0x164c/0x3eb0 mm/memory.c:4006 handle_mm_fault+0x3b7/0xa90 mm/memory.c:4053 do_user_addr_fault arch/x86/mm/fault.c:1455 [inline] __do_page_fault+0x5ef/0xda0 arch/x86/mm/fault.c:1521 do_page_fault+0x71/0x57d arch/x86/mm/fault.c:1552 page_fault+0x1e/0x30 arch/x86/entry/entry_64.S:1156 RIP: 0033:0x400590 Code: 06 e9 49 01 00 00 48 8b 44 24 10 48 0b 44 24 28 75 1f 48 8b 14 24 48 8b 7c 24 20 be 04 00 00 00 e8 f5 56 00 00 48 8b 74 24 08 <89> 06 e9 1e 01 00 00 48 8b 44 24 08 48 8b 14 24 be 04 00 00 00 8b RSP: 002b:00007fff7bc49780 EFLAGS: 00010206 RAX: 0000000000000001 RBX: 0000000000760000 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 000000002000cffc RDI: 0000000000000001 RBP: fffffffffffffffe R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000075 R11: 0000000000000246 R12: 0000000000760008 R13: 00000000004c55f2 R14: 0000000000000000 R15: 00007fff7bc499b0 Modules linked in: ---[ end trace a65689219582ffff ]--- RIP: 0010:__read_once_size include/linux/compiler.h:194 [inline] RIP: 0010:has_intersects_mems_allowed mm/oom_kill.c:84 [inline] RIP: 0010:oom_unkillable_task mm/oom_kill.c:168 [inline] RIP: 0010:oom_unkillable_task+0x180/0x400 mm/oom_kill.c:155 Code: c1 ea 03 80 3c 02 00 0f 85 80 02 00 00 4c 8b a3 10 07 00 00 48 b8 00 00 00 00 00 fc ff df 4d 8d 74 24 10 4c 89 f2 48 c1 ea 03 <80> 3c 02 00 0f 85 67 02 00 00 49 8b 44 24 10 4c 8d a0 68 fa ff ff RSP: 0018:ffff888000127490 EFLAGS: 00010a03 RAX: dffffc0000000000 RBX: ffff8880a4cd5438 RCX: ffffffff818dae9c RDX: 100000000c3cc602 RSI: ffffffff818dac8d RDI: 0000000000000001 RBP: ffff8880001274d0 R08: ffff888000086180 R09: ffffed1015d26be0 R10: ffffed1015d26bdf R11: ffff8880ae935efb R12: 8000000061e63007 R13: 0000000000000000 R14: 8000000061e63017 R15: 1ffff11000024ea6 FS: 00005555561f5940(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000001b2f823000 CR3: 000000009237e000 CR4: 00000000001426f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600 The fix is to decouple the cpuset/mempolicy intersection check from oom_unkillable_task() and make sure cpuset/mempolicy intersection check is only done in the global oom context. [shakeelb@google.com: change function name and update comment] Link: http://lkml.kernel.org/r/20190628152421.198994-3-shakeelb@google.com Link: http://lkml.kernel.org/r/20190624212631.87212-3-shakeelb@google.com Signed-off-by: Shakeel Butt Reported-by: syzbot+d0fc9d3c166bc5e4a94b@syzkaller.appspotmail.com Acked-by: Roman Gushchin Acked-by: Michal Hocko Cc: David Rientjes Cc: Johannes Weiner Cc: KOSAKI Motohiro Cc: Nick Piggin Cc: Paul Jackson Cc: Tetsuo Handa Cc: Vladimir Davydov Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 6ba749ee78ef42ffdf4b95c042fc574a37d229d9 Author: Shakeel Butt Date: Thu Jul 11 21:00:26 2019 -0700 mm, oom: remove redundant task_in_mem_cgroup() check oom_unkillable_task() can be called from three different contexts i.e. global OOM, memcg OOM and oom_score procfs interface. At the moment oom_unkillable_task() does a task_in_mem_cgroup() check on the given process. Since there is no reason to perform task_in_mem_cgroup() check for global OOM and oom_score procfs interface, those contexts provide NULL memcg and skips the task_in_mem_cgroup() check. However for memcg OOM context, the oom_unkillable_task() is always called from mem_cgroup_scan_tasks() and thus task_in_mem_cgroup() check becomes redundant and effectively dead code. So, just remove the task_in_mem_cgroup() check altogether. Link: http://lkml.kernel.org/r/20190624212631.87212-2-shakeelb@google.com Signed-off-by: Shakeel Butt Signed-off-by: Tetsuo Handa Acked-by: Roman Gushchin Acked-by: Michal Hocko Cc: David Rientjes Cc: Johannes Weiner Cc: KOSAKI Motohiro Cc: Nick Piggin Cc: Paul Jackson Cc: Vladimir Davydov Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 5eee7e1cdb97123bb55ac14ccd3af8b6edc31537 Author: Shakeel Butt Date: Thu Jul 11 21:00:23 2019 -0700 mm, oom: refactor dump_tasks for memcg OOMs dump_tasks() traverses all the existing processes even for the memcg OOM context which is not only unnecessary but also wasteful. This imposes a long RCU critical section even from a contained context which can be quite disruptive. Change dump_tasks() to be aligned with select_bad_process and use mem_cgroup_scan_tasks to selectively traverse only processes of the target memcg hierarchy during memcg OOM. Link: http://lkml.kernel.org/r/20190617231207.160865-1-shakeelb@google.com Signed-off-by: Shakeel Butt Acked-by: Michal Hocko Acked-by: Roman Gushchin Cc: Johannes Weiner Cc: Tetsuo Handa Cc: Vladimir Davydov Cc: David Rientjes Cc: KOSAKI Motohiro Cc: Paul Jackson Cc: Nick Piggin Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit f168a9a54ec39b3f832c353733898b713b6b5c1f Author: Tetsuo Handa Date: Thu Jul 11 21:00:20 2019 -0700 mm: memcontrol: use CSS_TASK_ITER_PROCS at mem_cgroup_scan_tasks() Since commit c03cd7738a83 ("cgroup: Include dying leaders with live threads in PROCS iterations") corrected how CSS_TASK_ITER_PROCS works, mem_cgroup_scan_tasks() can use CSS_TASK_ITER_PROCS in order to check only one thread from each thread group. [penguin-kernel@I-love.SAKURA.ne.jp: remove thread group leader check in oom_evaluate_task()] Link: http://lkml.kernel.org/r/1560853257-14934-1-git-send-email-penguin-kernel@I-love.SAKURA.ne.jp Link: http://lkml.kernel.org/r/c763afc8-f0ae-756a-56a7-395f625b95fc@i-love.sakura.ne.jp Signed-off-by: Tetsuo Handa Acked-by: Michal Hocko Reviewed-by: Shakeel Butt Cc: Johannes Weiner Cc: Tejun Heo Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 135e53514ef2cb200b616bf3fa4272cfa6c39291 Author: Jane Chu Date: Thu Jul 11 21:00:17 2019 -0700 mm/memory-failure.c: clarify error message Some user who install SIGBUS handler that does longjmp out therefore keeping the process alive is confused by the error message "[188988.765862] Memory failure: 0x1840200: Killing cellsrv:33395 due to hardware memory corruption" Slightly modify the error message to improve clarity. Link: http://lkml.kernel.org/r/1558403523-22079-1-git-send-email-jane.chu@oracle.com Signed-off-by: Jane Chu Acked-by: Naoya Horiguchi Acked-by: Pankaj Gupta Reviewed-by: Anshuman Khandual Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 97105f0ab7b877a8ece2005e214894e93793950c Author: Roman Gushchin Date: Thu Jul 11 21:00:13 2019 -0700 mm: vmalloc: show number of vmalloc pages in /proc/meminfo Vmalloc() is getting more and more used these days (kernel stacks, bpf and percpu allocator are new top users), and the total % of memory consumed by vmalloc() can be pretty significant and changes dynamically. /proc/meminfo is the best place to display this information: its top goal is to show top consumers of the memory. Since the VmallocUsed field in /proc/meminfo is not in use for quite a long time (it has been defined to 0 by a5ad88ce8c7f ("mm: get rid of 'vmalloc_info' from /proc/meminfo")), let's reuse it for showing the actual physical memory consumption of vmalloc(). Link: http://lkml.kernel.org/r/20190417194002.12369-3-guro@fb.com Signed-off-by: Roman Gushchin Acked-by: Johannes Weiner Acked-by: Vlastimil Babka Reviewed-by: Andrew Morton Cc: Matthew Wilcox Cc: Minchan Kim Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit ee2ad71b0756e995fa4f6d922463e9bccd71b198 Author: Luigi Semenzato Date: Thu Jul 11 21:00:10 2019 -0700 mm: smaps: split PSS into components Report separate components (anon, file, and shmem) for PSS in smaps_rollup. This helps understand and tune the memory manager behavior in consumer devices, particularly mobile devices. Many of them (e.g. chromebooks and Android-based devices) use zram for anon memory, and perform disk reads for discarded file pages. The difference in latency is large (e.g. reading a single page from SSD is 30 times slower than decompressing a zram page on one popular device), thus it is useful to know how much of the PSS is anon vs. file. All the information is already present in /proc/pid/smaps, but much more expensive to obtain because of the large size of that procfs entry. This patch also removes a small code duplication in smaps_account, which would have gotten worse otherwise. Also updated Documentation/filesystems/proc.txt (the smaps section was a bit stale, and I added a smaps_rollup section) and Documentation/ABI/testing/procfs-smaps_rollup. [semenzato@chromium.org: v5] Link: http://lkml.kernel.org/r/20190626234333.44608-1-semenzato@chromium.org Link: http://lkml.kernel.org/r/20190626180429.174569-1-semenzato@chromium.org Signed-off-by: Luigi Semenzato Acked-by: Yu Zhao Cc: Sonny Rao Cc: Yu Zhao Cc: Brian Geffon Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 1e426fe28261b03f297992e89da3320b42816f4e Author: Konstantin Khlebnikov Date: Thu Jul 11 21:00:07 2019 -0700 mm: use down_read_killable for locking mmap_sem in access_remote_vm This function is used by ptrace and proc files like /proc/pid/cmdline and /proc/pid/environ. Access_remote_vm never returns error codes, all errors are ignored and only size of successfully read data is returned. So, if current task was killed we'll simply return 0 (bytes read). Mmap_sem could be locked for a long time or forever if something goes wrong. Using a killable lock permits cleanup of stuck tasks and simplifies investigation. Link: http://lkml.kernel.org/r/156007494202.3335.16782303099589302087.stgit@buzz Signed-off-by: Konstantin Khlebnikov Reviewed-by: Michal Koutný Acked-by: Oleg Nesterov Acked-by: Michal Hocko Cc: Alexey Dobriyan Cc: Matthew Wilcox Cc: Cyrill Gorcunov Cc: Kirill Tkhai Cc: Al Viro Cc: Roman Gushchin Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit cd9e2bb8271c971d9f37c722be2616c7f8ba0664 Author: Konstantin Khlebnikov Date: Thu Jul 11 21:00:03 2019 -0700 proc: use down_read_killable mmap_sem for /proc/pid/map_files Do not remain stuck forever if something goes wrong. Using a killable lock permits cleanup of stuck tasks and simplifies investigation. It seems ->d_revalidate() could return any error (except ECHILD) to abort validation and pass error as result of lookup sequence. [akpm@linux-foundation.org: fix proc_map_files_lookup() return value, per Andrei] Link: http://lkml.kernel.org/r/156007493995.3335.9595044802115356911.stgit@buzz Signed-off-by: Konstantin Khlebnikov Reviewed-by: Roman Gushchin Reviewed-by: Cyrill Gorcunov Reviewed-by: Kirill Tkhai Acked-by: Michal Hocko Cc: Alexey Dobriyan Cc: Al Viro Cc: Matthew Wilcox Cc: Michal Koutný Cc: Oleg Nesterov Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit c46038017fbdcac627b670c9d4176f1d0c2f5fa3 Author: Konstantin Khlebnikov Date: Thu Jul 11 21:00:00 2019 -0700 proc: use down_read_killable mmap_sem for /proc/pid/clear_refs Do not remain stuck forever if something goes wrong. Using a killable lock permits cleanup of stuck tasks and simplifies investigation. Replace the only unkillable mmap_sem lock in clear_refs_write(). Link: http://lkml.kernel.org/r/156007493826.3335.5424884725467456239.stgit@buzz Signed-off-by: Konstantin Khlebnikov Reviewed-by: Roman Gushchin Reviewed-by: Cyrill Gorcunov Reviewed-by: Kirill Tkhai Acked-by: Michal Hocko Cc: Alexey Dobriyan Cc: Al Viro Cc: Matthew Wilcox Cc: Michal Koutný Cc: Oleg Nesterov Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit ad80b932c57d85fd6377f97f359b025baf179a87 Author: Konstantin Khlebnikov Date: Thu Jul 11 20:59:56 2019 -0700 proc: use down_read_killable mmap_sem for /proc/pid/pagemap Do not remain stuck forever if something goes wrong. Using a killable lock permits cleanup of stuck tasks and simplifies investigation. Link: http://lkml.kernel.org/r/156007493638.3335.4872164955523928492.stgit@buzz Signed-off-by: Konstantin Khlebnikov Reviewed-by: Roman Gushchin Reviewed-by: Cyrill Gorcunov Reviewed-by: Kirill Tkhai Acked-by: Michal Hocko Cc: Alexey Dobriyan Cc: Al Viro Cc: Matthew Wilcox Cc: Michal Koutný Cc: Oleg Nesterov Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit a26a97815548574213fd37f29b4b78ccc6d9ed20 Author: Konstantin Khlebnikov Date: Thu Jul 11 20:59:53 2019 -0700 proc: use down_read_killable mmap_sem for /proc/pid/smaps_rollup Do not remain stuck forever if something goes wrong. Using a killable lock permits cleanup of stuck tasks and simplifies investigation. Link: http://lkml.kernel.org/r/156007493429.3335.14666825072272692455.stgit@buzz Signed-off-by: Konstantin Khlebnikov Reviewed-by: Roman Gushchin Reviewed-by: Cyrill Gorcunov Reviewed-by: Kirill Tkhai Acked-by: Michal Hocko Cc: Alexey Dobriyan Cc: Al Viro Cc: Matthew Wilcox Cc: Michal Koutný Cc: Oleg Nesterov Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 8a713e7df3352b8d9392476e9cf29e4e185dac32 Author: Konstantin Khlebnikov Date: Thu Jul 11 20:59:50 2019 -0700 proc: use down_read_killable mmap_sem for /proc/pid/maps Do not remain stuck forever if something goes wrong. Using a killable lock permits cleanup of stuck tasks and simplifies investigation. This function is also used for /proc/pid/smaps. Link: http://lkml.kernel.org/r/156007493160.3335.14447544314127417266.stgit@buzz Signed-off-by: Konstantin Khlebnikov Reviewed-by: Roman Gushchin Reviewed-by: Cyrill Gorcunov Reviewed-by: Kirill Tkhai Acked-by: Michal Hocko Cc: Alexey Dobriyan Cc: Al Viro Cc: Matthew Wilcox Cc: Michal Koutný Cc: Oleg Nesterov Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit cbf800d9c7fb38d953ba8ae1bd27a6382114c32e Author: Tobin C. Harding Date: Thu Jul 11 20:59:46 2019 -0700 tools/vm/slabinfo: add sorting info to help menu Passing more than one sorting option has undefined behaviour. Add an explicit statement as such to the help menu, this also has the advantage of highlighting all the sorting options. Link: http://lkml.kernel.org/r/20190426022622.4089-5-tobin@kernel.org Signed-off-by: Tobin C. Harding Cc: Alexander Duyck Cc: Brendan Gregg , Cc: Christoph Lameter Cc: David Rientjes Cc: Jesper Dangaard Brouer Cc: Joonsoo Kim Cc: Mel Gorman Cc: Michal Hocko Cc: Pekka Enberg Cc: Qian Cai Cc: Tejun Heo Cc: Vlastimil Babka Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 53a83f9766e33d6bf4e14d5592c1939777fb98db Author: Tobin C. Harding Date: Thu Jul 11 20:59:42 2019 -0700 tools/vm/slabinfo: add option to sort by partial slabs We would like to get a better view of the level of fragmentation within the SLUB allocator. Total number of partial slabs is an indicator of fragmentation. Add a command line option (-P | --partial) to sort the slab list by total number of partial slabs. Link: http://lkml.kernel.org/r/20190426022622.4089-4-tobin@kernel.org Signed-off-by: Tobin C. Harding Cc: Alexander Duyck Cc: Brendan Gregg , Cc: Christoph Lameter Cc: David Rientjes Cc: Jesper Dangaard Brouer Cc: Joonsoo Kim Cc: Mel Gorman Cc: Michal Hocko Cc: Pekka Enberg Cc: Qian Cai Cc: Tejun Heo Cc: Vlastimil Babka Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 1106b205a3fe034beafad24045b7c00a7eb89669 Author: Tobin C. Harding Date: Thu Jul 11 20:59:38 2019 -0700 tools/vm/slabinfo: add partial slab listing to -X We would like to see how fragmented the SLUB allocator is, one window into fragmentation is the total number of partial slabs. Currently `slabinfo -X` shows slabs sorted by loss and by size. We can use this option to also show slabs sorted by number of partial slabs. Option '-X' can be used in conjunction with '-N' to control the number of slabs shown e.g. list of top 5 slabs: slabinfo -X -N5 Add list of slabs ordered by number of partial slabs to output of `slabinfo -X`. Link: http://lkml.kernel.org/r/20190426022622.4089-3-tobin@kernel.org Signed-off-by: Tobin C. Harding Cc: Alexander Duyck Cc: Brendan Gregg , Cc: Christoph Lameter Cc: David Rientjes Cc: Jesper Dangaard Brouer Cc: Joonsoo Kim Cc: Mel Gorman Cc: Michal Hocko Cc: Pekka Enberg Cc: Qian Cai Cc: Tejun Heo Cc: Vlastimil Babka Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit d914999689609d45b36db2b0fabb05cf7fc1fa1f Author: Tobin C. Harding Date: Thu Jul 11 20:59:34 2019 -0700 tools/vm/slabinfo: order command line options During recent discussion on LKML over SLAB vs SLUB it was suggested by Jesper that it would be nice to have a tool to view the current fragmentation of the slab allocators. CC list for this set is taken from that thread. For SLUB we have all the information for this already exposed by the kernel and also we have a userspace tool for displaying this info: tools/vm/slabinfo.c Extend slabinfo to improve the fragmentation information by enabling sorting of caches by number of partial slabs. Also add cache list sorted in this manner to the output of `slabinfo -X`. This patch (of 4): get_opt() has a spurious character within the option string. Remove it and reorder the options in alphabetic order so that it is easier to keep the options correct. Use the same ordering for command help output and long option handling code. Link: http://lkml.kernel.org/r/20190426022622.4089-2-tobin@kernel.org Signed-off-by: Tobin C. Harding Cc: Jesper Dangaard Brouer Cc: Pekka Enberg Cc: Vlastimil Babka Cc: Christoph Lameter Cc: David Rientjes Cc: Joonsoo Kim Cc: Tejun Heo Cc: Qian Cai Cc: Mel Gorman Cc: Alexander Duyck Cc: Michal Hocko Cc: Brendan Gregg , Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 98879b3b9edc1604f2d1a6686576ef4d08ed3310 Author: Yang Shi Date: Thu Jul 11 20:59:30 2019 -0700 mm: vmscan: correct some vmscan counters for THP swapout Commit bd4c82c22c36 ("mm, THP, swap: delay splitting THP after swapped out"), THP can be swapped out in a whole. But, nr_reclaimed and some other vm counters still get inc'ed by one even though a whole THP (512 pages) gets swapped out. This doesn't make too much sense to memory reclaim. For example, direct reclaim may just need reclaim SWAP_CLUSTER_MAX pages, reclaiming one THP could fulfill it. But, if nr_reclaimed is not increased correctly, direct reclaim may just waste time to reclaim more pages, SWAP_CLUSTER_MAX * 512 pages in worst case. And, it may cause pgsteal_{kswapd|direct} is greater than pgscan_{kswapd|direct}, like the below: pgsteal_kswapd 122933 pgsteal_direct 26600225 pgscan_kswapd 174153 pgscan_direct 14678312 nr_reclaimed and nr_scanned must be fixed in parallel otherwise it would break some page reclaim logic, e.g. vmpressure: this looks at the scanned/reclaimed ratio so it won't change semantics as long as scanned & reclaimed are fixed in parallel. compaction/reclaim: compaction wants a certain number of physical pages freed up before going back to compacting. kswapd priority raising: kswapd raises priority if we scan fewer pages than the reclaim target (which itself is obviously expressed in order-0 pages). As a result, kswapd can falsely raise its aggressiveness even when it's making great progress. Other than nr_scanned and nr_reclaimed, some other counters, e.g. pgactivate, nr_skipped, nr_ref_keep and nr_unmap_fail need to be fixed too since they are user visible via cgroup, /proc/vmstat or trace points, otherwise they would be underreported. When isolating pages from LRUs, nr_taken has been accounted in base page, but nr_scanned and nr_skipped are still accounted in THP. It doesn't make too much sense too since this may cause trace point underreport the numbers as well. So accounting those counters in base page instead of accounting THP as one page. nr_dirty, nr_unqueued_dirty, nr_congested and nr_writeback are used by file cache, so they are not impacted by THP swap. This change may result in lower steal/scan ratio in some cases since THP may get split during page reclaim, then a part of tail pages get reclaimed instead of the whole 512 pages, but nr_scanned is accounted by 512, particularly for direct reclaim. But, this should be not a significant issue. Link: http://lkml.kernel.org/r/1559025859-72759-2-git-send-email-yang.shi@linux.alibaba.com Signed-off-by: Yang Shi Reviewed-by: "Huang, Ying" Cc: Johannes Weiner Cc: Michal Hocko Cc: Mel Gorman Cc: "Kirill A . Shutemov" Cc: Hugh Dickins Cc: Shakeel Butt Cc: Hillf Danton Cc: Josef Bacik Cc: Michal Hocko Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit af5d440365894b5ca51f29866c1a01496dce52c4 Author: Yang Shi Date: Thu Jul 11 20:59:27 2019 -0700 mm: vmscan: remove double slab pressure by inc'ing sc->nr_scanned Commit 9092c71bb724 ("mm: use sc->priority for slab shrink targets") has broken up the relationship between sc->nr_scanned and slab pressure. The sc->nr_scanned can't double slab pressure anymore. So, it sounds no sense to still keep sc->nr_scanned inc'ed. Actually, it would prevent from adding pressure on slab shrink since excessive sc->nr_scanned would prevent from scan->priority raise. The bonnie test doesn't show this would change the behavior of slab shrinkers. w/ w/o /sec %CP /sec %CP Sequential delete: 3960.6 94.6 3997.6 96.2 Random delete: 2518 63.8 2561.6 64.6 The slight increase of "/sec" without the patch would be caused by the slight increase of CPU usage. Link: http://lkml.kernel.org/r/1559025859-72759-1-git-send-email-yang.shi@linux.alibaba.com Signed-off-by: Yang Shi Acked-by: Johannes Weiner Cc: Josef Bacik Cc: Michal Hocko Cc: Mel Gorman Cc: "Kirill A . Shutemov" Cc: Hugh Dickins Cc: Shakeel Butt Cc: Hillf Danton Cc: "Huang, Ying" Cc: Michal Hocko Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 23a5c8cb7a91939cb08bc2dc880a7aa882bc6241 Author: Alexander Potapenko Date: Thu Jul 11 20:59:23 2019 -0700 mm: init: report memory auto-initialization features at boot time Print the currently enabled stack and heap initialization modes. Stack initialization is enabled by a config flag, while heap initialization is configured at boot time with defaults being set in the config. It's more convenient for the user to have all information about these hardening measures in one place at boot, so the user can reason about the expected behavior of the running system. The possible options for stack are: - "all" for CONFIG_INIT_STACK_ALL; - "byref_all" for CONFIG_GCC_PLUGIN_STRUCTLEAK_BYREF_ALL; - "byref" for CONFIG_GCC_PLUGIN_STRUCTLEAK_BYREF; - "__user" for CONFIG_GCC_PLUGIN_STRUCTLEAK_USER; - "off" otherwise. Depending on the values of init_on_alloc and init_on_free boottime options we also report "heap alloc" and "heap free" as "on"/"off". In the init_on_free mode initializing pages at boot time may take a while, so print a notice about that as well. This depends on how much memory is installed, the memory bandwidth, etc. On a relatively modern x86 system, it takes about 0.75s/GB to wipe all memory: [ 0.418722] mem auto-init: stack:byref_all, heap alloc:off, heap free:on [ 0.419765] mem auto-init: clearing system memory may take some time... [ 12.376605] Memory: 16408564K/16776672K available (14339K kernel code, 1397K rwdata, 3756K rodata, 1636K init, 11460K bss, 368108K reserved, 0K cma-reserved) Link: http://lkml.kernel.org/r/20190617151050.92663-3-glider@google.com Signed-off-by: Alexander Potapenko Suggested-by: Kees Cook Acked-by: Kees Cook Cc: Christoph Lameter Cc: Dmitry Vyukov Cc: James Morris Cc: Jann Horn Cc: Kostya Serebryany Cc: Laura Abbott Cc: Mark Rutland Cc: Masahiro Yamada Cc: Matthew Wilcox Cc: Nick Desaulniers Cc: Randy Dunlap Cc: Sandeep Patil Cc: "Serge E. Hallyn" Cc: Souptick Joarder Cc: Marco Elver Cc: Kaiwan N Billimoria Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 6471384af2a6530696fc0203bafe4de41a23c9ef Author: Alexander Potapenko Date: Thu Jul 11 20:59:19 2019 -0700 mm: security: introduce init_on_alloc=1 and init_on_free=1 boot options Patch series "add init_on_alloc/init_on_free boot options", v10. Provide init_on_alloc and init_on_free boot options. These are aimed at preventing possible information leaks and making the control-flow bugs that depend on uninitialized values more deterministic. Enabling either of the options guarantees that the memory returned by the page allocator and SL[AU]B is initialized with zeroes. SLOB allocator isn't supported at the moment, as its emulation of kmem caches complicates handling of SLAB_TYPESAFE_BY_RCU caches correctly. Enabling init_on_free also guarantees that pages and heap objects are initialized right after they're freed, so it won't be possible to access stale data by using a dangling pointer. As suggested by Michal Hocko, right now we don't let the heap users to disable initialization for certain allocations. There's not enough evidence that doing so can speed up real-life cases, and introducing ways to opt-out may result in things going out of control. This patch (of 2): The new options are needed to prevent possible information leaks and make control-flow bugs that depend on uninitialized values more deterministic. This is expected to be on-by-default on Android and Chrome OS. And it gives the opportunity for anyone else to use it under distros too via the boot args. (The init_on_free feature is regularly requested by folks where memory forensics is included in their threat models.) init_on_alloc=1 makes the kernel initialize newly allocated pages and heap objects with zeroes. Initialization is done at allocation time at the places where checks for __GFP_ZERO are performed. init_on_free=1 makes the kernel initialize freed pages and heap objects with zeroes upon their deletion. This helps to ensure sensitive data doesn't leak via use-after-free accesses. Both init_on_alloc=1 and init_on_free=1 guarantee that the allocator returns zeroed memory. The two exceptions are slab caches with constructors and SLAB_TYPESAFE_BY_RCU flag. Those are never zero-initialized to preserve their semantics. Both init_on_alloc and init_on_free default to zero, but those defaults can be overridden with CONFIG_INIT_ON_ALLOC_DEFAULT_ON and CONFIG_INIT_ON_FREE_DEFAULT_ON. If either SLUB poisoning or page poisoning is enabled, those options take precedence over init_on_alloc and init_on_free: initialization is only applied to unpoisoned allocations. Slowdown for the new features compared to init_on_free=0, init_on_alloc=0: hackbench, init_on_free=1: +7.62% sys time (st.err 0.74%) hackbench, init_on_alloc=1: +7.75% sys time (st.err 2.14%) Linux build with -j12, init_on_free=1: +8.38% wall time (st.err 0.39%) Linux build with -j12, init_on_free=1: +24.42% sys time (st.err 0.52%) Linux build with -j12, init_on_alloc=1: -0.13% wall time (st.err 0.42%) Linux build with -j12, init_on_alloc=1: +0.57% sys time (st.err 0.40%) The slowdown for init_on_free=0, init_on_alloc=0 compared to the baseline is within the standard error. The new features are also going to pave the way for hardware memory tagging (e.g. arm64's MTE), which will require both on_alloc and on_free hooks to set the tags for heap objects. With MTE, tagging will have the same cost as memory initialization. Although init_on_free is rather costly, there are paranoid use-cases where in-memory data lifetime is desired to be minimized. There are various arguments for/against the realism of the associated threat models, but given that we'll need the infrastructure for MTE anyway, and there are people who want wipe-on-free behavior no matter what the performance cost, it seems reasonable to include it in this series. [glider@google.com: v8] Link: http://lkml.kernel.org/r/20190626121943.131390-2-glider@google.com [glider@google.com: v9] Link: http://lkml.kernel.org/r/20190627130316.254309-2-glider@google.com [glider@google.com: v10] Link: http://lkml.kernel.org/r/20190628093131.199499-2-glider@google.com Link: http://lkml.kernel.org/r/20190617151050.92663-2-glider@google.com Signed-off-by: Alexander Potapenko Acked-by: Kees Cook Acked-by: Michal Hocko [page and dmapool parts Acked-by: James Morris ] Cc: Christoph Lameter Cc: Masahiro Yamada Cc: "Serge E. Hallyn" Cc: Nick Desaulniers Cc: Kostya Serebryany Cc: Dmitry Vyukov Cc: Sandeep Patil Cc: Laura Abbott Cc: Randy Dunlap Cc: Jann Horn Cc: Mark Rutland Cc: Marco Elver Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit ba5c5e4a5da443e80a3722e67515de5e37375b18 Author: Kees Cook Date: Thu Jul 11 20:59:15 2019 -0700 arm64: move jump_label_init() before parse_early_param() While jump_label_init() was moved earlier in the boot process in efd9e03facd0 ("arm64: Use static keys for CPU features"), it wasn't early enough for early params to use it. The old state of things was as described here... init/main.c calls out to arch-specific things before general jump label and early param handling: asmlinkage __visible void __init start_kernel(void) { ... setup_arch(&command_line); ... smp_prepare_boot_cpu(); ... /* parameters may set static keys */ jump_label_init(); parse_early_param(); ... } x86 setup_arch() wants those earlier, so it handles jump label and early param: void __init setup_arch(char **cmdline_p) { ... jump_label_init(); ... parse_early_param(); ... } arm64 setup_arch() only had early param: void __init setup_arch(char **cmdline_p) { ... parse_early_param(); ... } with jump label later in smp_prepare_boot_cpu(): void __init smp_prepare_boot_cpu(void) { ... jump_label_init(); ... } This moves arm64 jump_label_init() from smp_prepare_boot_cpu() to setup_arch(), as done already on x86, in preparation from early param usage in the init_on_alloc/free() series: https://lkml.kernel.org/r/1561572949.5154.81.camel@lca.pw Link: http://lkml.kernel.org/r/201906271003.005303B52@keescook Signed-off-by: Kees Cook Acked-by: Ard Biesheuvel Acked-by: Catalin Marinas Cc: Alexander Potapenko Cc: Qian Cai Cc: Will Deacon Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit e03a5125ec7bd1d4e8b062816a8813436876dc7c Author: Nicholas Piggin Date: Thu Jul 11 20:59:12 2019 -0700 mm/large system hash: clear hashdist when only one node with memory is booted CONFIG_NUMA on 64-bit CPUs currently enables hashdist unconditionally even when booting on single node machines. This causes the large system hashes to be allocated with vmalloc, and mapped with small pages. This change clears hashdist if only one node has come up with memory. This results in the important large inode and dentry hashes using memblock allocations. All others are within 4MB size up to about 128GB of RAM, which allows them to be allocated from the linear map on most non-NUMA images. Other big hashes like futex and TCP should eventually be moved over to the same style of allocation as those vfs caches that use HASH_EARLY if !hashdist, so they don't exceed MAX_ORDER on very large non-NUMA images. This brings dTLB misses for linux kernel tree `git diff` from ~45,000 to ~8,000 on a Kaby Lake KVM guest with 8MB dentry hash and mitigations=off (performance is in the noise, under 1% difference, page tables are likely to be well cached for this workload). Link: http://lkml.kernel.org/r/20190605144814.29319-2-npiggin@gmail.com Signed-off-by: Nicholas Piggin Reviewed-by: Andrew Morton Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit ec11408a1630eed2cb03db55b8b372267f5f1032 Author: Nicholas Piggin Date: Thu Jul 11 20:59:09 2019 -0700 mm/large system hash: use vmalloc for size > MAX_ORDER when !hashdist The kernel currently clamps large system hashes to MAX_ORDER when hashdist is not set, which is rather arbitrary. vmalloc space is limited on 32-bit machines, but this shouldn't result in much more used because of small physical memory limiting system hash sizes. Include "vmalloc" or "linear" in the kernel log message. Link: http://lkml.kernel.org/r/20190605144814.29319-1-npiggin@gmail.com Signed-off-by: Nicholas Piggin Reviewed-by: Andrew Morton Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit d9009d67f42e59760aae5471ba2f62b3d5d531d1 Author: Geert Uytterhoeven Date: Thu Jul 11 20:59:06 2019 -0700 mm/vmalloc.c: spelling> s/informaion/information/ Link: http://lkml.kernel.org/r/20190607113509.15032-1-geert+renesas@glider.be Signed-off-by: Geert Uytterhoeven Reviewed-by: Andrew Morton Acked-by: Souptick Joarder Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 460e42d19a13d49455c5b269e8e0a1b1d522a895 Author: Uladzislau Rezki (Sony) Date: Thu Jul 11 20:59:03 2019 -0700 mm/vmalloc.c: switch to WARN_ON() and move it under unlink_va() Trigger a warning if an object that is about to be freed is detached. We used to have a BUG_ON(), but even though it is considered as faulty behaviour that is not a good reason to break a system. Link: http://lkml.kernel.org/r/20190606120411.8298-5-urezki@gmail.com Signed-off-by: Uladzislau Rezki (Sony) Cc: Roman Gushchin Cc: Hillf Danton Cc: Michal Hocko Cc: Matthew Wilcox Cc: Oleksiy Avramchenko Cc: Steven Rostedt Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 54f63d9d8a39118486eb8a7168cda5845240c3d2 Author: Uladzislau Rezki (Sony) Date: Thu Jul 11 20:59:00 2019 -0700 mm/vmalloc.c: get rid of one single unlink_va() when merge It does not make sense to try to "unlink" the node that is definitely not linked with a list nor tree. On the first merge step VA just points to the previously disconnected busy area. On the second step, check if the node has been merged and do "unlink" if so, because now it points to an object that must be linked. Link: http://lkml.kernel.org/r/20190606120411.8298-4-urezki@gmail.com Signed-off-by: Uladzislau Rezki (Sony) Acked-by: Hillf Danton Reviewed-by: Roman Gushchin Cc: Matthew Wilcox Cc: Michal Hocko Cc: Oleksiy Avramchenko Cc: Steven Rostedt Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 82dd23e84be3ead53b6d584d836f51852d1096e6 Author: Uladzislau Rezki (Sony) Date: Thu Jul 11 20:58:57 2019 -0700 mm/vmalloc.c: preload a CPU with one object for split purpose Refactor the NE_FIT_TYPE split case when it comes to an allocation of one extra object. We need it in order to build a remaining space. The preload is done per CPU in non-atomic context with GFP_KERNEL flags. More permissive parameters can be beneficial for systems which are suffer from high memory pressure or low memory condition. For example on my KVM system(4xCPUs, no swap, 256MB RAM) i can simulate the failure of page allocation with GFP_NOWAIT flags. Using "stress-ng" tool and starting N workers spinning on fork() and exit(), i can trigger below trace: [ 179.815161] stress-ng-fork: page allocation failure: order:0, mode:0x40800(GFP_NOWAIT|__GFP_COMP), nodemask=(null),cpuset=/,mems_allowed=0 [ 179.815168] CPU: 0 PID: 12612 Comm: stress-ng-fork Not tainted 5.2.0-rc3+ #1003 [ 179.815170] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1 04/01/2014 [ 179.815171] Call Trace: [ 179.815178] dump_stack+0x5c/0x7b [ 179.815182] warn_alloc+0x108/0x190 [ 179.815187] __alloc_pages_slowpath+0xdc7/0xdf0 [ 179.815191] __alloc_pages_nodemask+0x2de/0x330 [ 179.815194] cache_grow_begin+0x77/0x420 [ 179.815197] fallback_alloc+0x161/0x200 [ 179.815200] kmem_cache_alloc+0x1c9/0x570 [ 179.815202] alloc_vmap_area+0x32c/0x990 [ 179.815206] __get_vm_area_node+0xb0/0x170 [ 179.815208] __vmalloc_node_range+0x6d/0x230 [ 179.815211] ? _do_fork+0xce/0x3d0 [ 179.815213] copy_process.part.46+0x850/0x1b90 [ 179.815215] ? _do_fork+0xce/0x3d0 [ 179.815219] _do_fork+0xce/0x3d0 [ 179.815226] ? __do_page_fault+0x2bf/0x4e0 [ 179.815229] do_syscall_64+0x55/0x130 [ 179.815231] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 179.815234] RIP: 0033:0x7fedec4c738b ... [ 179.815237] RSP: 002b:00007ffda469d730 EFLAGS: 00000246 ORIG_RAX: 0000000000000038 [ 179.815239] RAX: ffffffffffffffda RBX: 00007ffda469d730 RCX: 00007fedec4c738b [ 179.815240] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000001200011 [ 179.815241] RBP: 00007ffda469d780 R08: 00007fededd6e300 R09: 00007ffda47f50a0 [ 179.815242] R10: 00007fededd6e5d0 R11: 0000000000000246 R12: 0000000000000000 [ 179.815243] R13: 0000000000000020 R14: 0000000000000000 R15: 0000000000000000 [ 179.815245] Mem-Info: [ 179.815249] active_anon:12686 inactive_anon:14760 isolated_anon:0 active_file:502 inactive_file:61 isolated_file:70 unevictable:2 dirty:0 writeback:0 unstable:0 slab_reclaimable:2380 slab_unreclaimable:7520 mapped:15069 shmem:14813 pagetables:10833 bounce:0 free:1922 free_pcp:229 free_cma:0 Link: http://lkml.kernel.org/r/20190606120411.8298-3-urezki@gmail.com Signed-off-by: Uladzislau Rezki (Sony) Cc: Hillf Danton Cc: Matthew Wilcox Cc: Michal Hocko Cc: Oleksiy Avramchenko Cc: Roman Gushchin Cc: Steven Rostedt Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit cacca6baf0b0a2dfe8eb3430b5f81916f35284cc Author: Uladzislau Rezki (Sony) Date: Thu Jul 11 20:58:53 2019 -0700 mm/vmalloc.c: remove "node" argument Patch series "Some cleanups for the KVA/vmalloc", v5. This patch (of 4): Remove unused argument from the __alloc_vmap_area() function. Link: http://lkml.kernel.org/r/20190606120411.8298-2-urezki@gmail.com Signed-off-by: Uladzislau Rezki (Sony) Reviewed-by: Andrew Morton Reviewed-by: Roman Gushchin Cc: Hillf Danton Cc: Matthew Wilcox Cc: Michal Hocko Cc: Oleksiy Avramchenko Cc: Steven Rostedt Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 543bdb2d825fe2400d6e951f1786d92139a16931 Author: Jean-Philippe Brucker Date: Thu Jul 11 20:58:50 2019 -0700 mm/mmu_notifier: use hlist_add_head_rcu() Make mmu_notifier_register() safer by issuing a memory barrier before registering a new notifier. This fixes a theoretical bug on weakly ordered CPUs. For example, take this simplified use of notifiers by a driver: my_struct->mn.ops = &my_ops; /* (1) */ mmu_notifier_register(&my_struct->mn, mm) ... hlist_add_head(&mn->hlist, &mm->mmu_notifiers); /* (2) */ ... Once mmu_notifier_register() releases the mm locks, another thread can invalidate a range: mmu_notifier_invalidate_range() ... hlist_for_each_entry_rcu(mn, &mm->mmu_notifiers, hlist) { if (mn->ops->invalidate_range) The read side relies on the data dependency between mn and ops to ensure that the pointer is properly initialized. But the write side doesn't have any dependency between (1) and (2), so they could be reordered and the readers could dereference an invalid mn->ops. mmu_notifier_register() does take all the mm locks before adding to the hlist, but those have acquire semantics which isn't sufficient. By calling hlist_add_head_rcu() instead of hlist_add_head() we update the hlist using a store-release, ensuring that readers see prior initialization of my_struct. This situation is better illustated by litmus test MP+onceassign+derefonce. Link: http://lkml.kernel.org/r/20190502133532.24981-1-jean-philippe.brucker@arm.com Fixes: cddb8a5c14aa ("mmu-notifiers: core") Signed-off-by: Jean-Philippe Brucker Cc: Jérôme Glisse Cc: Michal Hocko Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 96756fcb831ddec3ad15f3a107b6e2749084aafb Author: Miguel Ojeda Date: Thu Jul 11 20:58:47 2019 -0700 mm/memory.c: fail when offset == num in first check of __vm_map_pages() If the caller asks us for offset == num, we should already fail in the first check, i.e. the one testing for offsets beyond the object. At the moment, we are failing on the second test anyway, since count cannot be 0. Still, to agree with the comment of the first test, we should first test it there. Link: http://lkml.kernel.org/r/20190528193004.GA7744@gmail.com Signed-off-by: Miguel Ojeda Reviewed-by: Andrew Morton Cc: Souptick Joarder Cc: Matthew Wilcox Cc: Peter Zijlstra Cc: "Aneesh Kumar K.V" Cc: Huang Ying Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 8b1e0f81fb6fcf3109465a168b2e2da3f711fa86 Author: Anshuman Khandual Date: Thu Jul 11 20:58:43 2019 -0700 mm/pgtable: drop pgtable_t variable from pte_fn_t functions Drop the pgtable_t variable from all implementation for pte_fn_t as none of them use it. apply_to_pte_range() should stop computing it as well. Should help us save some cycles. Link: http://lkml.kernel.org/r/1556803126-26596-1-git-send-email-anshuman.khandual@arm.com Signed-off-by: Anshuman Khandual Acked-by: Matthew Wilcox Cc: Ard Biesheuvel Cc: Russell King Cc: Catalin Marinas Cc: Will Deacon Cc: Thomas Gleixner Cc: Ingo Molnar Cc: Michal Hocko Cc: Logan Gunthorpe Cc: "Kirill A. Shutemov" Cc: Dan Williams Cc: Cc: Mike Rapoport Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit c2471e79a7ea0f48e3ae9253e1f3688a44cc944d Author: Mike Rapoport Date: Thu Jul 11 20:58:39 2019 -0700 unicore32: switch to generic version of pte allocation Replace __get_free_page() and alloc_pages() calls with the generic __pte_alloc_one_kernel() and __pte_alloc_one(). There is no functional change for the kernel PTE allocation. The difference for the user PTEs, is that the clear_pte_table() is now called after pgtable_page_ctor() and the addition of __GFP_ACCOUNT to the GFP flags. The pte_free() and pte_free_kernel() versions are identical to the generic ones and can be simply dropped. Link: http://lkml.kernel.org/r/1557296232-15361-15-git-send-email-rppt@linux.ibm.com Signed-off-by: Mike Rapoport Cc: Arnd Bergmann Cc: Anshuman Khandual Cc: Catalin Marinas Cc: Geert Uytterhoeven Cc: Greentime Hu Cc: Guan Xuetao Cc: Guo Ren Cc: Helge Deller Cc: Ley Foon Tan Cc: Matthew Wilcox Cc: Matt Turner Cc: Michael Ellerman Cc: Michal Hocko Cc: Palmer Dabbelt Cc: Paul Burton Cc: Richard Kuo Cc: Richard Weinberger Cc: Russell King Cc: Sam Creasey Cc: Ralf Baechle Cc: Vincent Chen Cc: Albert Ou Cc: Anton Ivanov Cc: Guo Ren Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit f32848e16939e1407ad3413f7faa3e0a8ad802eb Author: Mike Rapoport Date: Thu Jul 11 20:58:35 2019 -0700 um: switch to generic version of pte allocation um allocates PTE pages with __get_free_page() and uses GFP_KERNEL | __GFP_ZERO for the allocations. Switch it to the generic version that does exactly the same thing for the kernel page tables and adds __GFP_ACCOUNT for the user PTEs. The pte_free() and pte_free_kernel() versions are identical to the generic ones and can be simply dropped. Link: http://lkml.kernel.org/r/1557296232-15361-14-git-send-email-rppt@linux.ibm.com Signed-off-by: Mike Rapoport Reviewed-by: Anton Ivanov Acked-by: Anton Ivanov Cc: Albert Ou Cc: Anshuman Khandual Cc: Arnd Bergmann Cc: Catalin Marinas Cc: Geert Uytterhoeven Cc: Greentime Hu Cc: Guan Xuetao Cc: Guo Ren Cc: Guo Ren Cc: Helge Deller Cc: Ley Foon Tan Cc: Matthew Wilcox Cc: Matt Turner Cc: Michael Ellerman Cc: Michal Hocko Cc: Palmer Dabbelt Cc: Paul Burton Cc: Ralf Baechle Cc: Richard Kuo Cc: Richard Weinberger Cc: Russell King Cc: Sam Creasey Cc: Vincent Chen Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit d1b46fe50c8b0e0b4035c48ccd5f655aa7ceea16 Author: Mike Rapoport Date: Thu Jul 11 20:58:31 2019 -0700 riscv: switch to generic version of pte allocation The only difference between the generic and RISC-V implementation of PTE allocation is the usage of __GFP_RETRY_MAYFAIL for both kernel and user PTEs and the absence of __GFP_ACCOUNT for the user PTEs. The conversion to the generic version removes the __GFP_RETRY_MAYFAIL and ensures that GFP_ACCOUNT is used for the user PTE allocations. The pte_free() and pte_free_kernel() versions are identical to the generic ones and can be simply dropped. Link: http://lkml.kernel.org/r/1557296232-15361-13-git-send-email-rppt@linux.ibm.com Signed-off-by: Mike Rapoport Reviewed-by: Palmer Dabbelt Cc: Albert Ou Cc: Anshuman Khandual Cc: Anton Ivanov Cc: Arnd Bergmann Cc: Catalin Marinas Cc: Geert Uytterhoeven Cc: Greentime Hu Cc: Guan Xuetao Cc: Guo Ren Cc: Guo Ren Cc: Helge Deller Cc: Ley Foon Tan Cc: Matthew Wilcox Cc: Matt Turner Cc: Michael Ellerman Cc: Michal Hocko Cc: Paul Burton Cc: Ralf Baechle Cc: Richard Kuo Cc: Richard Weinberger Cc: Russell King Cc: Sam Creasey Cc: Vincent Chen Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 3f4a13085dd88cb806a2c64fb1286e9cf3a98cd0 Author: Mike Rapoport Date: Thu Jul 11 20:58:27 2019 -0700 parisc: switch to generic version of pte allocation parisc allocates PTE pages with __get_free_page() and uses GFP_KERNEL | __GFP_ZERO for the allocations. Switch it to the generic version that does exactly the same thing for the kernel page tables and adds __GFP_ACCOUNT for the user PTEs. The pte_free_kernel() and pte_free() versions on are identical to the generic ones and can be simply dropped. Link: http://lkml.kernel.org/r/1557296232-15361-12-git-send-email-rppt@linux.ibm.com Signed-off-by: Mike Rapoport Cc: Albert Ou Cc: Anshuman Khandual Cc: Anton Ivanov Cc: Arnd Bergmann Cc: Catalin Marinas Cc: Geert Uytterhoeven Cc: Greentime Hu Cc: Guan Xuetao Cc: Guo Ren Cc: Guo Ren Cc: Helge Deller Cc: Ley Foon Tan Cc: Matthew Wilcox Cc: Matt Turner Cc: Michael Ellerman Cc: Michal Hocko Cc: Palmer Dabbelt Cc: Paul Burton Cc: Ralf Baechle Cc: Richard Kuo Cc: Richard Weinberger Cc: Russell King Cc: Sam Creasey Cc: Vincent Chen Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit fc7835c2f8ea800ded22f68bd782cd17a6dd83cd Author: Mike Rapoport Date: Thu Jul 11 20:58:22 2019 -0700 nios2: switch to generic version of pte allocation nios2 allocates kernel PTE pages with __get_free_pages(GFP_KERNEL | __GFP_ZERO, PTE_ORDER); and user page tables with pte = alloc_pages(GFP_KERNEL, PTE_ORDER); if (pte) clear_highpage(); The PTE_ORDER is hardwired to zero, which makes nios2 implementation almost identical to the generic one. Switch nios2 to the generic version that does exactly the same thing for the kernel page tables and adds __GFP_ACCOUNT for the user PTEs. The pte_free_kernel() and pte_free() versions on nios2 are identical to the generic ones and can be simply dropped. Link: http://lkml.kernel.org/r/1557296232-15361-11-git-send-email-rppt@linux.ibm.com Signed-off-by: Mike Rapoport Cc: Albert Ou Cc: Anshuman Khandual Cc: Anton Ivanov Cc: Arnd Bergmann Cc: Catalin Marinas Cc: Geert Uytterhoeven Cc: Greentime Hu Cc: Guan Xuetao Cc: Guo Ren Cc: Guo Ren Cc: Helge Deller Cc: Ley Foon Tan Cc: Matthew Wilcox Cc: Matt Turner Cc: Michael Ellerman Cc: Michal Hocko Cc: Palmer Dabbelt Cc: Paul Burton Cc: Ralf Baechle Cc: Richard Kuo Cc: Richard Weinberger Cc: Russell King Cc: Sam Creasey Cc: Vincent Chen Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit f52a8e1a67cde67c33d5c2eabd6494dcab956677 Author: Mike Rapoport Date: Thu Jul 11 20:58:18 2019 -0700 nds32: switch to generic version of pte allocation The nds32 implementation of pte_alloc_one_kernel() differs from the generic in the use of __GFP_RETRY_MAYFAIL flag, which is removed after the conversion. The nds32 version of pte_alloc_one() missed the call to pgtable_page_ctor() and also used __GFP_RETRY_MAYFAIL. Switching it to use generic __pte_alloc_one() for the PTE page allocation ensures that page table constructor is run and the user page tables are allocated with __GFP_ACCOUNT. The conversion to the generic version of pte_free_kernel() removes the NULL check for pte. The pte_free() version on nds32 is identical to the generic one and can be simply dropped. Link: http://lkml.kernel.org/r/1557296232-15361-10-git-send-email-rppt@linux.ibm.com Signed-off-by: Mike Rapoport Cc: Albert Ou Cc: Anshuman Khandual Cc: Anton Ivanov Cc: Arnd Bergmann Cc: Catalin Marinas Cc: Geert Uytterhoeven Cc: Greentime Hu Cc: Guan Xuetao Cc: Guo Ren Cc: Guo Ren Cc: Helge Deller Cc: Ley Foon Tan Cc: Matthew Wilcox Cc: Matt Turner Cc: Michael Ellerman Cc: Michal Hocko Cc: Palmer Dabbelt Cc: Paul Burton Cc: Ralf Baechle Cc: Richard Kuo Cc: Richard Weinberger Cc: Russell King Cc: Sam Creasey Cc: Vincent Chen Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit b7902ce175476b767e6c614fded293faf906deee Author: Mike Rapoport Date: Thu Jul 11 20:58:14 2019 -0700 mips: switch to generic version of pte allocation MIPS allocates kernel PTE pages with __get_free_pages(GFP_KERNEL | __GFP_ZERO, PTE_ORDER) and user PTE pages with pte = alloc_pages(GFP_KERNEL, PTE_ORDER) and then uses clear_highpage(pte) to zero out the allocated page for the user page tables. The PTE_ORDER is hardwired to zero, which makes MIPS implementation almost identical to the generic one. Switch MIPS to the generic version that does exactly the same thing for the kernel page tables and adds __GFP_ACCOUNT for the user PTEs. The pte_free_kernel() and pte_free() versions on mips are identical to the generic ones and can be simply dropped. Link: http://lkml.kernel.org/r/1557296232-15361-9-git-send-email-rppt@linux.ibm.com Signed-off-by: Mike Rapoport Acked-by: Paul Burton Cc: Albert Ou Cc: Anshuman Khandual Cc: Anton Ivanov Cc: Arnd Bergmann Cc: Catalin Marinas Cc: Geert Uytterhoeven Cc: Greentime Hu Cc: Guan Xuetao Cc: Guo Ren Cc: Guo Ren Cc: Helge Deller Cc: Ley Foon Tan Cc: Matthew Wilcox Cc: Matt Turner Cc: Michael Ellerman Cc: Michal Hocko Cc: Palmer Dabbelt Cc: Ralf Baechle Cc: Richard Kuo Cc: Richard Weinberger Cc: Russell King Cc: Sam Creasey Cc: Vincent Chen Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 14c0a39c9af9a25e0f94f9be89431c2debb34f2c Author: Mike Rapoport Date: Thu Jul 11 20:58:10 2019 -0700 m68k: sun3: switch to generic version of pte allocation The sun3 MMU variant of m68k uses GFP_KERNEL to allocate a PTE page and then memset(0) or clear_highpage() to clear it. This is equivalent to allocating the page with GFP_KERNEL | __GFP_ZERO, which allows replacing sun3 implementation of pte_alloc_one() and pte_alloc_one_kernel() with the generic ones. The pte_free() and pte_free_kernel() versions are identical to the generic ones and can be simply dropped. Link: http://lkml.kernel.org/r/1557296232-15361-8-git-send-email-rppt@linux.ibm.com Signed-off-by: Mike Rapoport Cc: Albert Ou Cc: Anshuman Khandual Cc: Anton Ivanov Cc: Arnd Bergmann Cc: Catalin Marinas Cc: Geert Uytterhoeven Cc: Greentime Hu Cc: Guan Xuetao Cc: Guo Ren Cc: Guo Ren Cc: Helge Deller Cc: Ley Foon Tan Cc: Matthew Wilcox Cc: Matt Turner Cc: Michael Ellerman Cc: Michal Hocko Cc: Palmer Dabbelt Cc: Paul Burton Cc: Ralf Baechle Cc: Richard Kuo Cc: Richard Weinberger Cc: Russell King Cc: Sam Creasey Cc: Vincent Chen Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit bd5ff066514c2dcffd443cfaa55580db0f19caf8 Author: Mike Rapoport Date: Thu Jul 11 20:58:06 2019 -0700 csky: switch to generic version of pte allocation The csky implementation pte_alloc_one(), pte_free_kernel() and pte_free() is identical to the generic except of lack of __GFP_ACCOUNT for the user PTEs allocation. Switch csky to use generic version of these functions. The csky implementation of pte_alloc_one_kernel() is not replaced because it does not clear the allocated page but rather sets each PTE in it to a non-zero value. The pte_free_kernel() and pte_free() versions on csky are identical to the generic ones and can be simply dropped. Link: http://lkml.kernel.org/r/1557296232-15361-6-git-send-email-rppt@linux.ibm.com Signed-off-by: Mike Rapoport Acked-by: Guo Ren Cc: Albert Ou Cc: Anshuman Khandual Cc: Anton Ivanov Cc: Arnd Bergmann Cc: Catalin Marinas Cc: Geert Uytterhoeven Cc: Greentime Hu Cc: Guan Xuetao Cc: Guo Ren Cc: Helge Deller Cc: Ley Foon Tan Cc: Matthew Wilcox Cc: Matt Turner Cc: Michael Ellerman Cc: Michal Hocko Cc: Palmer Dabbelt Cc: Paul Burton Cc: Ralf Baechle Cc: Richard Kuo Cc: Richard Weinberger Cc: Russell King Cc: Sam Creasey Cc: Vincent Chen Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 50f11a8a4620eee6b6831e69ab5d42456546d7d8 Author: Mike Rapoport Date: Thu Jul 11 20:58:02 2019 -0700 arm64: switch to generic version of pte allocation The PTE allocations in arm64 are identical to the generic ones modulo the GFP flags. Using the generic pte_alloc_one() functions ensures that the user page tables are allocated with __GFP_ACCOUNT set. The arm64 definition of PGALLOC_GFP is removed and replaced with GFP_PGTABLE_USER for p[gum]d_alloc_one() for the user page tables and GFP_PGTABLE_KERNEL for the kernel page tables. The KVM memory cache is now using GFP_PGTABLE_USER. The mappings created with create_pgd_mapping() are now using GFP_PGTABLE_KERNEL. The conversion to the generic version of pte_free_kernel() removes the NULL check for pte. The pte_free() version on arm64 is identical to the generic one and can be simply dropped. [cai@lca.pw: fix a bogus GFP flag in pgd_alloc()] Link: https://lore.kernel.org/r/1559656836-24940-1-git-send-email-cai@lca.pw/ [and fix it more] Link: https://lore.kernel.org/linux-mm/20190617151252.GF16810@rapoport-lnx/ Link: http://lkml.kernel.org/r/1557296232-15361-5-git-send-email-rppt@linux.ibm.com Signed-off-by: Mike Rapoport Cc: Albert Ou Cc: Anshuman Khandual Cc: Anton Ivanov Cc: Arnd Bergmann Cc: Catalin Marinas Cc: Geert Uytterhoeven Cc: Greentime Hu Cc: Guan Xuetao Cc: Guo Ren Cc: Guo Ren Cc: Helge Deller Cc: Ley Foon Tan Cc: Matthew Wilcox Cc: Matt Turner Cc: Michael Ellerman Cc: Michal Hocko Cc: Palmer Dabbelt Cc: Paul Burton Cc: Ralf Baechle Cc: Richard Kuo Cc: Richard Weinberger Cc: Russell King Cc: Sam Creasey Cc: Vincent Chen Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 28bcf5937536062d96ee0b581a76a0b1b652eec6 Author: Mike Rapoport Date: Thu Jul 11 20:57:57 2019 -0700 arm: switch to generic version of pte allocation Replace __get_free_page() and alloc_pages() calls with the generic __pte_alloc_one_kernel() and __pte_alloc_one(). There is no functional change for the kernel PTE allocation. The difference for the user PTEs, is that the clear_pte_table() is now called after pgtable_page_ctor() and the addition of __GFP_ACCOUNT to the GFP flags. The conversion to the generic version of pte_free_kernel() removes the NULL check for pte. The pte_free() version on arm is identical to the generic one and can be simply dropped. Link: http://lkml.kernel.org/r/1557296232-15361-4-git-send-email-rppt@linux.ibm.com Signed-off-by: Mike Rapoport Cc: Albert Ou Cc: Anshuman Khandual Cc: Anton Ivanov Cc: Arnd Bergmann Cc: Catalin Marinas Cc: Geert Uytterhoeven Cc: Greentime Hu Cc: Guan Xuetao Cc: Guo Ren Cc: Guo Ren Cc: Helge Deller Cc: Ley Foon Tan Cc: Matthew Wilcox Cc: Matt Turner Cc: Michael Ellerman Cc: Michal Hocko Cc: Palmer Dabbelt Cc: Paul Burton Cc: Ralf Baechle Cc: Richard Kuo Cc: Richard Weinberger Cc: Russell King Cc: Sam Creasey Cc: Vincent Chen Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit bc3ace9b520f97d5650d096a5f95cac3fa64e204 Author: Mike Rapoport Date: Thu Jul 11 20:57:53 2019 -0700 alpha: switch to generic version of pte allocation alpha allocates PTE pages with __get_free_page() and uses GFP_KERNEL | __GFP_ZERO for the allocations. Switch it to the generic version that does exactly the same thing for the kernel page tables and adds __GFP_ACCOUNT for the user PTEs. The alpha pte_free() and pte_free_kernel() versions are identical to the generic ones and can be simply dropped. Link: http://lkml.kernel.org/r/1557296232-15361-3-git-send-email-rppt@linux.ibm.com Signed-off-by: Mike Rapoport Cc: Albert Ou Cc: Anshuman Khandual Cc: Anton Ivanov Cc: Arnd Bergmann Cc: Catalin Marinas Cc: Geert Uytterhoeven Cc: Greentime Hu Cc: Guan Xuetao Cc: Guo Ren Cc: Guo Ren Cc: Helge Deller Cc: Ley Foon Tan Cc: Matthew Wilcox Cc: Matt Turner Cc: Michael Ellerman Cc: Michal Hocko Cc: Palmer Dabbelt Cc: Paul Burton Cc: Ralf Baechle Cc: Richard Kuo Cc: Richard Weinberger Cc: Russell King Cc: Sam Creasey Cc: Vincent Chen Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 5fba4af4456b5d3f982d4ac1c879d16b36aaa0fb Author: Mike Rapoport Date: Thu Jul 11 20:57:49 2019 -0700 asm-generic, x86: introduce generic pte_{alloc,free}_one[_kernel] Most architectures have identical or very similar implementation of pte_alloc_one_kernel(), pte_alloc_one(), pte_free_kernel() and pte_free(). Add a generic implementation that can be reused across architectures and enable its use on x86. The generic implementation uses GFP_KERNEL | __GFP_ZERO for the kernel page tables and GFP_KERNEL | __GFP_ZERO | __GFP_ACCOUNT for the user page tables. The "base" functions for PTE allocation, namely __pte_alloc_one_kernel() and __pte_alloc_one() are intended for the architectures that require additional actions after actual memory allocation or must use non-default GFP flags. x86 is switched to use generic pte_alloc_one_kernel(), pte_free_kernel() and pte_free(). x86 still implements pte_alloc_one() to allow run-time control of GFP flags required for "userpte" command line option. Link: http://lkml.kernel.org/r/1557296232-15361-2-git-send-email-rppt@linux.ibm.com Signed-off-by: Mike Rapoport Cc: Albert Ou Cc: Anshuman Khandual Cc: Anton Ivanov Cc: Arnd Bergmann Cc: Catalin Marinas Cc: Geert Uytterhoeven Cc: Greentime Hu Cc: Guan Xuetao Cc: Guo Ren Cc: Guo Ren Cc: Helge Deller Cc: Ley Foon Tan Cc: Matthew Wilcox Cc: Matt Turner Cc: Michael Ellerman Cc: Michal Hocko Cc: Palmer Dabbelt Cc: Paul Burton Cc: Ralf Baechle Cc: Richard Kuo Cc: Richard Weinberger Cc: Russell King Cc: Sam Creasey Cc: Vincent Chen Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 790c73690c2bbecb3f6f8becbdb11ddc9bcff8cc Author: Guenter Roeck Date: Thu Jul 11 20:57:46 2019 -0700 mm/gup.c: mark undo_dev_pagemap as __maybe_unused Several mips builds generate the following build warning. mm/gup.c:1788:13: warning: 'undo_dev_pagemap' defined but not used The function is declared unconditionally but only called from behind various ifdefs. Mark it __maybe_unused. Link: http://lkml.kernel.org/r/1562072523-22311-1-git-send-email-linux@roeck-us.net Signed-off-by: Guenter Roeck Reviewed-by: Andrew Morton Cc: Stephen Rothwell Cc: Robin Murphy Cc: Kirill A. Shutemov Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit b5d1c39f34d1c9bca0c4b9ae2e339fbbe264a9c7 Author: Andy Lutomirski Date: Thu Jul 11 20:57:43 2019 -0700 mm/gup.c: remove some BUG_ONs from get_gate_page() If we end up without a PGD or PUD entry backing the gate area, don't BUG -- just fail gracefully. It's not entirely implausible that this could happen some day on x86. It doesn't right now even with an execute-only emulated vsyscall page because the fixmap shares the PUD, but the core mm code shouldn't rely on that particular detail to avoid OOPSing. Link: http://lkml.kernel.org/r/a1d9f4efb75b9d464e59fd6af00104b21c58f6f7.1561610798.git.luto@kernel.org Signed-off-by: Andy Lutomirski Reviewed-by: Kees Cook Reviewed-by: Andrew Morton Cc: Florian Weimer Cc: Jann Horn Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit aa712399c1e8245c375a5c44760de684ec2ebefb Author: Pingfan Liu Date: Thu Jul 11 20:57:39 2019 -0700 mm/gup: speed up check_and_migrate_cma_pages() on huge page Both hugetlb and thp locate on the same migration type of pageblock, since they are allocated from a free_list[]. Based on this fact, it is enough to check on a single subpage to decide the migration type of the whole huge page. By this way, it saves (2M/4K - 1) times loop for pmd_huge on x86, similar on other archs. Furthermore, when executing isolate_huge_page(), it avoid taking global hugetlb_lock many times, and meanless remove/add to the local link list cma_page_list. [akpm@linux-foundation.org: make `i' and `step' unsigned] Link: http://lkml.kernel.org/r/1561612545-28997-1-git-send-email-kernelfans@gmail.com Signed-off-by: Pingfan Liu Reviewed-by: Andrew Morton Reviewed-by: Ira Weiny Cc: Mike Rapoport Cc: "Kirill A. Shutemov" Cc: Thomas Gleixner Cc: John Hubbard Cc: "Aneesh Kumar K.V" Cc: Christoph Hellwig Cc: Keith Busch Cc: Mike Kravetz Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 520b4a4496f12b117b94f3ac7c493651881c5fe3 Author: Christoph Hellwig Date: Thu Jul 11 20:57:36 2019 -0700 mm: mark the page referenced in gup_hugepte All other get_user_page_fast cases mark the page referenced, so do this here as well. Link: http://lkml.kernel.org/r/20190625143715.1689-17-hch@lst.de Signed-off-by: Christoph Hellwig Cc: Andrey Konovalov Cc: Benjamin Herrenschmidt Cc: David Miller Cc: James Hogan Cc: Jason Gunthorpe Cc: Khalid Aziz Cc: Michael Ellerman Cc: Nicholas Piggin Cc: Paul Burton Cc: Paul Mackerras Cc: Ralf Baechle Cc: Rich Felker Cc: Yoshinori Sato Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 01a369160bbea43727aa2b99877f86ebddba9acc Author: Christoph Hellwig Date: Thu Jul 11 20:57:32 2019 -0700 mm: switch gup_hugepte to use try_get_compound_head This applies the overflow fixes from 8fde12ca79aff ("mm: prevent get_user_pages() from overflowing page refcount") to the powerpc hugepd code and brings it back in sync with the other GUP cases. Link: http://lkml.kernel.org/r/20190625143715.1689-16-hch@lst.de Signed-off-by: Christoph Hellwig Cc: Andrey Konovalov Cc: Benjamin Herrenschmidt Cc: David Miller Cc: James Hogan Cc: Jason Gunthorpe Cc: Khalid Aziz Cc: Michael Ellerman Cc: Nicholas Piggin Cc: Paul Burton Cc: Paul Mackerras Cc: Ralf Baechle Cc: Rich Felker Cc: Yoshinori Sato Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit cbd34da7dc9afd521e0bea5e7d12701f4a9da7c7 Author: Christoph Hellwig Date: Thu Jul 11 20:57:28 2019 -0700 mm: move the powerpc hugepd code to mm/gup.c While only powerpc supports the hugepd case, the code is pretty generic and I'd like to keep all GUP internals in one place. Link: http://lkml.kernel.org/r/20190625143715.1689-15-hch@lst.de Signed-off-by: Christoph Hellwig Cc: Andrey Konovalov Cc: Benjamin Herrenschmidt Cc: David Miller Cc: James Hogan Cc: Jason Gunthorpe Cc: Khalid Aziz Cc: Michael Ellerman Cc: Nicholas Piggin Cc: Paul Burton Cc: Paul Mackerras Cc: Ralf Baechle Cc: Rich Felker Cc: Yoshinori Sato Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 817be129e6f254e5bd8c17b1da834c8f612dca28 Author: Christoph Hellwig Date: Thu Jul 11 20:57:25 2019 -0700 mm: validate get_user_pages_fast flags We can only deal with FOLL_WRITE and/or FOLL_LONGTERM in get_user_pages_fast, so reject all other flags. Link: http://lkml.kernel.org/r/20190625143715.1689-14-hch@lst.de Signed-off-by: Christoph Hellwig Cc: Andrey Konovalov Cc: Benjamin Herrenschmidt Cc: David Miller Cc: James Hogan Cc: Jason Gunthorpe Cc: Khalid Aziz Cc: Michael Ellerman Cc: Nicholas Piggin Cc: Paul Burton Cc: Paul Mackerras Cc: Ralf Baechle Cc: Rich Felker Cc: Yoshinori Sato Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 050a9adc64383aed3429a31432b4f5a7b0cdc8ac Author: Christoph Hellwig Date: Thu Jul 11 20:57:21 2019 -0700 mm: consolidate the get_user_pages* implementations Always build mm/gup.c so that we don't have to provide separate nommu stubs. Also merge the get_user_pages_fast and __get_user_pages_fast stubs when HAVE_FAST_GUP into the main implementations, which will never call the fast path if HAVE_FAST_GUP is not set. This also ensures the new put_user_pages* helpers are available for nommu, as those are currently missing, which would create a problem as soon as we actually grew users for it. Link: http://lkml.kernel.org/r/20190625143715.1689-13-hch@lst.de Signed-off-by: Christoph Hellwig Cc: Andrey Konovalov Cc: Benjamin Herrenschmidt Cc: David Miller Cc: James Hogan Cc: Jason Gunthorpe Cc: Khalid Aziz Cc: Michael Ellerman Cc: Nicholas Piggin Cc: Paul Burton Cc: Paul Mackerras Cc: Ralf Baechle Cc: Rich Felker Cc: Yoshinori Sato Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit d3649f68b4336e7ef7aa264cf05ba1265feb0968 Author: Christoph Hellwig Date: Thu Jul 11 20:57:18 2019 -0700 mm: reorder code blocks in gup.c This moves the actually exported functions towards the end of the file, and reorders some functions to be in more logical blocks as a preparation for moving various stubs inline into the main functionality using IS_ENABLED(). Link: http://lkml.kernel.org/r/20190625143715.1689-12-hch@lst.de Signed-off-by: Christoph Hellwig Cc: Andrey Konovalov Cc: Benjamin Herrenschmidt Cc: David Miller Cc: James Hogan Cc: Jason Gunthorpe Cc: Khalid Aziz Cc: Michael Ellerman Cc: Nicholas Piggin Cc: Paul Burton Cc: Paul Mackerras Cc: Ralf Baechle Cc: Rich Felker Cc: Yoshinori Sato Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 67a929e097b774c69253c8b61ef9eb8a42b463a3 Author: Christoph Hellwig Date: Thu Jul 11 20:57:14 2019 -0700 mm: rename CONFIG_HAVE_GENERIC_GUP to CONFIG_HAVE_FAST_GUP We only support the generic GUP now, so rename the config option to be more clear, and always use the mm/Kconfig definition of the symbol and select it from the arch Kconfigs. Link: http://lkml.kernel.org/r/20190625143715.1689-11-hch@lst.de Signed-off-by: Christoph Hellwig Reviewed-by: Khalid Aziz Reviewed-by: Jason Gunthorpe Cc: Andrey Konovalov Cc: Benjamin Herrenschmidt Cc: David Miller Cc: James Hogan Cc: Michael Ellerman Cc: Nicholas Piggin Cc: Paul Burton Cc: Paul Mackerras Cc: Ralf Baechle Cc: Rich Felker Cc: Yoshinori Sato Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 7b9afb86b6328f10dc2cad9223d7def12d60e505 Author: Christoph Hellwig Date: Thu Jul 11 20:57:11 2019 -0700 sparc64: use the generic get_user_pages_fast code The sparc64 code is mostly equivalent to the generic one, minus various bugfixes and two arch overrides that this patch adds to pgtable.h. Link: http://lkml.kernel.org/r/20190625143715.1689-10-hch@lst.de Signed-off-by: Christoph Hellwig Reviewed-by: Khalid Aziz Cc: David Miller Cc: Andrey Konovalov Cc: Benjamin Herrenschmidt Cc: James Hogan Cc: Jason Gunthorpe Cc: Michael Ellerman Cc: Nicholas Piggin Cc: Paul Burton Cc: Paul Mackerras Cc: Ralf Baechle Cc: Rich Felker Cc: Yoshinori Sato Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 5875509d2f30eb8963163f255ded98095989142f Author: Christoph Hellwig Date: Thu Jul 11 20:57:07 2019 -0700 sparc64: define untagged_addr() Add a helper to untag a user pointer. This is needed for ADI support in get_user_pages_fast. Link: http://lkml.kernel.org/r/20190625143715.1689-9-hch@lst.de Signed-off-by: Christoph Hellwig Reviewed-by: Khalid Aziz Cc: David Miller Cc: Andrey Konovalov Cc: Benjamin Herrenschmidt Cc: James Hogan Cc: Jason Gunthorpe Cc: Michael Ellerman Cc: Nicholas Piggin Cc: Paul Burton Cc: Paul Mackerras Cc: Ralf Baechle Cc: Rich Felker Cc: Yoshinori Sato Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit d85507901f6a0a4fbd04cbdd567f4798a695b6d3 Author: Christoph Hellwig Date: Thu Jul 11 20:57:03 2019 -0700 sparc64: add the missing pgd_page definition sparc64 only had pgd_page_vaddr, but not pgd_page. [hch@lst.de: fix sparc64 build] Link: http://lkml.kernel.org/r/20190626131318.GA5101@lst.de Link: http://lkml.kernel.org/r/20190625143715.1689-8-hch@lst.de Signed-off-by: Christoph Hellwig Cc: David Miller Cc: Andrey Konovalov Cc: Benjamin Herrenschmidt Cc: James Hogan Cc: Jason Gunthorpe Cc: Khalid Aziz Cc: Michael Ellerman Cc: Nicholas Piggin Cc: Paul Burton Cc: Paul Mackerras Cc: Ralf Baechle Cc: Rich Felker Cc: Yoshinori Sato Cc: Stephen Rothwell Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 3c9b9accad9f25a52438c790f76b08d79051d383 Author: Christoph Hellwig Date: Thu Jul 11 20:57:00 2019 -0700 sh: use the generic get_user_pages_fast code The sh code is mostly equivalent to the generic one, minus various bugfixes and two arch overrides that this patch adds to pgtable.h. Link: http://lkml.kernel.org/r/20190625143715.1689-7-hch@lst.de Signed-off-by: Christoph Hellwig Cc: Andrey Konovalov Cc: Benjamin Herrenschmidt Cc: David Miller Cc: James Hogan Cc: Jason Gunthorpe Cc: Khalid Aziz Cc: Michael Ellerman Cc: Nicholas Piggin Cc: Paul Burton Cc: Paul Mackerras Cc: Ralf Baechle Cc: Rich Felker Cc: Yoshinori Sato Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 2f85e7f948a2c9f7e1524397d1818191ff5abb03 Author: Christoph Hellwig Date: Thu Jul 11 20:56:56 2019 -0700 sh: add the missing pud_page definition sh only had pud_page_vaddr, but not pud_page. [hch@lst.de: sh: stub out pud_page] Link: http://lkml.kernel.org/r/20190701151818.32227-2-hch@lst.de Link: http://lkml.kernel.org/r/20190625143715.1689-6-hch@lst.de Signed-off-by: Christoph Hellwig Tested-by: Guenter Roeck Cc: Andrey Konovalov Cc: Benjamin Herrenschmidt Cc: David Miller Cc: James Hogan Cc: Jason Gunthorpe Cc: Khalid Aziz Cc: Michael Ellerman Cc: Nicholas Piggin Cc: Paul Burton Cc: Paul Mackerras Cc: Ralf Baechle Cc: Rich Felker Cc: Yoshinori Sato Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 446f062bf06c81de85edd279ee179715c83a4270 Author: Christoph Hellwig Date: Thu Jul 11 20:56:52 2019 -0700 MIPS: use the generic get_user_pages_fast code The mips code is mostly equivalent to the generic one, minus various bugfixes and an arch override for gup_fast_permitted. Note that this defines ARCH_HAS_PTE_SPECIAL for mips as mips has pte_special and pte_mkspecial implemented and used in the existing gup code. They are no-op stubs, though which makes me a little unsure if this is really right thing to do. Note that this also adds back a missing cpu_has_dc_aliases check for __get_user_pages_fast, which the old code was only doing for get_user_pages_fast. This clearly looks like an oversight, as any condition that makes get_user_pages_fast unsafe also applies to __get_user_pages_fast. [hch@lst.de: MIPS: don't select ARCH_HAS_PTE_SPECIAL] Link: http://lkml.kernel.org/r/20190701151818.32227-3-hch@lst.de Link: http://lkml.kernel.org/r/20190625143715.1689-5-hch@lst.de Signed-off-by: Christoph Hellwig Reviewed-by: Jason Gunthorpe Tested-by: Guenter Roeck Cc: Ralf Baechle Cc: Andrey Konovalov Cc: Benjamin Herrenschmidt Cc: David Miller Cc: James Hogan Cc: Khalid Aziz Cc: Michael Ellerman Cc: Nicholas Piggin Cc: Paul Burton Cc: Paul Mackerras Cc: Rich Felker Cc: Yoshinori Sato Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 39656e83dab918861931ef96e5c41731b0899e56 Author: Christoph Hellwig Date: Thu Jul 11 20:56:49 2019 -0700 mm: lift the x86_32 PAE version of gup_get_pte to common code The split low/high access is the only non-READ_ONCE version of gup_get_pte that did show up in the various arch implemenations. Lift it to common code and drop the ifdef based arch override. Link: http://lkml.kernel.org/r/20190625143715.1689-4-hch@lst.de Signed-off-by: Christoph Hellwig Reviewed-by: Jason Gunthorpe Cc: Andrey Konovalov Cc: Benjamin Herrenschmidt Cc: David Miller Cc: James Hogan Cc: Khalid Aziz Cc: Michael Ellerman Cc: Nicholas Piggin Cc: Paul Burton Cc: Paul Mackerras Cc: Ralf Baechle Cc: Rich Felker Cc: Yoshinori Sato Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 26f4c328079d78d6cd0462c53c14ec0b69f4748e Author: Christoph Hellwig Date: Thu Jul 11 20:56:45 2019 -0700 mm: simplify gup_fast_permitted Pass in the already calculated end value instead of recomputing it, and leave the end > start check in the callers instead of duplicating them in the arch code. Link: http://lkml.kernel.org/r/20190625143715.1689-3-hch@lst.de Signed-off-by: Christoph Hellwig Reviewed-by: Jason Gunthorpe Cc: Andrey Konovalov Cc: Benjamin Herrenschmidt Cc: David Miller Cc: James Hogan Cc: Khalid Aziz Cc: Michael Ellerman Cc: Nicholas Piggin Cc: Paul Burton Cc: Paul Mackerras Cc: Ralf Baechle Cc: Rich Felker Cc: Yoshinori Sato Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit f455c854877dcce5d714b00203ea804bf601fb02 Author: Christoph Hellwig Date: Thu Jul 11 20:56:41 2019 -0700 mm: use untagged_addr() for get_user_pages_fast addresses Patch series "switch the remaining architectures to use generic GUP", v4. A series to switch mips, sh and sparc64 to use the generic GUP code so that we only have one codebase to touch for further improvements to this code. This patch (of 16): This will allow sparc64, or any future architecture with memory tagging to override its tags for get_user_pages and get_user_pages_fast. Link: http://lkml.kernel.org/r/20190625143715.1689-2-hch@lst.de Signed-off-by: Christoph Hellwig Reviewed-by: Khalid Aziz Reviewed-by: Jason Gunthorpe Cc: Paul Burton Cc: James Hogan Cc: Yoshinori Sato Cc: Rich Felker Cc: David Miller Cc: Nicholas Piggin Cc: Khalid Aziz Cc: Andrey Konovalov Cc: Benjamin Herrenschmidt Cc: Paul Mackerras Cc: Michael Ellerman Cc: Ralf Baechle Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit fcf8a1e483490cd249df4e02d5425636c3f43c86 Author: Waiman Long Date: Thu Jul 11 20:56:38 2019 -0700 mm, memcg: add a memcg_slabinfo debugfs file There are concerns about memory leaks from extensive use of memory cgroups as each memory cgroup creates its own set of kmem caches. There is a possiblity that the memcg kmem caches may remain even after the memory cgroups have been offlined. Therefore, it will be useful to show the status of each of memcg kmem caches. This patch introduces a new /memcg_slabinfo file which is somewhat similar to /proc/slabinfo in format, but lists only information about kmem caches that have child memcg kmem caches. Information available in /proc/slabinfo are not repeated in memcg_slabinfo. A portion of a sample output of the file was: # rpc_inode_cache root 13 51 1 1 rpc_inode_cache 48 0 0 0 0 fat_inode_cache root 1 45 1 1 fat_inode_cache 41 2 45 1 1 xfs_inode root 770 816 24 24 xfs_inode 92 22 34 1 1 xfs_inode 88:dead 1 34 1 1 xfs_inode 89:dead 23 34 1 1 xfs_inode 85 4 34 1 1 xfs_inode 84 9 34 1 1 The css id of the memcg is also listed. If a memcg is not online, the tag ":dead" will be attached as shown above. [longman@redhat.com: memcg: add ":deact" tag for reparented kmem caches in memcg_slabinfo] Link: http://lkml.kernel.org/r/20190621173005.31514-1-longman@redhat.com [longman@redhat.com: set the flag in the common code as suggested by Roman] Link: http://lkml.kernel.org/r/20190627184324.5875-1-longman@redhat.com Link: http://lkml.kernel.org/r/20190619171621.26209-1-longman@redhat.com Signed-off-by: Waiman Long Suggested-by: Shakeel Butt Reviewed-by: Shakeel Butt Acked-by: Roman Gushchin Acked-by: David Rientjes Cc: Christoph Lameter Cc: Pekka Enberg Cc: Joonsoo Kim Cc: Michal Hocko Cc: Johannes Weiner Cc: Vladimir Davydov Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit fb2f2b0adb98bbbbbb51c5a5327f3f90f5dc417e Author: Roman Gushchin Date: Thu Jul 11 20:56:34 2019 -0700 mm: memcg/slab: reparent memcg kmem_caches on cgroup removal Let's reparent non-root kmem_caches on memcg offlining. This allows us to release the memory cgroup without waiting for the last outstanding kernel object (e.g. dentry used by another application). Since the parent cgroup is already charged, everything we need to do is to splice the list of kmem_caches to the parent's kmem_caches list, swap the memcg pointer, drop the css refcounter for each kmem_cache and adjust the parent's css refcounter. Please, note that kmem_cache->memcg_params.memcg isn't a stable pointer anymore. It's safe to read it under rcu_read_lock(), cgroup_mutex held, or any other way that protects the memory cgroup from being released. We can race with the slab allocation and deallocation paths. It's not a big problem: parent's charge and slab global stats are always correct, and we don't care anymore about the child usage and global stats. The child cgroup is already offline, so we don't use or show it anywhere. Local slab stats (NR_SLAB_RECLAIMABLE and NR_SLAB_UNRECLAIMABLE) aren't used anywhere except count_shadow_nodes(). But even there it won't break anything: after reparenting "nodes" will be 0 on child level (because we're already reparenting shrinker lists), and on parent level page stats always were 0, and this patch won't change anything. [guro@fb.com: properly handle kmem_caches reparented to root_mem_cgroup] Link: http://lkml.kernel.org/r/20190620213427.1691847-1-guro@fb.com Link: http://lkml.kernel.org/r/20190611231813.3148843-11-guro@fb.com Signed-off-by: Roman Gushchin Acked-by: Vladimir Davydov Reviewed-by: Shakeel Butt Acked-by: David Rientjes Cc: Christoph Lameter Cc: Johannes Weiner Cc: Michal Hocko Cc: Waiman Long Cc: David Rientjes Cc: Joonsoo Kim Cc: Pekka Enberg Cc: Andrei Vagin Cc: Qian Cai Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 4d96ba3530750fae3f3f01150adfecde96157815 Author: Roman Gushchin Date: Thu Jul 11 20:56:31 2019 -0700 mm: memcg/slab: stop setting page->mem_cgroup pointer for slab pages Every slab page charged to a non-root memory cgroup has a pointer to the memory cgroup and holds a reference to it, which protects a non-empty memory cgroup from being released. At the same time the page has a pointer to the corresponding kmem_cache, and also hold a reference to the kmem_cache. And kmem_cache by itself holds a reference to the cgroup. So there is clearly some redundancy, which allows to stop setting the page->mem_cgroup pointer and rely on getting memcg pointer indirectly via kmem_cache. Further it will allow to change this pointer easier, without a need to go over all charged pages. So let's stop setting page->mem_cgroup pointer for slab pages, and stop using the css refcounter directly for protecting the memory cgroup from going away. Instead rely on kmem_cache as an intermediate object. Make sure that vmstats and shrinker lists are working as previously, as well as /proc/kpagecgroup interface. Link: http://lkml.kernel.org/r/20190611231813.3148843-10-guro@fb.com Signed-off-by: Roman Gushchin Acked-by: Vladimir Davydov Reviewed-by: Shakeel Butt Cc: Christoph Lameter Cc: Johannes Weiner Cc: Michal Hocko Cc: Waiman Long Cc: David Rientjes Cc: Joonsoo Kim Cc: Pekka Enberg Cc: Andrei Vagin Cc: Qian Cai Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit f0a3a24b532d9a7e56a33c5112b2a212ed6ec580 Author: Roman Gushchin Date: Thu Jul 11 20:56:27 2019 -0700 mm: memcg/slab: rework non-root kmem_cache lifecycle management Currently each charged slab page holds a reference to the cgroup to which it's charged. Kmem_caches are held by the memcg and are released all together with the memory cgroup. It means that none of kmem_caches are released unless at least one reference to the memcg exists, which is very far from optimal. Let's rework it in a way that allows releasing individual kmem_caches as soon as the cgroup is offline, the kmem_cache is empty and there are no pending allocations. To make it possible, let's introduce a new percpu refcounter for non-root kmem caches. The counter is initialized to the percpu mode, and is switched to the atomic mode during kmem_cache deactivation. The counter is bumped for every charged page and also for every running allocation. So the kmem_cache can't be released unless all allocations complete. To shutdown non-active empty kmem_caches, let's reuse the work queue, previously used for the kmem_cache deactivation. Once the reference counter reaches 0, let's schedule an asynchronous kmem_cache release. * I used the following simple approach to test the performance (stolen from another patchset by T. Harding): time find / -name fname-no-exist echo 2 > /proc/sys/vm/drop_caches repeat 10 times Results: orig patched real 0m1.455s real 0m1.355s user 0m0.206s user 0m0.219s sys 0m0.855s sys 0m0.807s real 0m1.487s real 0m1.699s user 0m0.221s user 0m0.256s sys 0m0.806s sys 0m0.948s real 0m1.515s real 0m1.505s user 0m0.183s user 0m0.215s sys 0m0.876s sys 0m0.858s real 0m1.291s real 0m1.380s user 0m0.193s user 0m0.198s sys 0m0.843s sys 0m0.786s real 0m1.364s real 0m1.374s user 0m0.180s user 0m0.182s sys 0m0.868s sys 0m0.806s real 0m1.352s real 0m1.312s user 0m0.201s user 0m0.212s sys 0m0.820s sys 0m0.761s real 0m1.302s real 0m1.349s user 0m0.205s user 0m0.203s sys 0m0.803s sys 0m0.792s real 0m1.334s real 0m1.301s user 0m0.194s user 0m0.201s sys 0m0.806s sys 0m0.779s real 0m1.426s real 0m1.434s user 0m0.216s user 0m0.181s sys 0m0.824s sys 0m0.864s real 0m1.350s real 0m1.295s user 0m0.200s user 0m0.190s sys 0m0.842s sys 0m0.811s So it looks like the difference is not noticeable in this test. [cai@lca.pw: fix an use-after-free in kmemcg_workfn()] Link: http://lkml.kernel.org/r/1560977573-10715-1-git-send-email-cai@lca.pw Link: http://lkml.kernel.org/r/20190611231813.3148843-9-guro@fb.com Signed-off-by: Roman Gushchin Signed-off-by: Qian Cai Acked-by: Vladimir Davydov Cc: Christoph Lameter Cc: Johannes Weiner Cc: Michal Hocko Cc: Shakeel Butt Cc: Waiman Long Cc: David Rientjes Cc: Joonsoo Kim Cc: Pekka Enberg Cc: Andrei Vagin Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 63b02ef7dc4ec239df45c018ac0adbd02ba30a0c Author: Roman Gushchin Date: Thu Jul 11 20:56:24 2019 -0700 mm: memcg/slab: synchronize access to kmem_cache dying flag using a spinlock Currently the memcg_params.dying flag and the corresponding workqueue used for the asynchronous deactivation of kmem_caches is synchronized using the slab_mutex. It makes impossible to check this flag from the irq context, which will be required in order to implement asynchronous release of kmem_caches. So let's switch over to the irq-save flavor of the spinlock-based synchronization. Link: http://lkml.kernel.org/r/20190611231813.3148843-8-guro@fb.com Signed-off-by: Roman Gushchin Acked-by: Vladimir Davydov Reviewed-by: Shakeel Butt Cc: Christoph Lameter Cc: Johannes Weiner Cc: Michal Hocko Cc: Waiman Long Cc: David Rientjes Cc: Joonsoo Kim Cc: Pekka Enberg Cc: Andrei Vagin Cc: Qian Cai Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 570332978ea7fdbec86a07086a584d796a87da2c Author: Roman Gushchin Date: Thu Jul 11 20:56:20 2019 -0700 mm: memcg/slab: don't check the dying flag on kmem_cache creation There is no point in checking the root_cache->memcg_params.dying flag on kmem_cache creation path. New allocations shouldn't be performed using a dead root kmem_cache, so no new memcg kmem_cache creation can be scheduled after the flag is set. And if it was scheduled before, flush_memcg_workqueue() will wait for it anyway. So let's drop this check to simplify the code. Link: http://lkml.kernel.org/r/20190611231813.3148843-7-guro@fb.com Signed-off-by: Roman Gushchin Acked-by: Vladimir Davydov Reviewed-by: Shakeel Butt Cc: Christoph Lameter Cc: Johannes Weiner Cc: Michal Hocko Cc: Waiman Long Cc: David Rientjes Cc: Joonsoo Kim Cc: Pekka Enberg Cc: Andrei Vagin Cc: Qian Cai Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 6cea1d569d24af6f9e95f70cb301807440ae2981 Author: Roman Gushchin Date: Thu Jul 11 20:56:16 2019 -0700 mm: memcg/slab: unify SLAB and SLUB page accounting Currently the page accounting code is duplicated in SLAB and SLUB internals. Let's move it into new (un)charge_slab_page helpers in the slab_common.c file. These helpers will be responsible for statistics (global and memcg-aware) and memcg charging. So they are replacing direct memcg_(un)charge_slab() calls. Link: http://lkml.kernel.org/r/20190611231813.3148843-6-guro@fb.com Signed-off-by: Roman Gushchin Reviewed-by: Shakeel Butt Acked-by: Christoph Lameter Acked-by: Vladimir Davydov Acked-by: Johannes Weiner Cc: Michal Hocko Cc: Waiman Long Cc: David Rientjes Cc: Joonsoo Kim Cc: Pekka Enberg Cc: Andrei Vagin Cc: Qian Cai Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 49a18eae2e98a794477b5af5d85938e430c0be72 Author: Roman Gushchin Date: Thu Jul 11 20:56:13 2019 -0700 mm: memcg/slab: introduce __memcg_kmem_uncharge_memcg() Let's separate the page counter modification code out of __memcg_kmem_uncharge() in a way similar to what __memcg_kmem_charge() and __memcg_kmem_charge_memcg() work. This will allow to reuse this code later using a new memcg_kmem_uncharge_memcg() wrapper, which calls __memcg_kmem_uncharge_memcg() if memcg_kmem_enabled() check is passed. Link: http://lkml.kernel.org/r/20190611231813.3148843-5-guro@fb.com Signed-off-by: Roman Gushchin Reviewed-by: Shakeel Butt Acked-by: Vladimir Davydov Cc: Christoph Lameter Cc: Johannes Weiner Cc: Michal Hocko Cc: Waiman Long Cc: David Rientjes Cc: Joonsoo Kim Cc: Pekka Enberg Cc: Andrei Vagin Cc: Qian Cai Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 434866947564b954409c2fe561605e22f7b49f64 Author: Roman Gushchin Date: Thu Jul 11 20:56:09 2019 -0700 mm: memcg/slab: generalize postponed non-root kmem_cache deactivation Currently SLUB uses a work scheduled after an RCU grace period to deactivate a non-root kmem_cache. This mechanism can be reused for kmem_caches release, but requires generalization for SLAB case. Introduce kmemcg_cache_deactivate() function, which calls allocator-specific __kmem_cache_deactivate() and schedules execution of __kmem_cache_deactivate_after_rcu() with all necessary locks in a worker context after an rcu grace period. Here is the new calling scheme: kmemcg_cache_deactivate() __kmemcg_cache_deactivate() SLAB/SLUB-specific kmemcg_rcufn() rcu kmemcg_workfn() work __kmemcg_cache_deactivate_after_rcu() SLAB/SLUB-specific instead of: __kmemcg_cache_deactivate() SLAB/SLUB-specific slab_deactivate_memcg_cache_rcu_sched() SLUB-only kmemcg_rcufn() rcu kmemcg_workfn() work kmemcg_cache_deact_after_rcu() SLUB-only For consistency, all allocator-specific functions start with "__". Link: http://lkml.kernel.org/r/20190611231813.3148843-4-guro@fb.com Signed-off-by: Roman Gushchin Acked-by: Vladimir Davydov Reviewed-by: Shakeel Butt Cc: Christoph Lameter Cc: Johannes Weiner Cc: Michal Hocko Cc: Waiman Long Cc: David Rientjes Cc: Joonsoo Kim Cc: Pekka Enberg Cc: Andrei Vagin Cc: Qian Cai Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 0b14e8aa68223c2c124d408aa4b110b364d13c53 Author: Roman Gushchin Date: Thu Jul 11 20:56:06 2019 -0700 mm: memcg/slab: rename slab delayed deactivation functions and fields The delayed work/rcu deactivation infrastructure of non-root kmem_caches can be also used for asynchronous release of these objects. Let's get rid of the word "deactivation" in corresponding names to make the code look better after generalization. It's easier to make the renaming first, so that the generalized code will look consistent from scratch. Let's rename struct memcg_cache_params fields: deact_fn -> work_fn deact_rcu_head -> rcu_head deact_work -> work And RCU/delayed work callbacks in slab common code: kmemcg_deactivate_rcufn -> kmemcg_rcufn kmemcg_deactivate_workfn -> kmemcg_workfn This patch contains no functional changes, only renamings. Link: http://lkml.kernel.org/r/20190611231813.3148843-3-guro@fb.com Signed-off-by: Roman Gushchin Acked-by: Vladimir Davydov Reviewed-by: Shakeel Butt Cc: Christoph Lameter Cc: Johannes Weiner Cc: Michal Hocko Cc: Waiman Long Cc: David Rientjes Cc: Joonsoo Kim Cc: Pekka Enberg Cc: Andrei Vagin Cc: Qian Cai Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit c03914b7aa319fb2b6701a6427c13752c7418b9b Author: Roman Gushchin Date: Thu Jul 11 20:56:02 2019 -0700 mm: memcg/slab: postpone kmem_cache memcg pointer initialization to memcg_link_cache() Patch series "mm: reparent slab memory on cgroup removal", v7. # Why do we need this? We've noticed that the number of dying cgroups is steadily growing on most of our hosts in production. The following investigation revealed an issue in the userspace memory reclaim code [1], accounting of kernel stacks [2], and also the main reason: slab objects. The underlying problem is quite simple: any page charged to a cgroup holds a reference to it, so the cgroup can't be reclaimed unless all charged pages are gone. If a slab object is actively used by other cgroups, it won't be reclaimed, and will prevent the origin cgroup from being reclaimed. Slab objects, and first of all vfs cache, is shared between cgroups, which are using the same underlying fs, and what's even more important, it's shared between multiple generations of the same workload. So if something is running periodically every time in a new cgroup (like how systemd works), we do accumulate multiple dying cgroups. Strictly speaking pagecache isn't different here, but there is a key difference: we disable protection and apply some extra pressure on LRUs of dying cgroups, and these LRUs contain all charged pages. My experiments show that with the disabled kernel memory accounting the number of dying cgroups stabilizes at a relatively small number (~100, depends on memory pressure and cgroup creation rate), and with kernel memory accounting it grows pretty steadily up to several thousands. Memory cgroups are quite complex and big objects (mostly due to percpu stats), so it leads to noticeable memory losses. Memory occupied by dying cgroups is measured in hundreds of megabytes. I've even seen a host with more than 100Gb of memory wasted for dying cgroups. It leads to a degradation of performance with the uptime, and generally limits the usage of cgroups. My previous attempt [3] to fix the problem by applying extra pressure on slab shrinker lists caused a regressions with xfs and ext4, and has been reverted [4]. The following attempts to find the right balance [5, 6] were not successful. So instead of trying to find a maybe non-existing balance, let's do reparent accounted slab caches to the parent cgroup on cgroup removal. # Implementation approach There is however a significant problem with reparenting of slab memory: there is no list of charged pages. Some of them are in shrinker lists, but not all. Introducing of a new list is really not an option. But fortunately there is a way forward: every slab page has a stable pointer to the corresponding kmem_cache. So the idea is to reparent kmem_caches instead of slab pages. It's actually simpler and cheaper, but requires some underlying changes: 1) Make kmem_caches to hold a single reference to the memory cgroup, instead of a separate reference per every slab page. 2) Stop setting page->mem_cgroup pointer for memcg slab pages and use page->kmem_cache->memcg indirection instead. It's used only on slab page release, so performance overhead shouldn't be a big issue. 3) Introduce a refcounter for non-root slab caches. It's required to be able to destroy kmem_caches when they become empty and release the associated memory cgroup. There is a bonus: currently we release all memcg kmem_caches all together with the memory cgroup itself. This patchset allows individual kmem_caches to be released as soon as they become inactive and free. Some additional implementation details are provided in corresponding commit messages. # Results Below is the average number of dying cgroups on two groups of our production hosts. They do run some sort of web frontend workload, the memory pressure is moderate. As we can see, with the kernel memory reparenting the number stabilizes in 60s range; however with the original version it grows almost linearly and doesn't show any signs of plateauing. The difference in slab and percpu usage between patched and unpatched versions also grows linearly. In 7 days it exceeded 200Mb. day 0 1 2 3 4 5 6 7 original 56 362 628 752 1070 1250 1490 1560 patched 23 46 51 55 60 57 67 69 mem diff(Mb) 22 74 123 152 164 182 214 241 # Links [1]: commit 68600f623d69 ("mm: don't miss the last page because of round-off error") [2]: commit 9b6f7e163cd0 ("mm: rework memcg kernel stack accounting") [3]: commit 172b06c32b94 ("mm: slowly shrink slabs with a relatively small number of objects") [4]: commit a9a238e83fbb ("Revert "mm: slowly shrink slabs with a relatively small number of objects") [5]: https://lkml.org/lkml/2019/1/28/1865 [6]: https://marc.info/?l=linux-mm&m=155064763626437&w=2 This patch (of 10): Initialize kmem_cache->memcg_params.memcg pointer in memcg_link_cache() rather than in init_memcg_params(). Once kmem_cache will hold a reference to the memory cgroup, it will simplify the refcounting. For non-root kmem_caches memcg_link_cache() is always called before the kmem_cache becomes visible to a user, so it's safe. Link: http://lkml.kernel.org/r/20190611231813.3148843-2-guro@fb.com Signed-off-by: Roman Gushchin Reviewed-by: Shakeel Butt Acked-by: Vladimir Davydov Acked-by: Johannes Weiner Cc: Waiman Long Cc: Michal Hocko Cc: Christoph Lameter Cc: Pekka Enberg Cc: David Rientjes Cc: Joonsoo Kim Cc: Andrei Vagin Cc: Qian Cai Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit c8713d0b23123759c9d86b0421243c2c309505d7 Author: Johannes Weiner Date: Thu Jul 11 20:55:59 2019 -0700 mm: memcontrol: dump memory.stat during cgroup OOM The current cgroup OOM memory info dump doesn't include all the memory we are tracking, nor does it give insight into what the VM tried to do leading up to the OOM. All that useful info is in memory.stat. Furthermore, the recursive printing for every child cgroup can generate absurd amounts of data on the console for larger cgroup trees, and it's not like we provide a per-cgroup breakdown during global OOM kills. When an OOM kill is triggered, print one set of recursive memory.stat items at the level whose limit triggered the OOM condition. Example output: stress invoked oom-killer: gfp_mask=0x100cca(GFP_HIGHUSER_MOVABLE), order=0, oom_score_adj=0 CPU: 2 PID: 210 Comm: stress Not tainted 5.2.0-rc2-mm1-00247-g47d49835983c #135 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-20181126_142135-anatol 04/01/2014 Call Trace: dump_stack+0x46/0x60 dump_header+0x4c/0x2d0 oom_kill_process.cold.10+0xb/0x10 out_of_memory+0x200/0x270 ? try_to_free_mem_cgroup_pages+0xdf/0x130 mem_cgroup_out_of_memory+0xb7/0xc0 try_charge+0x680/0x6f0 mem_cgroup_try_charge+0xb5/0x160 __add_to_page_cache_locked+0xc6/0x300 ? list_lru_destroy+0x80/0x80 add_to_page_cache_lru+0x45/0xc0 pagecache_get_page+0x11b/0x290 filemap_fault+0x458/0x6d0 ext4_filemap_fault+0x27/0x36 __do_fault+0x2f/0xb0 __handle_mm_fault+0x9c5/0x1140 ? apic_timer_interrupt+0xa/0x20 handle_mm_fault+0xc5/0x180 __do_page_fault+0x1ab/0x440 ? page_fault+0x8/0x30 page_fault+0x1e/0x30 RIP: 0033:0x55c32167fc10 Code: Bad RIP value. RSP: 002b:00007fff1d031c50 EFLAGS: 00010206 RAX: 000000000dc00000 RBX: 00007fd2db000010 RCX: 00007fd2db000010 RDX: 0000000000000000 RSI: 0000000010001000 RDI: 0000000000000000 RBP: 000055c321680a54 R08: 00000000ffffffff R09: 0000000000000000 R10: 0000000000000022 R11: 0000000000000246 R12: ffffffffffffffff R13: 0000000000000002 R14: 0000000000001000 R15: 0000000010000000 memory: usage 1024kB, limit 1024kB, failcnt 75131 swap: usage 0kB, limit 9007199254740988kB, failcnt 0 Memory cgroup stats for /foo: anon 0 file 0 kernel_stack 36864 slab 274432 sock 0 shmem 0 file_mapped 0 file_dirty 0 file_writeback 0 anon_thp 0 inactive_anon 126976 active_anon 0 inactive_file 0 active_file 0 unevictable 0 slab_reclaimable 0 slab_unreclaimable 274432 pgfault 59466 pgmajfault 1617 workingset_refault 2145 workingset_activate 0 workingset_nodereclaim 0 pgrefill 98952 pgscan 200060 pgsteal 59340 pgactivate 40095 pgdeactivate 96787 pglazyfree 0 pglazyfreed 0 thp_fault_alloc 0 thp_collapse_alloc 0 Tasks state (memory values in pages): [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name [ 200] 0 200 1121 884 53248 29 0 bash [ 209] 0 209 905 246 45056 19 0 stress [ 210] 0 210 66442 56 499712 56349 0 stress oom-kill:constraint=CONSTRAINT_NONE,nodemask=(null),oom_memcg=/foo,task_memcg=/foo,task=stress,pid=210,uid=0 Memory cgroup out of memory: Killed process 210 (stress) total-vm:265768kB, anon-rss:0kB, file-rss:224kB, shmem-rss:0kB oom_reaper: reaped process 210 (stress), now anon-rss:0kB, file-rss:0kB, shmem-rss:0kB [hannes@cmpxchg.org: s/kvmalloc/kmalloc/ per Michal] Link: http://lkml.kernel.org/r/20190605161133.GA12453@cmpxchg.org Link: http://lkml.kernel.org/r/20190604210509.9744-1-hannes@cmpxchg.org Signed-off-by: Johannes Weiner Acked-by: Michal Hocko Cc: Vladimir Davydov Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 1e577f970f66a53d429cbee37b36177c9712f488 Author: Shakeel Butt Date: Thu Jul 11 20:55:55 2019 -0700 mm, memcg: introduce memory.events.local The memory controller in cgroup v2 exposes memory.events file for each memcg which shows the number of times events like low, high, max, oom and oom_kill have happened for the whole tree rooted at that memcg. Users can also poll or register notification to monitor the changes in that file. Any event at any level of the tree rooted at memcg will notify all the listeners along the path till root_mem_cgroup. There are existing users which depend on this behavior. However there are users which are only interested in the events happening at a specific level of the memcg tree and not in the events in the underlying tree rooted at that memcg. One such use-case is a centralized resource monitor which can dynamically adjust the limits of the jobs running on a system. The jobs can create their sub-hierarchy for their own sub-tasks. The centralized monitor is only interested in the events at the top level memcgs of the jobs as it can then act and adjust the limits of the jobs. Using the current memory.events for such centralized monitor is very inconvenient. The monitor will keep receiving events which it is not interested and to find if the received event is interesting, it has to read memory.event files of the next level and compare it with the top level one. So, let's introduce memory.events.local to the memcg which shows and notify for the events at the memcg level. Now, does memory.stat and memory.pressure need their local versions. IMHO no due to the no internal process contraint of the cgroup v2. The memory.stat file of the top level memcg of a job shows the stats and vmevents of the whole tree. The local stats or vmevents of the top level memcg will only change if there is a process running in that memcg but v2 does not allow that. Similarly for memory.pressure there will not be any process in the internal nodes and thus no chance of local pressure. Link: http://lkml.kernel.org/r/20190527174643.209172-1-shakeelb@google.com Signed-off-by: Shakeel Butt Reviewed-by: Roman Gushchin Acked-by: Johannes Weiner Acked-by: Michal Hocko Cc: Vladimir Davydov Cc: Chris Down Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit ec165450968b26298bd1c373de37b0ab6d826b33 Author: Shakeel Butt Date: Thu Jul 11 20:55:52 2019 -0700 memcg, fsnotify: no oom-kill for remote memcg charging Commit d46eb14b735b ("fs: fsnotify: account fsnotify metadata to kmemcg") added remote memcg charging for fanotify and inotify event objects. The aim was to charge the memory to the listener who is interested in the events but without triggering the OOM killer. Otherwise there would be security concerns for the listener. At the time, oom-kill trigger was not in the charging path. A parallel work added the oom-kill back to charging path i.e. commit 29ef680ae7c2 ("memcg, oom: move out_of_memory back to the charge path"). So to not trigger oom-killer in the remote memcg, explicitly add __GFP_RETRY_MAYFAIL to the fanotigy and inotify event allocations. Link: http://lkml.kernel.org/r/20190514212259.156585-2-shakeelb@google.com Signed-off-by: Shakeel Butt Reviewed-by: Roman Gushchin Acked-by: Jan Kara Cc: Johannes Weiner Cc: Vladimir Davydov Cc: Michal Hocko Cc: Amir Goldstein Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 38d384932ed1b58f0ed8dd17c66e0cd89acb354a Author: Shakeel Butt Date: Thu Jul 11 20:55:48 2019 -0700 memcg, oom: no oom-kill for __GFP_RETRY_MAYFAIL The documentation of __GFP_RETRY_MAYFAIL clearly mentioned that the OOM killer will not be triggered and indeed the page alloc does not invoke OOM killer for such allocations. However we do trigger memcg OOM killer for __GFP_RETRY_MAYFAIL. Fix that. This flag will used later to not trigger oom-killer in the charging path for fanotify and inotify event allocations. Link: http://lkml.kernel.org/r/20190514212259.156585-1-shakeelb@google.com Signed-off-by: Shakeel Butt Acked-by: Michal Hocko Cc: Amir Goldstein Cc: Jan Kara Cc: Johannes Weiner Cc: Roman Gushchin Cc: Vladimir Davydov Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit aeb309b81c6bada783c3695528a3e10748e97285 Author: Huang Ying Date: Thu Jul 11 20:55:44 2019 -0700 mm/mincore.c: fix race between swapoff and mincore Via commit 4b3ef9daa4fc ("mm/swap: split swap cache into 64MB trunks"), after swapoff, the address_space associated with the swap device will be freed. So swap_address_space() users which touch the address_space need some kind of mechanism to prevent the address_space from being freed during accessing. When mincore processes an unmapped range for swapped shmem pages, it doesn't hold the lock to prevent swap device from being swapped off. So the following race is possible: CPU1 CPU2 do_mincore() swapoff() walk_page_range() mincore_unmapped_range() __mincore_unmapped_range mincore_page as = swap_address_space() ... exit_swap_address_space() ... kvfree(spaces) find_get_page(as) The address space may be accessed after being freed. To fix the race, get_swap_device()/put_swap_device() is used to enclose find_get_page() to check whether the swap entry is valid and prevent the swap device from being swapoff during accessing. Link: http://lkml.kernel.org/r/20190611020510.28251-1-ying.huang@intel.com Fixes: 4b3ef9daa4fc ("mm/swap: split swap cache into 64MB trunks") Signed-off-by: "Huang, Ying" Reviewed-by: Andrew Morton Acked-by: Michal Hocko Cc: Hugh Dickins Cc: Paul E. McKenney Cc: Minchan Kim Cc: Johannes Weiner Cc: Tim Chen Cc: Mel Gorman Cc: Jérôme Glisse Cc: Andrea Arcangeli Cc: Yang Shi Cc: David Rientjes Cc: Rik van Riel Cc: Jan Kara Cc: Dave Jiang Cc: Daniel Jordan Cc: Andrea Parri Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 4efaceb1c5f8136d5fec3f26549d294b8e898bd7 Author: Aaron Lu Date: Thu Jul 11 20:55:41 2019 -0700 mm, swap: use rbtree for swap_extent swap_extent is used to map swap page offset to backing device's block offset. For a continuous block range, one swap_extent is used and all these swap_extents are managed in a linked list. These swap_extents are used by map_swap_entry() during swap's read and write path. To find out the backing device's block offset for a page offset, the swap_extent list will be traversed linearly, with curr_swap_extent being used as a cache to speed up the search. This works well as long as swap_extents are not huge or when the number of processes that access swap device are few, but when the swap device has many extents and there are a number of processes accessing the swap device concurrently, it can be a problem. On one of our servers, the disk's remaining size is tight: $df -h Filesystem Size Used Avail Use% Mounted on ... ... /dev/nvme0n1p1 1.8T 1.3T 504G 72% /home/t4 When creating a 80G swapfile there, there are as many as 84656 swap extents. The end result is, kernel spends abou 30% time in map_swap_entry() and swap throughput is only 70MB/s. As a comparison, when I used smaller sized swapfile, like 4G whose swap_extent dropped to 2000, swap throughput is back to 400-500MB/s and map_swap_entry() is about 3%. One downside of using rbtree for swap_extent is, 'struct rbtree' takes 24 bytes while 'struct list_head' takes 16 bytes, that's 8 bytes more for each swap_extent. For a swapfile that has 80k swap_extents, that means 625KiB more memory consumed. Test: Since it's not possible to reboot that server, I can not test this patch diretly there. Instead, I tested it on another server with NVMe disk. I created a 20G swapfile on an NVMe backed XFS fs. By default, the filesystem is quite clean and the created swapfile has only 2 extents. Testing vanilla and this patch shows no obvious performance difference when swapfile is not fragmented. To see the patch's effects, I used some tweaks to manually fragment the swapfile by breaking the extent at 1M boundary. This made the swapfile have 20K extents. nr_task=4 kernel swapout(KB/s) map_swap_entry(perf) swapin(KB/s) map_swap_entry(perf) vanilla 165191 90.77% 171798 90.21% patched 858993 +420% 2.16% 715827 +317% 0.77% nr_task=8 kernel swapout(KB/s) map_swap_entry(perf) swapin(KB/s) map_swap_entry(perf) vanilla 306783 92.19% 318145 87.76% patched 954437 +211% 2.35% 1073741 +237% 1.57% swapout: the throughput of swap out, in KB/s, higher is better 1st map_swap_entry: cpu cycles percent sampled by perf swapin: the throughput of swap in, in KB/s, higher is better. 2nd map_swap_entry: cpu cycles percent sampled by perf nr_task=1 doesn't show any difference, this is due to the curr_swap_extent can be effectively used to cache the correct swap extent for single task workload. [akpm@linux-foundation.org: s/BUG_ON(1)/BUG()/] Link: http://lkml.kernel.org/r/20190523142404.GA181@aaronlu Signed-off-by: Aaron Lu Cc: Huang Ying Cc: Hugh Dickins Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 054f1d1faaed6a7930b77286d607ae45c01d0443 Author: Huang Ying Date: Thu Jul 11 20:55:37 2019 -0700 mm/swap_state.c: simplify total_swapcache_pages() with get_swap_device() total_swapcache_pages() may race with swapper_spaces[] allocation and freeing. Previously, this is protected with a swapper_spaces[] specific RCU mechanism. To simplify the logic/code complexity, it is replaced with get/put_swap_device(). The code line number is reduced too. Although not so important, the swapoff() performance improves too because one synchronize_rcu() call during swapoff() is deleted. [ying.huang@intel.com: fix bad swap file entry warning] Link: http://lkml.kernel.org/r/20190531024102.21723-1-ying.huang@intel.com Link: http://lkml.kernel.org/r/20190527082714.12151-1-ying.huang@intel.com Signed-off-by: "Huang, Ying" Reviewed-by: Andrew Morton Tested-by: Mike Kravetz Cc: Hugh Dickins Cc: Paul E. McKenney Cc: Minchan Kim Cc: Johannes Weiner Cc: Tim Chen Cc: Mel Gorman Cc: Jérôme Glisse Cc: Michal Hocko Cc: Andrea Arcangeli Cc: Yang Shi Cc: David Rientjes Cc: Rik van Riel Cc: Jan Kara Cc: Dave Jiang Cc: Daniel Jordan Cc: Andrea Parri Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit eb085574a7526c4375965c5fbf7e5b0c19cdd336 Author: Huang Ying Date: Thu Jul 11 20:55:33 2019 -0700 mm, swap: fix race between swapoff and some swap operations When swapin is performed, after getting the swap entry information from the page table, system will swap in the swap entry, without any lock held to prevent the swap device from being swapoff. This may cause the race like below, CPU 1 CPU 2 ----- ----- do_swap_page swapin_readahead __read_swap_cache_async swapoff swapcache_prepare p->swap_map = NULL __swap_duplicate p->swap_map[?] /* !!! NULL pointer access */ Because swapoff is usually done when system shutdown only, the race may not hit many people in practice. But it is still a race need to be fixed. To fix the race, get_swap_device() is added to check whether the specified swap entry is valid in its swap device. If so, it will keep the swap entry valid via preventing the swap device from being swapoff, until put_swap_device() is called. Because swapoff() is very rare code path, to make the normal path runs as fast as possible, rcu_read_lock/unlock() and synchronize_rcu() instead of reference count is used to implement get/put_swap_device(). >From get_swap_device() to put_swap_device(), RCU reader side is locked, so synchronize_rcu() in swapoff() will wait until put_swap_device() is called. In addition to swap_map, cluster_info, etc. data structure in the struct swap_info_struct, the swap cache radix tree will be freed after swapoff, so this patch fixes the race between swap cache looking up and swapoff too. Races between some other swap cache usages and swapoff are fixed too via calling synchronize_rcu() between clearing PageSwapCache() and freeing swap cache data structure. Another possible method to fix this is to use preempt_off() + stop_machine() to prevent the swap device from being swapoff when its data structure is being accessed. The overhead in hot-path of both methods is similar. The advantages of RCU based method are, 1. stop_machine() may disturb the normal execution code path on other CPUs. 2. File cache uses RCU to protect its radix tree. If the similar mechanism is used for swap cache too, it is easier to share code between them. 3. RCU is used to protect swap cache in total_swapcache_pages() and exit_swap_address_space() already. The two mechanisms can be merged to simplify the logic. Link: http://lkml.kernel.org/r/20190522015423.14418-1-ying.huang@intel.com Fixes: 235b62176712 ("mm/swap: add cluster lock") Signed-off-by: "Huang, Ying" Reviewed-by: Andrea Parri Not-nacked-by: Hugh Dickins Cc: Andrea Arcangeli Cc: Paul E. McKenney Cc: Daniel Jordan Cc: Michal Hocko Cc: Minchan Kim Cc: Johannes Weiner Cc: Tim Chen Cc: Mel Gorman Cc: Jérôme Glisse Cc: Yang Shi Cc: David Rientjes Cc: Rik van Riel Cc: Jan Kara Cc: Dave Jiang Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit a4985833885b8f568bab90d5dc1886ae68dc82cf Author: Yang Shi Date: Thu Jul 11 20:55:29 2019 -0700 mm/filemap.c: correct the comment about VM_FAULT_RETRY Commit 6b4c9f446981 ("filemap: drop the mmap_sem for all blocking operations") changed when mmap_sem is dropped during filemap page fault and when returning VM_FAULT_RETRY. Correct the comment to reflect the change. Link: http://lkml.kernel.org/r/1556234531-108228-1-git-send-email-yang.shi@linux.alibaba.com Signed-off-by: Yang Shi Reviewed-by: Josef Bacik Acked-by: Song Liu Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit f053cbd4366051d7eb6ba1b8d529d20f719c2963 Author: Christoph Hellwig Date: Thu Jul 11 20:55:26 2019 -0700 9p: pass the correct prototype to read_cache_page Fix the callback 9p passes to read_cache_page to actually have the proper type expected. Casting around function pointers can easily hide typing bugs, and defeats control flow protection. Link: http://lkml.kernel.org/r/20190520055731.24538-5-hch@lst.de Signed-off-by: Christoph Hellwig Reviewed-by: Kees Cook Cc: Sami Tolvanen Cc: Nick Desaulniers Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 265de8ce3d5b3c70644a1a45457580bb07548b56 Author: Christoph Hellwig Date: Thu Jul 11 20:55:23 2019 -0700 jffs2: pass the correct prototype to read_cache_page Fix the callback jffs2 passes to read_cache_page to actually have the proper type expected. Casting around function pointers can easily hide typing bugs, and defeats control flow protection. Link: http://lkml.kernel.org/r/20190520055731.24538-4-hch@lst.de Signed-off-by: Christoph Hellwig Reviewed-by: Kees Cook Cc: Nick Desaulniers Cc: Sami Tolvanen Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 6c45b454191b330c8bc21d1ed3cf39bb6da1a4eb Author: Christoph Hellwig Date: Thu Jul 11 20:55:20 2019 -0700 mm/filemap: don't cast ->readpage to filler_t for do_read_cache_page We can just pass a NULL filler and do the right thing inside of do_read_cache_page based on the NULL parameter. Link: http://lkml.kernel.org/r/20190520055731.24538-3-hch@lst.de Signed-off-by: Christoph Hellwig Reviewed-by: Kees Cook Cc: Nick Desaulniers Cc: Sami Tolvanen Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit d322a8e5e3e9742fa6b76a207e5df57e03f318f9 Author: Christoph Hellwig Date: Thu Jul 11 20:55:17 2019 -0700 mm/filemap.c: fix an overly long line in read_cache_page Patch series "fix filler_t callback type mismatches", v2. Casting mapping->a_ops->readpage to filler_t causes an indirect call type mismatch with Control-Flow Integrity checking. This change fixes the mismatch in read_cache_page_gfp and read_mapping_page by adding using a NULL filler argument as an indication to call ->readpage directly, and by passing the right parameter callbacks in nfs and jffs2. This patch (of 4): Code cleanup. Link: http://lkml.kernel.org/r/20190520055731.24538-2-hch@lst.de Signed-off-by: Christoph Hellwig Reviewed-by: Kees Cook Cc: Nick Desaulniers Cc: Sami Tolvanen Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 3972f6bb1c6ae1d32dcf2e4ff635d24b77f26dcb Author: Vlastimil Babka Date: Thu Jul 11 20:55:13 2019 -0700 mm, debug_pagealloc: use a page type instead of page_ext flag When debug_pagealloc is enabled, we currently allocate the page_ext array to mark guard pages with the PAGE_EXT_DEBUG_GUARD flag. Now that we have the page_type field in struct page, we can use that instead, as guard pages are neither PageSlab nor mapped to userspace. This reduces memory overhead when debug_pagealloc is enabled and there are no other features requiring the page_ext array. Link: http://lkml.kernel.org/r/20190603143451.27353-4-vbabka@suse.cz Signed-off-by: Vlastimil Babka Cc: Joonsoo Kim Cc: Matthew Wilcox Cc: "Kirill A. Shutemov" Cc: Mel Gorman Cc: Michal Hocko Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 4462b32c9285b521ef378907aa66a5ca485aae41 Author: Vlastimil Babka Date: Thu Jul 11 20:55:09 2019 -0700 mm, page_alloc: more extensive free page checking with debug_pagealloc The page allocator checks struct pages for expected state (mapcount, flags etc) as pages are being allocated (check_new_page()) and freed (free_pages_check()) to provide some defense against errors in page allocator users. Prior commits 479f854a207c ("mm, page_alloc: defer debugging checks of pages allocated from the PCP") and 4db7548ccbd9 ("mm, page_alloc: defer debugging checks of freed pages until a PCP drain") this has happened for order-0 pages as they were allocated from or freed to the per-cpu caches (pcplists). Since those are fast paths, the checks are now performed only when pages are moved between pcplists and global free lists. This however lowers the chances of catching errors soon enough. In order to increase the chances of the checks to catch errors, the kernel has to be rebuilt with CONFIG_DEBUG_VM, which also enables multiple other internal debug checks (VM_BUG_ON() etc), which is suboptimal when the goal is to catch errors in mm users, not in mm code itself. To catch some wrong users of the page allocator we have CONFIG_DEBUG_PAGEALLOC, which is designed to have virtually no overhead unless enabled at boot time. Memory corruptions when writing to freed pages have often the same underlying errors (use-after-free, double free) as corrupting the corresponding struct pages, so this existing debugging functionality is a good fit to extend by also perform struct page checks at least as often as if CONFIG_DEBUG_VM was enabled. Specifically, after this patch, when debug_pagealloc is enabled on boot, and CONFIG_DEBUG_VM disabled, pages are checked when allocated from or freed to the pcplists *in addition* to being moved between pcplists and free lists. When both debug_pagealloc and CONFIG_DEBUG_VM are enabled, pages are checked when being moved between pcplists and free lists *in addition* to when allocated from or freed to the pcplists. When debug_pagealloc is not enabled on boot, the overhead in fast paths should be virtually none thanks to the use of static key. Link: http://lkml.kernel.org/r/20190603143451.27353-3-vbabka@suse.cz Signed-off-by: Vlastimil Babka Reviewed-by: Andrew Morton Cc: Mel Gorman Cc: Joonsoo Kim Cc: "Kirill A. Shutemov" Cc: Matthew Wilcox Cc: Michal Hocko Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 96a2b03f281d3a3b29c27028164f43090d6495b9 Author: Vlastimil Babka Date: Thu Jul 11 20:55:06 2019 -0700 mm, debug_pagelloc: use static keys to enable debugging Patch series "debug_pagealloc improvements". I have been recently debugging some pcplist corruptions, where it would be useful to perform struct page checks immediately as pages are allocated from and freed to pcplists, which is now only possible by rebuilding the kernel with CONFIG_DEBUG_VM (details in Patch 2 changelog). To make this kind of debugging simpler in future on a distro kernel, I have improved CONFIG_DEBUG_PAGEALLOC so that it has even smaller overhead when not enabled at boot time (Patch 1) and also when enabled (Patch 3), and extended it to perform the struct page checks more often when enabled (Patch 2). Now it can be configured in when building a distro kernel without extra overhead, and debugging page use after free or double free can be enabled simply by rebooting with debug_pagealloc=on. This patch (of 3): CONFIG_DEBUG_PAGEALLOC has been redesigned by 031bc5743f15 ("mm/debug-pagealloc: make debug-pagealloc boottime configurable") to allow being always enabled in a distro kernel, but only perform its expensive functionality when booted with debug_pagelloc=on. We can further reduce the overhead when not boot-enabled (including page allocator fast paths) using static keys. This patch introduces one for debug_pagealloc core functionality, and another for the optional guard page functionality (enabled by booting with debug_guardpage_minorder=X). Link: http://lkml.kernel.org/r/20190603143451.27353-2-vbabka@suse.cz Signed-off-by: Vlastimil Babka Reviewed-by: Andrew Morton Cc: Joonsoo Kim Cc: "Kirill A. Shutemov" Cc: Michal Hocko Cc: Vlastimil Babka Cc: Matthew Wilcox Cc: Mel Gorman Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit a9659476d4b391aec3f5357f176b63b9f8c46231 Author: Nicolas Boichat Date: Thu Jul 11 20:55:03 2019 -0700 mm/failslab.c: by default, do not fail allocations with direct reclaim only When failslab was originally written, the intention of the "ignore-gfp-wait" flag default value ("N") was to fail GFP_ATOMIC allocations. Those were defined as (__GFP_HIGH), and the code would test for __GFP_WAIT (0x10u). However, since then, __GFP_WAIT was replaced by __GFP_RECLAIM (___GFP_DIRECT_RECLAIM|___GFP_KSWAPD_RECLAIM), and GFP_ATOMIC is now defined as (__GFP_HIGH|__GFP_ATOMIC|__GFP_KSWAPD_RECLAIM). This means that when the flag is false, almost no allocation ever fails (as even GFP_ATOMIC allocations contain ___GFP_KSWAPD_RECLAIM). Restore the original intent of the code, by ignoring calls that directly reclaim only (__GFP_DIRECT_RECLAIM), and thus, failing GFP_ATOMIC calls again by default. Link: http://lkml.kernel.org/r/20190520214514.81360-1-drinkcat@chromium.org Fixes: 71baba4b92dc1fa1 ("mm, page_alloc: rename __GFP_WAIT to __GFP_RECLAIM") Signed-off-by: Nicolas Boichat Reviewed-by: Akinobu Mita Acked-by: David Rientjes Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit f445884562dd8bc51eb4136bd21f014403d1813d Author: Andrew Morton Date: Thu Jul 11 20:54:59 2019 -0700 include/linux/pagemap.h: document trylock_page() return value Cc: Henry Burns Cc: Jonathan Adams Cc: David Rientjes Cc: Mike Rapoport Cc: Vitaly Wool Cc: Xidong Wang Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 98ef2046f28b642ad35935972a173194ea58a21d Author: Denis Efremov Date: Thu Jul 11 20:54:56 2019 -0700 mm: remove the exporting of totalram_pages Previously totalram_pages was the global variable. Currently, totalram_pages is the static inline function from the include/linux/mm.h However, the function is also marked as EXPORT_SYMBOL, which is at best an odd combination. Because there is no point for the static inline function from a public header to be exported, this commit removes the EXPORT_SYMBOL() marking. It will be still possible to use the function in modules because all the symbols it depends on are exported. Link: http://lkml.kernel.org/r/20190710141031.15642-1-efremov@linux.com Fixes: ca79b0c211af6 ("mm: convert totalram_pages and totalhigh_pages variables to atomic") Signed-off-by: Denis Efremov Acked-by: Michal Hocko Cc: Vlastimil Babka Cc: Oscar Salvador Cc: Pavel Tatashin Cc: Mel Gorman Cc: Mike Rapoport Cc: Alexander Duyck Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 51b176290496518d6701bc40e63f70e4b6870198 Author: Sebastian Andrzej Siewior Date: Thu Jul 11 20:54:52 2019 -0700 include/linux/vmpressure.h: use spinlock_t instead of struct spinlock For spinlocks the type spinlock_t should be used instead of "struct spinlock". Use spinlock_t for spinlock's definition. Link: http://lkml.kernel.org/r/20190704153803.12739-3-bigeasy@linutronix.de Signed-off-by: Sebastian Andrzej Siewior Reviewed-by: Andrew Morton Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 1fcf0a561cd09d7fb7f7afa2ddfe05f72f32050e Author: Pingfan Liu Date: Thu Jul 11 20:54:49 2019 -0700 mm/page_isolation.c: change the prototype of undo_isolate_page_range() undo_isolate_page_range() never fails, so no need to return value. Link: http://lkml.kernel.org/r/1562075604-8979-1-git-send-email-kernelfans@gmail.com Signed-off-by: Pingfan Liu Acked-by: Michal Hocko Reviewed-by: Oscar Salvador Reviewed-by: Anshuman Khandual Cc: Qian Cai Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit ac1c3e49a9a734150b33297eeca5b43d92fd5be8 Author: Christoph Hellwig Date: Thu Jul 11 20:54:46 2019 -0700 mm: remove the account_page_dirtied export account_page_dirtied() is only used by our set_page_dirty() helpers and should not be used anywhere else. Link: http://lkml.kernel.org/r/20190605183702.30572-1-hch@lst.de Signed-off-by: Christoph Hellwig Reviewed-by: Andrew Morton Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 219f8a2e25f0abbe222b170a0de2fd38c22d43ad Author: Alexey Dobriyan Date: Thu Jul 11 20:54:43 2019 -0700 include/linux/mm_types.h: ifdef struct vm_area_struct::swap_readahead_info The field is only used in swap code. Link: http://lkml.kernel.org/r/20190503190500.GA30589@avx2 Signed-off-by: Alexey Dobriyan Acked-by: Michal Hocko Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 442a5a9a9295bfd9b0cffd0691ef8a6ce81db7c4 Author: Jason Gunthorpe Date: Thu Jul 11 20:54:40 2019 -0700 mm: make !CONFIG_HUGE_PAGE wrappers into static inlines Instead of using defines, which loses type safety and provokes unused variable warnings from gcc, put the constants into static inlines. Link: http://lkml.kernel.org/r/20190522235102.GA15370@mellanox.com Signed-off-by: Jason Gunthorpe Suggested-by: Andrew Morton Reviewed-by: Mike Kravetz Cc: Jerome Glisse Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 465fc3a9b3129722b0df395529b3894b0b90d2de Author: Miklos Szeredi Date: Thu Jul 11 20:54:37 2019 -0700 mm/memory.c: trivial clean up in insert_page() Make the success case use the same cleanup path as the failure case. Link: http://lkml.kernel.org/r/20190523134024.GC24093@localhost.localdomain Signed-off-by: Miklos Szeredi Reviewed-by: Andrew Morton Reviewed-by: Anshuman Khandual Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit a7030aea20d9191c271607aa1478f72a41948b0a Author: Bharath Vedartham Date: Thu Jul 11 20:54:34 2019 -0700 mm/gup.c: make follow_page_mask() static follow_page_mask() is only used in gup.c, make it static. Link: http://lkml.kernel.org/r/20190510190831.GA4061@bharath12345-Inspiron-5559 Signed-off-by: Bharath Vedartham Reviewed-by: Ira Weiny Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 445676071776de492624a063923736637f9eb3e8 Author: Mike Rapoport Date: Thu Jul 11 20:54:31 2019 -0700 sparc: remove ARCH_SELECT_MEMORY_MODEL The ARCH_SELECT_MEMORY_MODEL option is enabled only for 64-bit. However, 64-bit configuration also enables ARCH_SPARSEMEM_DEFAULT and there is no ARCH_FLATMEM_ENABLE in arch/sparc/Kconfig. With such settings, the dependencies in mm/Kconfig are always evaluated to SPARSEMEM=y for 64-bit and to FLATMEM=y for 32-bit. The ARCH_SELECT_MEMORY_MODEL option in arch/sparc/Kconfig does not affect anything and can be removed. Link: http://lkml.kernel.org/r/1556740577-4140-4-git-send-email-rppt@linux.ibm.com Signed-off-by: Mike Rapoport Cc: Arnd Bergmann Cc: Christoph Hellwig Cc: "David S. Miller" Cc: Heiko Carstens Cc: Russell King Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit a9d8777e397e3d1630377fa1d0f0dea0329057c3 Author: Mike Rapoport Date: Thu Jul 11 20:54:27 2019 -0700 s390: remove ARCH_SELECT_MEMORY_MODEL The only reason s390 has ARCH_SELECT_MEMORY_MODEL option in arch/s390/Kconfig is an ancient compile error with allnoconfig which was fixed by commit 97195d6b411f ("[S390] fix sparsemem related compile error with allnoconfig on s390") by adding the ARCH_SELECT_MEMORY_MODEL option. Since then a lot have changed and now allnoconfig builds just fine without ARCH_SELECT_MEMORY_MODEL, so it can be removed. Link: http://lkml.kernel.org/r/1556740577-4140-3-git-send-email-rppt@linux.ibm.com Signed-off-by: Mike Rapoport Acked-by: Heiko Carstens Cc: Arnd Bergmann Cc: Christoph Hellwig Cc: "David S. Miller" Cc: Russell King Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 03069bb0b19f8c3b6e079099dd8ac5e974756381 Author: Mike Rapoport Date: Thu Jul 11 20:54:24 2019 -0700 arm: remove ARCH_SELECT_MEMORY_MODEL Patch series "remove ARCH_SELECT_MEMORY_MODEL where it has no effect". For several architectures the ARCH_SELECT_MEMORY_MODEL has no real effect because the dependencies for the memory model are always evaluated to a single value. Remove the ARCH_SELECT_MEMORY_MODEL from the Kconfigs for these architectures. This patch (of 3): The ARCH_SELECT_MEMORY_MODEL in arch/arm/Kconfig is enabled only when ARCH_SPARSEMEM_ENABLE=y. But in this case, ARCH_SPARSEMEM_DEFAULT is also enabled and this in turn enables SPARSEMEM_MANUAL. Since there is no definition of ARCH_FLATMEM_ENABLE in arch/arm/Kconfig, SPARSEMEM_MANUAL is the only enabled memory model, hence the final selection will evaluate to SPARSEMEM=y. Since ARCH_SPARSEMEM_ENABLE is set to 'y' only by several sub-arch configurations, the default for must sub-arches would be the falback to FLATMEM regardless of ARCH_SELECT_MEMORY_MODEL. Link: http://lkml.kernel.org/r/1556740577-4140-2-git-send-email-rppt@linux.ibm.com Signed-off-by: Mike Rapoport Cc: Arnd Bergmann Cc: Christoph Hellwig Cc: "David S. Miller" Cc: Heiko Carstens Cc: Russell King Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 2236b99d6a33df72befa7205c2d8381aca7ae701 Author: Andrew Morton Date: Thu Jul 11 20:54:21 2019 -0700 include/linux/pfn_t.h: remove pfn_t_to_virt() It has no callers and there is no virt_to_pfn_t(). Reported-by: Anshuman Khandual Cc: Dan Williams Cc: Jérôme Glisse Cc: Laurent Dufour Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 0d4ca4c9bab397b525c9a4f875d31410ce4bc738 Author: Marco Elver Date: Thu Jul 11 20:54:18 2019 -0700 mm/kasan: add object validation in ksize() ksize() has been unconditionally unpoisoning the whole shadow memory region associated with an allocation. This can lead to various undetected bugs, for example, double-kzfree(). Specifically, kzfree() uses ksize() to determine the actual allocation size, and subsequently zeroes the memory. Since ksize() used to just unpoison the whole shadow memory region, no invalid free was detected. This patch addresses this as follows: 1. Add a check in ksize(), and only then unpoison the memory region. 2. Preserve kasan_unpoison_slab() semantics by explicitly unpoisoning the shadow memory region using the size obtained from __ksize(). Tested: 1. With SLAB allocator: a) normal boot without warnings; b) verified the added double-kzfree() is detected. 2. With SLUB allocator: a) normal boot without warnings; b) verified the added double-kzfree() is detected. [elver@google.com: s/BUG_ON/WARN_ON_ONCE/, per Kees] Link: http://lkml.kernel.org/r/20190627094445.216365-6-elver@google.com Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=199359 Link: http://lkml.kernel.org/r/20190626142014.141844-6-elver@google.com Signed-off-by: Marco Elver Acked-by: Kees Cook Reviewed-by: Andrey Ryabinin Cc: Dmitry Vyukov Cc: Alexander Potapenko Cc: Andrey Konovalov Cc: Christoph Lameter Cc: Pekka Enberg Cc: David Rientjes Cc: Joonsoo Kim Cc: Mark Rutland Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 10d1f8cb3965a6f633bf23eb984cda552927e3a5 Author: Marco Elver Date: Thu Jul 11 20:54:14 2019 -0700 mm/slab: refactor common ksize KASAN logic into slab_common.c This refactors common code of ksize() between the various allocators into slab_common.c: __ksize() is the allocator-specific implementation without instrumentation, whereas ksize() includes the required KASAN logic. Link: http://lkml.kernel.org/r/20190626142014.141844-5-elver@google.com Signed-off-by: Marco Elver Acked-by: Christoph Lameter Reviewed-by: Andrey Ryabinin Cc: Dmitry Vyukov Cc: Alexander Potapenko Cc: Andrey Konovalov Cc: Pekka Enberg Cc: David Rientjes Cc: Joonsoo Kim Cc: Mark Rutland Cc: Kees Cook Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit bb104ed78552147bed3a981fdada622afd2084b6 Author: Marco Elver Date: Thu Jul 11 20:54:11 2019 -0700 lib/test_kasan: Add test for double-kzfree detection Add a simple test that checks if double-kzfree is being detected correctly. Link: http://lkml.kernel.org/r/20190626142014.141844-4-elver@google.com Signed-off-by: Marco Elver Reviewed-by: Andrey Ryabinin Cc: Dmitry Vyukov Cc: Alexander Potapenko Cc: Andrey Konovalov Cc: Christoph Lameter Cc: Pekka Enberg Cc: David Rientjes Cc: Joonsoo Kim Cc: Mark Rutland Cc: Kees Cook Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit b5f6e0fc7d60e0234dac82498e90dfe9027bad1f Author: Marco Elver Date: Thu Jul 11 20:54:07 2019 -0700 mm/kasan: change kasan_check_{read,write} to return boolean This changes {,__}kasan_check_{read,write} functions to return a boolean denoting if the access was valid or not. [sfr@canb.auug.org.au: include types.h for "bool"] Link: http://lkml.kernel.org/r/20190705184949.13cdd021@canb.auug.org.au Link: http://lkml.kernel.org/r/20190626142014.141844-3-elver@google.com Signed-off-by: Marco Elver Signed-off-by: Stephen Rothwell Reviewed-by: Andrey Ryabinin Cc: Dmitry Vyukov Cc: Alexander Potapenko Cc: Andrey Konovalov Cc: Christoph Lameter Cc: Pekka Enberg Cc: David Rientjes Cc: Joonsoo Kim Cc: Mark Rutland Cc: Kees Cook Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 7d8ad890dad00f6cd64bfb44d9be4fceb10cf819 Author: Marco Elver Date: Thu Jul 11 20:54:03 2019 -0700 mm/kasan: introduce __kasan_check_{read,write} Patch series "mm/kasan: Add object validation in ksize()", v3. This patch (of 5): This introduces __kasan_check_{read,write}. __kasan_check functions may be used from anywhere, even compilation units that disable instrumentation selectively. This change eliminates the need for the __KASAN_INTERNAL definition. [elver@google.com: v5] Link: http://lkml.kernel.org/r/20190708170706.174189-2-elver@google.com Link: http://lkml.kernel.org/r/20190626142014.141844-2-elver@google.com Signed-off-by: Marco Elver Acked-by: Mark Rutland Reviewed-by: Andrey Ryabinin Cc: Dmitry Vyukov Cc: Alexander Potapenko Cc: Andrey Konovalov Cc: Christoph Lameter Cc: Pekka Enberg Cc: David Rientjes Cc: Joonsoo Kim Cc: Kees Cook Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 751ad98d5f881df91ba47e013b82422912381e8e Author: Marco Elver Date: Thu Jul 11 20:54:00 2019 -0700 asm-generic, x86: add bitops instrumentation for KASAN This adds a new header to asm-generic to allow optionally instrumenting architecture-specific asm implementations of bitops. This change includes the required change for x86 as reference and changes the kernel API doc to point to bitops-instrumented.h instead. Rationale: the functions in x86's bitops.h are no longer the kernel API functions, but instead the arch_ prefixed functions, which are then instrumented via bitops-instrumented.h. Other architectures can similarly add support for asm implementations of bitops. The documentation text was derived from x86 and existing bitops asm-generic versions: 1) references to x86 have been removed; 2) as a result, some of the text had to be reworded for clarity and consistency. Tested using lib/test_kasan with bitops tests (pre-requisite patch). Bugzilla ref: https://bugzilla.kernel.org/show_bug.cgi?id=198439 Link: http://lkml.kernel.org/r/20190613125950.197667-4-elver@google.com Signed-off-by: Marco Elver Acked-by: Mark Rutland Reviewed-by: Andrey Ryabinin Cc: Alexander Potapenko Cc: Andrey Konovalov Cc: Arnd Bergmann Cc: Borislav Petkov Cc: Dmitry Vyukov Cc: "H. Peter Anvin" Cc: Ingo Molnar Cc: Jonathan Corbet Cc: Josh Poimboeuf Cc: Peter Zijlstra (Intel) Cc: Thomas Gleixner Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit ff66135015726696568e998720d9b6afe2d04642 Author: Marco Elver Date: Thu Jul 11 20:53:56 2019 -0700 x86: use static_cpu_has in uaccess region to avoid instrumentation This patch is a pre-requisite for enabling KASAN bitops instrumentation; using static_cpu_has instead of boot_cpu_has avoids instrumentation of test_bit inside the uaccess region. With instrumentation, the KASAN check would otherwise be flagged by objtool. For consistency, kernel/signal.c was changed to mirror this change, however, is never instrumented with KASAN (currently unsupported under x86 32bit). Link: http://lkml.kernel.org/r/20190613125950.197667-3-elver@google.com Signed-off-by: Marco Elver Suggested-by: H. Peter Anvin Acked-by: Peter Zijlstra (Intel) Reviewed-by: Andrey Ryabinin Cc: Alexander Potapenko Cc: Andrey Konovalov Cc: Arnd Bergmann Cc: Borislav Petkov Cc: Dmitry Vyukov Cc: Ingo Molnar Cc: Jonathan Corbet Cc: Josh Poimboeuf Cc: Mark Rutland Cc: Thomas Gleixner Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 19a33ca6c209f5e22c73b6beb4b1974153e93050 Author: Marco Elver Date: Thu Jul 11 20:53:52 2019 -0700 lib/test_kasan: add bitops tests Patch series "Bitops instrumentation for KASAN", v5. This patch (of 3): This adds bitops tests to the test_kasan module. In a follow-up patch, support for bitops instrumentation will be added. Link: http://lkml.kernel.org/r/20190613125950.197667-2-elver@google.com Signed-off-by: Marco Elver Acked-by: Mark Rutland Reviewed-by: Andrey Ryabinin Cc: Peter Zijlstra (Intel) Cc: Dmitry Vyukov Cc: Alexander Potapenko Cc: Andrey Konovalov Cc: "H. Peter Anvin" Cc: Jonathan Corbet Cc: Thomas Gleixner Cc: Ingo Molnar Cc: Borislav Petkov Cc: Arnd Bergmann Cc: Josh Poimboeuf Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit e89692190065c12386bd37272ae8b7d142dd079f Author: Marco Elver Date: Thu Jul 11 20:53:49 2019 -0700 mm/kasan: print frame description for stack bugs This adds support for printing stack frame description on invalid stack accesses. The frame description is embedded by the compiler, which is parsed and then pretty-printed. Currently, we can only print the stack frame info for accesses to the task's own stack, but not accesses to other tasks' stacks. Example of what it looks like: page dumped because: kasan: bad access detected addr ffff8880673ef98a is located in stack of task insmod/2008 at offset 106 in frame: kasan_stack_oob+0x0/0xf5 [test_kasan] this frame has 2 objects: [32, 36) 'i' [96, 106) 'stack_array' Memory state around the buggy address: Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=198435 Link: http://lkml.kernel.org/r/20190522100048.146841-1-elver@google.com Signed-off-by: Marco Elver Reviewed-by: Andrey Ryabinin Cc: Alexander Potapenko Cc: Dmitry Vyukov Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit b7c3613e685076bad6e5540501d84cc31bb30377 Author: André Almeida Date: Thu Jul 11 20:53:46 2019 -0700 docs: kmemleak: add more documentation details Wikipedia now has a main article to "tracing garbage collector" topic. Change the URL and use the reStructuredText syntax for hyperlinks and add more details about the use of the tool. Add a section about how to use the kmemleak-test module to test the memory leak scanning. Link: http://lkml.kernel.org/r/20190612155231.19448-2-andrealmeid@collabora.com Signed-off-by: André Almeida Acked-by: Catalin Marinas Cc: Jonathan Corbet Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 4e4dfce2278929de4379cdcfa2335dad7a6c4aa0 Author: André Almeida Date: Thu Jul 11 20:53:43 2019 -0700 mm/kmemleak.c: change error at _write when kmemleak is disabled According to POSIX, EBUSY means that the "device or resource is busy", and this can lead to people thinking that the file `/sys/kernel/debug/kmemleak/` is somehow locked or being used by other process. Change this error code to a more appropriate one. Link: http://lkml.kernel.org/r/20190612155231.19448-1-andrealmeid@collabora.com Signed-off-by: André Almeida Reviewed-by: Andrew Morton Acked-by: Catalin Marinas Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 6ef9056952532c3b746de46aa10d45b4d7797bd8 Author: Dmitry Vyukov Date: Thu Jul 11 20:53:39 2019 -0700 mm/kmemleak.c: fix check for softirq context in_softirq() is a wrong predicate to check if we are in a softirq context. It also returns true if we have BH disabled, so objects are falsely stamped with "softirq" comm. The correct predicate is in_serving_softirq(). If user does cat from /sys/kernel/debug/kmemleak previously they would see this, which is clearly wrong, this is system call context (see the comm): unreferenced object 0xffff88805bd661c0 (size 64): comm "softirq", pid 0, jiffies 4294942959 (age 12.400s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 ff ff ff ff 00 00 00 00 ................ 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 ................ backtrace: [<0000000007dcb30c>] kmemleak_alloc_recursive include/linux/kmemleak.h:55 [inline] [<0000000007dcb30c>] slab_post_alloc_hook mm/slab.h:439 [inline] [<0000000007dcb30c>] slab_alloc mm/slab.c:3326 [inline] [<0000000007dcb30c>] kmem_cache_alloc_trace+0x13d/0x280 mm/slab.c:3553 [<00000000969722b7>] kmalloc include/linux/slab.h:547 [inline] [<00000000969722b7>] kzalloc include/linux/slab.h:742 [inline] [<00000000969722b7>] ip_mc_add1_src net/ipv4/igmp.c:1961 [inline] [<00000000969722b7>] ip_mc_add_src+0x36b/0x400 net/ipv4/igmp.c:2085 [<00000000a4134b5f>] ip_mc_msfilter+0x22d/0x310 net/ipv4/igmp.c:2475 [<00000000d20248ad>] do_ip_setsockopt.isra.0+0x19fe/0x1c00 net/ipv4/ip_sockglue.c:957 [<000000003d367be7>] ip_setsockopt+0x3b/0xb0 net/ipv4/ip_sockglue.c:1246 [<000000003c7c76af>] udp_setsockopt+0x4e/0x90 net/ipv4/udp.c:2616 [<000000000c1aeb23>] sock_common_setsockopt+0x3e/0x50 net/core/sock.c:3130 [<000000000157b92b>] __sys_setsockopt+0x9e/0x120 net/socket.c:2078 [<00000000a9f3d058>] __do_sys_setsockopt net/socket.c:2089 [inline] [<00000000a9f3d058>] __se_sys_setsockopt net/socket.c:2086 [inline] [<00000000a9f3d058>] __x64_sys_setsockopt+0x26/0x30 net/socket.c:2086 [<000000001b8da885>] do_syscall_64+0x7c/0x1a0 arch/x86/entry/common.c:301 [<00000000ba770c62>] entry_SYSCALL_64_after_hwframe+0x44/0xa9 now they will see this: unreferenced object 0xffff88805413c800 (size 64): comm "syz-executor.4", pid 8960, jiffies 4294994003 (age 14.350s) hex dump (first 32 bytes): 00 7a 8a 57 80 88 ff ff e0 00 00 01 00 00 00 00 .z.W............ 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 ................ backtrace: [<00000000c5d3be64>] kmemleak_alloc_recursive include/linux/kmemleak.h:55 [inline] [<00000000c5d3be64>] slab_post_alloc_hook mm/slab.h:439 [inline] [<00000000c5d3be64>] slab_alloc mm/slab.c:3326 [inline] [<00000000c5d3be64>] kmem_cache_alloc_trace+0x13d/0x280 mm/slab.c:3553 [<0000000023865be2>] kmalloc include/linux/slab.h:547 [inline] [<0000000023865be2>] kzalloc include/linux/slab.h:742 [inline] [<0000000023865be2>] ip_mc_add1_src net/ipv4/igmp.c:1961 [inline] [<0000000023865be2>] ip_mc_add_src+0x36b/0x400 net/ipv4/igmp.c:2085 [<000000003029a9d4>] ip_mc_msfilter+0x22d/0x310 net/ipv4/igmp.c:2475 [<00000000ccd0a87c>] do_ip_setsockopt.isra.0+0x19fe/0x1c00 net/ipv4/ip_sockglue.c:957 [<00000000a85a3785>] ip_setsockopt+0x3b/0xb0 net/ipv4/ip_sockglue.c:1246 [<00000000ec13c18d>] udp_setsockopt+0x4e/0x90 net/ipv4/udp.c:2616 [<0000000052d748e3>] sock_common_setsockopt+0x3e/0x50 net/core/sock.c:3130 [<00000000512f1014>] __sys_setsockopt+0x9e/0x120 net/socket.c:2078 [<00000000181758bc>] __do_sys_setsockopt net/socket.c:2089 [inline] [<00000000181758bc>] __se_sys_setsockopt net/socket.c:2086 [inline] [<00000000181758bc>] __x64_sys_setsockopt+0x26/0x30 net/socket.c:2086 [<00000000d4b73623>] do_syscall_64+0x7c/0x1a0 arch/x86/entry/common.c:301 [<00000000c1098bec>] entry_SYSCALL_64_after_hwframe+0x44/0xa9 Link: http://lkml.kernel.org/r/20190517171507.96046-1-dvyukov@gmail.com Signed-off-by: Dmitry Vyukov Acked-by: Catalin Marinas Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit cb097cd48313575b03a5de092a04f6af8aa0739e Author: Shakeel Butt Date: Thu Jul 11 20:53:36 2019 -0700 slub: don't panic for memcg kmem cache creation failure Currently for CONFIG_SLUB, if a memcg kmem cache creation is failed and the corresponding root kmem cache has SLAB_PANIC flag, the kernel will be crashed. This is unnecessary as the kernel can handle the creation failures of memcg kmem caches. Additionally CONFIG_SLAB does not implement this behavior. So, to keep the behavior consistent between SLAB and SLUB, removing the panic for memcg kmem cache creation failures. The root kmem cache creation failure for SLAB_PANIC correctly panics for both SLAB and SLUB. Link: http://lkml.kernel.org/r/20190619232514.58994-1-shakeelb@google.com Reported-by: Dave Hansen Signed-off-by: Shakeel Butt Acked-by: David Rientjes Acked-by: Michal Hocko Cc: Alexey Dobriyan Cc: Johannes Weiner Cc: Christoph Lameter Cc: Roman Gushchin Cc: Pekka Enberg Cc: Joonsoo Kim Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 9cf3a8d847bd08977dc168ed243ffbef3c456d88 Author: Yury Norov Date: Thu Jul 11 20:53:33 2019 -0700 mm/slub.c: avoid double string traverse in kmem_cache_flags() If ',' is not found, kmem_cache_flags() calls strlen() to find the end of line. We can do it in a single pass using strchrnul(). Link: http://lkml.kernel.org/r/20190501053111.7950-1-ynorov@marvell.com Signed-off-by: Yury Norov Acked-by: Aaron Tomlin Reviewed-by: Andrew Morton Cc: Christoph Lameter Cc: Pekka Enberg Cc: David Rientjes Cc: Joonsoo Kim Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 966fede8e4be15bcc08e3c390080d3f9072a5367 Author: Kees Cook Date: Thu Jul 11 20:53:29 2019 -0700 lkdtm/heap: add tests for freelist hardening This adds tests for double free and cross-cache freeing, which should both be caught by CONFIG_SLAB_FREELIST_HARDENED. Link: http://lkml.kernel.org/r/20190530045017.15252-4-keescook@chromium.org Signed-off-by: Kees Cook Cc: Alexander Popov Cc: Alexander Potapenko Cc: Christoph Lameter Cc: David Rientjes Cc: Greg Kroah-Hartman Cc: Joonsoo Kim Cc: Matthew Wilcox Cc: Pekka Enberg Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit a64b53780ec35b77daf817210c88aa42d172c98f Author: Kees Cook Date: Thu Jul 11 20:53:26 2019 -0700 mm/slab: sanity-check page type when looking up cache This avoids any possible type confusion when looking up an object. For example, if a non-slab were to be passed to kfree(), the invalid slab_cache pointer (i.e. overlapped with some other value from the struct page union) would be used for subsequent slab manipulations that could lead to further memory corruption. Since the page is already in cache, adding the PageSlab() check will have nearly zero cost, so add a check and WARN() to virt_to_cache(). Additionally replaces an open-coded virt_to_cache(). To support the failure mode this also updates all callers of virt_to_cache() and cache_from_obj() to handle a NULL cache pointer return value (though note that several already handle this case gracefully). [dan.carpenter@oracle.com: restore IRQs in kfree()] Link: http://lkml.kernel.org/r/20190613065637.GE16334@mwanda Link: http://lkml.kernel.org/r/20190530045017.15252-3-keescook@chromium.org Signed-off-by: Kees Cook Signed-off-by: Dan Carpenter Cc: Alexander Popov Cc: Alexander Potapenko Cc: Christoph Lameter Cc: David Rientjes Cc: Greg Kroah-Hartman Cc: Joonsoo Kim Cc: Matthew Wilcox Cc: Pekka Enberg Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 598a0717a816abc8f5d3c4598628338b9190d127 Author: Kees Cook Date: Thu Jul 11 20:53:23 2019 -0700 mm/slab: validate cache membership under freelist hardening Patch series "mm/slab: Improved sanity checking". This adds defenses against slab cache confusion (as seen in real-world exploits[1]) and gracefully handles type confusions when trying to look up slab caches from an arbitrary page. (Also is patch 3: new LKDTM tests for these defenses as well as for the existing double-free detection. This patch (of 3): When building under CONFIG_SLAB_FREELIST_HARDENING, it makes sense to perform sanity-checking on the assumed slab cache during kmem_cache_free() to make sure the kernel doesn't mix freelists across slab caches and corrupt memory (as seen in the exploitation of flaws like CVE-2018-9568[1]). Note that the prior code might WARN() but still corrupt memory (i.e. return the assumed cache instead of the owned cache). There is no noticeable performance impact (changes are within noise). Measuring parallel kernel builds, I saw the following with CONFIG_SLAB_FREELIST_HARDENED, before and after this patch: before: Run times: 288.85 286.53 287.09 287.07 287.21 Min: 286.53 Max: 288.85 Mean: 287.35 Std Dev: 0.79 after: Run times: 289.58 287.40 286.97 287.20 287.01 Min: 286.97 Max: 289.58 Mean: 287.63 Std Dev: 0.99 Delta: 0.1% which is well below the standard deviation [1] https://github.com/ThomasKing2014/slides/raw/master/Building%20universal%20Android%20rooting%20with%20a%20type%20confusion%20vulnerability.pdf Link: http://lkml.kernel.org/r/20190530045017.15252-2-keescook@chromium.org Signed-off-by: Kees Cook Cc: Christoph Lameter Cc: Pekka Enberg Cc: David Rientjes Cc: Joonsoo Kim Cc: Matthew Wilcox Cc: Alexander Popov Cc: Alexander Potapenko Cc: Greg Kroah-Hartman Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit d8b2fa657deaa73ff70d40aea9a54997fc0c7fc9 Author: Fuqian Huang Date: Thu Jul 11 20:53:19 2019 -0700 ocfs2: use kmemdup rather than duplicating its implementation kmemdup is introduced to duplicate a region of memory in a neat way. Rather than kmalloc/kzalloc + memcpy, which the programmer needs to write the size twice (sometimes lead to mistakes), kmemdup improves readability, leads to smaller code and also reduce the chances of mistakes. Suggestion to use kmemdup rather than using kmalloc/kzalloc + memcpy. [akpm@linux-foundation.org: coding style fixes] Link: http://lkml.kernel.org/r/20190703163147.881-1-huangfq.daxian@gmail.com Signed-off-by: Fuqian Huang Reviewed-by: Joseph Qi Cc: Mark Fasheh Cc: Joel Becker Cc: Junxiao Bi Cc: Changwei Ge Cc: Gang He Cc: Jun Piao Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 4658d87cb38cb3ab3a234d1b8d63f65df4cce62b Author: Hariprasad Kelam Date: Thu Jul 11 20:53:16 2019 -0700 fs/ocfs2/dlmglue.c: unneeded variable: "status" fix below issue reported by coccicheck fs/ocfs2/dlmglue.c:4410:5-11: Unneeded variable: "status". Return "0" on line 4428 We can not change return type of ocfs2_downconvert_thread as its registered as callback of kthread_create. Link: http://lkml.kernel.org/r/20190702183237.GA13975@hari-Inspiron-1545 Signed-off-by: Hariprasad Kelam Reviewed-by: Joseph Qi Cc: Mark Fasheh Cc: Joel Becker Cc: Junxiao Bi Cc: Changwei Ge Cc: Gang He Cc: Jun Piao Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit e581595ea29c737587bcc349420bfdacb9a6b02b Author: Greg Kroah-Hartman Date: Thu Jul 11 20:53:12 2019 -0700 ocfs: no need to check return value of debugfs_create functions When calling debugfs functions, there is no need to ever check the return value. The function can work or not, but the code logic should never do something different based on this. Also, because there is no need to save the file dentry, remove all of the variables that were being saved, and just recursively delete the whole directory when shutting down, saving a lot of logic and local variables. [gregkh@linuxfoundation.org: v2] Link: http://lkml.kernel.org/r/20190613055455.GE19717@kroah.com Link: http://lkml.kernel.org/r/20190612152912.GA19151@kroah.com Signed-off-by: Greg Kroah-Hartman Reviewed-by: Joseph Qi Cc: Mark Fasheh Cc: Joel Becker Cc: Joseph Qi Cc: Jia Guo Cc: Junxiao Bi Cc: Changwei Ge Cc: Gang He Cc: Jun Piao Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 5da844a2c7df642de2618fc3efe9a92eec40899d Author: Gang He Date: Thu Jul 11 20:53:09 2019 -0700 ocfs2: add first lock wait time in locking_state ocfs2 file system uses locking_state file under debugfs to dump each ocfs2 file system's dlm lock resources, but the users ever encountered some hang(deadlock) problems in ocfs2 file system. I'd like to add first lock wait time in locking_state file, which can help the upper scripts detect these deadlock problems via comparing the first lock wait time with the current time. Link: http://lkml.kernel.org/r/20190611015414.27754-3-ghe@suse.com Signed-off-by: Gang He Reviewed-by: Joseph Qi Cc: Mark Fasheh Cc: Joel Becker Cc: Junxiao Bi Cc: Changwei Ge Cc: Gang He Cc: Jun Piao Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 8056773ac4b42f36bae6406030218a5f12749c64 Author: Gang He Date: Thu Jul 11 20:53:05 2019 -0700 ocfs2: add locking filter debugfs file Add locking filter debugfs file, which is used to filter lock resources dump from locking_state debugfs file. We use d_filter_secs field to filter lock resources dump, the default d_filter_secs(0) value filters nothing, otherwise, only dump the last N seconds active lock resources. This enhancement can avoid dumping lots of old records. The d_filter_secs value can be changed via locking_filter file. [akpm@linux-foundation.org: fix undefined reference to `__udivdi3'] Link: http://lkml.kernel.org/r/20190611015414.27754-2-ghe@suse.com Signed-off-by: Gang He Reviewed-by: Joseph Qi Acked-by: Randy Dunlap [build-tested] Cc: Mark Fasheh Cc: Joel Becker Cc: Junxiao Bi Cc: Changwei Ge Cc: Gang He Cc: Jun Piao Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 8a7f5f4c26dd4e969b5f3b30d06c54dc6a520eda Author: Gang He Date: Thu Jul 11 20:53:02 2019 -0700 ocfs2: add last unlock times in locking_state ocfs2 file system uses locking_state file under debugfs to dump each ocfs2 file system's dlm lock resources, but the dlm lock resources in memory are becoming more and more after the files were touched by the user. it will become a bit difficult to analyze these dlm lock resource records in locking_state file by the upper scripts, though some files are not active for now, which were accessed long time ago. Then, I'd like to add last pr/ex unlock times in locking_state file for each dlm lock resource record, the the upper scripts can use last unlock time to filter inactive dlm lock resource record. Link: http://lkml.kernel.org/r/20190611015414.27754-1-ghe@suse.com Signed-off-by: Gang He Reviewed-by: Joseph Qi Cc: Mark Fasheh Cc: Joel Becker Cc: Junxiao Bi Cc: Changwei Ge Cc: Gang He Cc: Jun Piao Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 0e71666b8b9e21e4cb5d805219eb5ed7c5617ca3 Author: Gustavo A. R. Silva Date: Thu Jul 11 20:52:58 2019 -0700 ocfs2/dlm: use struct_size() helper One of the more common cases of allocation size calculations is finding the size of a structure that has a zero-sized array at the end, along with memory for some number of elements for that array. For example: struct dlm_migratable_lockres { ... struct dlm_migratable_lock ml[0]; // 16 bytes each, begins at byte 112 }; Make use of the struct_size() helper instead of an open-coded version in order to avoid any potential type mistakes. So, replace the following form: sizeof(struct dlm_migratable_lockres) + (mres->num_locks * sizeof(struct dlm_migratable_lock)) with: struct_size(mres, ml, mres->num_locks) Notice that, in this case, variable sz is not necessary, hence it is removed. This code was detected with the help of Coccinelle. Link: http://lkml.kernel.org/r/20190605204926.GA24467@embeddedor Signed-off-by: Gustavo A. R. Silva Reviewed-by: Joseph Qi Cc: Mark Fasheh Cc: Joel Becker Cc: Junxiao Bi Cc: Changwei Ge Cc: Gang He Cc: Jun Piao Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit e926d8a1e8675422e53104855a7bedec82fb570f Author: ChenGang Date: Thu Jul 11 20:52:55 2019 -0700 fs: ocfs: fix spelling mistake "hearbeating" -> "heartbeat" There are some spelling mistakes in ocfs, fix it. Link: http://lkml.kernel.org/r/1558964623-106628-1-git-send-email-cg.chen@huawei.com Signed-off-by: ChenGang Cc: Mark Fasheh Cc: Joel Becker Cc: Junxiao Bi Cc: Joseph Qi Cc: Changwei Ge Cc: Gang He Cc: Jun Piao Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 733f0025f0fb43e382b84db0930ae502099b7e62 Author: Sam Ravnborg Date: Thu Jul 11 20:52:52 2019 -0700 sh: prevent warnings when using iounmap When building drm/exynos for sh, as part of an allmodconfig build, the following warning triggered: exynos7_drm_decon.c: In function `decon_remove': exynos7_drm_decon.c:769:24: warning: unused variable `ctx' struct decon_context *ctx = dev_get_drvdata(&pdev->dev); The ctx variable is only used as argument to iounmap(). In sh - allmodconfig CONFIG_MMU is not defined so it ended up in: \#define __iounmap(addr) do { } while (0) \#define iounmap __iounmap Fix the warning by introducing a static inline function for iounmap. This is similar to several other architectures. Link: http://lkml.kernel.org/r/20190622114208.24427-1-sam@ravnborg.org Signed-off-by: Sam Ravnborg Reviewed-by: Geert Uytterhoeven Cc: Yoshinori Sato Cc: Rich Felker Cc: Will Deacon Cc: Mark Brown Cc: Inki Dae Cc: Krzysztof Kozlowski Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 410615478667e5ed374755cafea60917ec322b64 Author: Krzysztof Kozlowski Date: Thu Jul 11 20:52:48 2019 -0700 sh: config: remove left-over BACKLIGHT_LCD_SUPPORT CONFIG_BACKLIGHT_LCD_SUPPORT was removed in 8c5dc8d9f19c ("video: backlight: Remove useless BACKLIGHT_LCD_SUPPORT kernel symbol"). Options protected by CONFIG_BACKLIGHT_LCD_SUPPORT are now available directly. Link: http://lkml.kernel.org/r/20190603191925.20659-1-krzk@kernel.org Signed-off-by: Krzysztof Kozlowski Cc: Yoshinori Sato Cc: Rich Felker Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 38ce85f028fe4ea7350f448260845bc3cb030ad1 Author: Kefeng Wang Date: Thu Jul 11 20:52:45 2019 -0700 arch/sh/configs/sdk7786_defconfig: remove CONFIG_LOGFS After commit 1d0fd57a50aa ("logfs: remove from tree"), logfs was removed, drop CONFIG_LOGFS from all defconfigs. Link: http://lkml.kernel.org/r/20190530021032.190639-1-wangkefeng.wang@huawei.com Signed-off-by: Kefeng Wang Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 6e22fd003e28d4414d2a84eb51f1491f49a70ab9 Author: Colin Ian King Date: Thu Jul 11 20:52:42 2019 -0700 scripts/spelling.txt: add more spellings to spelling.txt Here are some of the more common spelling mistakes and typos that I've found while fixing up spelling mistakes in the kernel over the past few months. Developers keep on coming up with more inventive ways to spell words. Link: http://lkml.kernel.org/r/20190618134807.9729-1-colin.king@canonical.com Signed-off-by: Colin Ian King Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit ca90bbd410a1dc4b607210a5483786726043e9ec Author: Evan Green Date: Thu Jul 11 20:52:39 2019 -0700 scripts/decode_stacktrace: Accept dash/underscore in modules The manpage for modprobe mentions that dashes and underscores are treated interchangeably in module names. The stack trace dumps seem to print module names with underscores. Use bash to replace _ with the pattern [-_] so that file names with dashes or underscores can be found. For example, this line: [ 27.919759] hda_widget_sysfs_init+0x2b8/0x3a5 [snd_hda_core] should find a module named snd-hda-core.ko. Link: http://lkml.kernel.org/r/20190531205926.42474-1-evgreen@chromium.org Signed-off-by: Evan Green Reviewed-by: Douglas Anderson Acked-by: Konstantin Khlebnikov Cc: Stephen Rothwell Cc: Douglas Anderson Cc: Evan Green Cc: Nicolas Boichat Cc: Marc Zyngier Cc: Manuel Traut Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 85f946ffd3b61ffccefd41a52f267437d878dd3e Author: Chris Paterson Date: Thu Jul 11 20:52:36 2019 -0700 scripts/spelling.txt: add spelling fix for prohibited Misspelling 'prohibited' is quite common in the real world, although surprisingly not so much in the Linux Kernel. In addition to fixing the typo we may as well add it to the spelling checker. Also adding the present participle (prohibiting). Link: http://lkml.kernel.org/r/20190514153341.22540-1-chris.paterson2@renesas.com Fixes: 5bf2fbbef50c ("clk: renesas: cpg-mssr: Add r8a77470 support") Signed-off-by: Chris Paterson Acked-by: Stephen Boyd Acked-by: Geert Uytterhoeven Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit cc0e5f1ce0a8017c68983eb6b41a1dbd0d24aa98 Author: Paul Walmsley Date: Thu Jul 11 20:52:33 2019 -0700 scripts/spelling.txt: drop "sepc" from the misspelling list The RISC-V architecture has a register named the "Supervisor Exception Program Counter", or "sepc". This abbreviation triggers checkpatch.pl's misspelling detector, resulting in noise in the checkpatch output. The risk that this noise could cause more useful warnings to be missed seems to outweigh the harm of an occasional misspelling of "spec". Thus drop the "sepc" entry from the misspelling list. [akpm@linux-foundation.org: fix existing "sepc" instances, per Joe] Link: http://lkml.kernel.org/r/20190518210037.13674-1-paul.walmsley@sifive.com Signed-off-by: Paul Walmsley Cc: Joe Perches Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit fe7d14f174f18745d8dc141377e5f85ae7757d66 Author: Nicolas Boichat Date: Thu Jul 11 20:52:30 2019 -0700 scripts/decode_stacktrace: look for modules with .ko.debug extension In Chromium OS kernel builds, we split the debug information as .ko.debug files, and that's what decode_stacktrace.sh needs to use. Relax objfile matching rule to allow any .ko* file to be matched. [drinkcat@chromium.org: add quotes around name pattern] Link: http://lkml.kernel.org/r/20190528103346.42720-1-drinkcat@chromium.org Link: http://lkml.kernel.org/r/20190521234148.64060-1-drinkcat@chromium.org Signed-off-by: Nicolas Boichat Cc: Marc Zyngier Cc: Konstantin Khlebnikov Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 31013836a71e07751a6827f9d2ad41ef502ddaff Author: Nicolas Boichat Date: Thu Jul 11 20:52:27 2019 -0700 scripts/decode_stacktrace: match basepath using shell prefix operator, not regex The basepath may contain special characters, which would confuse the regex matcher. ${var#prefix} does the right thing. Link: http://lkml.kernel.org/r/20190518055946.181563-1-drinkcat@chromium.org Fixes: 67a28de47faa8358 ("scripts/decode_stacktrace: only strip base path when a prefix of the path") Signed-off-by: Nicolas Boichat Reviewed-by: Stephen Boyd Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit a760f8a67cb38d19fd52f2a28c65c967e469367e Author: Qian Cai Date: Thu Jul 11 20:52:24 2019 -0700 include/linux/dmar.h: replace single-char identifiers in macros There are a few macros in IOMMU have single-char identifiers make the code hard to read and debug. Replace them with meaningful names. Link: http://lkml.kernel.org/r/1559566783-13627-1-git-send-email-cai@lca.pw Signed-off-by: Qian Cai Suggested-by: Andrew Morton Cc: Joerg Roedel Cc: Robin Murphy Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit ae2c8880482977a8b6772657b7c400462695be46 Author: Ryusuke Konishi Date: Thu Jul 11 20:52:21 2019 -0700 MAINTAINERS: nilfs2: update email address Change my email since lab.ntt.co.jp email domain has been deprecated due to company policy. Link: http://lkml.kernel.org/r/1562495153-8166-1-git-send-email-konishi.ryusuke@gmail.com Signed-off-by: Ryusuke Konishi Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit c32cc30c0544f13982ee0185d55f4910319b1a79 Author: Masahiro Yamada Date: Thu Jul 11 20:52:18 2019 -0700 nilfs2: do not use unexported cpu_to_le32()/le32_to_cpu() in uapi header cpu_to_le32/le32_to_cpu is defined in include/linux/byteorder/generic.h, which is not exported to user-space. UAPI headers must use the ones prefixed with double-underscore. Detected by compile-testing exported headers: include/linux/nilfs2_ondisk.h: In function `nilfs_checkpoint_set_snapshot': include/linux/nilfs2_ondisk.h:536:17: error: implicit declaration of function `cpu_to_le32' [-Werror=implicit-function-declaration] cp->cp_flags = cpu_to_le32(le32_to_cpu(cp->cp_flags) | \ ^ include/linux/nilfs2_ondisk.h:552:1: note: in expansion of macro `NILFS_CHECKPOINT_FNS' NILFS_CHECKPOINT_FNS(SNAPSHOT, snapshot) ^~~~~~~~~~~~~~~~~~~~ include/linux/nilfs2_ondisk.h:536:29: error: implicit declaration of function `le32_to_cpu' [-Werror=implicit-function-declaration] cp->cp_flags = cpu_to_le32(le32_to_cpu(cp->cp_flags) | \ ^ include/linux/nilfs2_ondisk.h:552:1: note: in expansion of macro `NILFS_CHECKPOINT_FNS' NILFS_CHECKPOINT_FNS(SNAPSHOT, snapshot) ^~~~~~~~~~~~~~~~~~~~ include/linux/nilfs2_ondisk.h: In function `nilfs_segment_usage_set_clean': include/linux/nilfs2_ondisk.h:622:19: error: implicit declaration of function `cpu_to_le64' [-Werror=implicit-function-declaration] su->su_lastmod = cpu_to_le64(0); ^~~~~~~~~~~ Link: http://lkml.kernel.org/r/20190605053006.14332-1-yamada.masahiro@socionext.com Fixes: e63e88bc53ba ("nilfs2: move ioctl interface and disk layout to uapi separately") Signed-off-by: Masahiro Yamada Acked-by: Ryusuke Konishi Cc: Arnd Bergmann Cc: Greg KH Cc: Joe Perches Cc: [4.9+] Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 810481a246089117d98e3373a3cb735c3efc1f90 Author: Henry Burns Date: Thu Jul 11 20:52:14 2019 -0700 mm/z3fold.c: lock z3fold page before __SetPageMovable() Following zsmalloc.c's example we call trylock_page() and unlock_page(). Also make z3fold_page_migrate() assert that newpage is passed in locked, as per the documentation. [akpm@linux-foundation.org: fix trylock_page return value test, per Shakeel] Link: http://lkml.kernel.org/r/20190702005122.41036-1-henryburns@google.com Link: http://lkml.kernel.org/r/20190702233538.52793-1-henryburns@google.com Signed-off-by: Henry Burns Suggested-by: Vitaly Wool Acked-by: Vitaly Wool Acked-by: David Rientjes Reviewed-by: Shakeel Butt Cc: Vitaly Vul Cc: Mike Rapoport Cc: Xidong Wang Cc: Jonathan Adams Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit dd9239900e12db84c198855b262ae7796db1123b Author: Yafang Shao Date: Thu Jul 11 20:52:11 2019 -0700 mm/memcontrol: fix wrong statistics in memory.stat When we calculate total statistics for memcg1_stats and memcg1_events, we use the the index 'i' in the for loop as the events index. Actually we should use memcg1_stats[i] and memcg1_events[i] as the events index. Link: http://lkml.kernel.org/r/1562116978-19539-1-git-send-email-laoar.shao@gmail.com Fixes: 42a300353577 ("mm: memcontrol: fix recursive statistics correctness & scalabilty"). Signed-off-by: Yafang Shao Cc: Michal Hocko Cc: Johannes Weiner Cc: Yafang Shao Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 9bd3bb6703d8c0a5fb8aec8e3287bd55b7341dcd Author: Aneesh Kumar K.V Date: Thu Jul 11 20:52:08 2019 -0700 mm/nvdimm: add is_ioremap_addr and use that to check ioremap address Architectures like powerpc use different address range to map ioremap and vmalloc range. The memunmap() check used by the nvdimm layer was wrongly using is_vmalloc_addr() to check for ioremap range which fails for ppc64. This result in ppc64 not freeing the ioremap mapping. The side effect of this is an unbind failure during module unload with papr_scm nvdimm driver Link: http://lkml.kernel.org/r/20190701134038.14165-1-aneesh.kumar@linux.ibm.com Signed-off-by: Aneesh Kumar K.V Fixes: b5beae5e224f ("powerpc/pseries: Add driver for PAPR SCM regions") Cc: Dan Williams Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 2c012a4ad1a2cd3fb5a0f9307b9d219f84eda1fa Author: Kuo-Hsin Yang Date: Thu Jul 11 20:52:04 2019 -0700 mm: vmscan: scan anonymous pages on file refaults When file refaults are detected and there are many inactive file pages, the system never reclaim anonymous pages, the file pages are dropped aggressively when there are still a lot of cold anonymous pages and system thrashes. This issue impacts the performance of applications with large executable, e.g. chrome. With this patch, when file refault is detected, inactive_list_is_low() always returns true for file pages in get_scan_count() to enable scanning anonymous pages. The problem can be reproduced by the following test program. ---8<--- void fallocate_file(const char *filename, off_t size) { struct stat st; int fd; if (!stat(filename, &st) && st.st_size >= size) return; fd = open(filename, O_WRONLY | O_CREAT, 0600); if (fd < 0) { perror("create file"); exit(1); } if (posix_fallocate(fd, 0, size)) { perror("fallocate"); exit(1); } close(fd); } long *alloc_anon(long size) { long *start = malloc(size); memset(start, 1, size); return start; } long access_file(const char *filename, long size, long rounds) { int fd, i; volatile char *start1, *end1, *start2; const int page_size = getpagesize(); long sum = 0; fd = open(filename, O_RDONLY); if (fd == -1) { perror("open"); exit(1); } /* * Some applications, e.g. chrome, use a lot of executable file * pages, map some of the pages with PROT_EXEC flag to simulate * the behavior. */ start1 = mmap(NULL, size / 2, PROT_READ | PROT_EXEC, MAP_SHARED, fd, 0); if (start1 == MAP_FAILED) { perror("mmap"); exit(1); } end1 = start1 + size / 2; start2 = mmap(NULL, size / 2, PROT_READ, MAP_SHARED, fd, size / 2); if (start2 == MAP_FAILED) { perror("mmap"); exit(1); } for (i = 0; i < rounds; ++i) { struct timeval before, after; volatile char *ptr1 = start1, *ptr2 = start2; gettimeofday(&before, NULL); for (; ptr1 < end1; ptr1 += page_size, ptr2 += page_size) sum += *ptr1 + *ptr2; gettimeofday(&after, NULL); printf("File access time, round %d: %f (sec) ", i, (after.tv_sec - before.tv_sec) + (after.tv_usec - before.tv_usec) / 1000000.0); } return sum; } int main(int argc, char *argv[]) { const long MB = 1024 * 1024; long anon_mb, file_mb, file_rounds; const char filename[] = "large"; long *ret1; long ret2; if (argc != 4) { printf("usage: thrash ANON_MB FILE_MB FILE_ROUNDS "); exit(0); } anon_mb = atoi(argv[1]); file_mb = atoi(argv[2]); file_rounds = atoi(argv[3]); fallocate_file(filename, file_mb * MB); printf("Allocate %ld MB anonymous pages ", anon_mb); ret1 = alloc_anon(anon_mb * MB); printf("Access %ld MB file pages ", file_mb); ret2 = access_file(filename, file_mb * MB, file_rounds); printf("Print result to prevent optimization: %ld ", *ret1 + ret2); return 0; } ---8<--- Running the test program on 2GB RAM VM with kernel 5.2.0-rc5, the program fills ram with 2048 MB memory, access a 200 MB file for 10 times. Without this patch, the file cache is dropped aggresively and every access to the file is from disk. $ ./thrash 2048 200 10 Allocate 2048 MB anonymous pages Access 200 MB file pages File access time, round 0: 2.489316 (sec) File access time, round 1: 2.581277 (sec) File access time, round 2: 2.487624 (sec) File access time, round 3: 2.449100 (sec) File access time, round 4: 2.420423 (sec) File access time, round 5: 2.343411 (sec) File access time, round 6: 2.454833 (sec) File access time, round 7: 2.483398 (sec) File access time, round 8: 2.572701 (sec) File access time, round 9: 2.493014 (sec) With this patch, these file pages can be cached. $ ./thrash 2048 200 10 Allocate 2048 MB anonymous pages Access 200 MB file pages File access time, round 0: 2.475189 (sec) File access time, round 1: 2.440777 (sec) File access time, round 2: 2.411671 (sec) File access time, round 3: 1.955267 (sec) File access time, round 4: 0.029924 (sec) File access time, round 5: 0.000808 (sec) File access time, round 6: 0.000771 (sec) File access time, round 7: 0.000746 (sec) File access time, round 8: 0.000738 (sec) File access time, round 9: 0.000747 (sec) Checked the swap out stats during the test [1], 19006 pages swapped out with this patch, 3418 pages swapped out without this patch. There are more swap out, but I think it's within reasonable range when file backed data set doesn't fit into the memory. $ ./thrash 2000 100 2100 5 1 # ANON_MB FILE_EXEC FILE_NOEXEC ROUNDS PROCESSES Allocate 2000 MB anonymous pages active_anon: 1613644, inactive_anon: 348656, active_file: 892, inactive_file: 1384 (kB) pswpout: 7972443, pgpgin: 478615246 Access 100 MB executable file pages Access 2100 MB regular file pages File access time, round 0: 12.165, (sec) active_anon: 1433788, inactive_anon: 478116, active_file: 17896, inactive_file: 24328 (kB) File access time, round 1: 11.493, (sec) active_anon: 1430576, inactive_anon: 477144, active_file: 25440, inactive_file: 26172 (kB) File access time, round 2: 11.455, (sec) active_anon: 1427436, inactive_anon: 476060, active_file: 21112, inactive_file: 28808 (kB) File access time, round 3: 11.454, (sec) active_anon: 1420444, inactive_anon: 473632, active_file: 23216, inactive_file: 35036 (kB) File access time, round 4: 11.479, (sec) active_anon: 1413964, inactive_anon: 471460, active_file: 31728, inactive_file: 32224 (kB) pswpout: 7991449 (+ 19006), pgpgin: 489924366 (+ 11309120) With 4 processes accessing non-overlapping parts of a large file, 30316 pages swapped out with this patch, 5152 pages swapped out without this patch. The swapout number is small comparing to pgpgin. [1]: https://github.com/vovo/testing/blob/master/mem_thrash.c Link: http://lkml.kernel.org/r/20190701081038.GA83398@google.com Fixes: e9868505987a ("mm,vmscan: only evict file pages when we have plenty") Fixes: 7c5bd705d8f9 ("mm: memcg: only evict file pages when we have plenty") Signed-off-by: Kuo-Hsin Yang Acked-by: Johannes Weiner Cc: Michal Hocko Cc: Sonny Rao Cc: Mel Gorman Cc: Rik van Riel Cc: Vladimir Davydov Cc: Minchan Kim Cc: [4.12+] Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 1df379924304b687263942452836db1d725155df Author: Stephen Rothwell Date: Tue Jul 2 12:03:50 2019 +1000 clk: consoldiate the __clk_get_hw() declarations Without this we were getting errors like: In file included from drivers/clk/clkdev.c:22:0: drivers/clk/clk.h:36:23: error: static declaration of '__clk_get_hw' follows non-static declaration include/linux/clk-provider.h:808:16: note: previous declaration of '__clk_get_hw' was here Fixes: 59fcdce425b7 ("clk: Remove ifdef for COMMON_CLK in clk-provider.h") fixes: 73e0e496afda ("clkdev: Always allocate a struct clk and call __clk_get() w/ CCF") Signed-off-by: Stephen Rothwell Signed-off-by: Stephen Boyd commit a101b043c44dfcb63bed7f29a675e9fa0259005e Author: Trond Myklebust Date: Thu Jul 11 16:33:12 2019 -0400 SUNRPC: Fix transport accounting when caller specifies an rpc_xprt Ensure that we do the required accounting for the round robin queue when the caller to rpc_init_task() has passed in a transport to be used. Reported-by: Olga Kornievskaia Reported-by: Neil Brown Signed-off-by: Trond Myklebust commit 6e67d77d673d785631b0c52314b60d3c68ebe809 Author: Thomas Richter Date: Fri Jul 12 14:31:13 2019 +0200 perf vendor events s390: Add JSON files for machine type 8561 Add CPU measurement counter facility event description files (JSON) for IBM machine types 8561 and 8562. Signed-off-by: Thomas Richter Reviewed-by: Vasily Gorbik Cc: Heiko Carstens Cc: Hendrik Brueckner Link: http://lkml.kernel.org/r/20190712123113.100882-1-tmricht@linux.ibm.com Signed-off-by: Arnaldo Carvalho de Melo commit 347543e64082782379627cb21162cb859590f3c7 Merge: 80d3c45fd765 62a92ba97a31 Author: Trond Myklebust Date: Thu Jul 11 16:52:47 2019 -0400 Merge tag 'nfs-rdma-for-5.3-1' of git://git.linux-nfs.org/projects/anna/linux-nfs NFSoRDMA client updates for 5.3 New features: - Add a way to place MRs back on the free list - Reduce context switching - Add new trace events Bugfixes and cleanups: - Fix a BUG when tracing is enabled with NFSv4.1 - Fix a use-after-free in rpcrdma_post_recvs - Replace use of xdr_stream_pos in rpcrdma_marshal_req - Fix occasional transport deadlock - Fix show_nfs_errors macros, other tracing improvements - Remove RPCRDMA_REQ_F_PENDING and fr_state - Various simplifications and refactors commit e9a1379f9219be439f47a0f063431a92dc529eda Author: Naohiro Aota Date: Fri Jul 12 19:15:55 2019 +0900 x86/vdso: Fix flip/flop vdso build bug Two consecutive "make" on an already compiled kernel tree will show different behavior: $ make CALL scripts/checksyscalls.sh CALL scripts/atomic/check-atomics.sh DESCEND objtool CHK include/generated/compile.h VDSOCHK arch/x86/entry/vdso/vdso64.so.dbg VDSOCHK arch/x86/entry/vdso/vdso32.so.dbg Kernel: arch/x86/boot/bzImage is ready (#3) Building modules, stage 2. MODPOST 12 modules $ make make CALL scripts/checksyscalls.sh CALL scripts/atomic/check-atomics.sh DESCEND objtool CHK include/generated/compile.h VDSO arch/x86/entry/vdso/vdso64.so.dbg OBJCOPY arch/x86/entry/vdso/vdso64.so VDSO2C arch/x86/entry/vdso/vdso-image-64.c CC arch/x86/entry/vdso/vdso-image-64.o VDSO arch/x86/entry/vdso/vdso32.so.dbg OBJCOPY arch/x86/entry/vdso/vdso32.so VDSO2C arch/x86/entry/vdso/vdso-image-32.c CC arch/x86/entry/vdso/vdso-image-32.o AR arch/x86/entry/vdso/built-in.a AR arch/x86/entry/built-in.a AR arch/x86/built-in.a GEN .version CHK include/generated/compile.h UPD include/generated/compile.h CC init/version.o AR init/built-in.a LD vmlinux.o This is causing "LD vmlinux" once every two times even without any modifications. This is the same bug fixed in commit 92a4728608a8 ("x86/boot: Fix if_changed build flip/flop bug"). Two "if_changed" cannot be used in one target. Fix this merging two commands into one function. Fixes: 7ac870747988 ("x86/vdso: Switch to generic vDSO implementation") Signed-off-by: Naohiro Aota Signed-off-by: Thomas Gleixner Tested-by: Vincenzo Frascino Reviewed-by: Vincenzo Frascino Reviewed-by: Masahiro Yamada Link: https://lkml.kernel.org/r/20190712101556.17833-1-naohiro.aota@wdc.com commit 787c79d6393fc028887cc1b6066915f0b094e92f Author: Konstantin Khlebnikov Date: Thu Jul 11 13:19:47 2019 +0300 MAINTAINERS: add entry for block io cgroup This links mailing list cgroups@vger.kernel.org with related files. $ ./scripts/get_maintainer.pl -f block/blk-cgroup.c Jens Axboe (maintainer:BLOCK LAYER) cgroups@vger.kernel.org (open list:CONTROL GROUP - BLOCK IO CONTROLLER (BLKIO)) linux-block@vger.kernel.org (open list:BLOCK LAYER) linux-kernel@vger.kernel.org (open list) Signed-off-by: Konstantin Khlebnikov Added git tree/maintainer entries from Tejun. Signed-off-by: Jens Axboe commit 0b043644c0ca601cb19943a81aa1f1455dbe9461 Author: Jason Gunthorpe Date: Fri Jul 12 12:12:06 2019 -0300 RMDA/siw: Require a 64 bit arch The new siw driver fails to build on i386 with drivers/infiniband/sw/siw/siw_qp.c:1025:3: error: invalid output size for constraint '+q' smp_store_mb(*cq->notify, SIW_NOTIFY_NOT); As it is using 64 bit values with the smp_store_mb. Since the entire scheme here seems questionable, and we are in the merge window, fix the compile failures by disabling 32 bit support on this driver. A proper fix will be reviewed post merge window. Fixes: c0cf5bdde46c ("rdma/siw: addition to kernel build environment") Reported-by: Arnd Bergmann Signed-off-by: Jason Gunthorpe commit e347946439ed70e3af0d0c330b36d5648e71727b Author: Jens Axboe Date: Fri Jul 12 09:09:57 2019 -0600 null_blk: fixup ->report_zones() for !CONFIG_BLK_DEV_ZONED A previous commit changed the prototype, but didn't adjust the function for when zoned device support is disabled. Fix it up. Fixes: bd976e527259 ("block: Kill gfp_t argument of blkdev_report_zones()") Signed-off-by: Jens Axboe commit bd293d071ffe65e645b4d8104f9d8fe15ea13862 Author: Junxiao Bi Date: Tue Jul 9 17:17:19 2019 -0700 dm bufio: fix deadlock with loop device When thin-volume is built on loop device, if available memory is low, the following deadlock can be triggered: One process P1 allocates memory with GFP_FS flag, direct alloc fails, memory reclaim invokes memory shrinker in dm_bufio, dm_bufio_shrink_scan() runs, mutex dm_bufio_client->lock is acquired, then P1 waits for dm_buffer IO to complete in __try_evict_buffer(). But this IO may never complete if issued to an underlying loop device that forwards it using direct-IO, which allocates memory using GFP_KERNEL (see: do_blockdev_direct_IO()). If allocation fails, memory reclaim will invoke memory shrinker in dm_bufio, dm_bufio_shrink_scan() will be invoked, and since the mutex is already held by P1 the loop thread will hang, and IO will never complete. Resulting in ABBA deadlock. Cc: stable@vger.kernel.org Signed-off-by: Junxiao Bi Signed-off-by: Mike Snitzer commit 2e6023850e177dbaca21498ada04c5a5ac93f812 Author: Mike Snitzer Date: Wed Jun 19 17:05:54 2019 -0400 dm snapshot: add optional discard support features discard_zeroes_cow - a discard issued to the snapshot device that maps to entire chunks to will zero the corresponding exception(s) in the snapshot's exception store. discard_passdown_origin - a discard to the snapshot device is passed down to the snapshot-origin's underlying device. This doesn't cause copy-out to the snapshot exception store because the snapshot-origin target is bypassed. The discard_passdown_origin feature depends on the discard_zeroes_cow feature being enabled. When these 2 features are enabled they allow a temporarily read-only device that has completely exhausted its free space to recover space. To do so dm-snapshot provides temporary buffer to accommodate writes that the temporarily read-only device cannot handle yet. Once the upper layer frees space (e.g. fstrim to XFS) the discards issued to the dm-snapshot target will be issued to underlying read-only device whose free space was exhausted. In addition those discards will also cause zeroes to be written to the snapshot exception store if corresponding exceptions exist. If the underlying origin device provides deduplication for zero blocks then if/when the snapshot is merged backed to the origin those blocks will become unused. Once the origin has gained adequate space, merging the snapshot back to the thinly provisioned device will permit continued use of that device without the temporary space provided by the snapshot. Requested-by: John Dorminy Signed-off-by: Mike Snitzer commit af3c24e0e2ed25177b03b60ada9117bb596e8d95 Author: Ilya Leoshkevich Date: Thu Jul 11 16:29:30 2019 +0200 selftests/bpf: fix compiling loop{1, 2, 3}.c on s390 Use PT_REGS_RC(ctx) instead of ctx->rax, which is not present on s390. Signed-off-by: Ilya Leoshkevich Reviewed-by: Stanislav Fomichev Tested-by: Stanislav Fomichev Signed-off-by: Daniel Borkmann commit 7cd04535abc95c50ba9bfa48efc76274b63c70f5 Author: Ilya Leoshkevich Date: Thu Jul 11 16:29:29 2019 +0200 selftests/bpf: make PT_REGS_* work in userspace Right now, on certain architectures, these macros are usable only with kernel headers. This patch makes it possible to use them with userspace headers and, as a consequence, not only in BPF samples, but also in BPF selftests. On s390, provide the forward declaration of struct pt_regs and cast it to user_pt_regs in PT_REGS_* macros. This is necessary, because instead of the full struct pt_regs, s390 exposes only its first member user_pt_regs to userspace, and bpf_helpers.h is used with both userspace (in selftests) and kernel (in samples) headers. It was added in commit 466698e654e8 ("s390/bpf: correct broken uapi for BPF_PROG_TYPE_PERF_EVENT program type"). Ditto on arm64. On x86, provide userspace versions of PT_REGS_* macros. Unlike s390 and arm64, x86 provides struct pt_regs to both userspace and kernel, however, with different member names. Signed-off-by: Ilya Leoshkevich Acked-by: Andrii Nakryiko Reviewed-by: Stanislav Fomichev Signed-off-by: Daniel Borkmann commit 05c2dc17dae310f92a0c5979e227133b0e85f2fa Author: Ilya Leoshkevich Date: Thu Jul 11 16:29:28 2019 +0200 selftests/bpf: fix s930 -> s390 typo Also check for __s390__ instead of __s390x__, just in case bpf_helpers.h is ever used by 32-bit userspace. Signed-off-by: Ilya Leoshkevich Acked-by: Andrii Nakryiko Reviewed-by: Stanislav Fomichev Signed-off-by: Daniel Borkmann commit 748e50c1c13d33dffcdca66f0b1cb3d96d17fe31 Author: Ilya Leoshkevich Date: Thu Jul 11 16:29:27 2019 +0200 selftests/bpf: compile progs with -D__TARGET_ARCH_$(SRCARCH) This opens up the possibility of accessing registers in an arch-independent way. Signed-off-by: Ilya Leoshkevich Reviewed-by: Stanislav Fomichev Signed-off-by: Daniel Borkmann commit 9cae4ace80ef39005da106fbb89c952b27d7b89e Author: Ilya Leoshkevich Date: Thu Jul 11 11:12:49 2019 +0200 selftests/bpf: do not ignore clang failures When compiling an eBPF prog fails, make still returns 0, because failing clang command's output is piped to llc and therefore its exit status is ignored. When clang fails, pipe the string "clang failed" to llc. This will make llc fail with an informative error message. This solution was chosen over using pipefail, having separate targets or getting rid of llc invocation due to its simplicity. In addition, pull Kbuild.include in order to get .DELETE_ON_ERROR target, which would cause partial .o files to be removed. Signed-off-by: Ilya Leoshkevich Acked-by: Andrii Nakryiko Signed-off-by: Daniel Borkmann commit 216b65fb706e34128a5317d71b300daac9c428c4 Author: Daniel T. Lee Date: Fri Jul 12 10:35:39 2019 +0900 tools: bpftool: add raw_tracepoint_writable prog type to header From commit 9df1c28bb752 ("bpf: add writable context for raw tracepoints"), a new type of BPF_PROG, RAW_TRACEPOINT_WRITABLE has been added. Since this BPF_PROG_TYPE_RAW_TRACEPOINT_WRITABLE is not listed at bpftool's header, it causes a segfault when executing 'bpftool feature'. This commit adds BPF_PROG_TYPE_RAW_TRACEPOINT_WRITABLE entry to prog_type_name enum, and will eventually fixes the segfault issue. Fixes: 9df1c28bb752 ("bpf: add writable context for raw tracepoints") Signed-off-by: Daniel T. Lee Signed-off-by: Daniel Borkmann commit ed4ed4043a127c5ca9a35339bb614693be9037a3 Author: Gustavo A. R. Silva Date: Thu Jul 11 11:22:33 2019 -0500 bpf: verifier: avoid fall-through warnings In preparation to enabling -Wimplicit-fallthrough, this patch silences the following warning: kernel/bpf/verifier.c: In function ‘check_return_code’: kernel/bpf/verifier.c:6106:6: warning: this statement may fall through [-Wimplicit-fallthrough=] if (env->prog->expected_attach_type == BPF_CGROUP_UDP4_RECVMSG || ^ kernel/bpf/verifier.c:6109:2: note: here case BPF_PROG_TYPE_CGROUP_SKB: ^~~~ Warning level 3 was used: -Wimplicit-fallthrough=3 Notice that is much clearer to explicitly add breaks in each case statement (that actually contains some code), rather than letting the code to fall through. This patch is part of the ongoing efforts to enable -Wimplicit-fallthrough. Signed-off-by: Gustavo A. R. Silva Acked-by: Andrii Nakryiko Signed-off-by: Daniel Borkmann commit 59d82657a08d4a9e6e2d99acc525ef748d36016b Author: Ilya Leoshkevich Date: Wed Jul 10 13:56:54 2019 +0200 selftests/bpf: fix bpf_target_sparc check bpf_helpers.h fails to compile on sparc: the code should be checking for defined(bpf_target_sparc), but checks simply for bpf_target_sparc. Also change #ifdef bpf_target_powerpc to #if defined() for consistency. Signed-off-by: Ilya Leoshkevich Acked-by: Andrii Nakryiko Acked-by: David S. Miller Signed-off-by: Daniel Borkmann commit 5464c3a0e9a037b63d5229cdea08dddc01a98aac Author: Ilya Maximets Date: Mon Jul 8 14:03:44 2019 +0300 xdp: fix potential deadlock on socket mutex There are 2 call chains: a) xsk_bind --> xdp_umem_assign_dev b) unregister_netdevice_queue --> xsk_notifier with the following locking order: a) xs->mutex --> rtnl_lock b) rtnl_lock --> xdp.lock --> xs->mutex Different order of taking 'xs->mutex' and 'rtnl_lock' could produce a deadlock here. Fix that by moving the 'rtnl_lock' before 'xs->lock' in the bind call chain (a). Reported-by: syzbot+bf64ec93de836d7f4c2c@syzkaller.appspotmail.com Fixes: 455302d1c9ae ("xdp: fix hang while unregistering device bound to xdp socket") Signed-off-by: Ilya Maximets Acked-by: Jonathan Lemon Signed-off-by: Daniel Borkmann commit 7d67c8ac25fbc66ee254aa3e33329d1c9bc152ce Author: YueHaibing Date: Thu Jul 4 14:27:25 2019 +0800 platform/x86: Fix PCENGINES_APU2 Kconfig warning Fix Kconfig warning for PCENGINES_APU2 symbol: WARNING: unmet direct dependencies detected for GPIO_AMD_FCH Depends on [n]: GPIOLIB [=n] && HAS_IOMEM [=y] Selected by [y]: - PCENGINES_APU2 [=y] && X86 [=y] && X86_PLATFORM_DEVICES [=y] && INPUT [=y] && INPUT_KEYBOARD [=y] && LEDS_CLASS [=y] WARNING: unmet direct dependencies detected for KEYBOARD_GPIO_POLLED Depends on [n]: !UML && INPUT [=y] && INPUT_KEYBOARD [=y] && GPIOLIB [=n] Selected by [y]: - PCENGINES_APU2 [=y] && X86 [=y] && X86_PLATFORM_DEVICES [=y] && INPUT [=y] && INPUT_KEYBOARD [=y] && LEDS_CLASS [=y] Add GPIOLIB dependency to fix it. Reported-by: Hulk Robot Fixes: f8eb0235f659 ("x86: pcengines apuv2 gpio/leds/keys platform driver") Signed-off-by: YueHaibing Signed-off-by: Andy Shevchenko commit 2b4f3dab09b3a2853c49c866a383ffda8ee54a6f Author: Prarit Bhargava Date: Wed Jul 10 10:23:00 2019 -0700 tools/power/x86/intel-speed-select: Add .gitignore file Add a .gitignore file for build include/ and final binary. Signed-off-by: Prarit Bhargava Acked-by: Rafael J. Wysocki Acked-by: Srinivas Pandruvada Cc: Srinivas Pandruvada Cc: Andy Shevchenko Cc: David Arcari Signed-off-by: Andy Shevchenko commit e6fbb97da5212ceab7149896832d35fa1ab02f34 Author: Wei Yongjun Date: Tue Jul 9 01:38:42 2019 +0000 platform/x86: mlx-platform: Fix error handling in mlxplat_init() Add the missing platform_device_unregister() before return from mlxplat_init() in the error handling case. Fixes: 6b266e91a071 ("platform/x86: mlx-platform: Move regmap initialization before all drivers activation") Signed-off-by: Wei Yongjun Signed-off-by: Andy Shevchenko commit 64974ab24908a92b5dfe52e1ace3d67c47d657cb Author: Kevin Wang Date: Fri Jul 12 11:27:50 2019 +0800 drm/amd/powerplay: add pstate mclk(uclk) support for navi10 add pstate mclk(uclk) support. Signed-off-by: Kevin Wang Reviewed-by: Evan Quan Signed-off-by: Alex Deucher commit d36893362d22ff46fdb105ebab12df00bbf23397 Author: Kevin Wang Date: Thu Jul 11 21:33:17 2019 +0800 drm/amd/powerplay: fix smu clock type change miss error in the smu module, use the smu_xxxclk type to identify the CLK type use SMU_SCLK, SMU_MCLK to replace PP_SCLK, PP_MCLK. Signed-off-by: Kevin Wang Reviewed-by: Feifei Xu Reviewed-by: Evan Quan Signed-off-by: Alex Deucher commit 4298935924a9057f2424636d1d29ae7caef4764a Author: Hawking Zhang Date: Thu Jul 11 00:13:54 2019 +0800 drm/amdgpu: support key database loading for navi10 Starting from navi10, driver should send Key Database Load command to bootloader before loading sys_drv and sos Signed-off-by: John Clements Signed-off-by: Hawking Zhang Reviewed-by: Xiaojie Yuan Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher commit 3840fe256ae431d79e93988757a6f89db8192237 Author: Hawking Zhang Date: Thu Jul 11 22:02:02 2019 +0800 drm/amdgpu: switch to macro for psp bootloader command The command will be sent to psp bootloader from driver to ask psp bootloader to exerise tOS, sys_drv and kdb loading Signed-off-by: Hawking Zhang Reviewed-by: Alex Deucher Reviewed-by: Xiaojie Yuan Signed-off-by: Alex Deucher commit 675716400da6f15b9d3db04ef74ee74ca9a00af3 Author: Ilya Maximets Date: Thu Jul 4 17:25:03 2019 +0300 xdp: fix possible cq entry leak Completion queue address reservation could not be undone. In case of bad 'queue_id' or skb allocation failure, reserved entry will be leaked reducing the total capacity of completion queue. Fix that by moving reservation to the point where failure is not possible. Additionally, 'queue_id' checking moved out from the loop since there is no point to check it there. Fixes: 35fcde7f8deb ("xsk: support for Tx") Signed-off-by: Ilya Maximets Acked-by: Björn Töpel Tested-by: William Tu Signed-off-by: Daniel Borkmann commit 36db2a94f19ae1fcf1e6d8253df0c32f90f92860 Author: Andrii Nakryiko Date: Mon Jul 8 21:00:07 2019 -0700 libbpf: fix ptr to u64 conversion warning on 32-bit platforms On 32-bit platforms compiler complains about conversion: libbpf.c: In function ‘perf_event_open_probe’: libbpf.c:4112:17: error: cast from pointer to integer of different size [-Werror=pointer-to-int-cast] attr.config1 = (uint64_t)(void *)name; /* kprobe_func or uprobe_path */ ^ Reported-by: Matt Hart Fixes: b26500274767 ("libbpf: add kprobe/uprobe attach API") Tested-by: Matt Hart Signed-off-by: Andrii Nakryiko Acked-by: Yonghong Song Signed-off-by: Daniel Borkmann commit b3b50f05dc501cc2cd90349a7bbfd932af0ceb31 Author: Andrii Nakryiko Date: Mon Jul 8 20:32:44 2019 -0700 bpf: fix precision bit propagation for BPF_ST instructions When backtracking instructions to propagate precision bit for registers and stack slots, one class of instructions (BPF_ST) weren't handled causing extra stack slots to be propagated into parent state. Parent state might not have that much stack allocated, though, which causes warning on invalid stack slot usage. This patch adds handling of BPF_ST instructions: BPF_MEM | | BPF_ST: *(size *) (dst_reg + off) = imm32 Reported-by: syzbot+4da3ff23081bafe74fc2@syzkaller.appspotmail.com Fixes: b5dc0163d8fd ("bpf: precise scalar_value tracking") Cc: Alexei Starovoitov Signed-off-by: Andrii Nakryiko Signed-off-by: Daniel Borkmann commit f5a9e488d62360c91c5770bd55a0b40e419a71ce Author: Athira Rajeev Date: Tue Jul 2 16:28:36 2019 +0530 powerpc/powernv/idle: Fix restore of SPRN_LDBAR for POWER9 stop state. commit 10d91611f426 ("powerpc/64s: Reimplement book3s idle code in C") reimplemented book3S code to pltform/powernv/idle.c. But when doing so missed to add the per-thread LDBAR update in the core_woken path of the power9_idle_stop(). Patch fixes the same. Fixes: 10d91611f426 ("powerpc/64s: Reimplement book3s idle code in C") Cc: stable@vger.kernel.org # v5.2+ Signed-off-by: Athira Rajeev Signed-off-by: Madhavan Srinivasan Reviewed-by: Nicholas Piggin Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20190702105836.26695-1-maddy@linux.vnet.ibm.com commit 327835fb1e838c7098731899ec76aba912edddf1 Author: Vasily Gorbik Date: Wed Jul 10 12:43:45 2019 +0200 MAINTAINERS: update BPF JIT S390 maintainers Ilya Leoshkevich is joining as s390 bpf maintainer. With his background as gcc developer he would be valuable for the team and community as a whole. Ilya, have fun! Since there is now enough eyes on s390 bpf, relieve Christian Borntraeger, so that he could focus on his maintainer tasks for other components. Signed-off-by: Vasily Gorbik Acked-by: Christian Borntraeger Acked-by: Ilya Leoshkevich Signed-off-by: Daniel Borkmann commit 20e833dc36355ed642d00067641a679c618303fa Author: Hook, Gary Date: Wed Jul 10 00:09:22 2019 +0000 crypto: ccp - memset structure fields to zero before reuse The AES GCM function reuses an 'op' data structure, which members contain values that must be cleared for each (re)use. This fix resolves a crypto self-test failure: alg: aead: gcm-aes-ccp encryption test failed (wrong result) on test vector 2, cfg="two even aligned splits" Fixes: 36cf515b9bbe ("crypto: ccp - Enable support for AES GCM on v5 CCPs") Cc: Signed-off-by: Gary R Hook Signed-off-by: Herbert Xu commit 95566aa75cd6b3b404502c06f66956b5481194b3 Author: Wen Yang Date: Mon Jul 8 14:19:03 2019 +0800 crypto: crypto4xx - fix a potential double free in ppc4xx_trng_probe There is a possible double free issue in ppc4xx_trng_probe(): 85: dev->trng_base = of_iomap(trng, 0); 86: of_node_put(trng); ---> released here 87: if (!dev->trng_base) 88: goto err_out; ... 110: ierr_out: 111: of_node_put(trng); ---> double released here ... This issue was detected by using the Coccinelle software. We fix it by removing the unnecessary of_node_put(). Fixes: 5343e674f32f ("crypto4xx: integrate ppc4xx-rng into crypto4xx") Signed-off-by: Wen Yang Cc: Cc: "David S. Miller" Cc: Thomas Gleixner Cc: Greg Kroah-Hartman Cc: Allison Randal Cc: Armijn Hemel Cc: Julia Lawall Cc: linux-crypto@vger.kernel.org Cc: linux-kernel@vger.kernel.org Acked-by: Julia Lawall Signed-off-by: Herbert Xu commit 049ce1505b3a6504f4cb59148baaacc36d5c75e3 Author: Herbert Xu Date: Wed Jul 3 22:26:53 2019 +0800 crypto: stm32/hash - Fix incorrect printk modifier for size_t This patch fixes a warning when compiling stm32 because %d is being used on a size_t argument instead of %zd. Signed-off-by: Herbert Xu commit cc95527cceb3d1aaadd5cc1cf601d466af2e53f2 Author: Nishka Dasgupta Date: Thu Jul 11 23:49:47 2019 -0700 Input: mtk-pmic-keys - add of_node_put() before return Each iteration of for_each_child_of_node puts the previous node, but in the case of a return from the middle of the loop, there is no put, thus causing a memory leak. Hence add an of_node_put before the return in three places. Issue found with Coccinelle. Signed-off-by: Nishka Dasgupta Signed-off-by: Dmitry Torokhov commit 071cfc43c875ee2e6ac2ae6929c2c153e1d13fe7 Author: Nishka Dasgupta Date: Thu Jul 11 23:49:16 2019 -0700 Input: sun4i-lradc-keys - add of_node_put() before return Each iteration of for_each_child_of_node puts the previous node, but in the case of a return from the middle of the loop, there is no put, thus causing a memory leak. Hence add an of_node_put before the return in three places. Issue found with Coccinelle. Signed-off-by: Nishka Dasgupta Signed-off-by: Dmitry Torokhov commit 1976d7d200c5a32e72293a2ada36b7b7c9d6dd6e Author: Nick Black Date: Thu Jul 11 23:42:03 2019 -0700 Input: synaptics - whitelist Lenovo T580 SMBus intertouch Adds the Lenovo T580 to the SMBus intertouch list for Synaptics touchpads. I've tested with this for a week now, and it seems a great improvement. It's also nice to have the complaint gone from dmesg. Signed-off-by: Nick Black Cc: stable@vger.kernel.org Signed-off-by: Dmitry Torokhov commit 5f0f531c4f8a97258dd3133db74926574e6373ab Author: Paul Menzel Date: Mon Jul 8 13:50:05 2019 +0200 drm/amdgpu: Print out voltage in DM_PPLIB As the clock is already logged, also log the voltage. Signed-off-by: Paul Menzel Signed-off-by: Alex Deucher commit 26202928fafad8bda8b478edb7e62c885be623d7 Author: Damien Le Moal Date: Mon Jul 1 14:09:18 2019 +0900 block: Limit zone array allocation size Limit the size of the struct blk_zone array used in blk_revalidate_disk_zones() to avoid memory allocation failures leading to disk revalidation failure. Also further reduce the likelyhood of such failures by using kvcalloc() (that is vmalloc()) instead of allocating contiguous pages with alloc_pages(). Fixes: 515ce6061312 ("scsi: sd_zbc: Fix sd_zbc_report_zones() buffer allocation") Fixes: e76239a3748c ("block: add a report_zones method") Cc: stable@vger.kernel.org Reviewed-by: Christoph Hellwig Reviewed-by: Martin K. Petersen Signed-off-by: Damien Le Moal Signed-off-by: Jens Axboe commit b091ac616846a1da75b1f2566b41255ce7f0e0a6 Author: Damien Le Moal Date: Mon Jul 1 14:09:17 2019 +0900 sd_zbc: Fix report zones buffer allocation During disk scan and revalidation done with sd_revalidate(), the zones of a zoned disk are checked using the helper function blk_revalidate_disk_zones() if a configuration change is detected (change in the number of zones or zone size). The function blk_revalidate_disk_zones() issues report_zones calls that are very large, that is, to obtain zone information for all zones of the disk with a single command. The size of the report zones command buffer necessary for such large request generally is lower than the disk max_hw_sectors and KMALLOC_MAX_SIZE (4MB) and succeeds on boot (no memory fragmentation), but often fail at run time (e.g. hot-plug event). This causes the disk revalidation to fail and the disk capacity to be changed to 0. This problem can be avoided by using vmalloc() instead of kmalloc() for the buffer allocation. To limit the amount of memory to be allocated, this patch also introduces the arbitrary SD_ZBC_REPORT_MAX_ZONES maximum number of zones to report with a single report zones command. This limit may be lowered further to satisfy the disk max_hw_sectors limit. Finally, to ensure that the vmalloc-ed buffer can always be mapped in a request, the buffer size is further limited to at most queue_max_segments() pages, allowing successful mapping of the buffer even in the worst case scenario where none of the buffer pages are contiguous. Fixes: 515ce6061312 ("scsi: sd_zbc: Fix sd_zbc_report_zones() buffer allocation") Fixes: e76239a3748c ("block: add a report_zones method") Cc: stable@vger.kernel.org Reviewed-by: Christoph Hellwig Reviewed-by: Martin K. Petersen Signed-off-by: Damien Le Moal Signed-off-by: Jens Axboe commit bd976e52725965ddcceb9abecbcc7ca46863665c Author: Damien Le Moal Date: Mon Jul 1 14:09:16 2019 +0900 block: Kill gfp_t argument of blkdev_report_zones() Only GFP_KERNEL and GFP_NOIO are used with blkdev_report_zones(). In preparation of using vmalloc() for large report buffer and zone array allocations used by this function, remove its "gfp_t gfp_mask" argument and rely on the caller context to use memalloc_noio_save/restore() where necessary (block layer zone revalidation and dm-zoned I/O error path). Reviewed-by: Christoph Hellwig Reviewed-by: Martin K. Petersen Signed-off-by: Damien Le Moal Signed-off-by: Jens Axboe commit b4c5875d36178e8df409bdce232f270cac89fafe Author: Damien Le Moal Date: Mon Jul 1 14:09:15 2019 +0900 block: Allow mapping of vmalloc-ed buffers To allow the SCSI subsystem scsi_execute_req() function to issue requests using large buffers that are better allocated with vmalloc() rather than kmalloc(), modify bio_map_kern() to allow passing a buffer allocated with vmalloc(). To do so, detect vmalloc-ed buffers using is_vmalloc_addr(). For vmalloc-ed buffers, flush the buffer using flush_kernel_vmap_range(), use vmalloc_to_page() instead of virt_to_page() to obtain the pages of the buffer, and invalidate the buffer addresses with invalidate_kernel_vmap_range() on completion of read BIOs. This last point is executed using the function bio_invalidate_vmalloc_pages() which is defined only if the architecture defines ARCH_HAS_FLUSH_KERNEL_DCACHE_PAGE, that is, if the architecture actually needs the invalidation done. Fixes: 515ce6061312 ("scsi: sd_zbc: Fix sd_zbc_report_zones() buffer allocation") Fixes: e76239a3748c ("block: add a report_zones method") Cc: stable@vger.kernel.org Reviewed-by: Martin K. Petersen Signed-off-by: Damien Le Moal Reviewed-by: Christoph Hellwig Reviewed-by: Chaitanya Kulkarni Reviewed-by: Ming Lei Signed-off-by: Jens Axboe commit e7bf90e5afe3aa1d1282c1635a49e17a32c4ecec Author: Wenwen Wang Date: Thu Jul 11 14:22:02 2019 -0500 block/bio-integrity: fix a memory leak bug In bio_integrity_prep(), a kernel buffer is allocated through kmalloc() to hold integrity metadata. Later on, the buffer will be attached to the bio structure through bio_integrity_add_page(), which returns the number of bytes of integrity metadata attached. Due to unexpected situations, bio_integrity_add_page() may return 0. As a result, bio_integrity_prep() needs to be terminated with 'false' returned to indicate this error. However, the allocated kernel buffer is not freed on this execution path, leading to a memory leak. To fix this issue, free the allocated buffer before returning from bio_integrity_prep(). Reviewed-by: Ming Lei Acked-by: Martin K. Petersen Signed-off-by: Wenwen Wang Signed-off-by: Jens Axboe commit d7d170a8e357bd9926cc6bfea5c2385c2eac65b2 Merge: d06e4156430e 8c3166e17cf1 Author: Linus Torvalds Date: Thu Jul 11 18:45:29 2019 -0700 Merge tag 'tag-chrome-platform-for-v5.3' of git://git.kernel.org/pub/scm/linux/kernel/git/chrome-platform/linux Pull chrome platform updates from Benson Leung "CrOS EC: - Add new CrOS ISHTP transport protocol - Add proper documentation for debugfs entries and expose resume and uptime files - Select LPC transport protocol variant at runtime. - Add lid angle sensor driver - Fix oops on suspend/resume for lightbar driver - Set CrOS SPI transport protol in realtime Wilco EC: - Add telemetry char device interface - Add support for event handling - Add new sysfs attributes Misc: - Contains ib-mfd-cros-v5.3 immutable branch from mfd, with cros_ec_commands.h header freshly synced with Chrome OS's EC project" * tag 'tag-chrome-platform-for-v5.3' of git://git.kernel.org/pub/scm/linux/kernel/git/chrome-platform/linux: (54 commits) mfd / platform: cros_ec_debugfs: Expose resume result via debugfs platform/chrome: lightbar: Get drvdata from parent in suspend/resume iio: cros_ec: Add lid angle driver platform/chrome: wilco_ec: Add circular buffer as event queue platform/chrome: cros_ec_lpc_mec: Fix kernel-doc comment first line platform/chrome: cros_ec_lpc: Choose Microchip EC at runtime platform/chrome: cros_ec_lpc: Merge cros_ec_lpc and cros_ec_lpc_reg Input: cros_ec_keyb: mask out extra flags in event_type platform/chrome: wilco_ec: Fix unreleased lock in event_read() platform/chrome: cros_ec_debugfs: cros_ec_uptime_fops can be static platform/chrome: cros_ec_debugfs: Add debugfs ABI documentation platform/chrome: cros_ec_debugfs: Fix kernel-doc comment first line platform/chrome: cros_ec_debugfs: Add debugfs entry to retrieve EC uptime mfd: cros_ec: Update I2S API mfd: cros_ec: Add Management API entry points mfd: cros_ec: Add SKU ID and Secure storage API mfd: cros_ec: Add API for rwsig mfd: cros_ec: Add API for Fingerprint support mfd: cros_ec: Add API for Touchpad support mfd: cros_ec: Add API for EC-EC communication ... commit d06e4156430e7c5eb4f04dabcaa0d9e2fba335e3 Merge: 8931084c0d01 f59d261180f3 Author: Linus Torvalds Date: Thu Jul 11 18:35:30 2019 -0700 Merge tag 'devicetree-for-5.3' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux Pull Devicetree updates from Rob Herring: - DT binding schema examples are now validated against the schemas. Various examples are fixed due to that. - Sync dtc with upstream version v1.5.0-30-g702c1b6c0e73 - Initial schemas for networking bindings. This includes ethernet, phy and mdio common bindings with several Allwinner and stmmac converted to the schema. - Conversion of more Arm top-level SoC/board bindings to DT schema - Conversion of PSCI binding to DT schema - Rework Arm CPU schema to coexist with other CPU schemas - Add a bunch of missing vendor prefixes and new ones for SoChip, Sipeed, Kontron, B&R Industrial Automation GmbH, and Espressif - Add Mediatek UART RX wakeup support to binding - Add reset to ST UART binding - Remove some Linuxisms from the endianness common-properties.txt binding - Make the flattened DT read-only after init - Ignore disabled reserved memory nodes - Clean-up some dead code in FDT functions * tag 'devicetree-for-5.3' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux: (56 commits) dt-bindings: vendor-prefixes: add Sipeed dt-bindings: vendor-prefixes: add SoChip dt-bindings: 83xx-512x-pci: Drop cell-index property dt-bindings: serial: add documentation for Rx in-band wakeup support dt-bindings: arm: Convert RDA Micro board/soc bindings to json-schema of: unittest: simplify getting the adapter of a client of/fdt: pass early_init_dt_reserve_memory_arch() with bool type nomap of/platform: Drop superfluous cast in of_device_make_bus_id() dt-bindings: usb: ehci: Fix example warnings dt-bindings: net: Use phy-mode instead of phy-connection-type dt-bindings: simple-framebuffer: Add requirement for pipelines dt-bindings: display: Fix simple-framebuffer example dt-bindings: net: mdio: Add child nodes dt-bindings: net: mdio: Add address and size cells dt-bindings: net: mdio: Add a nodename pattern dt-bindings: mtd: sunxi-nand: Drop 'maxItems' from child 'reg' property dt-bindings: arm: Limit cpus schema to only check Arm 'cpu' nodes dt-bindings: backlight: lm3630a: correct schema validation dt-bindings: net: dwmac: Deprecate the PHY reset properties dt-bindings: net: sun8i-emac: Convert the binding to a schemas ... commit 8931084c0d017314ad025f19353f7c5c1d3782d8 Merge: 17a20acaf171 59592cc1f593 Author: Linus Torvalds Date: Thu Jul 11 18:11:21 2019 -0700 Merge tag 'mmc-v5.3' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc Pull MMC updates from Ulf Hansson: "MMC core: - Let the dma map ops deal with bouncing and drop dma_max_pfn() from the dma-mapping interface for ARM - Convert the generic MMC DT doc to YAML schemas - Drop questionable support for powered-on re-init of SDIO cards at runtime resume and for SDIO HW reset - Prevent questionable re-init of powered-on removable SDIO cards at system resume - Cleanup and clarify some SDIO core code MMC host: - tmio: Make runtime PM enablement more flexible for variants - tmio/renesas_sdhi: Rename DT doc tmio_mmc.txt to renesas,sdhi.txt to clarify - sdhci-pci: Add support for Intel EHL - sdhci-pci-o2micro: Enable support for 8-bit bus - sdhci-msm: Prevent acquiring a mutex while holding a spin_lock - sdhci-of-esdhc: Improve clock management and tuning - sdhci_am654: Enable support for 4 and 8-bit bus on J721E - sdhci-sprd: Use pinctrl for a proper signal voltage switch - sdhci-sprd: Add support for HS400 enhanced strobe mode - sdhci-sprd: Enable PHY DLL and allow delay config to stabilize the clock - sdhci-sprd: Add support for optional gate clock - sunxi-mmc: Convert DT doc to YAML schemas - meson-gx: Add support for broken DRAM access for DMA MEMSTICK core: - Fixup error path of memstick_init()" * tag 'mmc-v5.3' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc: (52 commits) mmc: sdhci_am654: Add dependency on MMC_SDHCI_AM654 mmc: alcor: remove a redundant greater or equal to zero comparison mmc: sdhci-msm: fix mutex while in spinlock mmc: sdhci_am654: Make some symbols static dma-mapping: remove dma_max_pfn mmc: core: let the dma map ops handle bouncing dt-binding: mmc: rename tmio_mmc.txt to renesas,sdhi.txt mmc: sdhci-sprd: Add pin control support for voltage switch dt-bindings: mmc: sprd: Add pinctrl support mmc: sdhci-sprd: Add start_signal_voltage_switch ops mmc: sdhci-pci: Add support for Intel EHL mmc: tmio: Use dma_max_mapping_size() instead of a workaround mmc: sdio: Drop unused in-parameter from mmc_sdio_init_card() mmc: sdio: Drop unused in-parameter to mmc_sdio_reinit_card() mmc: sdio: Don't re-initialize powered-on removable SDIO cards at resume mmc: sdio: Drop powered-on re-init at runtime resume and HW reset mmc: sdio: Move comment about re-initialization to mmc_sdio_reinit_card() mmc: sdio: Drop mmc_claim|release_host() in mmc_sdio_power_restore() mmc: sdio: Turn sdio_run_irqs() into static mmc: sdhci: Fix indenting on SDHCI_CTRL_8BITBUS ... commit 484647088826f2f651acbda6bcf9536b8a466703 Author: Benjamin Block Date: Tue Jul 2 23:02:02 2019 +0200 scsi: zfcp: fix GCC compiler warning emitted with -Wmaybe-uninitialized GCC v9 emits this warning: CC drivers/s390/scsi/zfcp_erp.o drivers/s390/scsi/zfcp_erp.c: In function 'zfcp_erp_action_enqueue': drivers/s390/scsi/zfcp_erp.c:217:26: warning: 'erp_action' may be used uninitialized in this function [-Wmaybe-uninitialized] 217 | struct zfcp_erp_action *erp_action; | ^~~~~~~~~~ This is a possible false positive case, as also documented in the GCC documentations: https://gcc.gnu.org/onlinedocs/gcc/Warning-Options.html#index-Wmaybe-uninitialized The actual code-sequence is like this: Various callers can invoke the function below with the argument "want" being one of: ZFCP_ERP_ACTION_REOPEN_ADAPTER, ZFCP_ERP_ACTION_REOPEN_PORT_FORCED, ZFCP_ERP_ACTION_REOPEN_PORT, or ZFCP_ERP_ACTION_REOPEN_LUN. zfcp_erp_action_enqueue(want, ...) ... need = zfcp_erp_required_act(want, ...) need = want ... maybe: need = ZFCP_ERP_ACTION_REOPEN_PORT maybe: need = ZFCP_ERP_ACTION_REOPEN_ADAPTER ... return need ... zfcp_erp_setup_act(need, ...) struct zfcp_erp_action *erp_action; // <== line 217 ... switch(need) { case ZFCP_ERP_ACTION_REOPEN_LUN: ... erp_action = &zfcp_sdev->erp_action; WARN_ON_ONCE(erp_action->port != port); // <== access ... break; case ZFCP_ERP_ACTION_REOPEN_PORT: case ZFCP_ERP_ACTION_REOPEN_PORT_FORCED: ... erp_action = &port->erp_action; WARN_ON_ONCE(erp_action->port != port); // <== access ... break; case ZFCP_ERP_ACTION_REOPEN_ADAPTER: ... erp_action = &adapter->erp_action; WARN_ON_ONCE(erp_action->port != NULL); // <== access ... break; } ... WARN_ON_ONCE(erp_action->adapter != adapter); // <== access When zfcp_erp_setup_act() is called, 'need' will never be anything else than one of the 4 possible enumeration-names that are used in the switch-case, and 'erp_action' is initialized for every one of them, before it is used. Thus the warning is a false positive, as documented. We introduce the extra if{} in the beginning to create an extra code-flow, so the compiler can be convinced that the switch-case will never see any other value. BUG_ON()/BUG() is intentionally not used to not crash anything, should this ever happen anyway - right now it's impossible, as argued above; and it doesn't introduce a 'default:' switch-case to retain warnings should 'enum zfcp_erp_act_type' ever be extended and no explicit case be introduced. See also v5.0 commit 399b6c8bc9f7 ("scsi: zfcp: drop old default switch case which might paper over missing case"). Signed-off-by: Benjamin Block Reviewed-by: Jens Remus Reviewed-by: Steffen Maier Signed-off-by: Martin K. Petersen commit 106d45f350c7cac876844dc685845cba4ffdb70b Author: Benjamin Block Date: Tue Jul 2 23:02:01 2019 +0200 scsi: zfcp: fix request object use-after-free in send path causing wrong traces When tracing instances where we open and close WKA ports, we also pass the request-ID of the respective FSF command. But after successfully sending the FSF command we must not use the request-object anymore, as this might result in an use-after-free (see "zfcp: fix request object use-after-free in send path causing seqno errors" ). To fix this add a new variable that caches the request-ID before sending the request. This won't change during the hand-off to the FCP channel, and so it's safe to trace this cached request-ID later, instead of using the request object. Signed-off-by: Benjamin Block Fixes: d27a7cb91960 ("zfcp: trace on request for open and close of WKA port") Cc: #2.6.38+ Reviewed-by: Steffen Maier Reviewed-by: Jens Remus Signed-off-by: Martin K. Petersen commit b76becde2b84137faa29bbc9a3b20953b5980e48 Author: Benjamin Block Date: Tue Jul 2 23:02:00 2019 +0200 scsi: zfcp: fix request object use-after-free in send path causing seqno errors With a recent change to our send path for FSF commands we introduced a possible use-after-free of request-objects, that might further lead to zfcp crafting bad requests, which the FCP channel correctly complains about with an error (FSF_PROT_SEQ_NUMB_ERROR). This error is then handled by an adapter-wide recovery. The following sequence illustrates the possible use-after-free: Send Path: int zfcp_fsf_open_port(struct zfcp_erp_action *erp_action) { struct zfcp_fsf_req *req; ... spin_lock_irq(&qdio->req_q_lock); // ^^^^^^^^^^^^^^^^ // protects QDIO queue during sending ... req = zfcp_fsf_req_create(qdio, FSF_QTCB_OPEN_PORT_WITH_DID, SBAL_SFLAGS0_TYPE_READ, qdio->adapter->pool.erp_req); // ^^^^^^^^^^^^^^^^^^^ // allocation of the request-object ... retval = zfcp_fsf_req_send(req); ... spin_unlock_irq(&qdio->req_q_lock); return retval; } static int zfcp_fsf_req_send(struct zfcp_fsf_req *req) { struct zfcp_adapter *adapter = req->adapter; struct zfcp_qdio *qdio = adapter->qdio; ... zfcp_reqlist_add(adapter->req_list, req); // ^^^^^^^^^^^^^^^^ // add request to our driver-internal hash-table for tracking // (protected by separate lock req_list->lock) ... if (zfcp_qdio_send(qdio, &req->qdio_req)) { // ^^^^^^^^^^^^^^ // hand-off the request to FCP channel; // the request can complete at any point now ... } /* Don't increase for unsolicited status */ if (!zfcp_fsf_req_is_status_read_buffer(req)) // ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ // possible use-after-free adapter->fsf_req_seq_no++; // ^^^^^^^^^^^^^^^^ // because of the use-after-free we might // miss this accounting, and as follow-up // this results in the FCP channel error // FSF_PROT_SEQ_NUMB_ERROR adapter->req_no++; return 0; } static inline bool zfcp_fsf_req_is_status_read_buffer(struct zfcp_fsf_req *req) { return req->qtcb == NULL; // ^^^^^^^^^ // possible use-after-free } Response Path: void zfcp_fsf_reqid_check(struct zfcp_qdio *qdio, int sbal_idx) { ... struct zfcp_fsf_req *fsf_req; ... for (idx = 0; idx < QDIO_MAX_ELEMENTS_PER_BUFFER; idx++) { ... fsf_req = zfcp_reqlist_find_rm(adapter->req_list, req_id); // ^^^^^^^^^^^^^^^^^^^^ // remove request from our driver-internal // hash-table (lock req_list->lock) ... zfcp_fsf_req_complete(fsf_req); } } static void zfcp_fsf_req_complete(struct zfcp_fsf_req *req) { ... if (likely(req->status & ZFCP_STATUS_FSFREQ_CLEANUP)) zfcp_fsf_req_free(req); // ^^^^^^^^^^^^^^^^^ // free memory for request-object else complete(&req->completion); // ^^^^^^^^ // completion notification for code-paths that wait // synchronous for the completion of the request; in // those the memory is freed separately } The result of the use-after-free only affects the send path, and can not lead to any data corruption. In case we miss the sequence-number accounting, because the memory was already re-purposed, the next FSF command will fail with said FCP channel error, and we will recover the whole adapter. This causes no additional errors, but it slows down traffic. There is a slight chance of the same thing happen again recursively after the adapter recovery, but so far this has not been seen. This was seen under z/VM, where the send path might run on a virtual CPU that gets scheduled away by z/VM, while the return path might still run, and so create the necessary timing. Running with KASAN can also slow down the kernel sufficiently to run into this user-after-free, and then see the report by KASAN. To fix this, simply pull the test for the sequence-number accounting in front of the hand-off to the FCP channel (this information doesn't change during hand-off), but leave the sequence-number accounting itself where it is. To make future regressions of the same kind less likely, add comments to all closely related code-paths. Signed-off-by: Benjamin Block Fixes: f9eca0227600 ("scsi: zfcp: drop duplicate fsf_command from zfcp_fsf_req which is also in QTCB header") Cc: #5.0+ Reviewed-by: Steffen Maier Reviewed-by: Jens Remus Signed-off-by: Martin K. Petersen commit 705d3b088af9c1aac8a388456f5b9c38f04f97a1 Author: Shivasharan S Date: Fri Jun 28 02:50:41 2019 -0700 scsi: megaraid_sas: Update driver version to 07.710.50.00 Signed-off-by: Shivasharan S Signed-off-by: Martin K. Petersen commit d956a116c96cfa651b5ed5c783984a33d5222268 Author: Shivasharan S Date: Fri Jun 28 02:50:40 2019 -0700 scsi: megaraid_sas: Add module parameter for FW Async event logging Add module parameter to control logging levels of async event notifications from firmware that get logged to system log. Also, allow changing the value from sysfs after driver load. Signed-off-by: Shivasharan S Signed-off-by: Martin K. Petersen commit 1175b88452cad208894412b955ee698934968aed Author: Shivasharan S Date: Fri Jun 28 02:50:39 2019 -0700 scsi: megaraid_sas: Enable msix_load_balance for Invader and later controllers Load balancing IO completions across all available MSI-X vectors should be enabled for Invader and later generation controllers only. This needs to be disabled for older controllers. Add an adapter type check before setting msix_load_balance flag. Fixes: 1d15d9098ad1 ("scsi: megaraid_sas: Load balance completions across all MSI-X") Signed-off-by: Shivasharan S Signed-off-by: Martin K. Petersen commit c8f96df5b8e633056b7ebf5d52a9d6fb1b156ce3 Author: Shivasharan S Date: Fri Jun 28 18:02:12 2019 -0700 scsi: megaraid_sas: Fix calculation of target ID In megasas_get_target_prop(), driver is incorrectly calculating the target ID for devices with channel 1 and 3. Due to this, firmware will either fail the command (if there is no device with the target id sent from driver) or could return the properties for a target which was not intended. Devices could end up with the wrong queue depth due to this. Fix target id calculation for channel 1 and 3. Fixes: 96188a89cc6d ("scsi: megaraid_sas: NVME interface target prop added") Cc: stable@vger.kernel.org Signed-off-by: Shivasharan S Signed-off-by: Martin K. Petersen commit 057959c6e36e4e6e5303a39c4df79c4af9d40923 Author: Arnd Bergmann Date: Fri Jun 28 14:37:47 2019 +0200 scsi: lpfc: reduce stack size with CONFIG_GCC_PLUGIN_STRUCTLEAK_VERBOSE The lpfc_debug_dump_all_queues() function repeatedly calls into lpfc_debug_dump_qe() which has a temporary 128 byte buffer. This was fine before the introduction of CONFIG_GCC_PLUGIN_STRUCTLEAK_VERBOSE because each instance could occupy the same stack slot. However, now they each get their own copy, which leads to a huge increase in stack usage as seen from the compiler warning: drivers/scsi/lpfc/lpfc_debugfs.c: In function 'lpfc_debug_dump_all_queues': drivers/scsi/lpfc/lpfc_debugfs.c:6474:1: error: the frame size of 1712 bytes is larger than 100 bytes [-Werror=frame-larger-than=] Avoid this by not marking lpfc_debug_dump_qe() as inline so the compiler can choose to emit a static version of this function when it's needed or otherwise silently drop it. As an added benefit, not inlining multiple copies of this function means we save several kilobytes of .text section, reducing the file size from 47kb to 43. It is somewhat unusual to have a function that is static but not inline in a header file, but this does not cause problems here because it is only used by other inline functions. It would however seem reasonable to move all the lpfc_debug_dump_* functions into lpfc_debugfs.c and not mark them inline as a later cleanup. Fixes: 81a56f6dcd20 ("gcc-plugins: structleak: Generalize to all variable types") Signed-off-by: Arnd Bergmann Acked-by: James Smart Signed-off-by: Martin K. Petersen commit 4bc022145c939dd3938771535a8074a884aec0f9 Author: Marcos Paulo de Souza Date: Mon Jun 17 22:31:45 2019 -0300 scsi: devinfo: BLIST_TRY_VPD_PAGES for SanDisk Cruzer Blade Currently, all USB devices skip VPD pages, even when the device supports them (SPC-3 and later), but some of them support VPD, like Cruzer Blade. Signed-off-by: Marcos Paulo de Souza Signed-off-by: Martin K. Petersen commit 196ba6629cf95e51403337235d09742fcdc3febd Author: Deepak Ukey Date: Tue Jul 9 15:30:48 2019 +0530 scsi: pm80xx: Fixed kernel panic during error recovery for SATA drive Disabling the SATA drive interface cause kernel panic. When the drive Interface is disabled, device should be deregistered after aborting all pending I/Os. Also changed the port recovery timeout to 10000 ms for PM8006 controller. Signed-off-by: Deepak Ukey Signed-off-by: Viswas G Reviewed-by: Jack Wang Signed-off-by: Martin K. Petersen commit 9b79ee9773a8c11772b2d0ed0cec831c7a68dc4f Author: Denis Efremov Date: Mon Jul 8 19:43:39 2019 +0300 scsi: libsas: remove the exporting of sas_wait_eh The function sas_wait_eh is declared static and marked EXPORT_SYMBOL, which is at best an odd combination. Because the function is not used outside of the drivers/scsi/libsas/sas_scsi_host.c file it is defined in, this commit removes the EXPORT_SYMBOL() marking. Signed-off-by: Denis Efremov Reviewed-by: Jason Yan Signed-off-by: Martin K. Petersen commit 6764f519bcb007bf09f328133311d6cdc2bbc72f Author: YueHaibing Date: Tue Jul 2 21:01:14 2019 +0800 scsi: megaraid_sas: Make some symbols static Fix sparse warnings: drivers/scsi/megaraid/megaraid_sas_base.c:271:1: warning: symbol 'megasas_issue_dcmd' was not declared. Should it be static? drivers/scsi/megaraid/megaraid_sas_base.c:2227:6: warning: symbol 'megasas_do_ocr' was not declared. Should it be static? drivers/scsi/megaraid/megaraid_sas_base.c:3194:25: warning: symbol 'megaraid_host_attrs' was not declared. Should it be static? Reported-by: Hulk Robot Signed-off-by: YueHaibing Acked-by: Sumit Saxena Signed-off-by: Martin K. Petersen commit 463cdad83823830dd59572fb81ac243f6a44b589 Author: Maurizio Lombardi Date: Tue Jul 2 13:27:05 2019 +0200 scsi: core: use scmd_printk() to print which command timed out With a possibly faulty disk the following messages may appear in the logs: kernel: sd 0:0:9:0: timing out command, waited 180s kernel: sd 0:0:9:0: timing out command, waited 20s kernel: sd 0:0:9:0: timing out command, waited 20s kernel: sd 0:0:9:0: timing out command, waited 60s kernel: sd 0:0:9:0: timing out command, waited 20s This is not very informative because it's not possible to identify the command that timed out. This patch replaces sdev_printk() with scmd_printk(). Signed-off-by: Maurizio Lombardi Reviewed-by: Ewan D. Milne Reviewed-by: Ming Lei Signed-off-by: Martin K. Petersen commit 17a20acaf171124017f43bc70bb4d7ca88070659 Merge: d72619706abc 2bc8bb813cba Author: Linus Torvalds Date: Thu Jul 11 15:40:06 2019 -0700 Merge tag 'usb-5.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb Pull USB / PHY updates from Greg KH: "Here is the big USB and PHY driver pull request for 5.3-rc1. Lots of stuff here, all of which has been in linux-next for a while with no reported issues. Nothing is earth-shattering, just constant forward progress for more devices supported and cleanups and small fixes: - USB gadget driver updates and fixes - new USB gadget driver for some hardware, followed by a quick revert of those patches as they were not ready to be merged... - PHY driver updates - Lots of new driver additions and cleanups with a few fixes mixed in" * tag 'usb-5.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (145 commits) Revert "usb: gadget: storage: Remove warning message" Revert "dt-bindings: add binding for USBSS-DRD controller." Revert "usb:gadget Separated decoding functions from dwc3 driver." Revert "usb:gadget Patch simplify usb_decode_set_clear_feature function." Revert "usb:gadget Simplify usb_decode_get_set_descriptor function." Revert "usb:cdns3 Add Cadence USB3 DRD Driver" Revert "usb:cdns3 Fix for stuck packets in on-chip OUT buffer." usb :fsl: Change string format for errata property usb: host: Stops USB controller init if PLL fails to lock usb: linux/fsl_device: Add platform member has_fsl_erratum_a006918 usb: phy: Workaround for USB erratum-A005728 usb: fsl: Set USB_EN bit to select ULPI phy usb: Handle USB3 remote wakeup for LPM enabled devices correctly drivers/usb/typec/tps6598x.c: fix 4CC cmd write drivers/usb/typec/tps6598x.c: fix portinfo width usb: storage: scsiglue: Do not skip VPD if try_vpd_pages is set usb: renesas_usbhs: add a workaround for a race condition of workqueue usb: gadget: udc: renesas_usb3: remove redundant assignment to ret usb: dwc2: use a longer AHB idle timeout in dwc2_core_reset() USB: gadget: function: fix issue Unneeded variable: "value" ... commit d72619706abc4aa7e540ea882dae883cee7cc3b3 Merge: e786741ff1b5 35a4ed0164e9 Author: Linus Torvalds Date: Thu Jul 11 15:38:21 2019 -0700 Merge tag 'tty-5.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty Pull tty / serial driver updates from Greg KH: "Here is the "large" TTY and Serial driver update for 5.3-rc1. It's in the negative number of lines overall as we removed an obsolete serial driver that was causing problems for some people who were trying to clean up some apis (the mpsc.c driver, which only worked for some pre-production hardware that no one has anymore.) Other than that, lots of tiny changes, cleaning up small things along with some platform-specific serial driver updates. All of these have been in linux-next for a while now with no reported issues" * tag 'tty-5.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty: (68 commits) tty: serial: fsl_lpuart: add imx8qxp support serial: imx: set_termios(): preserve RTS state serial: imx: set_termios(): clarify RTS/CTS bits calculation serial: imx: set_termios(): factor-out 'ucr2' initial value serial: sh-sci: Terminate TX DMA during buffer flushing serial: sh-sci: Fix TX DMA buffer flushing and workqueue races serial: mpsc: Remove obsolete MPSC driver serial: 8250: 8250_core: Fix missing unlock on error in serial8250_register_8250_port() serial: stm32: add RX and TX FIFO flush serial: stm32: add support of RX FIFO threshold serial: stm32: add support of TX FIFO threshold serial: stm32: update PIO transmission serial: stm32: add support of timeout interrupt for RX Revert "serial: 8250: Don't service RX FIFO if interrupts are disabled" tty/serial/8250: use mctrl_gpio helpers serial: mctrl_gpio: Check if GPIO property exisits before requesting it serial: 8250: pericom_do_set_divisor can be static tty: serial_core: Set port active bit in uart_port_activate serial: 8250: Add MSR/MCR TIOCM conversion wrapper functions serial: 8250: factor out serial8250_{set,clear}_THRI() helpers ... commit e786741ff1b52769b044b7f4407f39cd13ee5d2d Merge: 97ff4ca46d32 5d1532482943 Author: Linus Torvalds Date: Thu Jul 11 15:36:02 2019 -0700 Merge tag 'staging-5.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging Pull staging and IIO driver updates from Greg KH: "Here is the big Staging and IIO driver update for 5.3-rc1. Lots of new IIO drivers are in here, along with loads of tiny staging driver cleanups and fixes. Overall we almost break even with the same lines added as removed. Full details are in the shortlog, they are too large to list here. All of these changes have been in linux-next for a while with no reported issues" * tag 'staging-5.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging: (608 commits) staging: kpc2000: simplify comparison to NULL in fileops.c staging: kpc2000: simplify comparison to NULL in dma.c staging: kpc2000: simplify comparison to NULL in kpc2000_spi.c staging: rtl8723bs: hal: remove redundant assignment to packetType staging: rtl8723bs: Change return type of hal_btcoex_IsBtDisabled() staging: rtl8723bs: Remove rtw_btcoex_DisplayBtCoexInfo() staging: rtl8723bs: Remove function rtw_btcoex_GetDBG() staging: rtl8723bs: Remove function rtw_btcoex_SetDBG() staging: rtl8723bs: Remove rtw_btcoex_IsBTCoexCtrlAMPDUSize() staging: rtl8723bs: Remove rtw_btcoex_BtInfoNotify() staging: rtl8723bs: Remove rtw_btcoex_ScanNotify() staging: rtl8723bs: Remove rtw_btcoex_SetSingleAntPath() staging: rtl8723bs: Remove rtw_btcoex_SetPGAntNum() staging: rtl8192e: remove redundant initialization of rtstatus staging: rtl8723bs: Remove rtw_btcoex_GetRaMask() staging: rtl8723bs: Remove rtw_btcoex_SetChipType() staging: rtl8723bs: Remove rtw_btcoex_ConnectNotify() staging: rtl8723bs: Remove rtw_btcoex_SetBTCoexist() staging: rtl8723bs: Remove rtw_btcoex_IsBtDisabled() staging: rtl8723bs: Remove rtw_btcoex_IsBtControlLps() ... commit 97ff4ca46d3279134cec49752de8c5a62dc68460 Merge: 4832a4dada1a 2f4281f4dce1 Author: Linus Torvalds Date: Thu Jul 11 15:34:05 2019 -0700 Merge tag 'char-misc-5.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc Pull char / misc driver updates from Greg KH: "Here is the "large" pull request for char and misc and other assorted smaller driver subsystems for 5.3-rc1. It seems that this tree is becoming the funnel point of lots of smaller driver subsystems, which is fine for me, but that's why it is getting larger over time and does not just contain stuff under drivers/char/ and drivers/misc. Lots of small updates all over the place here from different driver subsystems: - habana driver updates - coresight driver updates - documentation file movements and updates - Android binder fixes and updates - extcon driver updates - google firmware driver updates - fsi driver updates - smaller misc and char driver updates - soundwire driver updates - nvmem driver updates - w1 driver fixes All of these have been in linux-next for a while with no reported issues" * tag 'char-misc-5.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: (188 commits) coresight: Do not default to CPU0 for missing CPU phandle dt-bindings: coresight: Change CPU phandle to required property ocxl: Allow contexts to be attached with a NULL mm fsi: sbefifo: Don't fail operations when in SBE IPL state coresight: tmc: Smatch: Fix potential NULL pointer dereference coresight: etm3x: Smatch: Fix potential NULL pointer dereference coresight: Potential uninitialized variable in probe() coresight: etb10: Do not call smp_processor_id from preemptible coresight: tmc-etf: Do not call smp_processor_id from preemptible coresight: tmc-etr: alloc_perf_buf: Do not call smp_processor_id from preemptible coresight: tmc-etr: Do not call smp_processor_id() from preemptible docs: misc-devices: convert files without extension to ReST fpga: dfl: fme: align PR buffer size per PR datawidth fpga: dfl: fme: remove copy_to_user() in ioctl for PR fpga: dfl-fme-mgr: fix FME_PR_INTFC_ID register address. intel_th: msu: Start read iterator from a non-empty window intel_th: msu: Split sgt array and pointer in multiwindow mode intel_th: msu: Support multipage blocks intel_th: pci: Add Ice Lake NNPI support intel_th: msu: Fix single mode with disabled IOMMU ... commit 4832a4dada1a2baefac76b70e4f3a78e71a7c35c Merge: db0457338ece 86766756ac2b Author: Linus Torvalds Date: Thu Jul 11 15:32:11 2019 -0700 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid Pull HID updates from Jiri Kosina: - Documentation conversion to ReST, from Mauro Carvalho Chehab - Wacom MobileStudio Pro support, from Ping Cheng - Wacom 2nd Gen Intuos Pro Small support, from Aaron Armstrong Skomra - assorted small fixes and device ID additions * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid: HID: Add another Primax PIXART OEM mouse quirk HID: wacom: generic: add touchring adjustment for 2nd Gen Pro Small docs: hid: convert to ReST HID: remove NO_D3 flag when remove driver HID: wacom: add new MobileStudio Pro support HID: wacom: generic: read the number of expected touches on a per collection basis HID: wacom: generic: support the 'report valid' usage for touch HID: wacom: generic: read HID_DG_CONTACTMAX from any feature report HID: wacom: Add 2nd gen Intuos Pro Small support HID: uclogic: Add support for Ugee Rainbow CV720 HID: logitech-dj: fix return value of logi_dj_recv_query_hidpp_devices HID: logitech-hidpp: HID: make const array consumer_rdesc_start static HID: logitech-dj: make const array template static HID: wacom: correct touch resolution x/y typo HID: wacom: generic: Correct pad syncing HID: wacom: generic: only switch the mode on devices with LEDs HID: logitech-dj: Add usb-id for the 27MHz MX3000 receiver commit db0457338ece7482378d88e50ad298191c3e6947 Merge: 1f7563f743d7 38195dd5e916 Author: Linus Torvalds Date: Thu Jul 11 15:30:05 2019 -0700 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/livepatching/livepatching Pull livepatching updates from Jiri Kosina: - stacktrace handling improvements from Miroslav benes - debug output improvements from Petr Mladek * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/livepatching/livepatching: livepatch: Remove duplicate warning about missing reliable stacktrace support Revert "livepatch: Remove reliable stacktrace check in klp_try_switch_task()" stacktrace: Remove weak version of save_stack_trace_tsk_reliable() livepatch: Use static buffer for debugging messages under rq lock livepatch: Remove stale kobj_added entries from kernel-doc descriptions commit 3194d6adfe8e4da74e04b8eacef2bd7eea3f8992 Merge: 114a5c324015 dc205a8d3422 Author: David S. Miller Date: Thu Jul 11 15:27:20 2019 -0700 Merge branch 'net/rds-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/ssantosh/linux Santosh Shilimkar says: ==================== rds fixes Few rds fixes which makes rds rdma transport reliably working on mainline First two fixes are applicable to v4.11+ stable versions and last three patches applies to only v5.1 stable and current mainline. Patchset is re-based against 'net' and also available on below tree ==================== Signed-off-by: David S. Miller commit 1f7563f743d7081710a9d186a8b203997d09f383 Merge: ba6d10ab8014 3e99b3b13a1f Author: Linus Torvalds Date: Thu Jul 11 15:17:41 2019 -0700 Merge tag 'scsi-sg' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull SCSI scatter-gather list updates from James Bottomley: "This topic branch covers a fundamental change in how our sg lists are allocated to make mq more efficient by reducing the size of the preallocated sg list. This necessitates a large number of driver changes because the previous guarantee that if a driver specified SG_ALL as the size of its scatter list, it would get a non-chained list and didn't need to bother with scatterlist iterators is now broken and every driver *must* use scatterlist iterators. This was broken out as a separate topic because we need to convert all the drivers before pulling the trigger and unconverted drivers kept being found, necessitating a rebase" * tag 'scsi-sg' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: (21 commits) scsi: core: don't preallocate small SGL in case of NO_SG_CHAIN scsi: lib/sg_pool.c: clear 'first_chunk' in case of no preallocation scsi: core: avoid preallocating big SGL for data scsi: core: avoid preallocating big SGL for protection information scsi: lib/sg_pool.c: improve APIs for allocating sg pool scsi: esp: use sg helper to iterate over scatterlist scsi: NCR5380: use sg helper to iterate over scatterlist scsi: wd33c93: use sg helper to iterate over scatterlist scsi: ppa: use sg helper to iterate over scatterlist scsi: pcmcia: nsp_cs: use sg helper to iterate over scatterlist scsi: imm: use sg helper to iterate over scatterlist scsi: aha152x: use sg helper to iterate over scatterlist scsi: s390: zfcp_fc: use sg helper to iterate over scatterlist scsi: staging: unisys: visorhba: use sg helper to iterate over scatterlist scsi: usb: image: microtek: use sg helper to iterate over scatterlist scsi: pmcraid: use sg helper to iterate over scatterlist scsi: ipr: use sg helper to iterate over scatterlist scsi: mvumi: use sg helper to iterate over scatterlist scsi: lpfc: use sg helper to iterate over scatterlist scsi: advansys: use sg helper to iterate over scatterlist ... commit ba6d10ab8014ac10d25ca513352b6665e73b5785 Merge: 64b08df460cf baf23eddbf2a Author: Linus Torvalds Date: Thu Jul 11 15:14:01 2019 -0700 Merge tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull SCSI updates from James Bottomley: "This is mostly update of the usual drivers: qla2xxx, hpsa, lpfc, ufs, mpt3sas, ibmvscsi, megaraid_sas, bnx2fc and hisi_sas as well as the removal of the osst driver (I heard from Willem privately that he would like the driver removed because all his test hardware has failed). Plus number of minor changes, spelling fixes and other trivia. The big merge conflict this time around is the SPDX licence tags. Following discussion on linux-next, we believe our version to be more accurate than the one in the tree, so the resolution is to take our version for all the SPDX conflicts" Note on the SPDX license tag conversion conflicts: the SCSI tree had done its own SPDX conversion, which in some cases conflicted with the treewide ones done by Thomas & co. In almost all cases, the conflicts were purely syntactic: the SCSI tree used the old-style SPDX tags ("GPL-2.0" and "GPL-2.0+") while the treewide conversion had used the new-style ones ("GPL-2.0-only" and "GPL-2.0-or-later"). In these cases I picked the new-style one. In a few cases, the SPDX conversion was actually different, though. As explained by James above, and in more detail in a pre-pull-request thread: "The other problem is actually substantive: In the libsas code Luben Tuikov originally specified gpl 2.0 only by dint of stating: * This file is licensed under GPLv2. In all the libsas files, but then muddied the water by quoting GPLv2 verbatim (which includes the or later than language). So for these files Christoph did the conversion to v2 only SPDX tags and Thomas converted to v2 or later tags" So in those cases, where the spdx tag substantially mattered, I took the SCSI tree conversion of it, but then also took the opportunity to turn the old-style "GPL-2.0" into a new-style "GPL-2.0-only" tag. Similarly, when there were whitespace differences or other differences to the comments around the copyright notices, I took the version from the SCSI tree as being the more specific conversion. Finally, in the spdx conversions that had no conflicts (because the treewide ones hadn't been done for those files), I just took the SCSI tree version as-is, even if it was old-style. The old-style conversions are perfectly valid, even if the "-only" and "-or-later" versions are perhaps more descriptive. * tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: (185 commits) scsi: qla2xxx: move IO flush to the front of NVME rport unregistration scsi: qla2xxx: Fix NVME cmd and LS cmd timeout race condition scsi: qla2xxx: on session delete, return nvme cmd scsi: qla2xxx: Fix kernel crash after disconnecting NVMe devices scsi: megaraid_sas: Update driver version to 07.710.06.00-rc1 scsi: megaraid_sas: Introduce various Aero performance modes scsi: megaraid_sas: Use high IOPS queues based on IO workload scsi: megaraid_sas: Set affinity for high IOPS reply queues scsi: megaraid_sas: Enable coalescing for high IOPS queues scsi: megaraid_sas: Add support for High IOPS queues scsi: megaraid_sas: Add support for MPI toolbox commands scsi: megaraid_sas: Offload Aero RAID5/6 division calculations to driver scsi: megaraid_sas: RAID1 PCI bandwidth limit algorithm is applicable for only Ventura scsi: megaraid_sas: megaraid_sas: Add check for count returned by HOST_DEVICE_LIST DCMD scsi: megaraid_sas: Handle sequence JBOD map failure at driver level scsi: megaraid_sas: Don't send FPIO to RL Bypass queue scsi: megaraid_sas: In probe context, retry IOC INIT once if firmware is in fault scsi: megaraid_sas: Release Mutex lock before OCR in case of DCMD timeout scsi: megaraid_sas: Call disable_irq from process IRQ poll scsi: megaraid_sas: Remove few debug counters from IO path ... commit 114a5c3240155fdb01bf821c9d326d7bb05bd464 Merge: 08d14c49ac94 ef1ce7d7b67b Author: David S. Miller Date: Thu Jul 11 15:06:37 2019 -0700 Merge tag 'mlx5-fixes-2019-07-11' of git://git.kernel.org/pub/scm/linux/kernel/git/saeed/linux Saeed Mahameed says: ==================== Mellanox, mlx5 fixes 2019-07-11 This series introduces some fixes to mlx5 driver. Please pull and let me know if there is any problem. For -stable v4.15 ('net/mlx5e: IPoIB, Add error path in mlx5_rdma_setup_rn') For -stable v5.1 ('net/mlx5e: Fix port tunnel GRE entropy control') ('net/mlx5e: Rx, Fix checksum calculation for new hardware') ('net/mlx5e: Fix return value from timeout recover function') ('net/mlx5e: Fix error flow in tx reporter diagnose') For -stable v5.2 ('net/mlx5: E-Switch, Fix default encap mode') Conflict note: This pull request will produce a small conflict when merged with net-next. In drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c Take the hunk from net and replace: esw_offloads_steering_init(esw, vf_nvports, total_nvports); with: esw_offloads_steering_init(esw); ==================== Signed-off-by: David S. Miller commit 08d14c49ac949b0e42f2aa36fb8d5c860cfe130d Merge: d44e3fa5d7e6 9446d17e0e21 Author: David S. Miller Date: Thu Jul 11 15:04:39 2019 -0700 Merge branch 'mlx5-build-fixes' Saeed Mahameed says: ==================== Mellanox, mlx5 build fixes I know net-next is closed but these patches are fixing some compiler build and warnings issues people have been complaining about. I hope it is not too late, but in case it is a lot of trouble for you, I guess they can wait. ==================== Signed-off-by: David S. Miller commit 9446d17e0e21889046568e5f970e9c706acb01f5 Author: Saeed Mahameed Date: Thu Jul 11 19:39:59 2019 +0000 net/mlx5: E-Switch, Reduce ingress acl modify metadata stack usage Fix the following compiler warning: In function ‘esw_vport_add_ingress_acl_modify_metadata’: the frame size of 1084 bytes is larger than 1024 bytes [-Wframe-larger-than=] Since the structure is never written to, we can statically allocate it to avoid the stack usage. Fixes: 7445cfb1169c ("net/mlx5: E-Switch, Tag packet with vport number in VF vports and uplink ingress ACLs") Signed-off-by: Saeed Mahameed Reviewed-by: Jianbo Liu Signed-off-by: David S. Miller commit 2f1f5a7731df239a0d1965bc6b75ac37dcb803f3 Author: Saeed Mahameed Date: Thu Jul 11 19:39:57 2019 +0000 net/mlx5e: Fix unused variable warning when CONFIG_MLX5_ESWITCH is off In mlx5e_setup_tc "priv" variable is not being used if CONFIG_MLX5_ESWITCH is off, one way to fix this is to actually use it. mlx5e_setup_tc_mqprio also needs the "priv" variable and it extracts it on its own. We can simply pass priv to mlx5e_setup_tc_mqprio instead of netdev and avoid extracting the priv var, which will also resolve the compiler warning. Fixes: 4e95bc268b91 ("net: flow_offload: add flow_block_cb_setup_simple()") Signed-off-by: Saeed Mahameed Reviewed-by: Mark Bloch Reviewed-by: Tariq Toukan CC: Nathan Chancellor Signed-off-by: David S. Miller commit c93dfec10f1d693a897bfd0d6e3a58a5ea7edc91 Author: Tariq Toukan Date: Thu Jul 11 19:39:55 2019 +0000 net/mlx5e: Fix compilation error in TLS code In the cited patch below, the Kconfig flags combination of: CONFIG_MLX5_FPGA is not set CONFIG_MLX5_TLS=y CONFIG_MLX5_EN_TLS=y leads to the compilation error: ./include/linux/mlx5/device.h:61:39: error: invalid application of sizeof to incomplete type struct mlx5_ifc_tls_flow_bits. Fix it. Fixes: 90687e1a9a50 ("net/mlx5: Kconfig, Better organize compilation flags") Signed-off-by: Tariq Toukan Signed-off-by: Saeed Mahameed CC: Mao Wenan Signed-off-by: David S. Miller commit 7d30c81b80ea9b0812d27030a46a5bf4c4e328f5 Author: Minwoo Im Date: Fri Jul 12 02:04:47 2019 +0900 nvme: fix NULL deref for fabrics options git://git.infradead.org/nvme.git nvme-5.3 branch now causes the following NULL deref oops. Check the ctrl->opts first before the deref. [ 16.337581] BUG: kernel NULL pointer dereference, address: 0000000000000056 [ 16.338551] #PF: supervisor read access in kernel mode [ 16.338551] #PF: error_code(0x0000) - not-present page [ 16.338551] PGD 0 P4D 0 [ 16.338551] Oops: 0000 [#1] SMP PTI [ 16.338551] CPU: 2 PID: 1035 Comm: kworker/u16:5 Not tainted 5.2.0-rc6+ #1 [ 16.338551] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.11.2-0-gf9626ccb91-prebuilt.qemu-project.org 04/01/2014 [ 16.338551] Workqueue: nvme-wq nvme_scan_work [nvme_core] [ 16.338551] RIP: 0010:nvme_validate_ns+0xc9/0x7e0 [nvme_core] [ 16.338551] Code: c0 49 89 c5 0f 84 00 07 00 00 48 8b 7b 58 e8 be 48 39 c1 48 3d 00 f0 ff ff 49 89 45 18 0f 87 a4 06 00 00 48 8b 93 70 0a 00 00 <80> 7a 56 00 74 0c 48 8b 40 68 83 48 3c 08 49 8b 45 18 48 89 c6 bf [ 16.338551] RSP: 0018:ffffc900024c7d10 EFLAGS: 00010283 [ 16.338551] RAX: ffff888135a30720 RBX: ffff88813a4fd1f8 RCX: 0000000000000007 [ 16.338551] RDX: 0000000000000000 RSI: ffffffff8256dd38 RDI: ffff888135a30720 [ 16.338551] RBP: 0000000000000001 R08: 0000000000000007 R09: ffff88813aa6a840 [ 16.338551] R10: 0000000000000001 R11: 000000000002d060 R12: ffff88813a4fd1f8 [ 16.338551] R13: ffff88813a77f800 R14: ffff88813aa35180 R15: 0000000000000001 [ 16.338551] FS: 0000000000000000(0000) GS:ffff88813ba80000(0000) knlGS:0000000000000000 [ 16.338551] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 16.338551] CR2: 0000000000000056 CR3: 000000000240a002 CR4: 0000000000360ee0 [ 16.338551] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 16.338551] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 16.338551] Call Trace: [ 16.338551] nvme_scan_work+0x2c0/0x340 [nvme_core] [ 16.338551] ? __switch_to_asm+0x40/0x70 [ 16.338551] ? _raw_spin_unlock_irqrestore+0x18/0x30 [ 16.338551] ? try_to_wake_up+0x408/0x450 [ 16.338551] process_one_work+0x20b/0x3e0 [ 16.338551] worker_thread+0x1f9/0x3d0 [ 16.338551] ? cancel_delayed_work+0xa0/0xa0 [ 16.338551] kthread+0x117/0x120 [ 16.338551] ? kthread_stop+0xf0/0xf0 [ 16.338551] ret_from_fork+0x3a/0x50 [ 16.338551] Modules linked in: nvme nvme_core [ 16.338551] CR2: 0000000000000056 [ 16.338551] ---[ end trace b9bf761a93e62d84 ]--- [ 16.338551] RIP: 0010:nvme_validate_ns+0xc9/0x7e0 [nvme_core] [ 16.338551] Code: c0 49 89 c5 0f 84 00 07 00 00 48 8b 7b 58 e8 be 48 39 c1 48 3d 00 f0 ff ff 49 89 45 18 0f 87 a4 06 00 00 48 8b 93 70 0a 00 00 <80> 7a 56 00 74 0c 48 8b 40 68 83 48 3c 08 49 8b 45 18 48 89 c6 bf [ 16.338551] RSP: 0018:ffffc900024c7d10 EFLAGS: 00010283 [ 16.338551] RAX: ffff888135a30720 RBX: ffff88813a4fd1f8 RCX: 0000000000000007 [ 16.338551] RDX: 0000000000000000 RSI: ffffffff8256dd38 RDI: ffff888135a30720 [ 16.338551] RBP: 0000000000000001 R08: 0000000000000007 R09: ffff88813aa6a840 [ 16.338551] R10: 0000000000000001 R11: 000000000002d060 R12: ffff88813a4fd1f8 [ 16.338551] R13: ffff88813a77f800 R14: ffff88813aa35180 R15: 0000000000000001 [ 16.338551] FS: 0000000000000000(0000) GS:ffff88813ba80000(0000) knlGS:0000000000000000 [ 16.338551] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 16.338551] CR2: 0000000000000056 CR3: 000000000240a002 CR4: 0000000000360ee0 [ 16.338551] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 16.338551] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Fixes: 958f2a0f8121 ("nvme-tcp: set the STABLE_WRITES flag when data digests are enabled") Cc: Christoph Hellwig Cc: Keith Busch Reviewed-by: Sagi Grimberg Signed-off-by: Minwoo Im Signed-off-by: Jens Axboe commit 64b08df460cfdfc2b010263043a057cdd33500ed Merge: c079512aad97 9f7546570bcb Author: Linus Torvalds Date: Thu Jul 11 14:44:13 2019 -0700 Merge tag 'hwmon-for-v5.3' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging Pull hwmon updates from Guenter Roeck: - New drivers for Infineon PXE1610 and IRPS5401 - Minor improvements, cleanup, and fixes in several drivers * tag 'hwmon-for-v5.3' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging: (33 commits) hwmon: (ina3221) Add of_node_put() before return hwmon: (gpio-fan) fix sysfs notifications and udev events for gpio-fan alarms hwmon: (gpio-fan) move fan_alarm_init after devm_hwmon_device_register_with_groups hwmon: (lm90) Introduce function to update configuration register hwmon: (lm90) Cache configuration register value hwmon: (lm90) Fix max6658 sporadic wrong temperature reading hwmon: (nct7904) Changes comments in probe function. hwmon: (nct7904) Add error handling in probe function. hwmon: Convert remaining drivers to use SPDX identifier hwmon: (max6650) Fix unused variable warning hwmon: (pmbus/adm1275) Fix power sampling support hwmon: (lm90) simplify getting the adapter of a client hwmon: (asus_atk0110) no need to check return value of debugfs_create functions hwmon: (max6650) Fix minor formatting issues hwmon: (max6650) Improve error handling in max6650_update_device hwmon: (max6650) Read non-volatile registers only once hwmon: (max6650) Convert to use devm_hwmon_device_register_with_info hwmon: (max6650) Simplify alarm handling hwmon: (max6650) Cache alarm_en register hwmon: (max6650) Declare valid as boolean ... commit d44e3fa5d7e6e9573c69f6f9f4f7f3200b0c9eee Author: Eric Dumazet Date: Wed Jul 10 06:40:11 2019 -0700 ipv6: fix static key imbalance in fl_create() fl_create() should call static_branch_deferred_inc() only in case of success. Also we should not call fl_free() in error path, as this could cause a static key imbalance. jump label: negative count! WARNING: CPU: 0 PID: 15907 at kernel/jump_label.c:221 static_key_slow_try_dec kernel/jump_label.c:221 [inline] WARNING: CPU: 0 PID: 15907 at kernel/jump_label.c:221 static_key_slow_try_dec+0x1ab/0x1d0 kernel/jump_label.c:206 Kernel panic - not syncing: panic_on_warn set ... CPU: 0 PID: 15907 Comm: syz-executor.2 Not tainted 5.2.0-rc6+ #62 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x172/0x1f0 lib/dump_stack.c:113 panic+0x2cb/0x744 kernel/panic.c:219 __warn.cold+0x20/0x4d kernel/panic.c:576 report_bug+0x263/0x2b0 lib/bug.c:186 fixup_bug arch/x86/kernel/traps.c:179 [inline] fixup_bug arch/x86/kernel/traps.c:174 [inline] do_error_trap+0x11b/0x200 arch/x86/kernel/traps.c:272 do_invalid_op+0x37/0x50 arch/x86/kernel/traps.c:291 invalid_op+0x14/0x20 arch/x86/entry/entry_64.S:986 RIP: 0010:static_key_slow_try_dec kernel/jump_label.c:221 [inline] RIP: 0010:static_key_slow_try_dec+0x1ab/0x1d0 kernel/jump_label.c:206 Code: c0 e8 e9 3e e5 ff 83 fb 01 0f 85 32 ff ff ff e8 5b 3d e5 ff 45 31 ff eb a0 e8 51 3d e5 ff 48 c7 c7 40 99 92 87 e8 13 75 b7 ff <0f> 0b eb 8b 4c 89 e7 e8 a9 c0 1e 00 e9 de fe ff ff e8 bf 6d b7 ff RSP: 0018:ffff88805f9c7450 EFLAGS: 00010286 RAX: 0000000000000000 RBX: 00000000ffffffff RCX: 0000000000000000 RDX: 000000000000e3e1 RSI: ffffffff815adb06 RDI: ffffed100bf38e7c RBP: ffff88805f9c74e0 R08: ffff88806acf0700 R09: ffffed1015d060a9 R10: ffffed1015d060a8 R11: ffff8880ae830547 R12: ffffffff89832ce0 R13: ffff88805f9c74b8 R14: 1ffff1100bf38e8b R15: 00000000ffffff01 __static_key_slow_dec_deferred+0x65/0x110 kernel/jump_label.c:272 fl_free+0xa9/0xe0 net/ipv6/ip6_flowlabel.c:121 fl_create+0x6af/0x9f0 net/ipv6/ip6_flowlabel.c:457 ipv6_flowlabel_opt+0x80e/0x2730 net/ipv6/ip6_flowlabel.c:624 do_ipv6_setsockopt.isra.0+0x2119/0x4100 net/ipv6/ipv6_sockglue.c:825 ipv6_setsockopt+0xf6/0x170 net/ipv6/ipv6_sockglue.c:944 tcp_setsockopt net/ipv4/tcp.c:3131 [inline] tcp_setsockopt+0x8f/0xe0 net/ipv4/tcp.c:3125 sock_common_setsockopt+0x94/0xd0 net/core/sock.c:3130 __sys_setsockopt+0x253/0x4b0 net/socket.c:2080 __do_sys_setsockopt net/socket.c:2096 [inline] __se_sys_setsockopt net/socket.c:2093 [inline] __x64_sys_setsockopt+0xbe/0x150 net/socket.c:2093 do_syscall_64+0xfd/0x680 arch/x86/entry/common.c:301 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x4597c9 Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007f2670556c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 00000000004597c9 RDX: 0000000000000020 RSI: 0000000000000029 RDI: 0000000000000003 RBP: 000000000075bfc8 R08: 000000000000fdf7 R09: 0000000000000000 R10: 0000000020000000 R11: 0000000000000246 R12: 00007f26705576d4 R13: 00000000004cec00 R14: 00000000004dd520 R15: 00000000ffffffff Kernel Offset: disabled Rebooting in 86400 seconds.. Fixes: 59c820b2317f ("ipv6: elide flowlabel check if no exclusive leases exist") Signed-off-by: Eric Dumazet Acked-by: Willem de Bruijn Reported-by: syzbot Signed-off-by: David S. Miller commit 8975a3abc3030bc8cdc3c94b988bcf819a14ed41 Author: Eric Dumazet Date: Wed Jul 10 06:40:10 2019 -0700 ipv6: fix potential crash in ip6_datagram_dst_update() Willem forgot to change one of the calls to fl6_sock_lookup(), which can now return an error or NULL. syzbot reported : kasan: CONFIG_KASAN_INLINE enabled kasan: GPF could be caused by NULL-ptr deref or user memory access general protection fault: 0000 [#1] PREEMPT SMP KASAN CPU: 1 PID: 31763 Comm: syz-executor.0 Not tainted 5.2.0-rc6+ #63 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:ip6_datagram_dst_update+0x559/0xc30 net/ipv6/datagram.c:83 Code: 00 00 e8 ea 29 3f fb 4d 85 f6 0f 84 96 04 00 00 e8 dc 29 3f fb 49 8d 7e 20 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 16 06 00 00 4d 8b 6e 20 e8 b4 29 3f fb 4c 89 ee RSP: 0018:ffff88809ba97ae0 EFLAGS: 00010207 RAX: dffffc0000000000 RBX: ffff8880a81254b0 RCX: ffffc90008118000 RDX: 0000000000000003 RSI: ffffffff86319a84 RDI: 000000000000001e RBP: ffff88809ba97c10 R08: ffff888065e9e700 R09: ffffed1015d26c80 R10: ffffed1015d26c7f R11: ffff8880ae9363fb R12: ffff8880a8124f40 R13: 0000000000000001 R14: fffffffffffffffe R15: ffff88809ba97b40 FS: 00007f38e606a700(0000) GS:ffff8880ae900000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00000000202c0140 CR3: 00000000a026a000 CR4: 00000000001406e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: __ip6_datagram_connect+0x5e9/0x1390 net/ipv6/datagram.c:246 ip6_datagram_connect+0x30/0x50 net/ipv6/datagram.c:269 ip6_datagram_connect_v6_only+0x69/0x90 net/ipv6/datagram.c:281 inet_dgram_connect+0x14a/0x2d0 net/ipv4/af_inet.c:571 __sys_connect+0x264/0x330 net/socket.c:1824 __do_sys_connect net/socket.c:1835 [inline] __se_sys_connect net/socket.c:1832 [inline] __x64_sys_connect+0x73/0xb0 net/socket.c:1832 do_syscall_64+0xfd/0x680 arch/x86/entry/common.c:301 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x4597c9 Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007f38e6069c78 EFLAGS: 00000246 ORIG_RAX: 000000000000002a RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000004597c9 RDX: 000000000000001c RSI: 0000000020000040 RDI: 0000000000000003 RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00007f38e606a6d4 R13: 00000000004bfd07 R14: 00000000004d1838 R15: 00000000ffffffff Modules linked in: RIP: 0010:ip6_datagram_dst_update+0x559/0xc30 net/ipv6/datagram.c:83 Code: 00 00 e8 ea 29 3f fb 4d 85 f6 0f 84 96 04 00 00 e8 dc 29 3f fb 49 8d 7e 20 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 16 06 00 00 4d 8b 6e 20 e8 b4 29 3f fb 4c 89 ee Fixes: 59c820b2317f ("ipv6: elide flowlabel check if no exclusive leases exist") Signed-off-by: Eric Dumazet Acked-by: Willem de Bruijn Reported-by: syzbot Signed-off-by: David S. Miller commit 052e0690f1f62f76493ba996d73847c7ca9fd132 Author: Eric Dumazet Date: Wed Jul 10 06:40:09 2019 -0700 ipv6: tcp: fix flowlabels reflection for RST packets In 323a53c41292 ("ipv6: tcp: enable flowlabel reflection in some RST packets") and 50a8accf1062 ("ipv6: tcp: send consistent flowlabel in TIME_WAIT state") we took care of IPv6 flowlabel reflections for two cases. This patch takes care of the remaining case, when the RST packet is sent on behalf of a 'full' socket. In Marek use case, this was a socket in TCP_CLOSE state. Signed-off-by: Eric Dumazet Reported-by: Marek Majkowski Tested-by: Marek Majkowski Signed-off-by: David S. Miller commit 416e8126a2672f6e91e9e81c6f5c07cf46808b13 Author: yangxingwu Date: Wed Jul 10 21:14:10 2019 +0800 ipv6: Use ipv6_authlen for len The length of AH header is computed manually as (hp->hdrlen+2)<<2. However, in include/linux/ipv6.h, a macro named ipv6_authlen is already defined for exactly the same job. This commit replaces the manual computation code with the macro. Signed-off-by: yangxingwu Signed-off-by: David S. Miller commit c079512aad9718c12c6bb1b661880b15a73dfd69 Merge: 6b44fccdb8cd 0ff9848067b7 Author: Linus Torvalds Date: Thu Jul 11 14:42:44 2019 -0700 Merge tag 'loadpin-v5.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux Pull security/loadpin updates from Kees Cook: - Allow exclusion of specific file types (Ke Wu) * tag 'loadpin-v5.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux: security/loadpin: Allow to exclude specific file types commit 6b44fccdb8cdcc7c1df522529307566aa89a4ab1 Merge: 753c8d9b7d81 4c6d80e1144b Author: Linus Torvalds Date: Thu Jul 11 14:40:32 2019 -0700 Merge tag 'pstore-v5.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux Pull pstore updates from Kees Cook: - Improve backward compatibility with older Chromebooks (Douglas Anderson) - Refactor debugfs initialization (Greg KH) - Fix double-free in pstore_mkfile() failure path (Norbert Manthey) * tag 'pstore-v5.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux: pstore: Fix double-free in pstore_mkfile() failure path pstore: no need to check return value of debugfs_create functions pstore/ram: Improve backward compatibility with older Chromebooks commit 311633b604063a8a5d3fbc74d0565b42df721f68 Author: Cong Wang Date: Tue Jul 9 23:24:54 2019 -0700 hsr: switch ->dellink() to ->ndo_uninit() Switching from ->priv_destructor to dellink() has an unexpected consequence: existing RCU readers, that is, hsr_port_get_hsr() callers, may still be able to read the port list. Instead of checking the return value of each hsr_port_get_hsr(), we can just move it to ->ndo_uninit() which is called after device unregister and synchronize_net(), and we still have RTNL lock there. Fixes: b9a1e627405d ("hsr: implement dellink to clean up resources") Fixes: edf070a0fb45 ("hsr: fix a NULL pointer deref in hsr_dev_xmit()") Reported-by: syzbot+097ef84cdc95843fbaa8@syzkaller.appspotmail.com Cc: Arvid Brodin Signed-off-by: Cong Wang Signed-off-by: David S. Miller commit f27b99a1cea7ce3a2a24b907c5a998f0ad5a0268 Merge: b784d6bff971 fee77829083a Author: Dave Airlie Date: Fri Jul 12 07:29:57 2019 +1000 Merge tag 'imx-drm-next-2019-07-05' of git://git.pengutronix.de/git/pza/linux into drm-next drm/imx: IPUv3 image converter improvements, enable scanout FIFO watermark - Fix a saturation bit position in the colorspace converter configuration memory. - Fully describe colorspace conversions in the API to the imx-media driver. - Add support for limited range and Rec.709 YUV encoding. - Enable colorimetry configuration via the media-controller API. - Enable the double write reduction feature for memory bandwidth savings when the image converter writes YUV 4:2:0 output. - Enable a scanout FIFO watermark feature that can increase priority of scanout read transfers at the memory controller whenever the FIFO runs low. Signed-off-by: Dave Airlie From: Philipp Zabel Link: https://patchwork.freedesktop.org/patch/msgid/1562326831.4291.8.camel@pengutronix.de commit aa4c0c9091b0bb4cb261bbe0718d17c2834c4690 Author: Joe Perches Date: Tue Jul 9 22:04:21 2019 -0700 net: stmmac: Fix misuses of GENMASK macro Arguments are supposed to be ordered high then low. Fixes: 293e4365a1ad ("stmmac: change descriptor layout") Fixes: 9f93ac8d4085 ("net-next: stmmac: Add dwmac-sun8i") Signed-off-by: Joe Perches Signed-off-by: David S. Miller commit 937a944090cca2f19458fd037a8aff61c546f0cd Author: Joe Perches Date: Tue Jul 9 22:04:20 2019 -0700 net: ethernet: mediatek: Fix misuses of GENMASK macro Arguments are supposed to be ordered high then low. Signed-off-by: Joe Perches Signed-off-by: David S. Miller commit 63f9ba1bf8b6550365dc17a65d544cd75e68bf48 Author: Petar Penkov Date: Fri Jul 5 11:46:43 2019 -0700 net: fib_rules: do not flow dissect local packets Rules matching on loopback iif do not need early flow dissection as the packet originates from the host. Stop counting such rules in fib_rule_requires_fldissect Signed-off-by: Petar Penkov Signed-off-by: David S. Miller commit b784d6bff97154af829e46271dbb16967106a493 Merge: 4cf643a39221 7f963d9f69bf Author: Dave Airlie Date: Fri Jul 12 06:57:16 2019 +1000 Merge tag 'drm-next-5.3-2019-07-09' of git://people.freedesktop.org/~agd5f/linux into drm-next drm-next-5.3-2019-07-09: amdgpu: - GPU reset for navi10 - Powerplay fixes for navi10 - GFX fixes for navi10 - Prepare for hmm_range_register API change - XGMI fixes - clang warning fixes - Fixes for various kconfig scenarios - Misc fixes and cleanups amdkfd: - Add workaround for soft hangs with oversubscribed runlists - Remove duplicated pcie atomics request Signed-off-by: Dave Airlie From: Alex Deucher Link: https://patchwork.freedesktop.org/patch/msgid/20190710035017.3407-1-alexander.deucher@amd.com commit 753c8d9b7d81206bb5d011b28abe829d364b028e Merge: d7fe42a64a19 cbf5b73d162b Author: Linus Torvalds Date: Thu Jul 11 13:54:00 2019 -0700 Merge branch 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 fixes from Thomas Gleixner: "A collection of assorted fixes: - Fix for the pinned cr0/4 fallout which escaped all testing efforts because the kvm-intel module was never loaded when the kernel was compiled with CONFIG_PARAVIRT=n. The cr0/4 accessors are moved out of line and static key is now solely used in the core code and therefore can stay in the RO after init section. So the kvm-intel and other modules do not longer reference the (read only) static key which the module loader tried to update. - Prevent an infinite loop in arch_stack_walk_user() by breaking out of the loop once the return address is detected to be 0. - Prevent the int3_emulate_call() selftest from corrupting the stack when KASAN is enabled. KASASN clobbers more registers than covered by the emulated call implementation. Convert the int3_magic() selftest to a ASM function so the compiler cannot KASANify it. - Unbreak the build with old GCC versions and with the Gold linker by reverting the 'Move of _etext to the actual end of .text'. In both cases the build fails with 'Invalid absolute R_X86_64_32S relocation: _etext' - Initialize the context lock for init_mm, which was never an issue until the alternatives code started to use a temporary mm for patching. - Fix a build warning vs. the LOWMEM_PAGES constant where clang complains rightfully about a signed integer overflow in the shift operation by converting the operand to an ULL. - Adjust the misnamed ENDPROC() of common_spurious in the 32bit entry code" * 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/stacktrace: Prevent infinite loop in arch_stack_walk_user() x86/asm: Move native_write_cr0/4() out of line x86/pgtable/32: Fix LOWMEM_PAGES constant x86/alternatives: Fix int3_emulate_call() selftest stack corruption x86/entry/32: Fix ENDPROC of common_spurious Revert "x86/build: Move _etext to actual end of .text" x86/ldt: Initialize the context lock for init_mm commit d7fe42a64a19a4140fb94bcf996035319cd3e6b9 Merge: 02150fab6ae9 0df1c9868c3a Author: Linus Torvalds Date: Thu Jul 11 13:52:23 2019 -0700 Merge branch 'timers-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull timer fixes from Thomas Gleixner: "Two small fixes from the timer departement: - Prevent the compiler from converting the nanoseconds adjustment loop in the VDSO update function to a division (__udivdi3) by using the __iter_div_u64_rem() inline function which exists to prevent exactly that problem. - Fix the wrong argument order of the GENMASK macro in the NPCM timer driver" * 'timers-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: timekeeping/vsyscall: Use __iter_div_u64_rem() clocksource/drivers/npcm: Fix misuse of GENMASK macro commit 02150fab6ae9924ef03e21a15f2d5f7415a9cdf7 Merge: 3a83f575a33b 7e8e6816c649 Author: Linus Torvalds Date: Thu Jul 11 13:50:44 2019 -0700 Merge branch 'core-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull stacktrace fix from Thomas Gleixner: "Fix yet another instance of kernel thread check which ignores that kernel threads can call use_mm()" * 'core-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: stacktrace: Use PF_KTHREAD to check for kernel threads commit 3a83f575a33b960b7b1d582dc17f154d887c9b8d Merge: a131c2bf1656 20faba848752 Author: Linus Torvalds Date: Thu Jul 11 13:48:36 2019 -0700 Merge branch 'irq-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull irq fixes from Thomas Gleixner: "Two small fixes for interrupt chip drivers: - Prevent UAF in the new RZA1 chip driver - Fix the wrong argument order of the GENMASK macro in the GIC code" * 'irq-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: irqchip/gic-v3-its: Fix misuse of GENMASK macro irqchip/renesas-rza1: Prevent use-after-free in rza1_irqc_probe() commit b80d6a42bdc97bdb6139107d6034222e9843c6e2 Author: Arnd Bergmann Date: Wed Jul 10 15:05:43 2019 +0200 ACPI: blacklist: fix clang warning for unused DMI table When CONFIG_DMI is disabled, we only have a tentative declaration, which causes a warning from clang: drivers/acpi/blacklist.c:20:35: error: tentative array definition assumed to have one element [-Werror] static const struct dmi_system_id acpi_rev_dmi_table[] __initconst; As the variable is not actually used here, hide it entirely in an #ifdef to shut up the warning. Signed-off-by: Arnd Bergmann Reviewed-by: Nathan Chancellor Signed-off-by: Rafael J. Wysocki commit d1fb5b2f623b1af5a0d2a83d205df1b61f430dc6 Author: Erik Schmauss Date: Thu Jul 11 09:58:21 2019 -0700 ACPICA: Update table load object initialization ACPICA commit c7ef9f3526765bed8930825dda1eed1a274b9668 Use the common internal "initialize objects" interface Affects: Load() load_table() acpi_load_table Link: https://github.com/acpica/acpica/commit/c7ef9f35 Tested-by: Rong Chen Signed-off-by: Bob Moore Signed-off-by: Erik Schmauss Signed-off-by: Rafael J. Wysocki commit 5e663f0410fa2f355042209154029842ba1abd43 Author: Ihor Matushchak Date: Tue Jul 2 17:48:18 2019 +0300 virtio-mmio: add error check for platform_get_irq in vm_find_vqs() irq has a wrong type so, in case of no IRQ resource defined, wrong parameter will be passed to request_irq() Signed-off-by: Ihor Matushchak Signed-off-by: Michael S. Tsirkin Reviewed-by: Ivan T. Ivanov commit 211f70ff1daa3b3bb877f0f6fa85a42ef50f8341 Author: Gustavo A. R. Silva Date: Wed Jun 19 14:28:33 2019 -0500 scsi: virtio_scsi: Use struct_size() helper One of the more common cases of allocation size calculations is finding the size of a structure that has a zero-sized array at the end, along with memory for some number of elements for that array. For example: struct virtio_scsi { ... struct virtio_scsi_vq req_vqs[]; }; Make use of the struct_size() helper instead of an open-coded version in order to avoid any potential type mistakes. So, replace the following form: sizeof(*vscsi) + sizeof(vscsi->req_vqs[0]) * num_queues with: struct_size(vscsi, req_vqs, num_queues) This code was detected with the help of Coccinelle. Signed-off-by: Gustavo A. R. Silva Signed-off-by: Michael S. Tsirkin Reviewed-by: Stefan Hajnoczi commit 6ce8f316673f61416738e6df7329ca508a607762 Author: Nicholas Kazlauskas Date: Thu Jul 11 14:31:46 2019 -0500 drm/amd/display: Add drm_audio_component support to amdgpu_dm [Why] The drm_audio_component can be used to give pin ELD notifications directly to the sound driver. This fixes audio endpoints disappearing due to missing unsolicited notifications. [How] Send the notification via the audio component whenever we enable or disable audio state on a stream. This matches what i915 does with their drm_audio_component and what Takashi Iwai's proposed hack for radeon/amdpgu did. This is a bit delayed in when the notification actually occurs, however. We wait until after all the programming is complete rather than sending the notification mid sequence. Particular care is needed for the get ELD callback since it can happen outside the locking and fencing DRM does for atomic commits. Cc: Leo Li Cc: Harry Wentland Signed-off-by: Nicholas Kazlauskas Reviewed-by: Alex Deucher Reviewed-by: Takashi Iwai Signed-off-by: Alex Deucher commit 5fdb7c4c7f2691efd760b0b0dc00da4a3699f1a6 Author: Nicholas Kazlauskas Date: Fri Jun 28 13:39:41 2019 -0400 drm/amd/display: Expose audio inst from DC to DM [Why] In order to give pin notifications to the sound driver from DM we need to know whether audio is enabled on a stream and what pin it's using from DC. [How] Expose the instance via stream status if it's a mapped resource for the stream. It will be -1 if there's no audio mapped. Cc: Leo Li Cc: Harry Wentland Signed-off-by: Nicholas Kazlauskas Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher commit 70df8273ca0cebd2bba443a4444b4944a5929151 Author: Eric Huang Date: Tue Jul 9 15:33:53 2019 -0400 drm/amdkfd: fix cp hang in eviction The cp hang occurs in OCL conformance test only on supermicro platform which has 40 cores and the test generates 40 threads. The root cause is race condition in non-protected flags. The fix is to add flags of is_evicted and is_active(init_mqd()) into protected area. Signed-off-by: Eric Huang Reviewed-by: Felix Kuehling Signed-off-by: Alex Deucher commit 63e2fef631383b9a44a2b727b9507fe058cba9c1 Author: Alex Deucher Date: Mon Jul 8 13:47:12 2019 -0500 drm/amdgpu: enable IP discovery by default on navi Use the IP discovery table rather than hardcoding the settings in the driver. Reviewed-by: Xiaojie Yuan Signed-off-by: Alex Deucher commit a349b39253d597a83f3d5eb85e129da429652583 Author: tiancyin Date: Thu Jul 11 14:09:50 2019 +0800 drm/amdgpu/discovery: fix DCE_HWIP mapping error in hw_id_map array ID of DCE_HWIP from vbios is DMU_HWID, mismatch cause null pointer crash in navi10 modprobe. Reviewed-by: Feifei Xu Reviewed-by: Xiaojie Yuan Signed-off-by: tiancyin Signed-off-by: Alex Deucher commit a54166d79a6b910182703c18379a26e414539501 Author: Kenneth Feng Date: Thu Jul 11 15:37:50 2019 +0800 drm/amd/powerplay: bug fix for sysfs when we set profile_peak to sysfs:power_dpm_force_performance_level, we gets the wrong socclk level and mclk level.this patch fix this issue. Signed-off-by: Kenneth Feng Reviewed-by: Feifei Xu Signed-off-by: Alex Deucher commit 617a64dc85f91c46ccf65aefbf7a4d194280a453 Author: Evan Quan Date: Wed Jul 3 09:21:37 2019 +0800 drm/amd/powerplay: increase the SMU msg response waiting time This is expected to fix some mode1 reset failures. And this affects SMU part only as the timeout setting for other parts is controlled by a different macro. Signed-off-by: Evan Quan Acked-by: Alex Deucher Signed-off-by: Alex Deucher commit 7e4dec58032deb75181ec56f31aa25184333f7d0 Author: Felix Kuehling Date: Tue Jul 9 19:31:21 2019 -0400 drm/amdgpu: Fix potential integer overflows With mm_nodes larger than 4GB, byte_count in amdgpu_fill_buffer would overflow. Signed-off-by: Felix Kuehling Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher commit 1e4d09d2212d9e230b967f57bc8df463527dbd75 Author: Alex Williamson Date: Thu Jul 11 13:26:52 2019 -0600 mdev: Send uevents around parent device registration This allows udev to trigger rules when a parent device is registered or unregistered from mdev. Reviewed-by: Cornelia Huck Reviewed-by: Kirti Wankhede Signed-off-by: Alex Williamson commit 0f327f2aaad6a87356cbccfa390d4d3b64d0d3b6 Author: Atish Patra Date: Thu Jun 6 16:08:00 2019 -0700 RISC-V: Add an Image header that boot loader can parse. Currently, the last stage boot loaders such as U-Boot can accept only uImage which is an unnecessary additional step in automating boot process. Add an image header that boot loader understands and boot Linux from flat Image directly. This header is based on ARM64 boot image header and provides an opportunity to combine both ARM64 & RISC-V image headers in future. Also make sure that PE/COFF header can co-exist in the same image so that EFI stub can be supported for RISC-V in future. EFI specification needs PE/COFF image header in the beginning of the kernel image in order to load it as an EFI application. In order to support EFI stub, code0 should be replaced with "MZ" magic string and res4(at offset 0x3c) should point to the rest of the PE/COFF header (which will be added during EFI support). Tested on both QEMU and HiFive Unleashed using OpenSBI + U-Boot + Linux. Signed-off-by: Atish Patra Reviewed-by: Karsten Merker Tested-by: Karsten Merker (QEMU+OpenSBI+U-Boot) Tested-by: Kevin Hilman (OpenSBI + U-Boot + Linux) [paul.walmsley@sifive.com: fixed whitespace in boot-image-header.txt; converted structure comment to kernel-doc format and added some detail] Signed-off-by: Paul Walmsley commit ef1ce7d7b67b46661091c7ccc0396186b7a247ef Author: Aya Levin Date: Sun Jul 7 16:57:06 2019 +0300 net/mlx5e: IPoIB, Add error path in mlx5_rdma_setup_rn Check return value from mlx5e_attach_netdev, add error path on failure. Fixes: 48935bbb7ae8 ("net/mlx5e: IPoIB, Add netdevice profile skeleton") Signed-off-by: Aya Levin Reviewed-by: Feras Daoud Signed-off-by: Saeed Mahameed commit 99d31cbd8953c6929da978bf049ab0f0b4e503d9 Author: Aya Levin Date: Sun Jun 30 11:11:26 2019 +0300 net/mlx5e: Fix error flow in tx reporter diagnose Fix tx reporter's diagnose callback. Propagate error when failing to gather diagnostics information or failing to print diagnostic data per queue. Fixes: de8650a82071 ("net/mlx5e: Add tx reporter support") Signed-off-by: Aya Levin Reviewed-by: Tariq Toukan Acked-by: Jiri Pirko Signed-off-by: Saeed Mahameed commit 39825350ae2a52f8513741b36e42118bd80dd689 Author: Aya Levin Date: Mon Jun 17 12:01:45 2019 +0300 net/mlx5e: Fix return value from timeout recover function Fix timeout recover function to return a meaningful return value. When an interrupt was not sent by the FW, return IO error instead of 'true'. Fixes: c7981bea48fb ("net/mlx5e: Fix return status of TX reporter timeout recover") Signed-off-by: Aya Levin Acked-by: Jiri Pirko Reviewed-by: Tariq Toukan Signed-off-by: Saeed Mahameed commit db849faa9bef993a1379dc510623f750a72fa7ce Author: Saeed Mahameed Date: Fri May 3 13:14:59 2019 -0700 net/mlx5e: Rx, Fix checksum calculation for new hardware CQE checksum full mode in new HW, provides a full checksum of rx frame. Covering bytes starting from eth protocol up to last byte in the received frame (frame_size - ETH_HLEN), as expected by the stack. Fixing up skb->csum by the driver is not required in such case. This fix is to avoid wrong checksum calculation in drivers which already support the new hardware with the new checksum mode. Fixes: 85327a9c4150 ("net/mlx5: Update the list of the PCI supported devices") Signed-off-by: Saeed Mahameed commit 914adbb1bcf89478ac138318d28b302704564d59 Author: Eli Britstein Date: Sun Jun 2 06:19:03 2019 +0000 net/mlx5e: Fix port tunnel GRE entropy control GRE entropy calculation is a single bit per card, and not per port. Force disable GRE entropy calculation upon the first GRE encap rule, and release the force at the last GRE encap rule removal. This is done per port. Fixes: 97417f6182f8 ("net/mlx5e: Fix GRE key by controlling port tunnel entropy calculation") Signed-off-by: Eli Britstein Signed-off-by: Saeed Mahameed commit 9a64144d683a4395f57562d90247c61a0bf5105f Author: Maor Gottlieb Date: Mon Jun 17 13:22:28 2019 +0300 net/mlx5: E-Switch, Fix default encap mode Encap mode is related to switchdev mode only. Move the init of the encap mode to eswitch_offloads. Before this change, we reported that eswitch supports encap, even tough the device was in non SRIOV mode. Fixes: 7768d1971de67 ('net/mlx5: E-Switch, Add control for encapsulation') Signed-off-by: Maor Gottlieb Reviewed-by: Roi Dayan Signed-off-by: Saeed Mahameed commit 9a159190414d461fdac7ae5bb749c2d532b35419 Author: Vasily Gorbik Date: Mon Jul 8 14:24:38 2019 +0200 s390/unwind: avoid int overflow in outside_of_stack When current task is interrupted in-between stack frame allocation and backchain write instructions new stack frame backchain pointer is left uninitialized. That invalid backchain value is passed into outside_of_stack for sanity check. Make sure int overflow does not happen by subtracting stack_frame size from the stack "end" rather than adding it to "random" backchain value. Fixes: 41b0474c1b1c ("s390/unwind: introduce stack unwind API") Reviewed-by: Christian Borntraeger Signed-off-by: Vasily Gorbik commit 73df167c819e49d65576e3015f2b1385034baafb Author: Denis Efremov Date: Tue Jul 9 15:25:07 2019 +0300 s390/zcrypt: remove the exporting of ap_query_configuration The function ap_query_configuration is declared static and marked EXPORT_SYMBOL, which is at best an odd combination. Because the function is not used outside of the drivers/s390/crypto/ap_bus.c file it is defined in, this commit removes the EXPORT_SYMBOL() marking. Link: http://lkml.kernel.org/r/20190709122507.11158-1-efremov@linux.com Fixes: f1b0a4343c41 ("s390/zcrypt: Integrate ap_asm.h into include/asm/ap.h.") Fixes: 050349b5b71d ("s390/zcrypt: externalize AP config info query") Signed-off-by: Denis Efremov Reviewed-by: Harald Freudenberger Signed-off-by: Vasily Gorbik commit 8e4708b3f8d949a74499426614b9b8ea5bcad15a Author: Sebastian Ott Date: Wed Jul 10 14:06:47 2019 +0200 s390/pci: add mio_enabled attribute Provide an attribute to query the usage of mio instructions. Signed-off-by: Sebastian Ott Signed-off-by: Vasily Gorbik commit 9964f396f1d0eed72c50f7ae367119afd355ab9c Author: Sebastian Ott Date: Wed Jul 10 13:08:06 2019 +0200 s390: fix setting of mio addressing control Move enablement of mio addressing control from detect_machine_facilities to pci_base_init. detect_machine_facilities runs so early that the static branches have not been toggled yet, thus mio addressing control was always off. In pci_base_init we have to use the SMP aware ctl_set_bit though. Fixes: 833b441ec0f6 ("s390: enable processes for mio instructions") Signed-off-by: Sebastian Ott Signed-off-by: Vasily Gorbik commit 1b2be2071aca9aab22e3f902bcb0fca46a1d3b00 Author: Philipp Rudo Date: Fri Jun 28 17:38:05 2019 +0200 s390/ipl: Fix detection of has_secure attribute Use the correct bit for detection of the machine capability associated with the has_secure attribute. It is expected that the underlying platform (including hypervisors) unsets the bit when they don't provide secure ipl for their guests. Fixes: c9896acc7851 ("s390/ipl: Provide has_secure sysfs attribute") Cc: stable@vger.kernel.org # 5.2 Signed-off-by: Philipp Rudo Reviewed-by: Christian Borntraeger Reviewed-by: Peter Oberparleiter Signed-off-by: Vasily Gorbik commit 5c4c2126fb69812e6e62a7d8bfaac308a3ddeec7 Author: Christian Borntraeger Date: Fri Jul 5 21:02:48 2019 +0200 s390: vfio-ap: fix irq registration vfio_ap_free_aqic_resources is called in two places: - during registration to have a "known state" - during interrupt disable We must not clear q->matrix_mdev in the registration phase as this will mess up the reference counting and can lead to some warning and other bugs. Fixes: ec89b55e3bce ("s390: ap: implement PAPQ AQIC interception in kernel") Reviewed-by: Halil Pasic Signed-off-by: Christian Borntraeger Signed-off-by: Vasily Gorbik commit 820bace734722715c643dcb5f74b502cb912d4eb Author: Thomas Richter Date: Fri Apr 12 11:32:28 2019 +0200 s390/cpumf: Add extended counter set definitions for model 8561 and 8562 Add the extended counter set definitions for s390 machine types 8561 and 8262. They are identical with machine types 3906 and 3907. Signed-off-by: Thomas Richter Signed-off-by: Vasily Gorbik commit 9e12e54c7a8f616190beffb0f7ce778a86aec175 Author: Jan Höppner Date: Tue Jul 3 10:56:51 2018 +0200 s390/dasd: Handle out-of-space constraint The storage server issues three different types of out-of-space messages whenever the Extent Pool or Extent Repository space runs short. When a configured warning watermark is reached, the physical space is completeley exhausted, or the capacity constraints have been relieved, a message is received. A log entry for the sysadmin to react to is generated in any case. In case the physical space is completely exhausted, sense data that reads "no space left on device" is received. In this case, currently running I/O will be blocked until space has either been released or added to the extent pool, and a relieve message was received via an attention interrupt. Signed-off-by: Jan Höppner Reviewed-by: Stefan Haberland Signed-off-by: Vasily Gorbik commit 7e64db1597fe114b83fe17d0ba96c6aa5fca419a Author: Jan Höppner Date: Fri Apr 27 16:57:44 2018 +0200 s390/dasd: Add discard support for ESE volumes ESE (Extent Space Efficient) volumes are thin-provisioned and therefore space is only occupied with real data. In order to make previously used space available for re-allocation again, discard support is enabled for ESE volumes allowing the DASD driver to release said space. Signed-off-by: Jan Höppner Reviewed-by: Stefan Haberland Signed-off-by: Vasily Gorbik commit b54441534e9648f8df24b75a63bb00ed3aa123de Author: Jan Höppner Date: Tue May 29 14:11:25 2018 +0200 s390/dasd: Use ALIGN_DOWN macro There is now an ALIGN_DOWN macro available. Let's rather use kernel provided macros that do the things we want. Signed-off-by: Jan Höppner Reviewed-by: Stefan Haberland Signed-off-by: Vasily Gorbik commit a0610a8ad80743ff916ebef0490418a298e5bd23 Author: Jan Höppner Date: Fri Apr 27 16:55:27 2018 +0200 s390/dasd: Make dasd_setup_queue() a discipline function ECKD, FBA, and the DIAG discipline use slightly different block layer settings. In preparation of even more diverse queue settings, make dasd_setup_queue() a discipline function. Signed-off-by: Jan Höppner Reviewed-by: Stefan Haberland Signed-off-by: Vasily Gorbik commit 91dc4a197569230683ca8bad551e655a4bf14c30 Author: Jan Höppner Date: Mon Jul 23 11:13:30 2018 +0200 s390/dasd: Add new ioctl to release space Userspace tools might have the need to release space for Extent Space Efficient (ESE) volumes when working with such a device. Provide the necessarry interface for such a task by implementing a new ioctl BIODASDRAS. The ioctl uses the format_data_t data structure for data input: typedef struct format_data_t { unsigned int start_unit; /* from track */ unsigned int stop_unit; /* to track */ unsigned int blksize; /* sectorsize */ unsigned int intensity; } format_data_t; If the intensity is set to 0x40, start_unit and stop_unit are ignored and space for the entire volume is released. Otherwise, if intensity is set to 0, the respective range is released (if possible). Signed-off-by: Jan Höppner Reviewed-by: Stefan Haberland Signed-off-by: Vasily Gorbik commit bcf36768ea688e926b04639c88c77d8caea3b736 Author: Jan Höppner Date: Thu Jun 27 14:33:17 2019 +0200 s390/dasd: Add dasd_sleep_on_queue_interruptible() There is dasd_sleep_on() and dasd_sleep_on_interruptible() to start CCW requests uninterruptible and interruptible. However, there is only dasd_sleep_on_queue() to start requests from CCW queues uninterruptible. Add dasd_sleep_on_queue_interruptible() to provide a way to start requests from CCW queues interruptible. _dasd_sleep_on_queue() already provides this functionality. Signed-off-by: Jan Höppner Reviewed-by: Stefan Haberland Signed-off-by: Vasily Gorbik commit d7a4434d6013c750f6c180f9678a870abc21993b Author: Jan Höppner Date: Fri Jun 7 16:58:38 2019 +0200 s390/dasd: Add missing intensity definition The definition for the bit that removes the write permission for record zero when formatting was missing. Add it to complete the list. Signed-off-by: Jan Höppner Reviewed-by: Stefan Haberland Signed-off-by: Vasily Gorbik commit 2df4774cb4d1a9280c01bde0f729e56deb36141d Author: Jan Höppner Date: Fri Jun 7 16:54:22 2019 +0200 s390/dasd: Fix whitespace Signed-off-by: Jan Höppner Reviewed-by: Stefan Haberland Signed-off-by: Vasily Gorbik commit 5e2b17e712cf10cc3cc98fde28a88e8f1a1267e9 Author: Jan Höppner Date: Fri Apr 27 16:51:22 2018 +0200 s390/dasd: Add dynamic formatting support for ESE volumes A dynamic formatting is issued whenever a write request returns with either a No Record Found error (Command Mode), Incorrect Length error (Transport Mode), or File Protected error (Transport Mode). All three cases mean that the tracks in question haven't been initialized in a desired format yet. The part of the volume that was tried to be written on is then formatted and the original request is re-queued. As the formatting will happen during normal I/O operations, it is quite likely that there won't be any memory available to build the respective request. Another two pages of memory are allocated per volume specifically for the dynamic formatting. The dasd_eckd_build_format() function is extended to make sure that the original startdev is reused. Also, all formatting and format check functions use the new memory pool exclusively now to reduce complexity. Read operations will always return zero data when unformatted areas are read. Signed-off-by: Jan Höppner Reviewed-by: Stefan Haberland Signed-off-by: Vasily Gorbik commit c729696bcf8b23450043dd9c9972c15e53419ae4 Author: Jan Höppner Date: Tue May 29 16:58:03 2018 +0200 s390/dasd: Recognise data for ESE volumes In order to work with Extent Space Efficient (ESE) volumes, certain viable information about those volumes and the corresponding extent pool (such as extent size, configured space, allocated space, etc.) can be provided. Use the CCW commands Volume Storage Query and Logical Configuration Query to receive detailed information about ESE volumes and the extent pool respectively. These information are made accessible via internal functions for subsequent users, and via sysfs attributes for userpsace usage. The new sysfs attributes reside in separate directories called capacity and extent_pool. attributes: ese: 0/1 depending on whether the volume is an ESE volume Capacity related attributes: space_allocated: Space currently allocated by the volume (in cyl) space_configured: Remaining space in the extent pool (in cyl) logical_capacity: The entire addressable space for this volume (in cyl) Extent Pool related attributes: pool_id: ID of the extent pool the volume in question resides in pool_oos: Extent pool is out-of-space extent_size: Size of a single extent in this pool cap_at_warnlevel Extent pool capacity at warn level warn_threshold: Threshold at which percentage of remaining extent pool space a warning message is issued Signed-off-by: Jan Höppner Reviewed-by: Stefan Haberland Signed-off-by: Vasily Gorbik commit 461db0ea03755e0eeb7186f8613ba2291dff7833 Author: Jan Höppner Date: Tue May 29 17:03:10 2018 +0200 s390/dasd: Put sub-order definitions in a separate section There are orders and sub-orders. Put them in different sections for a better overview. Signed-off-by: Jan Höppner Reviewed-by: Stefan Haberland Signed-off-by: Vasily Gorbik commit ce6915f5343f5f2a2a937b683d8ffbf12dab3ad4 Author: Jan Höppner Date: Thu Feb 21 16:22:46 2019 +0100 s390/dasd: Make layout analysis ESE compatible The disk layout and volume information of a DASD reside in the first two tracks of cylinder 0. When a DASD is set online, currently the first three tracks are read and analysed to confirm an expected layout. For CDL (Compatible Disk Layout) only count area data of the first track is evaluated and checked against expected key and data lengths. For LDL (Linux Disk Layout) the first and third track is evaluated. However, an LDL formatted volume is expected to be in the same format across all tracks. Checking the third track therefore doesn't have any more value than checking any other track at random. Now, an Extent Space Efficient (ESE) DASD is initialised by only formatting the first two tracks, as those tracks always contain all information necessarry. Checking the third track on an ESE volume will therefore most likely fail with a record not found error, as the third track will be empty. This in turn leads to the device being recognised with a volume size of 0. Attempts to write volume information on the first two tracks then fail with "no space left on device" errors. Initialising the first three tracks for an ESE volume is not a viable solution, because the third track is already a regular track and could contain user data. With that there is potential for data corruption. Instead, always only analyse the first two tracks, as it is sufficiant for both CDL and LDL, and allow ESE volumes to be recognised as well. Signed-off-by: Jan Höppner Reviewed-by: Stefan Haberland Signed-off-by: Vasily Gorbik commit 8a9f606fefadb903c323836fcd6e65a122dce66a Author: Jan Höppner Date: Thu Jun 7 14:52:57 2018 +0200 s390/dasd: Remove old defines and function Commit 4d284cac76d0 ("[S390] Avoid excessive inlining.") removed bytes_per_record() which was the only user of the defines ECKD_C0 and ECKD_F*, and round_up_multiple(). Let's get rid of those. Signed-off-by: Jan Höppner Reviewed-by: Stefan Haberland Signed-off-by: Vasily Gorbik commit 72ddd535128e4acefaec00d52c75385fd4db40c0 Author: Jan Höppner Date: Tue May 29 17:28:24 2018 +0200 s390/dasd: Remove unused structs and function prototypes There are structs that have never been used. There are also two function prototypes which were forgotton in commit f9f8d02fae0d ("[S390] dasd: revert LCU optimization"). Clean up and keep the header file tidy. Signed-off-by: Jan Höppner Reviewed-by: Stefan Haberland Signed-off-by: Vasily Gorbik commit a131c2bf165684315f606fdd88cf80be22ba32f3 Merge: 237f83dfbe66 6cf7fb5a95de Author: Linus Torvalds Date: Thu Jul 11 11:17:09 2019 -0700 Merge tag 'acpi-5.3-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull ACPI fix from Rafael Wysocki: "Revert a recent ACPICA commit causing systems to hang at boot time" * tag 'acpi-5.3-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: Revert "ACPICA: Update table load object initialization" commit cea743f2ea814d3d54dfab667b68271d4f4e5fdf Author: Gustavo A. R. Silva Date: Thu Jul 11 11:12:18 2019 -0500 RDMA/siw: Mark expected switch fall-throughs In preparation to enabling -Wimplicit-fallthrough, mark switch cases where we are expecting to fall through. This patch fixes the following warnings: drivers/infiniband/sw/siw/siw_qp_rx.c: In function ‘siw_rdmap_complete’: drivers/infiniband/sw/siw/siw_qp_rx.c:1214:18: warning: this statement may fall through [-Wimplicit-fallthrough=] wqe->rqe.flags |= SIW_WQE_SOLICITED; ~~~~~~~~~~~~~~~^~~~~~~~~~~~~~~~~~~~ drivers/infiniband/sw/siw/siw_qp_rx.c:1215:2: note: here case RDMAP_SEND: ^~~~ drivers/infiniband/sw/siw/siw_qp_tx.c: In function ‘siw_qp_sq_process’: drivers/infiniband/sw/siw/siw_qp_tx.c:1044:4: warning: this statement may fall through [-Wimplicit-fallthrough=] siw_wqe_put_mem(wqe, tx_type); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/infiniband/sw/siw/siw_qp_tx.c:1045:3: note: here case SIW_OP_INVAL_STAG: ^~~~ drivers/infiniband/sw/siw/siw_qp_tx.c:1128:4: warning: this statement may fall through [-Wimplicit-fallthrough=] siw_wqe_put_mem(wqe, tx_type); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/infiniband/sw/siw/siw_qp_tx.c:1129:3: note: here case SIW_OP_INVAL_STAG: ^~~~ Warning level 3 was used: -Wimplicit-fallthrough=3 This patch is part of the ongoing efforts to enable -Wimplicit-fallthrough. Signed-off-by: Gustavo A. R. Silva Reviewed-by: Bernard Metzler Signed-off-by: Jason Gunthorpe commit 237f83dfbe668443b5e31c3c7576125871cca674 Merge: 8f6ccf6159ae 1ff2f0fa450e Author: Linus Torvalds Date: Thu Jul 11 10:55:49 2019 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next Pull networking updates from David Miller: "Some highlights from this development cycle: 1) Big refactoring of ipv6 route and neigh handling to support nexthop objects configurable as units from userspace. From David Ahern. 2) Convert explored_states in BPF verifier into a hash table, significantly decreased state held for programs with bpf2bpf calls, from Alexei Starovoitov. 3) Implement bpf_send_signal() helper, from Yonghong Song. 4) Various classifier enhancements to mvpp2 driver, from Maxime Chevallier. 5) Add aRFS support to hns3 driver, from Jian Shen. 6) Fix use after free in inet frags by allocating fqdirs dynamically and reworking how rhashtable dismantle occurs, from Eric Dumazet. 7) Add act_ctinfo packet classifier action, from Kevin Darbyshire-Bryant. 8) Add TFO key backup infrastructure, from Jason Baron. 9) Remove several old and unused ISDN drivers, from Arnd Bergmann. 10) Add devlink notifications for flash update status to mlxsw driver, from Jiri Pirko. 11) Lots of kTLS offload infrastructure fixes, from Jakub Kicinski. 12) Add support for mv88e6250 DSA chips, from Rasmus Villemoes. 13) Various enhancements to ipv6 flow label handling, from Eric Dumazet and Willem de Bruijn. 14) Support TLS offload in nfp driver, from Jakub Kicinski, Dirk van der Merwe, and others. 15) Various improvements to axienet driver including converting it to phylink, from Robert Hancock. 16) Add PTP support to sja1105 DSA driver, from Vladimir Oltean. 17) Add mqprio qdisc offload support to dpaa2-eth, from Ioana Radulescu. 18) Add devlink health reporting to mlx5, from Moshe Shemesh. 19) Convert stmmac over to phylink, from Jose Abreu. 20) Add PTP PHC (Physical Hardware Clock) support to mlxsw, from Shalom Toledo. 21) Add nftables SYNPROXY support, from Fernando Fernandez Mancera. 22) Convert tcp_fastopen over to use SipHash, from Ard Biesheuvel. 23) Track spill/fill of constants in BPF verifier, from Alexei Starovoitov. 24) Support bounded loops in BPF, from Alexei Starovoitov. 25) Various page_pool API fixes and improvements, from Jesper Dangaard Brouer. 26) Just like ipv4, support ref-countless ipv6 route handling. From Wei Wang. 27) Support VLAN offloading in aquantia driver, from Igor Russkikh. 28) Add AF_XDP zero-copy support to mlx5, from Maxim Mikityanskiy. 29) Add flower GRE encap/decap support to nfp driver, from Pieter Jansen van Vuuren. 30) Protect against stack overflow when using act_mirred, from John Hurley. 31) Allow devmap map lookups from eBPF, from Toke Høiland-Jørgensen. 32) Use page_pool API in netsec driver, Ilias Apalodimas. 33) Add Google gve network driver, from Catherine Sullivan. 34) More indirect call avoidance, from Paolo Abeni. 35) Add kTLS TX HW offload support to mlx5, from Tariq Toukan. 36) Add XDP_REDIRECT support to bnxt_en, from Andy Gospodarek. 37) Add MPLS manipulation actions to TC, from John Hurley. 38) Add sending a packet to connection tracking from TC actions, and then allow flower classifier matching on conntrack state. From Paul Blakey. 39) Netfilter hw offload support, from Pablo Neira Ayuso" * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next: (2080 commits) net/mlx5e: Return in default case statement in tx_post_resync_params mlx5: Return -EINVAL when WARN_ON_ONCE triggers in mlx5e_tls_resync(). net: dsa: add support for BRIDGE_MROUTER attribute pkt_sched: Include const.h net: netsec: remove static declaration for netsec_set_tx_de() net: netsec: remove superfluous if statement netfilter: nf_tables: add hardware offload support net: flow_offload: rename tc_cls_flower_offload to flow_cls_offload net: flow_offload: add flow_block_cb_is_busy() and use it net: sched: remove tcf block API drivers: net: use flow block API net: sched: use flow block API net: flow_offload: add flow_block_cb_{priv, incref, decref}() net: flow_offload: add list handling functions net: flow_offload: add flow_block_cb_alloc() and flow_block_cb_free() net: flow_offload: rename TCF_BLOCK_BINDER_TYPE_* to FLOW_BLOCK_BINDER_TYPE_* net: flow_offload: rename TC_BLOCK_{UN}BIND to FLOW_BLOCK_{UN}BIND net: flow_offload: add flow_block_cb_setup_simple() net: hisilicon: Add an tx_desc to adapt HI13X1_GMAC net: hisilicon: Add an rx_desc to adapt HI13X1_GMAC ... commit 8f6ccf6159aed1f04c6d179f61f6fb2691261e84 Merge: 5450e8a316a6 d68dbb0c9ac8 Author: Linus Torvalds Date: Thu Jul 11 10:09:44 2019 -0700 Merge tag 'clone3-v5.3' of git://git.kernel.org/pub/scm/linux/kernel/git/brauner/linux Pull clone3 system call from Christian Brauner: "This adds the clone3 syscall which is an extensible successor to clone after we snagged the last flag with CLONE_PIDFD during the 5.2 merge window for clone(). It cleanly supports all of the flags from clone() and thus all legacy workloads. There are few user visible differences between clone3 and clone. First, CLONE_DETACHED will cause EINVAL with clone3 so we can reuse this flag. Second, the CSIGNAL flag is deprecated and will cause EINVAL to be reported. It is superseeded by a dedicated "exit_signal" argument in struct clone_args thus freeing up even more flags. And third, clone3 gives CLONE_PIDFD a dedicated return argument in struct clone_args instead of abusing CLONE_PARENT_SETTID's parent_tidptr argument. The clone3 uapi is designed to be easy to handle on 32- and 64 bit: /* uapi */ struct clone_args { __aligned_u64 flags; __aligned_u64 pidfd; __aligned_u64 child_tid; __aligned_u64 parent_tid; __aligned_u64 exit_signal; __aligned_u64 stack; __aligned_u64 stack_size; __aligned_u64 tls; }; and a separate kernel struct is used that uses proper kernel typing: /* kernel internal */ struct kernel_clone_args { u64 flags; int __user *pidfd; int __user *child_tid; int __user *parent_tid; int exit_signal; unsigned long stack; unsigned long stack_size; unsigned long tls; }; The system call comes with a size argument which enables the kernel to detect what version of clone_args userspace is passing in. clone3 validates that any additional bytes a given kernel does not know about are set to zero and that the size never exceeds a page. A nice feature is that this patchset allowed us to cleanup and simplify various core kernel codepaths in kernel/fork.c by making the internal _do_fork() function take struct kernel_clone_args even for legacy clone(). This patch also unblocks the time namespace patchset which wants to introduce a new CLONE_TIMENS flag. Note, that clone3 has only been wired up for x86{_32,64}, arm{64}, and xtensa. These were the architectures that did not require special massaging. Other architectures treat fork-like system calls individually and after some back and forth neither Arnd nor I felt confident that we dared to add clone3 unconditionally to all architectures. We agreed to leave this up to individual architecture maintainers. This is why there's an additional patch that introduces __ARCH_WANT_SYS_CLONE3 which any architecture can set once it has implemented support for clone3. The patch also adds a cond_syscall(clone3) for architectures such as nios2 or h8300 that generate their syscall table by simply including asm-generic/unistd.h. The hope is to get rid of __ARCH_WANT_SYS_CLONE3 and cond_syscall() rather soon" * tag 'clone3-v5.3' of git://git.kernel.org/pub/scm/linux/kernel/git/brauner/linux: arch: handle arches who do not yet define clone3 arch: wire-up clone3() syscall fork: add clone3 commit e65682b55956e9fbf8a88f303a48e7c1430ffe15 Author: Mike Marshall Date: Wed Jul 3 21:26:44 2019 +0000 orangefs: eliminate needless variable assignments Signed-off-by: Mike Marshall commit f10789e4f6d6e2d0592620e6e3f6b4ff35d3488d Author: Colin Ian King Date: Sat May 11 14:27:00 2019 +0100 orangefs: remove redundant assignment to variable buffer_index The variable buffer_index is being initialized however this is never read and later it is being reassigned to a new value. The initialization is redundant and hence can be removed. Addresses-Coverity: ("Unused Value") Signed-off-by: Colin Ian King Signed-off-by: Mike Marshall commit b516ea586d717472178e6ef1c152e85608b0ce32 Author: Lukas Wunner Date: Mon Jul 8 13:17:44 2019 +0800 PCI: Enable NVIDIA HDA controllers Many NVIDIA GPUs can be configured as either a single-function video device or a multi-function device with video at function 0 and an HDA audio controller at function 1. The HDA controller can be enabled or disabled by a bit in the function 0 config space. Some BIOSes leave the HDA disabled, which means the HDMI connector from the NVIDIA GPU may not work. Sometimes the BIOS enables the HDA if an HDMI cable is connected at boot time, but that doesn't handle hotplug cases. Enable the HDA controller on device enumeration and resume and re-read the header type, which tells us whether the GPU is a multi-function device. This quirk is limited to NVIDIA PCI devices with the VGA Controller device class. This is expected to correspond to product configurations where the NVIDIA GPU has connectors attached. Other products where the device class is 3D Controller are expected to correspond to configurations where the NVIDIA GPU is dedicated (dGPU) and has no connectors. See original post (URL below) for more details. This commit takes inspiration from an earlier patch by Daniel Drake. Link: https://lore.kernel.org/r/20190708051744.24039-1-drake@endlessm.com v2 Link: https://lore.kernel.org/r/20190613063514.15317-1-drake@endlessm.com v1 Link: https://devtalk.nvidia.com/default/topic/1024022 Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=75985 Signed-off-by: Lukas Wunner Signed-off-by: Daniel Drake [bhelgaas: commit log, log message, return early if already enabled] Signed-off-by: Bjorn Helgaas Cc: Aaron Plattner Cc: Peter Wu Cc: Ilia Mirkin Cc: Karol Herbst Cc: Maik Freudenberg commit a48f9721e6db74dfbeb8d4a2cd616b20017f4b78 Author: Greg Kroah-Hartman Date: Wed Jun 12 17:25:36 2019 +0200 dlm: no need to check return value of debugfs_create functions When calling debugfs functions, there is no need to ever check the return value. The function can work or not, but the code logic should never do something different based on this. Signed-off-by: Greg Kroah-Hartman Signed-off-by: David Teigland commit b355516f450703c9015316e429b66a93dfff0e6f Author: David Windsor Date: Tue Apr 2 08:37:10 2019 -0400 dlm: check if workqueues are NULL before flushing/destroying If the DLM lowcomms stack is shut down before any DLM traffic can be generated, flush_workqueue() and destroy_workqueue() can be called on empty send and/or recv workqueues. Insert guard conditionals to only call flush_workqueue() and destroy_workqueue() on workqueues that are not NULL. Signed-off-by: David Windsor Signed-off-by: David Teigland commit 6285bd151b95aa28d6de9b8b9249702681f059d2 Author: YueHaibing Date: Thu Mar 21 10:31:22 2019 +0800 perf cs-etm: Return errcode in cs_etm__process_auxtrace_info() The 'err' variable is set in the error path, but it's not returned to callers. Don't always return -EINVAL, return err. Signed-off-by: YueHaibing Reviewed-by: Mathieu Poirier Cc: Alexander Shishkin Cc: Jiri Olsa Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Suzuki Poulouse Cc: linux-arm-kernel@lists.infradead.org Fixes: cd8bfd8c973e ("perf tools: Add processing of coresight metadata") Link: http://lkml.kernel.org/r/20190321023122.21332-3-yuehaibing@huawei.com Signed-off-by: Arnaldo Carvalho de Melo commit edc82a99437a93c36b0ae18eb6daac0097fc6bd3 Author: YueHaibing Date: Thu Mar 21 10:31:21 2019 +0800 perf cs-etm: Remove errnoeous ERR_PTR() usage in cs_etm__process_auxtrace_info intlist__findnew() doesn't uses ERR_PTR() as a return mechanism so its callers shouldn't try to extract the error using PTR_ERR( ret) from intlist__findnew(), make cs_etm__process_auxtrace_info return -ENOMEM instead. Signed-off-by: YueHaibing Reviewed-by: Mathieu Poirier Cc: Alexander Shishkin Cc: Jiri Olsa Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Suzuki Poulouse Cc: linux-arm-kernel@lists.infradead.org Fixes: cd8bfd8c973e ("perf tools: Add processing of coresight metadata") Link: http://lkml.kernel.org/r/20190321023122.21332-2-yuehaibing@huawei.com Signed-off-by: Arnaldo Carvalho de Melo commit 25777e5784a7b417967460d4fcf9660d05a0c320 Author: morten petersen Date: Mon Jul 8 11:41:54 2019 +0000 mailbox: handle failed named mailbox channel request Previously, if mbox_request_channel_byname was used with a name which did not exist in the "mbox-names" property of a mailbox client, the mailbox corresponding to the last entry in the "mbox-names" list would be incorrectly selected. With this patch, -EINVAL is returned if the named mailbox is not found. Signed-off-by: Morten Borup Petersen Signed-off-by: Jassi Brar commit 33439620680be5225c1b8806579a291e0d761ca0 Author: Oliver O'Halloran Date: Thu Jul 11 01:05:17 2019 +1000 powerpc/eeh: Handle hugepages in ioremap space In commit 4a7b06c157a2 ("powerpc/eeh: Handle hugepages in ioremap space") support for using hugepages in the vmalloc and ioremap areas was enabled for radix. Unfortunately this broke EEH MMIO error checking. Detection works by inserting a hook which checks the results of the ioreadXX() set of functions. When a read returns a 0xFFs response we need to check for an error which we do by mapping the (virtual) MMIO address back to a physical address, then mapping physical address to a PCI device via an interval tree. When translating virt -> phys we currently assume the ioremap space is only populated by PAGE_SIZE mappings. If a hugepage mapping is found we emit a WARN_ON(), but otherwise handles the check as though a normal page was found. In pathalogical cases such as copying a buffer containing a lot of 0xFFs from BAR memory this can result in the system not booting because it's too busy printing WARN_ON()s. There's no real reason to assume huge pages can't be present and we're prefectly capable of handling them, so do that. Fixes: 4a7b06c157a2 ("powerpc/eeh: Handle hugepages in ioremap space") Reported-by: Sachin Sant Signed-off-by: Oliver O'Halloran Tested-by: Sachin Sant Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20190710150517.27114-1-oohall@gmail.com commit bedc0fd0f9b517698193d644f914b33951856fd2 Author: Qian Cai Date: Thu Jul 11 09:55:56 2019 -0400 RDMA/core: Fix -Wunused-const-variable warnings The commit below introduced a few compilation warnings. In file included from ./include/rdma/ib_verbs.h:64, from ./include/linux/mlx5/device.h:37, from ./include/linux/mlx5/driver.h:51, from drivers/net/ethernet/mellanox/mlx5/core/uar.c:36: ./include/linux/dim.h:378:1: warning: 'rdma_dim_prof' defined but not used [-Wunused-const-variable=] rdma_dim_prof[RDMA_DIM_PARAMS_NUM_PROFILES] = { ^~~~~~~~~~~~~ In file included from ./include/rdma/ib_verbs.h:64, from ./include/linux/mlx5/device.h:37, from ./include/linux/mlx5/driver.h:51, from drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c:37: ./include/linux/dim.h:378:1: warning: 'rdma_dim_prof' defined but not used [-Wunused-const-variable=] rdma_dim_prof[RDMA_DIM_PARAMS_NUM_PROFILES] = { ^~~~~~~~~~~~~ Since only ib_cq_rdma_dim_work() in drivers/infiniband/core/cq.c uses it, just move the definition over there. Fixes: f4915455dcf0 ("linux/dim: Implement RDMA adaptive moderation (DIM)") Signed-off-by: Qian Cai Reviewed-by: Jason Gunthorpe Signed-off-by: Jason Gunthorpe commit 855085d9686e107b77a1bdb935224a238a9fd8b9 Author: YueHaibing Date: Thu Jul 11 15:12:13 2019 +0800 rdma/siw: Remove set but not used variable 's' Fixes gcc '-Wunused-but-set-variable' warning: drivers/infiniband/sw/siw/siw_cm.c: In function siw_cm_llp_state_change: drivers/infiniband/sw/siw/siw_cm.c:1278:17: warning: variable s set but not used [-Wunused-but-set-variable] Fixes: 6c52fdc244b5 ("rdma/siw: connection management") Reported-by: Hulk Robot Signed-off-by: YueHaibing Reviewed-by: Bernard Metzler Signed-off-by: Jason Gunthorpe commit b45305d777f2f9209dae5a3b8249ca03166a4df3 Author: Geert Uytterhoeven Date: Wed Jul 10 15:39:30 2019 +0200 rdma/siw: Add missing dependencies on LIBCRC32C and DMA_VIRT_OPS If LIBCRC32C and DMA_VIRT_OPS are not enabled: drivers/infiniband/sw/siw/siw_main.o: In function `siw_newlink': siw_main.c:(.text+0x35c): undefined reference to `dma_virt_ops' drivers/infiniband/sw/siw/siw_qp_rx.o: In function `siw_csum_update': siw_qp_rx.c:(.text+0x16): undefined reference to `crc32c' Fix the first issue by adding a select of DMA_VIRT_OPS. Fix the second issue by replacing the unneeded dependency on CRYPTO_CRC32 by a dependency on LIBCRC32C. Reported-by: noreply@ellerman.id.au (first issue) Fixes: c0cf5bdde46c ("rdma/siw: addition to kernel build environment") Signed-off-by: Geert Uytterhoeven Reviewed-by: Jason Gunthorpe Signed-off-by: Jason Gunthorpe commit e3cd5136a4ecece6a7599a07add0dfb811a7f49d Author: Masahiro Yamada Date: Thu Jul 11 16:33:17 2019 +0900 kconfig: remove meaningless if-conditional in conf_read() sym_is_choice(sym) has already been checked by previous if-block: if (sym_is_choice(sym) || (sym->flags & SYMBOL_NO_WRITE)) continue; Hence, the following code is redundant, and the comment is misleading: if (!sym_is_choice(sym)) continue; /* fall through */ It always takes 'continue', never falls though. Clean up the dead code. Signed-off-by: Masahiro Yamada commit d4a74bbfee03acf7bbddc77b9c9236462c744fc7 Author: Masahiro Yamada Date: Tue Jul 9 15:13:00 2019 +0900 kbuild: use -- separater intead of $(filter-out ...) for cc-cross-prefix arch/mips/Makefile passes prefixes that start with '-' to cc-cross-prefix when $(tool-archpref) evaluates to the empty string. They are filtered-out before the $(shell ...) invocation. Otherwise, 'command -v' would be confused. $ command -v -linux-gcc bash: command: -l: invalid option command: usage: command [-pVv] command [arg ...] Since commit 913ab9780fc0 ("kbuild: use more portable 'command -v' for cc-cross-prefix"), cc-cross-prefix throws away the stderr output, so the console is not polluted in any way. This is not a big deal in practice, but I see a slightly better taste in adding '--' to teach it that '-linux-gcc' is an argument instead of a command option. This will cause extra forking of subshell, but it will not be noticeable performance regression. Signed-off-by: Masahiro Yamada commit c421651fa2295d1219c36674c7eb8c574542ceea Author: Jason Gunthorpe Date: Thu Jul 11 11:29:42 2019 -0300 RDMA/siw: Add missing rtnl_lock around access to ifa ifa is protected by rcu or rtnl, add the missing locking. In this case we have to use rtnl since siw_listen_address() is sleeping. Fixes: 6c52fdc244b5 ("rdma/siw: connection management") Reviewed-by: Bernard Metzler Signed-off-by: Jason Gunthorpe commit b7403066070d96fa3db23a4df6910f15c46ffc6d Merge: 4ddeaae8903d 420dc733f980 Author: Jens Axboe Date: Thu Jul 11 08:12:31 2019 -0600 Merge branch 'nvme-5.3' of git://git.infradead.org/nvme into for-linus Pull NVMe fixes from Christoph: "Lof of fixes all over the place, and two very minor features that were in the nvme tree by the end of the merge window, but hadn't made it out to Jens yet." * 'nvme-5.3' of git://git.infradead.org/nvme: nvme: fix regression upon hot device removal and insertion nvme-fc: fix module unloads while lports still pending nvme-tcp: don't use sendpage for SLAB pages nvme-tcp: set the STABLE_WRITES flag when data digests are enabled nvmet: print a hint while rejecting NSID 0 or 0xffffffff nvme-multipath: do not select namespaces which are about to be removed nvme-multipath: also check for a disabled path if there is a single sibling nvme-multipath: factor out a nvme_path_is_disabled helper nvme: set physical block size and optimal I/O size nvme: add I/O characteristics fields nvmet: export I/O characteristics attributes in Identify nvme-trace: add delete completion and submission queue to admin cmds tracer nvme-trace: fix spelling mistake "spcecific" -> "specific" nvme-pci: limit max_hw_sectors based on the DMA max mapping size nvme-pci: check for NULL return from pci_alloc_p2pmem() nvme-pci: don't create a read hctx mapping without read queues nvme-pci: don't fall back to a 32-bit DMA mask nvme-pci: make nvme_dev_pm_ops static nvme-fcloop: resolve warnings on RCU usage and sleep warnings nvme-fcloop: fix inconsistent lock state warnings commit a45ff5994c9cde41af627c46abb9f32beae68943 Merge: 429bb83af8bc 1e0cf16cdad1 Author: Paolo Bonzini Date: Thu Jul 11 15:14:16 2019 +0200 Merge tag 'kvm-arm-for-5.3' of git://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm into HEAD KVM/arm updates for 5.3 - Add support for chained PMU counters in guests - Improve SError handling - Handle Neoverse N1 erratum #1349291 - Allow side-channel mitigation status to be migrated - Standardise most AArch64 system register accesses to msr_s/mrs_s - Fix host MPIDR corruption on 32bit commit 429bb83af8bcea0115eb34fd7ed94a35166d8384 Author: Luke Nowakowski-Krijger Date: Wed Jul 10 08:30:54 2019 -0700 Documentation: virtual: Add toctree hooks Added toctree hooks for indexing. Hooks added only for newly added files. The hook for the top of the tree will be added in a later patch series when a few more substantial changes have been added. Signed-off-by: Luke Nowakowski-Krijger Signed-off-by: Paolo Bonzini commit e287d6de62f745e223d2f7d9b621c892d4b2b45a Author: Luke Nowakowski-Krijger Date: Wed Jul 10 08:30:53 2019 -0700 Documentation: kvm: Convert cpuid.txt to .rst Convert cpuid.txt to .rst format to be parsable by sphinx. Change format and spacing to make function definitions and return values much more clear. Also added a table that is parsable by sphinx and makes the information much more clean. Updated Author email to their new active email address. Added license identifier with the consent of the author. Signed-off-by: Luke Nowakowski-Krijger Signed-off-by: Paolo Bonzini commit 8373bc4f1b7072a020860896b404bff0a54c7583 Author: Luke Nowakowski-Krijger Date: Wed Jul 10 08:30:52 2019 -0700 Documentation: virtual: Convert paravirt_ops.txt to .rst Convert paravirt_opts.txt to .rst format to be able to be parsed by sphinx. Made some minor spacing and formatting corrections to make defintions much more clear and easy to read. Added default kernel license to the document. Signed-off-by: Luke Nowakowski-Krijger Signed-off-by: Paolo Bonzini commit d7a08882a0a4b4e176691331ee3f492996579534 Author: Sean Christopherson Date: Wed Jul 10 09:07:34 2019 -0700 KVM: x86: Unconditionally enable irqs in guest context On VMX, KVM currently does not re-enable irqs until after it has exited the guest context. As a result, a tick that fires in the window between VM-Exit and guest_exit_irqoff() will be accounted as system time. While said window is relatively small, it's large enough to be problematic in some configurations, e.g. if VM-Exits are consistently occurring a hair earlier than the tick irq. Intentionally toggle irqs back off so that guest_exit_irqoff() can be used in lieu of guest_exit() in order to avoid the save/restore of flags in guest_exit(). On my Haswell system, "nop; cli; sti" is ~6 cycles, versus ~28 cycles for "pushf; pop ; cli; push ; popf". Fixes: f2485b3e0c6c0 ("KVM: x86: use guest_exit_irqoff") Reported-by: Wei Yang Signed-off-by: Sean Christopherson Signed-off-by: Paolo Bonzini commit 2e3f45004715085ad53fb0098ae671194157eca4 Author: Rajneesh Bhardwaj Date: Wed Jul 10 21:44:38 2019 +0800 powercap/rapl: Add Ice Lake NNPI support to RAPL driver Enables support for ICL-NNPI, which is a neural network processor for deep learning inference. From RAPL point of view it is same as Ice Lake Mobile processor. Link: https://lkml.org/lkml/2019/6/5/1034 Signed-off-by: Rajneesh Bhardwaj Signed-off-by: Zhang Rui Signed-off-by: Rafael J. Wysocki commit 3231a21d5ca6f6baea95588406775304f35a203e Author: Zhang Rui Date: Wed Jul 10 21:44:37 2019 +0800 powercap/intel_rapl: add support for ICX-D Add ICX-D support in intel_rapl driver Signed-off-by: Zhang Rui Signed-off-by: Rafael J. Wysocki commit cceb1d9dfa680e8b0f5d70d87c2ee25903070b96 Author: Zhang Rui Date: Wed Jul 10 21:44:36 2019 +0800 powercap/intel_rapl: add support for ICX Add ICX support in intel_rapl driver Signed-off-by: Jacob Pan Signed-off-by: Rajneesh Bhardwaj Signed-off-by: Zhang Rui Signed-off-by: Rafael J. Wysocki commit 0ab74bcd1b50821391b264150d26b7f03ba6740b Author: Zhang Rui Date: Wed Jul 10 21:44:35 2019 +0800 powercap/intel_rapl: add support for IceLake desktop Add IceLake desktop support in intel_rapl driver Signed-off-by: Gayatri Kammela Signed-off-by: Joe Konno Signed-off-by: Zhang Rui Signed-off-by: Rafael J. Wysocki commit abcfaeb3f5dc8bded4ba446eb2fb017a7a41d9bc Author: Zhang Rui Date: Wed Jul 10 21:44:34 2019 +0800 intel_rapl: Fix module autoloading issue intel_rapl driver used to have a list of cpuids, which is used to 1. check if the processor support RAPL MSRs 2. do some cpu model specific setting 3. module autoloading Now, the cpu model specific setting are moved to intel_rapl_common.c as part of the common code, because the setup is also needed by RAPL MMIO interface on those platforms. But removing the cpuid list from intel_rapl MSR interface driver results in that the driver can not be loaded automatically. Maintaining another copy of the cpuid list in intel_rapl_msr.c does not make sense because it increases the complexity when enabling RAPL support on a new cpu model. Fix the problem by creating an "intel_rapl_msr" platform device in the common code, and make RAPL MSR interface driver (intel_rapl_msr.c) probe the platform device directly. Reviewed-by: Pandruvada, Srinivas Tested-by: Pandruvada, Srinivas Signed-off-by: Zhang Rui Signed-off-by: Rafael J. Wysocki commit 555c45fe0d04bd817e245a125d242b6a86af4593 Author: Zhang Rui Date: Wed Jul 10 21:44:33 2019 +0800 int340X/processor_thermal_device: add support for MMIO RAPL Introduce MMIO RAPL support as Intel processor_thermal device exposes the capability to do RAPL control via MMIO registers. Reviewed-by: Pandruvada, Srinivas Tested-by: Pandruvada, Srinivas Signed-off-by: Zhang Rui Signed-off-by: Rafael J. Wysocki commit 0c2ddedd8bcb88c4100acb9e0fc5ac8752d09501 Author: Zhang Rui Date: Wed Jul 10 21:44:32 2019 +0800 intel_rapl: support two power limits for every RAPL domain RAPL MSR interface supports 2 power limits for package domain, and 1 power limit for other domains, while RAPL MMIO interface supports 2 power limits for both package and dram domains. And when 2 power limits are supported, the FW_LOCK bit is in bit 63 of the register, instead of bit 31. Remove the assumption that only pakcage domain supports 2 power limits. And allow the RAPL interface driver to specify the number of power limits supported, for every single RAPL domain it owns.. Reviewed-by: Pandruvada, Srinivas Tested-by: Pandruvada, Srinivas Signed-off-by: Zhang Rui Signed-off-by: Rafael J. Wysocki commit d978e755aabe215cb67bf713e103ed3916ec306d Author: Zhang Rui Date: Wed Jul 10 21:44:31 2019 +0800 intel_rapl: support 64 bit register RAPL MMIO interface uses 64 bit registers, thus force use 64 bit register for all the RAPL code. Reviewed-by: Pandruvada, Srinivas Tested-by: Pandruvada, Srinivas Signed-off-by: Zhang Rui Signed-off-by: Rafael J. Wysocki commit 3382388d714891fc0f575926189f33d22e7c960b Author: Zhang Rui Date: Wed Jul 10 21:44:30 2019 +0800 intel_rapl: abstract RAPL common code Split intel_rapl.c to intel_rapl_common.c and intel_rapl_msr.c, where intel_rapl_common.c contains the common code that can be used by both MSR and MMIO interface. intel_rapl_msr.c contains the implementation of RAPL MSR interface. Reviewed-by: Pandruvada, Srinivas Tested-by: Pandruvada, Srinivas Signed-off-by: Zhang Rui Signed-off-by: Rafael J. Wysocki commit 1193b1658d16f03cdb2edbac5f2a796ccca225af Author: Zhang Rui Date: Wed Jul 10 21:44:29 2019 +0800 intel_rapl: cleanup hardcoded MSR access There are still some places in the common code that have hardcoded MSR access, convert them to follow the abstracted register access. Reviewed-by: Pandruvada, Srinivas Tested-by: Pandruvada, Srinivas Signed-off-by: Zhang Rui Signed-off-by: Rafael J. Wysocki commit 8a00676cd690941c9a18bd390c3b2cade631c516 Author: Zhang Rui Date: Wed Jul 10 21:44:28 2019 +0800 intel_rapl: cleanup some functions Previously, there are three functions: rapl_register_psys(), which registers platform rapl domain. rapl_register_powercap(), which registers powercap control type. rapl_unregsiter_powercap(), which unregisters platform rapl domain and powercap control type. This is confusing as the function name does not describe what it does clearly. With this patch, the three functions are removed, and two new functions rapl_register_platform_domain()/rapl_unregister_platform_domain() are introduced instead, and they do exactly what their function name describes. Plus, as part of the common code, hardcoded MSR accesses in these functions are converted to follow the abstracted register access. Reviewed-by: Pandruvada, Srinivas Tested-by: Pandruvada, Srinivas Signed-off-by: Zhang Rui Signed-off-by: Rafael J. Wysocki commit beea8df821d928e7755917da6c1e45d6afde5148 Author: Zhang Rui Date: Wed Jul 10 21:44:27 2019 +0800 intel_rapl: abstract register access operations MSR and MMIO RAPL interfaces have different ways to access the registers, thus in order to abstract the register access operations, two callbacks, .read_raw()/.write_raw() are introduced, and they should be implemented by MSR RAPL and MMIO RAPL interface driver respectly. This patch implements them for the MSR I/F only. Reviewed-by: Pandruvada, Srinivas Tested-by: Pandruvada, Srinivas Signed-off-by: Zhang Rui Signed-off-by: Rafael J. Wysocki commit 7fde2712a7adab721eaabafbd8ff93dff3262d35 Author: Zhang Rui Date: Wed Jul 10 21:44:26 2019 +0800 intel_rapl: abstract register address MSR and MMIO RAPL interface have different sets of registers, thus the RAPL register address should be obtained from interface specific structure, i.e. struct rapl_if_private, instead. Reviewed-by: Pandruvada, Srinivas Tested-by: Pandruvada, Srinivas Signed-off-by: Zhang Rui Signed-off-by: Rafael J. Wysocki commit 7ebf8eff63b4f349e7b2ded6aa5036d94bdf94b9 Author: Zhang Rui Date: Wed Jul 10 21:44:25 2019 +0800 intel_rapl: introduce struct rapl_if_private Introduce a new structure, rapl_if_private, to save the private data for different RAPL Interface. Reviewed-by: Pandruvada, Srinivas Tested-by: Pandruvada, Srinivas Signed-off-by: Zhang Rui Signed-off-by: Rafael J. Wysocki commit ff956826a403f5cf189978d5ff6b3eb53aa11610 Author: Zhang Rui Date: Wed Jul 10 21:44:24 2019 +0800 intel_rapl: introduce intel_rapl.h Create a new header file for the common definitions that might be used by different RAPL Interface. Reviewed-by: Pandruvada, Srinivas Tested-by: Pandruvada, Srinivas Signed-off-by: Zhang Rui Signed-off-by: Rafael J. Wysocki commit 8310e8202f24d674b6b2bd341af15d72299f696d Author: Zhang Rui Date: Wed Jul 10 21:44:23 2019 +0800 intel_rapl: remove hardcoded register index enum rapl_domain_reg_id is defined for the RAPL registers for each RAPL domain, thus use it whenever possible. Reviewed-by: Pandruvada, Srinivas Tested-by: Pandruvada, Srinivas Signed-off-by: Zhang Rui Signed-off-by: Rafael J. Wysocki commit f7c4e0c89bbd0f008b33d9dce02e207d9dea9f54 Author: Zhang Rui Date: Wed Jul 10 21:44:22 2019 +0800 intel_rapl: use reg instead of msr To support both MSR and MMIO Interface, use 'reg' to discribe RAPL registers instead of 'msr'. Reviewed-by: Pandruvada, Srinivas Tested-by: Pandruvada, Srinivas Signed-off-by: Zhang Rui Signed-off-by: Rafael J. Wysocki commit 66bb8a065f5aedd4551d8d3fbce582972f65c2e1 Author: Eric Hankland Date: Wed Jul 10 18:25:15 2019 -0700 KVM: x86: PMU Event Filter Some events can provide a guest with information about other guests or the host (e.g. L3 cache stats); providing the capability to restrict access to a "safe" set of events would limit the potential for the PMU to be used in any side channel attacks. This change introduces a new VM ioctl that sets an event filter. If the guest attempts to program a counter for any blacklisted or non-whitelisted event, the kernel counter won't be created, so any RDPMC/RDMSR will show 0 instances of that event. Signed-off-by: Eric Hankland [Lots of changes. All remaining bugs are probably mine. - Paolo] Signed-off-by: Paolo Bonzini commit 22be8233b34f4f468934c5fefcbe6151766fb8f2 Author: Hans Verkuil Date: Thu Jul 11 04:53:25 2019 -0400 media: videodev2.h: change V4L2_PIX_FMT_BGRA444 define: fourcc was already in use The V4L2_PIX_FMT_BGRA444 define clashed with the pre-existing V4L2_PIX_FMT_SGRBG12 which strangely enough used the same fourcc, even though that fourcc made no sense for a Bayer format. In any case, you can't have duplicates, so change the fourcc of V4L2_PIX_FMT_BGRA444. Signed-off-by: Hans Verkuil Cc: # for v5.2 and up Fixes: 6c84f9b1d2900 ("media: v4l: Add definitions for missing 16-bit RGB4444 formats") Reviewed-by: Laurent Pinchart Reviewed-by: Kieran Bingham Signed-off-by: Mauro Carvalho Chehab commit 6bda7073f335db261345d403123d9a8c0bc1e36b Author: Hans Verkuil Date: Sat Jun 29 09:00:10 2019 -0400 media: v4l2-subdev: fix regression in check_pad() sd->entity.graph_obj.mdev can be NULL when this function is called, and that breaks existing drivers (rcar-vin, but probably others as well). Check if sd->entity.num_pads is non-zero instead since that doesn't depend on mdev. Signed-off-by: Hans Verkuil Reported-by: Niklas Söderlund Fixes: a8fa55078a77 ("media: v4l2-subdev: Verify arguments in v4l2_subdev_call()") Tested-by: Niklas Söderlund Tested-by: Geert Uytterhoeven Acked-by: Sakari Ailus Signed-off-by: Mauro Carvalho Chehab commit ec3042ad39d4e2ddbc3a3344f90bb10d8feb53bc Author: Kuninori Morimoto Date: Thu Jul 11 13:10:45 2019 +0900 ASoC: audio-graph-card: add missing const at graph_get_dai_id() commit c152f8491a8d9 ("ASoC: audio-graph-card: fix an use-after-free in graph_get_dai_id()") fixups use-after-free issue, but, it need to use "const" for reg. This patch adds it. We will have below without this patch LINUX/sound/soc/generic/audio-graph-card.c: In function 'graph_get_dai_id': LINUX/sound/soc/generic/audio-graph-card.c:87:7: warning: assignment discards\ 'const' qualifier from pointer target type [-Wdiscarded-qualifiers] reg = of_get_property(node, "reg", NULL); Fixes: c152f8491a8d9 ("ASoC: audio-graph-card: fix an use-after-free in graph_get_dai_id()") Signed-off-by: Kuninori Morimoto Acked-by: Wen Yang Link: https://lore.kernel.org/r/87sgrd43ja.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 09297c2f7a5428776369ba3b9904718a358e5559 Author: Shuming Fan Date: Thu Jul 11 16:22:14 2019 +0800 ASoC: rt1011: fix DC calibration offset not applying There are two issues to fix: - DC offset calibration data will be reset after stopping playback. - DC offset calibration data should be applied in the initial setting. Signed-off-by: Shuming Fan Link: https://lore.kernel.org/r/20190711082214.8142-1-shumingf@realtek.com Signed-off-by: Mark Brown commit 597473720f4dc69749542bfcfed4a927a43d935e Merge: f0dd687815f9 593fdd4fb44e Author: Dmitry Torokhov Date: Wed Jul 10 23:24:10 2019 -0700 Merge branch 'next' into for-linus Prepare input updates for 5.3 merge window. commit cbf5b73d162b22e044fe0b7d51dcaa33be065253 Author: Eiichi Tsukata Date: Thu Jul 11 11:35:01 2019 +0900 x86/stacktrace: Prevent infinite loop in arch_stack_walk_user() arch_stack_walk_user() checks `if (fp == frame.next_fp)` to prevent a infinite loop by self reference but it's not enogh for circular reference. Once a lack of return address is found, there is no point to continue the loop, so break out. Fixes: 02b67518e2b1 ("tracing: add support for userspace stacktraces in tracing/iter_ctrl") Signed-off-by: Eiichi Tsukata Signed-off-by: Thomas Gleixner Acked-by: Linus Torvalds Link: https://lkml.kernel.org/r/20190711023501.963-1-devel@etsukata.com commit 5450e8a316a64cddcbc15f90733ebc78aa736545 Merge: 29cd581b5949 172bb24a4f48 Author: Linus Torvalds Date: Wed Jul 10 22:17:21 2019 -0700 Merge tag 'pidfd-updates-v5.3' of git://git.kernel.org/pub/scm/linux/kernel/git/brauner/linux Pull pidfd updates from Christian Brauner: "This adds two main features. - First, it adds polling support for pidfds. This allows process managers to know when a (non-parent) process dies in a race-free way. The notification mechanism used follows the same logic that is currently used when the parent of a task is notified of a child's death. With this patchset it is possible to put pidfds in an {e}poll loop and get reliable notifications for process (i.e. thread-group) exit. - The second feature compliments the first one by making it possible to retrieve pollable pidfds for processes that were not created using CLONE_PIDFD. A lot of processes get created with traditional PID-based calls such as fork() or clone() (without CLONE_PIDFD). For these processes a caller can currently not create a pollable pidfd. This is a problem for Android's low memory killer (LMK) and service managers such as systemd. Both patchsets are accompanied by selftests. It's perhaps worth noting that the work done so far and the work done in this branch for pidfd_open() and polling support do already see some adoption: - Android is in the process of backporting this work to all their LTS kernels [1] - Service managers make use of pidfd_send_signal but will need to wait until we enable waiting on pidfds for full adoption. - And projects I maintain make use of both pidfd_send_signal and CLONE_PIDFD [2] and will use polling support and pidfd_open() too" [1] https://android-review.googlesource.com/q/topic:%22pidfd+polling+support+4.9+backport%22 https://android-review.googlesource.com/q/topic:%22pidfd+polling+support+4.14+backport%22 https://android-review.googlesource.com/q/topic:%22pidfd+polling+support+4.19+backport%22 [2] https://github.com/lxc/lxc/blob/aab6e3eb73c343231cdde775db938994fc6f2803/src/lxc/start.c#L1753 * tag 'pidfd-updates-v5.3' of git://git.kernel.org/pub/scm/linux/kernel/git/brauner/linux: tests: add pidfd_open() tests arch: wire-up pidfd_open() pid: add pidfd_open() pidfd: add polling selftests pidfd: add polling support commit 29cd581b59496c26334c910a8b848baa81a6becd Merge: 398364a35dae f28a1f16135c Author: Linus Torvalds Date: Wed Jul 10 21:44:07 2019 -0700 Merge tag 'm68k-for-v5.3-tag2' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/linux-m68k Pull m68k fix from Geert Uytterhoeven: "Don't select ARCH_HAS_DMA_PREP_COHERENT for nommu or coldfire. This is a fix for an issue detected in next, to avoid introducing build failures when merging Christoph's dma-mapping tree later" * tag 'm68k-for-v5.3-tag2' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/linux-m68k: m68k: Don't select ARCH_HAS_DMA_PREP_COHERENT for nommu or coldfire commit 398364a35daed7361e76c3666fb9a97792edce09 Merge: d2b6b4c832f7 ad97f9df0fee Author: Linus Torvalds Date: Wed Jul 10 21:42:03 2019 -0700 Merge branch 'for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/gerg/m68knommu Pull m68nommu updates from Greg Ungerer: "A series of cleanups for the FLAT format binary loader, binfmt_flat, from Christoph. The end goal is to support no-MMU on RISC-V, and the last patch enables that" * 'for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/gerg/m68knommu: riscv: add binfmt_flat support binfmt_flat: don't offset the data start binfmt_flat: move the MAX_SHARED_LIBS definition to binfmt_flat.c binfmt_flat: remove the persistent argument from flat_get_addr_from_rp binfmt_flat: provide an asm-generic/flat.h binfmt_flat: make support for old format binaries optional binfmt_flat: add a ARCH_HAS_BINFMT_FLAT option binfmt_flat: add endianess annotations binfmt_flat: use fixed size type for the on-disk format binfmt_flat: consolidate two version of flat_v2_reloc_t binfmt_flat: remove the unused OLD_FLAT_FLAG_RAM definition binfmt_flat: remove the uapi header binfmt_flat: replace flat_argvp_envp_on_stack with a Kconfig variable binfmt_flat: remove flat_old_ram_flag binfmt_flat: provide a default version of flat_get_relocate_addr binfmt_flat: remove flat_set_persistent binfmt_flat: remove flat_reloc_valid commit d2b6b4c832f7e3067709e8d4970b7b82b44419ac Merge: 0248a8be6d21 b78fa45d4edb Author: Linus Torvalds Date: Wed Jul 10 21:22:43 2019 -0700 Merge tag 'nfsd-5.3' of git://linux-nfs.org/~bfields/linux Pull nfsd updates from Bruce Fields: "Highlights: - Add a new /proc/fs/nfsd/clients/ directory which exposes some long-requested information about NFSv4 clients (like open files) and allows forced revocation of client state. - Replace the global duplicate reply cache by a cache per network namespace; previously, a request in one network namespace could incorrectly match an entry from another, though we haven't seen this in production. This is the last remaining container bug that I'm aware of; at this point you should be able to run separate nfsd's in each network namespace, each with their own set of exports, and everything should work. - Cleanup and modify lock code to show the pid of lockd as the owner of NLM locks. This is the correct version of the bugfix originally attempted in b8eee0e90f97 ("lockd: Show pid of lockd for remote locks")" * tag 'nfsd-5.3' of git://linux-nfs.org/~bfields/linux: (34 commits) nfsd: Make __get_nfsdfs_client() static nfsd: Make two functions static nfsd: Fix misuse of strlcpy sunrpc/cache: remove the exporting of cache_seq_next nfsd: decode implementation id nfsd: create xdr_netobj_dup helper nfsd: allow forced expiration of NFSv4 clients nfsd: create get_nfsdfs_clp helper nfsd4: show layout stateids nfsd: show lock and deleg stateids nfsd4: add file to display list of client's opens nfsd: add more information to client info file nfsd: escape high characters in binary data nfsd: copy client's address including port number to cl_addr nfsd4: add a client info file nfsd: make client/ directory names small ints nfsd: add nfsd/clients directory nfsd4: use reference count to free client nfsd: rename cl_refcount nfsd: persist nfsd filesystem across mounts ... commit 0248a8be6d21dad72b9ce80a7565cf13c11509d8 Merge: 2e756758e5cb bb4cb25dd319 Author: Linus Torvalds Date: Wed Jul 10 21:20:05 2019 -0700 Merge tag 'gfs2-for-5.3' of git://git.kernel.org/pub/scm/linux/kernel/git/gfs2/linux-gfs2 Pull gfs2 updates from Andreas Gruenbacher: "Some relatively minor changes for gfs2: - An initial batch of obvious cleanups and fixes from Bob's recovery patch queue. - Two iomap conversion patches and some cleanups from Christoph Hellwig. - A cosmetic cleanup from Kefeng Wang (Huawei). - Another minor fix and cleanup by me" * tag 'gfs2-for-5.3' of git://git.kernel.org/pub/scm/linux/kernel/git/gfs2/linux-gfs2: gfs2: Remove unused gfs2_iomap_alloc argument gfs2: don't use buffer_heads in gfs2_allocate_page_backing gfs2: use iomap_bmap instead of generic_block_bmap gfs2: mark stuffed_readpage static gfs2: merge gfs2_writepage_common into gfs2_writepage gfs2: merge gfs2_writeback_aops and gfs2_ordered_aops gfs2: remove the unused gfs2_stuffed_write_end function gfs2: use page_offset in gfs2_page_mkwrite gfs2: replace more printk with calls to fs_info and friends gfs2: dump fsid when dumping glock problems gfs2: simplify gfs2_freeze by removing case gfs2: Rename SDF_SHUTDOWN to SDF_WITHDRAWN gfs2: Warn when a journal replay overwrites a rgrp with buffers gfs2: log which portion of the journal is replayed gfs2: eliminate tr_num_revoke_rm gfs2: kthread and remount improvements gfs2: Use IS_ERR_OR_NULL gfs2: Clean up freeing struct gfs2_sbd commit 20b5d24c7669813ec73589146f7dcefbf259a26a Author: Bitan Biswas Date: Fri Jun 14 09:31:01 2019 -0700 mailbox: tegra: avoid resume NULL mailboxes If Tegra HSP device tree does not have 'shared irqs', mailboxes pointer is NULL. Add non-NULL HSP mailboxes check in resume callback before tegra_hsp_mailbox_startup() call and prevent NULL pointer exception. Signed-off-by: Bitan Biswas Signed-off-by: Jassi Brar commit b1a399530ca9bc958ac48fe85837c791f89a3be2 Author: Bitan Biswas Date: Fri Jun 14 09:31:00 2019 -0700 mailbox: tegra: hsp: add noirq resume Add noirq resume instead of resume callback for Tegra HSP. Tegra HSP resume needs tegra_hsp_doorbell_startup() call to fix timeout error for tegra_bpmp_transfer() during genpd resume noirq on Jetson TX2. Signed-off-by: Bitan Biswas Signed-off-by: Jassi Brar commit 7836922d87175dbc9bc972a1aca08d2c8b6f5045 Author: Fuqian Huang Date: Thu Jul 4 10:36:27 2019 +0800 mailbox: bcm-flexrm-mailbox: using dev_get_drvdata directly Several drivers cast a struct device pointer to a struct platform_device pointer only to then call platform_get_drvdata(). To improve readability, these constructs can be simplified by using dev_get_drvdata() directly. Signed-off-by: Fuqian Huang Signed-off-by: Jassi Brar commit 11108f4671bda6bf93bea5455210346a0ccbaa10 Author: Daniel Baluta Date: Thu Jun 27 15:29:27 2019 +0300 mailbox: imx: Clear GIEn bit at shutdown GIEn is enabled at startup for RX doorbell mailboxes so we need to clear the bit at shutdown in order to avoid leaving the interrupt line enabled. Signed-off-by: Daniel Baluta Reviewed-by: Oleksij Rempel Signed-off-by: Jassi Brar commit 9c1f2a5dc2948b9f1170d4202c84745f0b0ff0c9 Author: Suman Anna Date: Tue Jun 4 12:01:46 2019 -0500 mailbox: omap: Add support for TI K3 SoCs The TI K3 AM65x and J721E family of SoCs have a new Mailbox IP that is based on the existing Mailbox IP present in OMAP architecture based SoCs. Each instance of the legacy OMAP Mailbox IP is now a single cluster within the newer Mailbox IP instance on K3 architecture based SoCs. A single K3 Mailbox IP instance has multiple clusters with each cluster providing the same functionality as the existing OMAP Mailbox IP. Reuse the existing OMAP Mailbox driver to extend the support for this newer IP present within the Main NavSS block on K3 SoCs. The K3 family of SoCs use 64-bit ARMv8 processors for running Linux, so the driver is also enhanced to deal with the differences between the 32-bit message payloads and the 64-bit pointers used by the client drivers. Signed-off-by: Suman Anna Signed-off-by: Jassi Brar commit 8c665292ec1263c627df60d10619e6f96deea788 Author: Suman Anna Date: Tue Jun 4 12:01:45 2019 -0500 dt-bindings: mailbox: omap: Update bindings for TI K3 SoCs The TI K3 AM65x and J721E family of SoCs have a new Mailbox IP that is based on the existing Mailbox IP present in OMAP architecture based SoCs. Update the existing OMAP Mailbox bindings for this new IP present on TI K3 AM65x and J721E SoCs. The same compatible from AM65x SoCs is reused for J721E SoCs. Signed-off-by: Suman Anna Reviewed-by: Rob Herring Signed-off-by: Jassi Brar commit 06c182c3bc4eebd6038999a611e4c963d4c87a93 Author: Sudeep Holla Date: Fri May 31 15:33:16 2019 +0100 mailbox: arm_mhu: reorder header inclusion and drop unneeded ones This patch just re-orders some of the headers includes and also drop the ones that are unnecessary. Signed-off-by: Sudeep Holla Signed-off-by: Jassi Brar commit dba9a3dfe912dc47c9dbc9ba1f5f65adbf9aea0f Author: Arnaud Pouliquen Date: Wed May 22 10:25:35 2019 +0200 mailbox: stm32_ipcc: add spinlock to fix channels concurrent access Add spinlock protection on IPCC register update to avoid race condition. Without this fix, stm32_ipcc_set_bits and stm32_ipcc_clr_bits can be called in parallel for different channels. This results in register corruptions. Signed-off-by: Arnaud Pouliquen Reviewed-by: Fabien Dessenne Signed-off-by: Jassi Brar commit 2e756758e5cb4ea29cba5865d00fad476ce94a93 Merge: 8dda9957e3a1 96fcaf86c3cb Author: Linus Torvalds Date: Wed Jul 10 21:06:01 2019 -0700 Merge tag 'ext4_for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4 Pull ext4 updates from Ted Ts'o: "Many bug fixes and cleanups, and an optimization for case-insensitive lookups" * tag 'ext4_for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4: ext4: fix coverity warning on error path of filename setup ext4: replace ktype default_attrs with default_groups ext4: rename htree_inline_dir_to_tree() to ext4_inlinedir_to_tree() ext4: refactor initialize_dirent_tail() ext4: rename "dirent_csum" functions to use "dirblock" ext4: allow directory holes jbd2: drop declaration of journal_sync_buffer() ext4: use jbd2_inode dirty range scoping jbd2: introduce jbd2_inode dirty range scoping mm: add filemap_fdatawait_range_keep_errors() ext4: remove redundant assignment to node ext4: optimize case-insensitive lookups ext4: make __ext4_get_inode_loc plug ext4: clean up kerneldoc warnigns when building with W=1 ext4: only set project inherit bit for directory ext4: enforce the immutable flag on open files ext4: don't allow any modifications to an immutable file jbd2: fix typo in comment of journal_submit_inode_data_buffers jbd2: fix some print format mistakes ext4: gracefully handle ext4_break_layouts() failure during truncate commit 8dda9957e3a1c871dfbabf84c4760f9b26032442 Merge: 25cd6f355dab 1eda8bab70ca Author: Linus Torvalds Date: Wed Jul 10 20:55:33 2019 -0700 Merge tag 'afs-next-20190628' of git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs Pull afs updates from David Howells: "A set of minor changes for AFS: - Remove an unnecessary check in afs_unlink() - Add a tracepoint for tracking callback management - Add a tracepoint for afs_server object usage - Use struct_size() - Add mappings for AFS UAE abort codes to Linux error codes, using symbolic names rather than hex numbers in the .c file" * tag 'afs-next-20190628' of git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs: afs: Add support for the UAE error table fs/afs: use struct_size() in kzalloc() afs: Trace afs_server usage afs: Add some callback management tracepoints afs: afs_unlink() doesn't need to check dentry->d_inode commit 25cd6f355dab9d11b7c8a4005867d5a30b8b14ee Merge: 40f06c799539 0564336329f0 Author: Linus Torvalds Date: Wed Jul 10 20:51:03 2019 -0700 Merge tag 'fscrypt-for-linus' of git://git.kernel.org/pub/scm/fs/fscrypt/fscrypt Pull fscrypt updates from Eric Biggers: - Preparations for supporting encryption on ext4 filesystems where the filesystem block size is smaller than PAGE_SIZE. - Don't allow setting encryption policies on dead directories. - Various cleanups. * tag 'fscrypt-for-linus' of git://git.kernel.org/pub/scm/fs/fscrypt/fscrypt: fscrypt: document testing with xfstests fscrypt: remove selection of CONFIG_CRYPTO_SHA256 fscrypt: remove unnecessary includes of ratelimit.h fscrypt: don't set policy for a dead directory ext4: encrypt only up to last block in ext4_bio_write_page() ext4: decrypt only the needed block in __ext4_block_zero_page_range() ext4: decrypt only the needed blocks in ext4_block_write_begin() ext4: clear BH_Uptodate flag on decryption error fscrypt: decrypt only the needed blocks in __fscrypt_decrypt_bio() fscrypt: support decrypting multiple filesystem blocks per page fscrypt: introduce fscrypt_decrypt_block_inplace() fscrypt: handle blocksize < PAGE_SIZE in fscrypt_zeroout_range() fscrypt: support encrypting multiple filesystem blocks per page fscrypt: introduce fscrypt_encrypt_block_inplace() fscrypt: clean up some BUG_ON()s in block encryption/decryption fscrypt: rename fscrypt_do_page_crypto() to fscrypt_crypt_block() fscrypt: remove the "write" part of struct fscrypt_ctx fscrypt: simplify bounce page handling commit 40f06c799539739a08a56be8a096f56aeed05731 Merge: a47f5c56b2eb fe0da9c09b2d Author: Linus Torvalds Date: Wed Jul 10 20:32:37 2019 -0700 Merge tag 'copy-file-range-fixes-1' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux Pull copy_file_range updates from Darrick Wong: "This fixes numerous parameter checking problems and inconsistent behaviors in the new(ish) copy_file_range system call. Now the system call will actually check its range parameters correctly; refuse to copy into files for which the caller does not have sufficient privileges; update mtime and strip setuid like file writes are supposed to do; and allows copying up to the EOF of the source file instead of failing the call like we used to. Summary: - Create a generic copy_file_range handler and make individual filesystems responsible for calling it (i.e. no more assuming that do_splice_direct will work or is appropriate) - Refactor copy_file_range and remap_range parameter checking where they are the same - Install missing copy_file_range parameter checking(!) - Remove suid/sgid and update mtime like any other file write - Change the behavior so that a copy range crossing the source file's eof will result in a short copy to the source file's eof instead of EINVAL - Permit filesystems to decide if they want to handle cross-superblock copy_file_range in their local handlers" * tag 'copy-file-range-fixes-1' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux: fuse: copy_file_range needs to strip setuid bits and update timestamps vfs: allow copy_file_range to copy across devices xfs: use file_modified() helper vfs: introduce file_modified() helper vfs: add missing checks to copy_file_range vfs: remove redundant checks from generic_remap_checks() vfs: introduce generic_file_rw_checks() vfs: no fallback for ->copy_file_range vfs: introduce generic_copy_file_range() commit a47f5c56b2eb55290e2a8668e9ca9c029990dbf6 Merge: 682f7c5c465d 36a7347de097 Author: Linus Torvalds Date: Wed Jul 10 20:29:45 2019 -0700 Merge tag 'iomap-5.3-merge-1' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux Pull iomap updates from Darrick Wong: "There are a few fixes for gfs2 but otherwise it's pretty quiet so far. - Only mark inode dirty at the end of writing to a file (instead of once for every page written). - Fix for an accounting error in the page_done callback" * tag 'iomap-5.3-merge-1' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux: iomap: fix page_done callback for short writes fs: fold __generic_write_end back into generic_write_end iomap: don't mark the inode dirty in iomap_write_end commit 682f7c5c465d7ac4107e51dbf2a847a026b384e8 Merge: e6983afd9254 fa33cdbf3ece Author: Linus Torvalds Date: Wed Jul 10 20:27:07 2019 -0700 Merge tag 'for_v5.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs Pull ext2, udf and quota updates from Jan Kara: - some ext2 fixes and cleanups - a fix of udf bug when extending files - a fix of quota Q_XGETQSTAT[V] handling * tag 'for_v5.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs: udf: Fix incorrect final NOT_ALLOCATED (hole) extent length ext2: Use kmemdup rather than duplicating its implementation quota: honor quota type in Q_XGETQSTAT[V] calls ext2: Always brelse bh on failure in ext2_iget() ext2: add missing brelse() in ext2_iget() ext2: Fix a typo in ext2_getattr argument ext2: fix a typo in comment ext2: add missing brelse() in ext2_new_inode() ext2: optimize ext2_xattr_get() ext2: introduce new helper for xattr entry comparison ext2: merge xattr next entry check to ext2_xattr_entry_valid() ext2: code cleanup for ext2_preread_inode() ext2: code cleanup by using test_opt() and clear_opt() doc: ext2: update description of quota options for ext2 ext2: Strengthen xattr block checks ext2: Merge loops in ext2_xattr_set() ext2: introduce helper for xattr entry validation ext2: introduce helper for xattr header validation quota: add dqi_dirty_list description to comment of Dquot List Management commit 4ddeaae8903d703201e493e2d19dc9ac9acf2c76 Author: Mike Christie Date: Wed May 29 15:16:06 2019 -0500 nbd: add netlink reconfigure resize support If the device is setup with ioctl we can resize the device after the initial setup, but if the device is setup with netlink we cannot use the resize related ioctls and there is no netlink reconfigure size ATTR handling code. This patch adds netlink reconfigure resize support to match the ioctl interface. Reviewed-by: Josef Bacik Signed-off-by: Mike Christie Signed-off-by: Jens Axboe commit 553768d1169a48c0cd87c4eb4ab57534ee663415 Author: Xiubo Li Date: Wed May 29 15:16:05 2019 -0500 nbd: fix crash when the blksize is zero This will allow the blksize to be set zero and then use 1024 as default. Reviewed-by: Josef Bacik Signed-off-by: Xiubo Li [fix to use goto out instead of return in genl_connect] Signed-off-by: Mike Christie Signed-off-by: Jens Axboe commit e6983afd9254c559acf67dd5f62df824d19851eb Merge: 988052f47adc 7377f5bec133 Author: Linus Torvalds Date: Wed Jul 10 20:09:17 2019 -0700 Merge tag 'fsnotify_for_v5.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs Pull fsnotify updates from Jan Kara: "This contains cleanups of the fsnotify name removal hook and also a patch to disable fanotify permission events for 'proc' filesystem" * tag 'fsnotify_for_v5.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs: fsnotify: get rid of fsnotify_nameremove() fsnotify: move fsnotify_nameremove() hook out of d_delete() configfs: call fsnotify_rmdir() hook debugfs: call fsnotify_{unlink,rmdir}() hooks debugfs: simplify __debugfs_remove_file() devpts: call fsnotify_unlink() hook tracefs: call fsnotify_{unlink,rmdir}() hooks rpc_pipefs: call fsnotify_{unlink,rmdir}() hooks btrfs: call fsnotify_rmdir() hook fsnotify: add empty fsnotify_{unlink,rmdir}() hooks fanotify: Disallow permission events for proc filesystem commit 988052f47adc5c3b0b004180b59bb3761d91b752 Merge: 028db3e290f1 387e3746d01c Author: Linus Torvalds Date: Wed Jul 10 19:21:38 2019 -0700 Merge tag 'locks-v5.3-1' of git://git.kernel.org/pub/scm/linux/kernel/git/jlayton/linux Pull file locking updates from Jeff Layton: "Just a couple of small lease-related patches this cycle. One from Ira to add a new tracepoint that fires during lease conflict checks, and another patch from Amir to reduce false positives when checking for lease conflicts" * tag 'locks-v5.3-1' of git://git.kernel.org/pub/scm/linux/kernel/git/jlayton/linux: locks: eliminate false positive conflicts for write lease locks: Add trace_leases_conflict commit 2d008835ec2fcf6eef3285e41e62a5eabd1fe76b Author: Chao Yu Date: Thu Jul 11 09:29:15 2019 +0800 f2fs: improve print log in f2fs_sanity_check_ckpt() As Park Ju Hyung suggested: "I'd like to suggest to write down an actual version of f2fs-tools here as we've seen older versions of fsck doing even more damage and the users might not have the latest f2fs-tools installed." This patch give a more detailed info of how we fix such corruption to user to avoid damageable repair with low version fsck. Signed-off-by: Park Ju Hyung Signed-off-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 028db3e290f15ac509084c0fc3b9d021f668f877 Author: Linus Torvalds Date: Wed Jul 10 18:43:43 2019 -0700 Revert "Merge tag 'keys-acl-20190703' of git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs" This reverts merge 0f75ef6a9cff49ff612f7ce0578bced9d0b38325 (and thus effectively commits 7a1ade847596 ("keys: Provide KEYCTL_GRANT_PERMISSION") 2e12256b9a76 ("keys: Replace uid/gid/perm permissions checking with an ACL") that the merge brought in). It turns out that it breaks booting with an encrypted volume, and Eric biggers reports that it also breaks the fscrypt tests [1] and loading of in-kernel X.509 certificates [2]. The root cause of all the breakage is likely the same, but David Howells is off email so rather than try to work it out it's getting reverted in order to not impact the rest of the merge window. [1] https://lore.kernel.org/lkml/20190710011559.GA7973@sol.localdomain/ [2] https://lore.kernel.org/lkml/20190710013225.GB7973@sol.localdomain/ Link: https://lore.kernel.org/lkml/CAHk-=wjxoeMJfeBahnWH=9zShKp2bsVy527vo3_y8HfOdhwAAw@mail.gmail.com/ Reported-by: Eric Biggers Cc: David Howells Cc: James Morris Signed-off-by: Linus Torvalds commit 56f3ce675103e3fb9e631cfb4131fc768bc23e9a Author: Ocean Chen Date: Mon Jul 8 12:34:56 2019 +0800 f2fs: avoid out-of-range memory access blkoff_off might over 512 due to fs corrupt or security vulnerability. That should be checked before being using. Use ENTRIES_IN_SUM to protect invalid value in cur_data_blkoff. Signed-off-by: Ocean Chen Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 6e0cd4a9dd4df1a0afcb454f1e654b5c80685913 Author: Heng Xiao Date: Wed Jul 3 10:29:57 2019 +0800 f2fs: fix to avoid long latency during umount In umount, we give an constand time to handle pending discard, previously, in __issue_discard_cmd() we missed to check timeout condition in loop, result in delaying long time, fix it. Signed-off-by: Heng Xiao [Chao Yu: add commit message] Signed-off-by: Chao Yu Signed-off-by: Jaegeuk Kim commit b13bdf03bb8007279bb0efdf127bafb2d84e8b0a Author: Jaegeuk Kim Date: Thu Jul 4 23:03:08 2019 -0700 f2fs: allow all the users to pin a file This patch allows users to pin files. Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit df070afd9b8c952eacf49db54cae7138eb9deaeb Author: Ronnie Sahlberg Date: Tue Jul 9 18:41:11 2019 +1000 cifs: fix parsing of symbolic link error response RHBZ: 1672539 In smb2_query_symlink(), if we are parsing the error buffer but it is not something we recognize as a symlink we should return -EINVAL and not -ENOENT. I.e. the entry does exist, it is just not something we recognize. Additionally, add check to verify that that the errortag and the reparsetag all make sense. Signed-off-by: Ronnie Sahlberg Acked-by: Paulo Alcantara Signed-off-by: Steve French commit b49773e7bcf316f238f6709ad9e1999dcc3ed433 Author: Damien Le Moal Date: Thu Jul 11 01:18:31 2019 +0900 block: Disable write plugging for zoned block devices Simultaneously writing to a sequential zone of a zoned block device from multiple contexts requires mutual exclusion for BIO issuing to ensure that writes happen sequentially. However, even for a well behaved user correctly implementing such synchronization, BIO plugging may interfere and result in BIOs from the different contextx to be reordered if plugging is done outside of the mutual exclusion section, e.g. the plug was started by a function higher in the call chain than the function issuing BIOs. Context A Context B | blk_start_plug() | ... | seq_write_zone() | mutex_lock(zone) | bio-0->bi_iter.bi_sector = zone->wp | zone->wp += bio_sectors(bio-0) | submit_bio(bio-0) | bio-1->bi_iter.bi_sector = zone->wp | zone->wp += bio_sectors(bio-1) | submit_bio(bio-1) | mutex_unlock(zone) | return | -----------------------> | seq_write_zone() | mutex_lock(zone) | bio-2->bi_iter.bi_sector = zone->wp | zone->wp += bio_sectors(bio-2) | submit_bio(bio-2) | mutex_unlock(zone) | <------------------------- | | blk_finish_plug() In the above example, despite the mutex synchronization ensuring the correct BIO issuing order 0, 1, 2, context A BIOs 0 and 1 end up being issued after BIO 2 of context B, when the plug is released with blk_finish_plug(). While this problem can be addressed using the blk_flush_plug_list() function (in the above example, the call must be inserted before the zone mutex lock is released), a simple generic solution in the block layer avoid this additional code in all zoned block device user code. The simple generic solution implemented with this patch is to introduce the internal helper function blk_mq_plug() to access the current context plug on BIO submission. This helper returns the current plug only if the target device is not a zoned block device or if the BIO to be plugged is not a write operation. Otherwise, the caller context plug is ignored and NULL returned, resulting is all writes to zoned block device to never be plugged. Signed-off-by: Damien Le Moal Signed-off-by: Jens Axboe commit 9305d5d721f2bd5e2eeb670035159b560ca211ca Author: Damien Le Moal Date: Thu Jul 11 00:57:41 2019 +0900 block: Fix elevator name declaration The elevator_name field in struct elevator_type is declared as an array of characters (ELV_NAME_MAX size) but in practice used as a string pointer with its initialization done statically within each elevator elevator_type structure declaration. Change the declaration of elevator_name to the more appropriate "const char *" type. Acked-by: Marcos Paulo de Souza Signed-off-by: Damien Le Moal Signed-off-by: Jens Axboe commit 36847a005489cfb74dc6388952da73346f867dca Author: Damien Le Moal Date: Thu Jul 11 00:56:08 2019 +0900 block: Remove unused definitions The ELV_MQUEUE_XXX definitions in include/linux/elevator.h are unused since the removal of elevator_may_queue_fn in kernel 5.0. Remove these definitions and also remove the documentation of elevator_may_queue_fn in Documentiation/block/biodoc.txt. Acked-by: Marcos Paulo de Souza Signed-off-by: Damien Le Moal Signed-off-by: Jens Axboe commit 7652ac92018536eb807b6c2130100c85f1ba7e3b Author: Thomas Gleixner Date: Wed Jul 10 21:42:46 2019 +0200 x86/asm: Move native_write_cr0/4() out of line The pinning of sensitive CR0 and CR4 bits caused a boot crash when loading the kvm_intel module on a kernel compiled with CONFIG_PARAVIRT=n. The reason is that the static key which controls the pinning is marked RO after init. The kvm_intel module contains a CR4 write which requires to update the static key entry list. That obviously does not work when the key is in a RO section. With CONFIG_PARAVIRT enabled this does not happen because the CR4 write uses the paravirt indirection and the actual write function is built in. As the key is intended to be immutable after init, move native_write_cr0/4() out of line. While at it consolidate the update of the cr4 shadow variable and store the value right away when the pinning is initialized on a booting CPU. No point in reading it back 20 instructions later. This allows to confine the static key and the pinning variable to cpu/common and allows to mark them static. Fixes: 8dbec27a242c ("x86/asm: Pin sensitive CR0 bits") Fixes: 873d50d58f67 ("x86/asm: Pin sensitive CR4 bits") Reported-by: Linus Torvalds Reported-by: Xi Ruoyao Signed-off-by: Thomas Gleixner Tested-by: Xi Ruoyao Acked-by: Kees Cook Acked-by: Peter Zijlstra (Intel) Link: https://lkml.kernel.org/r/alpine.DEB.2.21.1907102140340.1758@nanos.tec.linutronix.de commit 0df1c9868c3a1916198ee09c323ca5932a0b8a11 Author: Arnd Bergmann Date: Wed Jul 10 15:01:53 2019 +0200 timekeeping/vsyscall: Use __iter_div_u64_rem() On 32-bit x86 when building with clang-9, the 'division' loop gets turned back into an inefficient division that causes a link error: kernel/time/vsyscall.o: In function `update_vsyscall': vsyscall.c:(.text+0xe3): undefined reference to `__udivdi3' Use the existing __iter_div_u64_rem() function which is used to address the same issue in other places. Fixes: 44f57d788e7d ("timekeeping: Provide a generic update_vsyscall() implementation") Signed-off-by: Arnd Bergmann Signed-off-by: Thomas Gleixner Reviewed-by: Nathan Chancellor Tested-by: Nathan Chancellor Link: https://lkml.kernel.org/r/20190710130206.1670830-1-arnd@arndb.de commit 775a41e281cf08b1d9e0f2dd89c062430b289a10 Author: Nathan Chancellor Date: Wed Jul 10 10:48:00 2019 -0700 rdma/siw: Use proper enumerated type in map_cqe_status clang warns several times: drivers/infiniband/sw/siw/siw_cq.c:31:4: warning: implicit conversion from enumeration type 'enum siw_wc_status' to different enumeration type 'enum siw_opcode' [-Wenum-conversion] { SIW_WC_SUCCESS, IB_WC_SUCCESS }, ~ ^~~~~~~~~~~~~~ Fixes: b0fff7317bb4 ("rdma/siw: completion queue methods") Link: https://github.com/ClangBuiltLinux/linux/issues/596 Signed-off-by: Nathan Chancellor Reviewed-by: Jason Gunthorpe Signed-off-by: Jason Gunthorpe commit 85de5d53366f02dd0f81c9be8f435b27fb82b1f7 Author: Bernard Metzler Date: Wed Jul 10 08:38:00 2019 +0000 RDMA/siw: Remove unnecessary kthread create/destroy printouts There is already a warning if we cannot start any thread, and stopping those threads is not worth spamming the console. This also corrects a warning from gcc: drivers/infiniband/sw/siw/siw_main.c: In function 'siw_create_tx_threads': drivers/infiniband/sw/siw/siw_main.c:91:11: warning: variable 'rv' set but not used [-Wunused-but-set-variable] Reported-by: Hulk Robot Signed-off-by: YueHaibing Signed-off-by: Bernard Metzler Signed-off-by: Jason Gunthorpe commit 488ca3d8d088ec4658c87aaec6a91e98acccdd54 Author: Christoph Hellwig Date: Tue Jul 9 08:58:28 2019 -0700 xfs: chain bios the right way around in xfs_rw_bdev We need to chain the earlier bios to the later ones, so that submit_bio_wait waits on the bio that all the completions are dispatched to. Fixes: 6ad5b3255b9e ("xfs: use bios directly to read and write the log recovery buffers") Reported-by: Dave Chinner Tested-by: Dave Chinner Signed-off-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Darrick J. Wong commit 4d2b8517ba1f3aba9a952ebf153ec972a127c80c Author: Nathan Chancellor Date: Tue Jul 9 16:05:53 2019 -0700 IB/rdmavt: Fix variable shadowing issue in rvt_create_cq clang warns: drivers/infiniband/sw/rdmavt/cq.c:260:7: warning: variable 'err' is used uninitialized whenever 'if' condition is true [-Wsometimes-uninitialized] if (err) ^~~ drivers/infiniband/sw/rdmavt/cq.c:310:9: note: uninitialized use occurs here return err; ^~~ drivers/infiniband/sw/rdmavt/cq.c:260:3: note: remove the 'if' if its condition is always false if (err) ^~~~~~~~ drivers/infiniband/sw/rdmavt/cq.c:253:7: warning: variable 'err' is used uninitialized whenever 'if' condition is true [-Wsometimes-uninitialized] if (!cq->ip) { ^~~~~~~ drivers/infiniband/sw/rdmavt/cq.c:310:9: note: uninitialized use occurs here return err; ^~~ drivers/infiniband/sw/rdmavt/cq.c:253:3: note: remove the 'if' if its condition is always false if (!cq->ip) { ^~~~~~~~~~~~~~ drivers/infiniband/sw/rdmavt/cq.c:211:9: note: initialize the variable 'err' to silence this warning int err; ^ = 0 2 warnings generated. The function scoped err variable is uninitialized when the flow jumps into the if statement. The if scoped err variable shadows the function scoped err variable, preventing the err assignments within the if statement to be reflected at the function level, which will cause uninitialized use when the goto statements are taken. Just remove the if scoped err declaration so that there is only one copy of the err variable for this function. Fixes: 239b0e52d8aa ("IB/hfi1: Move rvt_cq_wc struct into uapi directory") Link: https://github.com/ClangBuiltLinux/linux/issues/594 Reviewed-by: Nick Desaulniers Signed-off-by: Nathan Chancellor Acked-by: Mike Marciniszyn Signed-off-by: Jason Gunthorpe commit 420dc733f980246f2179e0144f9cedab9ad4a91e Author: Sagi Grimberg Date: Wed Jul 10 09:31:31 2019 -0700 nvme: fix regression upon hot device removal and insertion When we validate the new controller id, we want to skip controllers that are either deleting or dead. Fix the check to do that and not on the newly added controller. Fixes: 1b1031ca63b2 ("nvme: validate cntlid during controller initialisation") Reported-by: Jon Derrick Tested-by: Jon Derrick Signed-off-by: Sagi Grimberg Signed-off-by: Christoph Hellwig commit 56789f3dc127d4f8c07ce2bb48629ba75e8ef16c Author: Adrian Hunter Date: Wed Jul 10 11:58:10 2019 +0300 perf scripts python: export-to-postgresql.py: Export switch events Export switch events to a new table 'context_switches' and create a view 'context_switches_view'. The table and view will show automatically in the exported-sql-viewer.py script. If the table ends up empty, then it and the view are dropped. Signed-off-by: Adrian Hunter Cc: Jiri Olsa Link: http://lkml.kernel.org/r/20190710085810.1650-22-adrian.hunter@intel.com Signed-off-by: Arnaldo Carvalho de Melo commit 37c1f991b1bcdbe268b99b22e265738f4209f4f4 Author: Adrian Hunter Date: Wed Jul 10 11:58:09 2019 +0300 perf scripts python: export-to-sqlite.py: Export switch events Export switch events to a new table 'context_switches' and create a view 'context_switches_view'. The table and view will show automatically in the exported-sql-viewer.py script. If the table ends up empty, then it and the view are dropped. Committer testing: Use the exported-sql-viewer.py and look at "Tables" -> "context_switches": id machine_id time cpu thread_out_id comm_out_id thread_in_id comm_in_id flags 1 1 187836111885918 7 1 1 2 2 3 2 1 187836111889369 7 1 1 2 2 0 3 1 187836112464618 7 2 3 1 1 1 4 1 187836112465511 7 2 3 1 1 0 Signed-off-by: Adrian Hunter Tested-by: Arnaldo Carvalho de Melo Cc: Jiri Olsa Link: http://lkml.kernel.org/r/20190710085810.1650-21-adrian.hunter@intel.com Signed-off-by: Arnaldo Carvalho de Melo commit abde8722d9b0a317935506d9824e26f1aef6c24a Author: Adrian Hunter Date: Wed Jul 10 11:58:08 2019 +0300 perf db-export: Export switch events Export details of switch events including the threads and their current comms. Signed-off-by: Adrian Hunter Cc: Jiri Olsa Link: http://lkml.kernel.org/r/20190710085810.1650-20-adrian.hunter@intel.com Signed-off-by: Arnaldo Carvalho de Melo commit b3694e6c0a05383891546c6e3cdef8659d50b653 Author: Adrian Hunter Date: Wed Jul 10 11:58:07 2019 +0300 perf db-export: Factor out db_export__threads() In preparation for exporting switch events, factor out db_export__threads(). Signed-off-by: Adrian Hunter Cc: Jiri Olsa Link: http://lkml.kernel.org/r/20190710085810.1650-19-adrian.hunter@intel.com Signed-off-by: Arnaldo Carvalho de Melo commit 5bf83c29a0ad2e78683c318b607539dbadbf7a3b Author: Adrian Hunter Date: Wed Jul 10 11:58:06 2019 +0300 perf script: Add scripting operation process_switch() Add scripting operation process_switch() to process switch events. Signed-off-by: Adrian Hunter Cc: Jiri Olsa Link: http://lkml.kernel.org/r/20190710085810.1650-18-adrian.hunter@intel.com Signed-off-by: Arnaldo Carvalho de Melo commit c152f8491a8d9a4b25afd65a86eb5e55e2a8c380 Author: Wen Yang Date: Wed Jul 10 15:25:09 2019 +0800 ASoC: audio-graph-card: fix an use-after-free in graph_get_dai_id() After calling of_node_put() on the node variable, it is still being used, which may result in use-after-free. Fix this issue by calling of_node_put() after the last usage. Fixes: a0c426fe1433 ("ASoC: simple-card-utils: check "reg" property on asoc_simple_card_get_dai_id()") Link: https://lore.kernel.org/r/1562743509-30496-5-git-send-email-wen.yang99@zte.com.cn Signed-off-by: Wen Yang Acked-by: Kuninori Morimoto Signed-off-by: Mark Brown commit aa2e362cb6b3f5ca88093ada01e1a0ace8a517b2 Author: Wen Yang Date: Wed Jul 10 15:25:08 2019 +0800 ASoC: audio-graph-card: fix use-after-free in graph_dai_link_of_dpcm() After calling of_node_put() on the ports, port, and node variables, they are still being used, which may result in use-after-free. Fix this issue by calling of_node_put() after the last usage. Fixes: dd98fbc558a0 ("ASoC: audio-graph-card: cleanup DAI link loop method - step1") Link: https://lore.kernel.org/r/1562743509-30496-4-git-send-email-wen.yang99@zte.com.cn Signed-off-by: Wen Yang Acked-by: Kuninori Morimoto Signed-off-by: Mark Brown commit 27862d5a3325bc531ec15e3c607e44aa0fd57f6f Author: Wen Yang Date: Wed Jul 10 15:25:07 2019 +0800 ASoC: simple-card: fix an use-after-free in simple_for_each_link() The codec variable is still being used after the of_node_put() call, which may result in use-after-free. Fixes: d947cdfd4be2 ("ASoC: simple-card: cleanup DAI link loop method - step1") Link: https://lore.kernel.org/r/1562743509-30496-3-git-send-email-wen.yang99@zte.com.cn Signed-off-by: Wen Yang Acked-by: Kuninori Morimoto Signed-off-by: Mark Brown commit 724808ad556c15e9473418d082f8aae81dd267f6 Author: Wen Yang Date: Wed Jul 10 15:25:06 2019 +0800 ASoC: simple-card: fix an use-after-free in simple_dai_link_of_dpcm() The node variable is still being used after the of_node_put() call, which may result in use-after-free. Fixes: cfc652a73331 ("ASoC: simple-card: tidyup prefix for snd_soc_codec_conf") Link: https://lore.kernel.org/r/1562743509-30496-2-git-send-email-wen.yang99@zte.com.cn Signed-off-by: Wen Yang Acked-by: Kuninori Morimoto Signed-off-by: Mark Brown commit d6b197a14863818a7ed7890e91f043fab49e8c60 Author: Han Xu Date: Wed Jul 10 10:31:27 2019 +0800 spi: spi-fsl-qspi: change i.MX7D RX FIFO size The RX FIFO should be 128 byte rather than 512 byte. It's a typo on reference manual. Signed-off-by: Han Xu Link: https://lore.kernel.org/r/20190710023128.13115-3-han.xu@nxp.com Signed-off-by: Mark Brown commit 43167bb1f6bb7efa73adc40d2dd700bb6546cc2c Author: Rob Herring Date: Tue Jul 9 13:26:31 2019 -0600 spi: dt-bindings: spi-controller: remove unnecessary 'maxItems: 1' from reg Mixing array constraints like 'maxItems' and string or integer value constraints like 'minimum' don't make sense. Also, with only value constraints, it is implied we have a single value. So lets remove 'maxItems: 1'. Cc: Mark Brown Cc: linux-spi@vger.kernel.org Signed-off-by: Rob Herring Link: https://lore.kernel.org/r/20190709192631.16394-1-robh@kernel.org Signed-off-by: Mark Brown commit 26c11206f433ea507a7541f48cb472b85870577e Author: Adrian Hunter Date: Wed Jul 10 11:58:05 2019 +0300 perf scripts python: exported-sql-viewer.py: Use new 'has_calls' column If the new 'has_calls' column is present, use it with the call graph and call tree to select only comms that have calls. Committer testing: Just started the exported-sql-view.py and accessed all the reports, no backtraces. Signed-off-by: Adrian Hunter Tested-by: Arnaldo Carvalho de Melo Cc: Jiri Olsa Link: http://lkml.kernel.org/r/20190710085810.1650-17-adrian.hunter@intel.com Signed-off-by: Arnaldo Carvalho de Melo commit 266887291cac7f4020b5c83d2af9a13aece44a74 Author: Adrian Hunter Date: Wed Jul 10 11:58:04 2019 +0300 perf scripts python: exported-sql-viewer.py: Remove redundant semi-colons Remove redundant semi-colons added inadvertently. Signed-off-by: Adrian Hunter Cc: Jiri Olsa Link: http://lkml.kernel.org/r/20190710085810.1650-16-adrian.hunter@intel.com Signed-off-by: Arnaldo Carvalho de Melo commit 794fcee8da3c0c8a01b08ecad1c181cb0a622868 Author: Kuninori Morimoto Date: Wed Jul 10 17:01:12 2019 +0900 ASoC: simple-card-utils: care no Platform for DPCM commit 34614739988ad ("ASoC: soc-core: support dai_link with platforms_num != 1") supports multi Platform, and commit 9f3eb91753451 ("ASoC: simple-card-utils: consider CPU-Platform possibility") removed no Platform from simple-card. Multi Platform is now checking both Platform name/of_node are NULL case. But in normal case, DPCM be doesn't have Platform. asoc_simple_canonicalize_platform() try to use CPU of_node to Platform (This is needed for DMAEngine platform case), but it still might be NULL at DPCM be. This patch try to use no Platform after that if Platform of_node is still NULL. It can't probe without this patch. Signed-off-by: Kuninori Morimoto Link: https://lore.kernel.org/r/87muhmgw2o.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 52db6685932e326ed607644ab7ebdae8c194adda Author: Kuninori Morimoto Date: Wed Jul 10 16:59:55 2019 +0900 ASoC: simple_card_utils.h: care NULL dai at asoc_simple_debug_dai() props->xxx_dai might be NULL when DPCM. This patch cares it for debug. Fixes: commit 0580dde59438 ("ASoC: simple-card-utils: add asoc_simple_debug_info()") Signed-off-by: Kuninori Morimoto Link: https://lore.kernel.org/r/87o922gw4u.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 9e944c9be2456159fb8c36b0ba3170b2f01c3887 Author: Kirill Marinushkin Date: Wed Jul 10 07:51:35 2019 +0200 ASoC: Relocate my e-mail to .com domain zone Signed-off-by: Kirill Marinushkin Link: https://lore.kernel.org/r/20190710055135.21377-1-kmarinushkin@birdec.com Signed-off-by: Mark Brown commit d9efc1d25214da500d6592095b542b32c15459df Author: Adrian Hunter Date: Wed Jul 10 11:58:03 2019 +0300 perf scripts python: export-to-postgresql.py: Add has_calls column to comms table Now that a thread's current comm is exported, it shows up in the call graph and call tree even if it has no calls. That can happen because the calls are recorded against the main thread's initial comm. Add a table column to make it easy for the exported-sql-viewer.py script to select only comms with calls. Committer testing: $ rm -f simple-retpoline.db $ sudo ~acme/bin/perf script -i simple-retpoline.perf.data --itrace=be -s ~/libexec/perf-core/scripts/python/export-to-sqlite.py simple-retpoline.db branches calls 2019-07-10 12:25:33.200529 Creating database ... 2019-07-10 12:25:33.211548 Writing records... 2019-07-10 12:25:33.549630 Adding indexes 2019-07-10 12:25:33.560715 Dropping unused tables 2019-07-10 12:25:33.580201 Done $ sha256sum tools/perf/scripts/python/export-to-sqlite.py ~/libexec/perf-core/scripts/python/export-to-sqlite.py 2922b642c392004dffa1d8789296478c85904623f5895bcb9b6cbf33e3ca999f tools/perf/scripts/python/export-to-sqlite.py 2922b642c392004dffa1d8789296478c85904623f5895bcb9b6cbf33e3ca999f /home/acme/libexec/perf-core/scripts/python/export-to-sqlite.py $ $ sqlite3 simple-retpoline.db SQLite version 3.26.0 2018-12-01 12:34:55 Enter ".help" for usage hints. sqlite> .schema comms CREATE TABLE comms (id integer NOT NULL PRIMARY KEY,comm varchar(16),c_thread_id bigint,c_time bigint,exec_flag boolean, has_calls boolean); sqlite> select id,has_calls from comms; 0|1 1|1 sqlite> select distinct comm_id from calls; 0 1 sqlite> Signed-off-by: Adrian Hunter Tested-by: Arnaldo Carvalho de Melo Cc: Jiri Olsa Link: http://lkml.kernel.org/r/20190710085810.1650-15-adrian.hunter@intel.com Signed-off-by: Arnaldo Carvalho de Melo commit 72365164cbefe3afa7a146d27d502ed688bf7323 Author: Joe Perches Date: Tue Jul 9 10:22:16 2019 -0700 ASoC: rt1308: Remove executable attribute from source files These are source files not executable. Signed-off-by: Joe Perches Link: https://lore.kernel.org/r/d198a3e6ed3a0e9070afeb6aca69903c3e985149.camel@perches.com Signed-off-by: Mark Brown commit 6cd249cfad68a231336983e2216d75b3ddfde1d6 Author: Tzung-Bi Shih Date: Mon Jul 8 22:19:01 2019 +0800 ASoC: max98357a: use mdelay for sdmode-delay max98357a_daiops_trigger() is possible to be called in atomic context if the .nonatomic flag is equal to 0 in the DAI links. When cancel_delayed_work_sync() in max98357a_daiops_trigger() is called in atomic context, kernel emits the following message: "BUG: sleeping function called from invalid context". According to the DT binding document, value less than or equal to 5ms of sdmod-delay should be sufficient to avoid the pop noise. Use mdelay (i.e. busy loop) for such low delay should be acceptable. Fixes: cec5b01f8f1c ("ASoC: max98357a: avoid speaker pop when playback startup") Signed-off-by: Tzung-Bi Shih Link: https://lore.kernel.org/r/20190708141901.68797-1-tzungbi@google.com Signed-off-by: Mark Brown commit ecc8c9984dae9812a10936cb9c74957b68075e07 Author: Adrian Hunter Date: Wed Jul 10 11:58:02 2019 +0300 perf scripts python: export-to-sqlite.py: Add has_calls column to comms table Now that a thread's current comm is exported, it shows up in the call graph and call tree even if it has no calls. That can happen because the calls are recorded against the main thread's initial comm. Add a table column to make it easy for the exported-sql-viewer.py script to select only comms with calls. Committer notes: Running the export-to-sqlite.py worked without warnings and using the exported-sql-viewer.py worked as before. Signed-off-by: Adrian Hunter Tested-by: Arnaldo Carvalho de Melo Cc: Jiri Olsa Link: http://lkml.kernel.org/r/20190710085810.1650-14-adrian.hunter@intel.com Signed-off-by: Arnaldo Carvalho de Melo commit 26515699863d68058e290e18e83f444925920be5 Author: Arnd Bergmann Date: Wed Jul 10 15:04:55 2019 +0200 x86/pgtable/32: Fix LOWMEM_PAGES constant clang points out that the computation of LOWMEM_PAGES causes a signed integer overflow on 32-bit x86: arch/x86/kernel/head32.c:83:20: error: signed shift result (0x100000000) requires 34 bits to represent, but 'int' only has 32 bits [-Werror,-Wshift-overflow] (PAGE_TABLE_SIZE(LOWMEM_PAGES) << PAGE_SHIFT); ^~~~~~~~~~~~ arch/x86/include/asm/pgtable_32.h:109:27: note: expanded from macro 'LOWMEM_PAGES' #define LOWMEM_PAGES ((((2<<31) - __PAGE_OFFSET) >> PAGE_SHIFT)) ~^ ~~ arch/x86/include/asm/pgtable_32.h:98:34: note: expanded from macro 'PAGE_TABLE_SIZE' #define PAGE_TABLE_SIZE(pages) ((pages) / PTRS_PER_PGD) Use the _ULL() macro to make it a 64-bit constant. Fixes: 1e620f9b23e5 ("x86/boot/32: Convert the 32-bit pgtable setup code from assembly to C") Signed-off-by: Arnd Bergmann Signed-off-by: Thomas Gleixner Link: https://lkml.kernel.org/r/20190710130522.1802800-1-arnd@arndb.de commit 4650c7bed79582c74452d284e45d5b76987c0ef3 Author: Adrian Hunter Date: Wed Jul 10 11:58:01 2019 +0300 perf db-export: Also export thread's current comm Currently, the initial comm of the main thread is exported. Export also a thread's current comm. That better supports the tracing of multi-threaded applications that set different comms for different threads to make it easier to distinguish them. Signed-off-by: Adrian Hunter Cc: Jiri Olsa Link: http://lkml.kernel.org/r/20190710085810.1650-13-adrian.hunter@intel.com Signed-off-by: Arnaldo Carvalho de Melo commit 80859c947a1eb170927d03e713abf7550a3d8766 Author: Adrian Hunter Date: Wed Jul 10 11:58:00 2019 +0300 perf db-export: Factor out db_export__comm() In preparation for exporting the current comm for a thread, factor out db_export__comm(). Signed-off-by: Adrian Hunter Cc: Jiri Olsa Link: http://lkml.kernel.org/r/20190710085810.1650-12-adrian.hunter@intel.com Signed-off-by: Arnaldo Carvalho de Melo commit 8534b5de81802a82b13fe05acc3e749e3baf980e Author: Adrian Hunter Date: Wed Jul 10 11:57:59 2019 +0300 perf scripts python: export-to-postgresql.py: Export comm details Add table columns for thread id, comm start time and exec flag. Signed-off-by: Adrian Hunter Cc: Jiri Olsa Link: http://lkml.kernel.org/r/20190710085810.1650-11-adrian.hunter@intel.com Signed-off-by: Arnaldo Carvalho de Melo commit 41085f2bdd5882632e7dd88d1e5b59b7eac2a2a9 Author: Adrian Hunter Date: Wed Jul 10 11:57:58 2019 +0300 perf scripts python: export-to-sqlite.py: Export comm details Add table columns for thread id, comm start time and exec flag. Signed-off-by: Adrian Hunter Cc: Jiri Olsa Link: http://lkml.kernel.org/r/20190710085810.1650-10-adrian.hunter@intel.com Signed-off-by: Arnaldo Carvalho de Melo commit 8ebf5cc0f6ce469d65ba2e8ce519dae34f0b3f50 Author: Adrian Hunter Date: Wed Jul 10 11:57:57 2019 +0300 perf db-export: Export comm details In preparation for exporting the current comm for a thread, export comm thread id, start time and exec flag. Signed-off-by: Adrian Hunter Cc: Jiri Olsa Link: http://lkml.kernel.org/r/20190710085810.1650-9-adrian.hunter@intel.com Signed-off-by: Arnaldo Carvalho de Melo commit a5defb2f3984e0f056e4113b54c461782796c7be Author: Adrian Hunter Date: Wed Jul 10 11:57:56 2019 +0300 perf db-export: Fix a white space issue in db_export__sample() Fix a white space issue in db_export__sample() Signed-off-by: Adrian Hunter Cc: Jiri Olsa Link: http://lkml.kernel.org/r/20190710085810.1650-8-adrian.hunter@intel.com Signed-off-by: Arnaldo Carvalho de Melo commit 1ed119589834e25c130fdaa911ca8b0e3fd1cddf Author: Adrian Hunter Date: Wed Jul 10 11:57:55 2019 +0300 perf db-export: Move export__comm_thread into db_export__sample() Move call to db_export__comm_thread() from db_export__thread() into db_export__sample() because it makes the code easier to understand, and add explanatory comments. Signed-off-by: Adrian Hunter Cc: Jiri Olsa Link: http://lkml.kernel.org/r/20190710085810.1650-7-adrian.hunter@intel.com Signed-off-by: Arnaldo Carvalho de Melo commit 6319790bcf825bcc4cd9bf01f01ae404a2fb7da8 Author: Adrian Hunter Date: Wed Jul 10 11:57:54 2019 +0300 perf db-export: Export comm before exporting thread Export comm before exporting the non-main thread because db_export__thread() also exports the comm_thread. Signed-off-by: Adrian Hunter Cc: Jiri Olsa Link: http://lkml.kernel.org/r/20190710085810.1650-6-adrian.hunter@intel.com Signed-off-by: Arnaldo Carvalho de Melo commit 19207d86940db9dad5f2e0a270a2490f7da451e3 Author: Adrian Hunter Date: Wed Jul 10 11:57:53 2019 +0300 perf db-export: Export main_thread in db_export__sample() Export main_thread in db_export__sample() because it makes the code easier to understand, and prepares db_export__thread() for further simplification. Signed-off-by: Adrian Hunter Cc: Jiri Olsa Link: http://lkml.kernel.org/r/20190710085810.1650-5-adrian.hunter@intel.com Signed-off-by: Arnaldo Carvalho de Melo commit ed5c0a16feb9f1a4347f109d5e9607f6f38688a0 Author: Adrian Hunter Date: Wed Jul 10 11:57:52 2019 +0300 perf db-export: Pass main_thread to db_export__thread() Calls to db_export__thread() already have main_thread so there is no reason to get it again, instead pass it as a parameter. Note that one difference in this approach is that the main thread is not created if it does not exist. It is better if it is not created because: - If main_thread is being traced it will have been created already. - If it is not being traced, there will be no other information about it, and it will never get deleted because there will be no EXIT event. Signed-off-by: Adrian Hunter Cc: Jiri Olsa Link: http://lkml.kernel.org/r/20190710085810.1650-4-adrian.hunter@intel.com Signed-off-by: Arnaldo Carvalho de Melo commit 208032fef13b68cf1eefc945dafb82efc88c6b8f Author: Adrian Hunter Date: Wed Jul 10 11:57:51 2019 +0300 perf db-export: Rename db_export__comm() to db_export__exec_comm() Rename db_export__comm() to db_export__exec_comm() to better reflect what it does and add explanatory comments. Signed-off-by: Adrian Hunter Cc: Jiri Olsa Link: http://lkml.kernel.org/r/20190710085810.1650-3-adrian.hunter@intel.com Signed-off-by: Arnaldo Carvalho de Melo commit fead24e52383c3f8eb25b5426d52b430b84a8194 Author: Adrian Hunter Date: Wed Jul 10 11:57:50 2019 +0300 perf db-export: Get rid of db_export__deferred() db_export__deferred() deferred the export of comms if the comm string had not been "set" (changed from :) however that problem was fixed a long time ago by commit e803cf97a4f9 ("perf record: Synthesize COMM event for a command line workload"), so get rid of db_export__deferred(). Signed-off-by: Adrian Hunter Cc: Jiri Olsa Cc: Namhyung Kim Link: http://lkml.kernel.org/r/20190710085810.1650-2-adrian.hunter@intel.com Signed-off-by: Arnaldo Carvalho de Melo commit 3a475b2166fd6aa5ac76e8c605dffdf7a2a457ee Author: Geert Uytterhoeven Date: Tue Jul 9 15:26:39 2019 +0200 kbuild: Inform user to pass ARCH= for make mrproper When cross-compiling an out-of-tree build with an unclean source tree directory, the build fails with: /path/to/kernel/source/tree is not clean, please run 'make mrproper' in the '/path/to/kernel/source/tree' directory. However, doing so does not fix the problem, as "make mrproper" now requires passing the target architecture to the make command, else it won't remove $(srctree)/arch/$(SRCARCH)/include/generated. "git ls-files -o" doesn't give a clue, as it doesn't list (empty) directories, only files. Improve usability by including the ARCH= option in the error output. Fixes: a788b2ed81ab ("kbuild: check arch/$(SRCARCH)/include/generated before out-of-tree build") Signed-off-by: Geert Uytterhoeven Signed-off-by: Masahiro Yamada commit b956c7a6df3aa01f357f8ac5bc3e44bc3ab7befb Author: Harald Seiler Date: Tue Jul 9 12:50:50 2019 +0200 kbuild: fix compression errors getting ignored A missing compression utility or other errors were not picked up by make and an empty kernel image was produced. By removing the &&, errors will no longer be ignored. Signed-off-by: Harald Seiler Signed-off-by: Masahiro Yamada commit 95fd3f87bfbe8edaa5e955e0f858a0a573c09ab6 Author: Masahiro Yamada Date: Sat Jul 6 12:07:13 2019 +0900 kbuild: add a flag to force absolute path for srctree In old days, Kbuild always used an absolute path for $(srctree). Since commit 890676c65d69 ("kbuild: Use relative path when building in the source tree"), $(srctree) is '.' when O= was not passed from the command line. Yet, using absolute paths is useful in some cases even without O=, for instance, to create a cscope file with absolute path tags. 'O=.' was known to work as a workaround to force Kbuild to use absolute paths even when you are building in the source tree. Since commit 25b146c5b8ce ("kbuild: allow Kbuild to start from any directory"), Kbuild is too clever to be tricked. Even if you pass 'O=.' Kbuild notices you are building in the source tree, then use '.' for $(srctree). So, 'make O=. cscope' is no help to create absolute path tags. We cannot force one or the other according to commit e93bc1a0cab3 ("Revert "kbuild: specify absolute paths for cscope""). Both of relative path and absolute path have pros and cons. This commit adds a new flag KBUILD_ABS_SRCTREE to allow users to choose the absolute path for $(srctree). 'make KBUILD_ABS_SRCTREE=1 cscope' will work as a replacement of 'make O=. cscope'. Reported-by: Pawan Gupta Signed-off-by: Masahiro Yamada commit 051f278e9d81bed253bf89c66c80b8b921aafa8a Author: Masahiro Yamada Date: Sat Jul 6 12:07:12 2019 +0900 kbuild: replace KBUILD_SRCTREE with boolean building_out_of_srctree Commit 25b146c5b8ce ("kbuild: allow Kbuild to start from any directory") deprecated KBUILD_SRCTREE. It is only used in tools/testing/selftest/ to distinguish out-of-tree build. Replace it with a new boolean flag, building_out_of_srctree. I also replaced the conditional ($(srctree),.) because the next commit will allow an absolute path to be used for $(srctree) even when building in the source tree. Signed-off-by: Masahiro Yamada commit 75dd47472b92c320304436c9e38638bc04ae7a4a Author: Masahiro Yamada Date: Sat Jul 6 12:07:11 2019 +0900 kbuild: remove src and obj from the top Makefile Replace $(src) and $(obj) with $(srctree) and $(objtree), respectively. Signed-off-by: Masahiro Yamada commit 3a10f999ffd464d01c5a05592a15470a3c4bbc36 Author: Konstantin Khlebnikov Date: Mon Jul 8 18:29:57 2019 +0300 blk-throttle: fix zero wait time for iops throttled group After commit 991f61fe7e1d ("Blk-throttle: reduce tail io latency when iops limit is enforced") wait time could be zero even if group is throttled and cannot issue requests right now. As a result throtl_select_dispatch() turns into busy-loop under irq-safe queue spinlock. Fix is simple: always round up target time to the next throttle slice. Fixes: 991f61fe7e1d ("Blk-throttle: reduce tail io latency when iops limit is enforced") Signed-off-by: Konstantin Khlebnikov Cc: stable@vger.kernel.org # v4.19+ Signed-off-by: Jens Axboe commit 113ab72ed4794c193509a97d7c6d32a6886e1682 Author: Damien Le Moal Date: Wed Jul 10 13:53:10 2019 +0900 block: Fix potential overflow in blk_report_zones() For large values of the number of zones reported and/or large zone sizes, the sector increment calculated with blk_queue_zone_sectors(q) * n in blk_report_zones() loop can overflow the unsigned int type used for the calculation as both "n" and blk_queue_zone_sectors() value are unsigned int. E.g. for a device with 256 MB zones (524288 sectors), overflow happens with 8192 or more zones reported. Changing the return type of blk_queue_zone_sectors() to sector_t, fixes this problem and avoids overflow problem for all other callers of this helper too. The same change is also applied to the bdev_zone_sectors() helper. Fixes: e76239a3748c ("block: add a report_zones method") Cc: stable@vger.kernel.org Signed-off-by: Damien Le Moal Signed-off-by: Jens Axboe commit d3f77dfdc71835f8db71ca57d272b1fbec9dfc18 Author: Tejun Heo Date: Thu Jun 27 13:39:52 2019 -0700 blkcg: implement REQ_CGROUP_PUNT When a shared kthread needs to issue a bio for a cgroup, doing so synchronously can lead to priority inversions as the kthread can be trapped waiting for that cgroup. This patch implements REQ_CGROUP_PUNT flag which makes submit_bio() punt the actual issuing to a dedicated per-blkcg work item to avoid such priority inversions. This will be used to fix priority inversions in btrfs compression and should be generally useful as we grow filesystem support for comprehensive IO control. Cc: Chris Mason Reviewed-by: Josef Bacik Reviewed-by: Jan Kara Signed-off-by: Tejun Heo Signed-off-by: Jens Axboe commit 653c45c6b90c9659facbef10546d1f3a8e37d0cf Author: Tejun Heo Date: Thu Jun 27 13:39:51 2019 -0700 blkcg, writeback: Implement wbc_blkcg_css() Add a helper to determine the target blkcg from wbc. Reviewed-by: Josef Bacik Reviewed-by: Jan Kara Signed-off-by: Tejun Heo Signed-off-by: Jens Axboe commit 27b36d8fa81fa8274fb72f4eb1484026f6b6daa8 Author: Tejun Heo Date: Thu Jun 27 13:39:50 2019 -0700 blkcg, writeback: Add wbc->no_cgroup_owner When writeback IOs are bounced through async layers, the IOs should only be accounted against the wbc from the original bdi writeback to avoid confusing cgroup inode ownership arbitration. Add wbc->no_cgroup_owner to allow disabling wbc cgroup owner accounting. This will be used make btrfs compression work well with cgroup IO control. v2: Renamed from no_wbc_acct to no_cgroup_owner and added comment as per Jan. Reviewed-by: Josef Bacik Reviewed-by: Jan Kara Signed-off-by: Tejun Heo Signed-off-by: Jens Axboe commit 34e51a5e1a6e939ed7d99c38173821ab86d577f4 Author: Tejun Heo Date: Thu Jun 27 13:39:49 2019 -0700 blkcg, writeback: Rename wbc_account_io() to wbc_account_cgroup_owner() wbc_account_io() does a very specific job - try to see which cgroup is actually dirtying an inode and transfer its ownership to the majority dirtier if needed. The name is too generic and confusing. Let's rename it to something more specific. Reviewed-by: Jan Kara Signed-off-by: Tejun Heo Signed-off-by: Jens Axboe commit 9b0eb69b75bccada2d341d7e7ca342f0cb1c9a6a Author: Tejun Heo Date: Thu Jun 27 13:39:48 2019 -0700 cgroup, blkcg: Prepare some symbols for module and !CONFIG_CGROUP usages btrfs is going to use css_put() and wbc helpers to improve cgroup writeback support. Add dummy css_get() definition and export wbc helpers to prepare for module and !CONFIG_CGROUP builds. Reported-by: kbuild test robot Reviewed-by: Jan Kara Signed-off-by: Tejun Heo Signed-off-by: Jens Axboe commit fd112c74652371a023f85d87b70bee7169e8f4d0 Author: Josef Bacik Date: Tue Jul 9 14:41:29 2019 -0700 blk-cgroup: turn on psi memstall stuff With the psi stuff in place we can use the memstall flag to indicate pressure that happens from throttling. Signed-off-by: Josef Bacik Signed-off-by: Tejun Heo Signed-off-by: Jens Axboe commit b554db147feea39617b533ab6bca247c91c6198a Author: Josef Bacik Date: Thu Mar 7 21:37:18 2019 +0000 block: init flush rq ref count to 1 We discovered a problem in newer kernels where a disconnect of a NBD device while the flush request was pending would result in a hang. This is because the blk mq timeout handler does if (!refcount_inc_not_zero(&rq->ref)) return true; to determine if it's ok to run the timeout handler for the request. Flush_rq's don't have a ref count set, so we'd skip running the timeout handler for this request and it would just sit there in limbo forever. Fix this by always setting the refcount of any request going through blk_init_rq() to 1. I tested this with a nbd-server that dropped flush requests to verify that it hung, and then tested with this patch to verify I got the timeout as expected and the error handling kicked in. Thanks, Signed-off-by: Josef Bacik Signed-off-by: Jens Axboe commit cdc238eb72f6b94b6c33b98c07b9fc3ac5e57b18 Author: Yi Wang Date: Wed Jul 10 08:24:03 2019 +0800 kvm: x86: Fix -Wmissing-prototypes warnings We get a warning when build kernel W=1: arch/x86/kvm/../../../virt/kvm/eventfd.c:48:1: warning: no previous prototype for ‘kvm_arch_irqfd_allowed’ [-Wmissing-prototypes] kvm_arch_irqfd_allowed(struct kvm *kvm, struct kvm_irqfd *args) ^ The reason is kvm_arch_irqfd_allowed() is declared in arch/x86/kvm/irq.h, which is not included by eventfd.c. Considering kvm_arch_irqfd_allowed() is a weakly defined function in eventfd.c, remove the declaration to kvm_host.h can fix this. Signed-off-by: Yi Wang Reviewed-by: Sean Christopherson Signed-off-by: Paolo Bonzini commit b614c6027896ff9ad6757122e84760d938cab15e Author: KarimAllah Ahmed Date: Wed Jul 10 11:13:13 2019 +0200 KVM: Properly check if "page" is valid in kvm_vcpu_unmap The field "page" is initialized to KVM_UNMAPPED_PAGE when it is not used (i.e. when the memory lives outside kernel control). So this check will always end up using kunmap even for memremap regions. Fixes: e45adf665a53 ("KVM: Introduce a new guest mapping API") Cc: stable@vger.kernel.org Signed-off-by: KarimAllah Ahmed Signed-off-by: Paolo Bonzini commit 9bdebc2bd1c4abfbf44dc154cc152ec333e004de Author: Al Viro Date: Sat Jun 29 18:31:24 2019 -0400 Teach shrink_dcache_parent() to cope with mixed-filesystem shrink lists Currently, running into a shrink list that contains dentries from different filesystems can cause several unpleasant things for shrink_dcache_parent() and for umount(2). The first problem is that there's a window during shrink_dentry_list() between __dentry_kill() takes a victim out and dropping reference to its parent. During that window the parent looks like a genuine busy dentry. shrink_dcache_parent() (or, worse yet, shrink_dcache_for_umount()) coming at that time will see no eviction candidates and no indication that it needs to wait for some shrink_dentry_list() to proceed further. That applies for any shrink list that might intersect with the subtree we are trying to shrink; the only reason it does not blow on umount(2) in the mainline is that we unregister the memory shrinker before hitting shrink_dcache_for_umount(). Another problem happens if something in a mixed-filesystem shrink list gets be stuck in e.g. iput(), getting umount of unrelated fs to spin waiting for the stuck shrinker to get around to our dentries. Solution: 1) have shrink_dentry_list() decrement the parent's refcount and make sure it's on a shrink list (ours unless it already had been on some other) before calling __dentry_kill(). That eliminates the window when shrink_dcache_parent() would've blown past the entire subtree without noticing anything with zero refcount not on shrink lists. 2) when shrink_dcache_parent() has found no eviction candidates, but some dentries are still sitting on shrink lists, rather than repeating the scan in hope that shrinkers have progressed, scan looking for something on shrink lists with zero refcount. If such a thing is found, grab rcu_read_lock() and stop the scan, with caller locking it for eviction, dropping out of RCU and doing __dentry_kill(), with the same treatment for parent as shrink_dentry_list() would do. Note that right now mixed-filesystem shrink lists do not occur, so this is not a mainline bug. Howevere, there's a bunch of uses for such beasts (e.g. the "try and evict everything we can out of given page" patches; there are potential uses in mount-related code, considerably simplifying the life in fs/namespace.c, etc.) Signed-off-by: Al Viro commit 59592cc1f5937ced72e11e681c3e358a0375f7ae Author: YueHaibing Date: Tue Jul 2 21:36:31 2019 +0800 mmc: sdhci_am654: Add dependency on MMC_SDHCI_AM654 Fix build error: drivers/mmc/host/sdhci_am654.o: In function `sdhci_am654_probe': drivers/mmc/host/sdhci_am654.c:464: undefined reference to `__devm_regmap_init_mmio_clk' drivers/mmc/host/sdhci_am654.o:(.debug_addr+0x3f8): undefined reference to `__devm_regmap_init_mmio_clk' Reported-by: Hulk Robot Fixes: aff88ff23512 ("mmc: sdhci_am654: Add Initial Support for AM654 SDHCI driver") Signed-off-by: YueHaibing Signed-off-by: Ulf Hansson commit 42248a918d7c18a535b08f05badb988b140298f6 Author: Colin Ian King Date: Mon Jul 1 18:52:46 2019 +0100 mmc: alcor: remove a redundant greater or equal to zero comparison A greater or equal comparison on the unsigned int variable tmp_diff is always true as unsigned ints are never negative. Hence the comparison is redundant and can be removed. Addresses-Coverity: ("Unsigned compared against 0") Signed-off-by: Colin Ian King Signed-off-by: Ulf Hansson commit 5e6b6651d22de109ebf48ca00d0373bc2c0cc080 Author: Jorge Ramirez-Ortiz Date: Mon Jul 1 17:01:25 2019 +0200 mmc: sdhci-msm: fix mutex while in spinlock mutexes can sleep and therefore should not be taken while holding a spinlock. move clk_get_rate (can sleep) outside the spinlock protected region. Fixes: 83736352e0ca ("mmc: sdhci-msm: Update DLL reset sequence") Cc: stable@vger.kernel.org Signed-off-by: Jorge Ramirez-Ortiz Reviewed-by: Bjorn Andersson Reviewed-by: Vinod Koul Acked-by: Adrian Hunter Signed-off-by: Ulf Hansson commit 8751c8bd8b91abb0887ab971651a1ac72d3b9398 Author: YueHaibing Date: Fri Jun 28 12:07:51 2019 +0800 mmc: sdhci_am654: Make some symbols static Fix sparse warnings: drivers/mmc/host/sdhci_am654.c:192:6: warning: symbol 'sdhci_j721e_4bit_set_clock' was not declared. Should it be static? drivers/mmc/host/sdhci_am654.c:261:18: warning: symbol 'sdhci_j721e_8bit_ops' was not declared. Should it be static? drivers/mmc/host/sdhci_am654.c:284:18: warning: symbol 'sdhci_j721e_4bit_ops' was not declared. Should it be static? Reported-by: Hulk Robot Signed-off-by: YueHaibing Signed-off-by: Ulf Hansson commit 79a986721decf428ba539e6e2c941c987acce655 Author: Christoph Hellwig Date: Tue Jun 25 11:20:42 2019 +0200 dma-mapping: remove dma_max_pfn These days, the DMA mapping code must bounce buffers for any unsupported address. If the driver needs to optimize for natively supported ranges, then it should use dma_get_required_mask. Signed-off-by: Christoph Hellwig Acked-by: Marc Gonzalez Signed-off-by: Ulf Hansson commit 7559d612dff0389aba5b49664e3bc94a150e45f2 Author: Christoph Hellwig Date: Tue Jun 25 11:20:41 2019 +0200 mmc: core: let the dma map ops handle bouncing Just like we do for all other block drivers. Especially as the limit imposed at the moment might be way to pessimistic for iommus. This also means we are not going to set a bounce limit for the queue, in case we have a dma mask. On most architectures it was never needed, the major hold out was x86-32 with PAE, but that has been fixed by now. Signed-off-by: Christoph Hellwig Signed-off-by: Ulf Hansson commit 1cdca16c043abd4803c3979e5faefaa623703e66 Author: Masahiro Yamada Date: Mon Jun 24 16:03:45 2019 +0900 dt-binding: mmc: rename tmio_mmc.txt to renesas,sdhi.txt As commit b6147490e6aa ("mmc: tmio: split core functionality, DMA and MFD glue") said, these MMC controllers use the IP from Panasonic. TMIO (Toshiba Mobile IO) MMC was the first upstreamed user of this IP. The common driver code was split and expanded as 'tmio-mmc-core', then it became historical misnomer since 'tmio' is not the name of this IP. In the discussion [1], we decide to keep this name as-is at least in Linux driver level because renaming everything is a big churn. However, DT should not be oriented to a particular project even though it is mainly developed in Linux communities. This is the misfortune only in Linux. Let's stop exporting it to other projects, where there is no good reason to call this hardware "TMIO". Rename the file to renesas,sdhi.txt. In fact, all the information in this file is specific to the Renesas platform. This commit also removes the first paragraph entirely. The DT-binding should describe the hardware. It is strange to talk about Linux driver internals such as how the drivers are probed, how platform data are handed off, etc. [1] https://www.spinics.net/lists/linux-mmc/msg46952.html Signed-off-by: Masahiro Yamada Reviewed-by: Simon Horman Signed-off-by: Ulf Hansson commit 29ca763fc26f382444887951b3443da0fa47e5fc Author: Baolin Wang Date: Fri Jun 21 14:12:33 2019 +0800 mmc: sdhci-sprd: Add pin control support for voltage switch For Spreadtrum SD card voltage switching, besides regulator setting, it also need switch related pin's state to output corresponding voltage. This patch adds pin control operation to support voltage switch. Signed-off-by: Baolin Wang Acked-by: Adrian Hunter Signed-off-by: Ulf Hansson commit f97ee8f5d9cdd03933517a6336836b8e4415e668 Author: Baolin Wang Date: Fri Jun 21 14:12:32 2019 +0800 dt-bindings: mmc: sprd: Add pinctrl support When changing SD card voltage signal for Spreadtrum SD host controller, it also need to switch related pin's state. Thus add pinctrl properties' description in documentation. Signed-off-by: Baolin Wang Signed-off-by: Ulf Hansson commit eef9e0a60e78be6873b515e85466cac2f25581ed Author: Baolin Wang Date: Fri Jun 21 14:12:31 2019 +0800 mmc: sdhci-sprd: Add start_signal_voltage_switch ops For Spreadtrum SD host controller, we can not use standard SD registers to change and detect the I/O voltage signals, since our voltage regulator for I/O is fixed in hardware, and no signals were connected to the SD controller. Thus add Spreadtrum specific voltage switch ops to change voltage instead of using standard SD host registers. Signed-off-by: Baolin Wang Acked-by: Adrian Hunter Signed-off-by: Ulf Hansson commit cb3a7d4a0aec4e56043d6433724e0606d6b6efba Author: Adrian Hunter Date: Thu Jun 20 12:49:01 2019 +0300 mmc: sdhci-pci: Add support for Intel EHL Add PCI Ids for Intel EHL. Signed-off-by: Adrian Hunter Signed-off-by: Ulf Hansson commit 63624d13b24d00fa3783181efdfdb9d5afaa7363 Author: Yoshihiro Shimoda Date: Wed Jun 19 13:55:30 2019 +0900 mmc: tmio: Use dma_max_mapping_size() instead of a workaround Since the commit 133d624b1cee ("dma: Introduce dma_max_mapping_size()") provides a helper function to get the max mapping size, we can use the function instead of the workaround code for swiotlb. Signed-off-by: Yoshihiro Shimoda Acked-by: Wolfram Sang Reviewed-by: Christoph Hellwig Reviewed-by: Geert Uytterhoeven Reviewed-by: Simon Horman Signed-off-by: Ulf Hansson commit 4aaaf3ab150947557345aedc178dac4f5c10cc87 Author: Ulf Hansson Date: Tue Jun 18 01:20:50 2019 +0200 mmc: sdio: Drop unused in-parameter from mmc_sdio_init_card() The "powered_resume" in-parameter to mmc_sdio_init_card() has now become redundant as all callers set it to 0. Therefore let's just drop it. Signed-off-by: Ulf Hansson Reviewed-by: Douglas Anderson Tested-by: Douglas Anderson commit 3c30e73977e5d1a14a2969cfebcca2655a29b40a Author: Ulf Hansson Date: Tue Jun 18 01:13:02 2019 +0200 mmc: sdio: Drop unused in-parameter to mmc_sdio_reinit_card() The "powered_resume" in-parameter to mmc_sdio_reinit_card() has now become redundant as all callers set it to 0. Therefore let's just drop it. Signed-off-by: Ulf Hansson Reviewed-by: Douglas Anderson Tested-by: Douglas Anderson commit 6ebc581c3f9e6fd11a1c9da492a5e05bbe96885a Author: Ulf Hansson Date: Tue Jun 18 00:52:59 2019 +0200 mmc: sdio: Don't re-initialize powered-on removable SDIO cards at resume It looks like the original idea behind always doing a re-initialization of a removable SDIO card during system resume in mmc_sdio_resume(), is to try to play safe to detect whether the card has been removed. However, this seems like a really a bad idea as it will most likely screw things up, especially when the card is expected to remain powered on during system suspend by the SDIO func driver. Let's fix this, simply by trusting that the detect work checks if the card is alive and inserted, which is being scheduled at the PM_POST_SUSPEND notification anyway. Signed-off-by: Ulf Hansson Tested-by: Douglas Anderson Reviewed-by: Douglas Anderson commit 7fbbe725378d62c30a076742a60a7e1812a2515a Author: Ulf Hansson Date: Mon Jun 17 23:51:31 2019 +0200 mmc: sdio: Drop powered-on re-init at runtime resume and HW reset To use the so called powered-on re-initialization of an SDIO card, the power to the card must obviously have stayed on. If not, the initialization will simply fail. In the runtime suspend case, the card is always powered off. Hence, let's drop the support for powered-on re-initialization during runtime resume, as it doesn't make sense. Moreover, during a HW reset, the point is to cut the power to the card and then do fresh re-initialization. Therefore drop the support for powered-on re-initialization during HW reset. Signed-off-by: Ulf Hansson Fixes: ca8971ca5753 ("mmc: dw_mmc: Prevent runtime PM suspend when SDIO IRQs are enabled") Tested-by: Douglas Anderson commit ee550947a0d696f7ddfe88b204d4eae7f879b583 Author: Ulf Hansson Date: Mon Jun 17 23:41:15 2019 +0200 mmc: sdio: Move comment about re-initialization to mmc_sdio_reinit_card() The comment in mmc_sdio_power_restore() belongs in mmc_sdio_reinit_card(), which was created during a previous commit that re-factored some code. Fix this by moving the comment into mmc_sdio_reinit_card(). Signed-off-by: Ulf Hansson Reviewed-by: Douglas Anderson commit cd23042d05468ab2e66e0298b46ee90a5f8d9a74 Author: Ulf Hansson Date: Tue Jun 11 17:44:32 2019 +0200 mmc: sdio: Drop mmc_claim|release_host() in mmc_sdio_power_restore() The function mmc_sdio_power_restore() is called either from mmc_sdio_runtime_resume() or from mmc_sdio_hw_reset(). Both callers either claims/releases the host or require its callers to do so. Therefore let's drop the redundant calls to mmc_claim|release_host() in mmc_sdio_power_restore(). Signed-off-by: Ulf Hansson Reviewed-by: Douglas Anderson Tested-by: Douglas Anderson commit 7f3bbc0b817b51206948b743331c7441bf918c7f Author: Dmitry Osipenko Date: Tue Jul 9 17:51:51 2019 +0300 drm/modes: Skip invalid cmdline mode The named mode could be invalid and then cmdline parser misses to validate mode's dimensions, happily adding 0x0 mode as a valid mode. One case where this happens is NVIDIA Tegra devices that are using downstream bootloader which adds "video=tegrafb" to the kernel's cmdline and thus upstream Tegra DRM driver fails to probe because of the invalid mode. Fixes: 3aeeb13d8996 ("drm/modes: Support modes names on the command line") Reviewed-by: Ville Syrjälä Signed-off-by: Dmitry Osipenko Signed-off-by: Maxime Ripard Link: https://patchwork.freedesktop.org/patch/msgid/20190709145151.23086-1-digetx@gmail.com commit 73948ca0571325aafd925497c1c37f6b09ed1724 Author: Hariprasad Kelam Date: Wed Jul 10 08:09:46 2019 +0530 ALSA: ps3: Remove Unneeded variable: "ret" This patch fixes below issue reported by coccicheck sound/ppc/snd_ps3.c:631:5-8: Unneeded variable: "ret". Return "0" on line 668 Signed-off-by: Hariprasad Kelam Signed-off-by: Takashi Iwai commit 7a3c2b69386102de9e78fa9ea679898f5502f77d Author: Hariprasad Kelam Date: Wed Jul 10 08:00:59 2019 +0530 ALSA: lx6464es: Remove unneeded variable err This patch fixes below issue reported by coccicheck sound/pci/lx6464es/lx6464es.c:256:5-8: Unneeded variable: "err". Return "0" on line 258 Signed-off-by: Hariprasad Kelam Signed-off-by: Takashi Iwai commit 6cf7fb5a95dec9743f4bfd96f9ece580a355cdd1 Author: Rafael J. Wysocki Date: Wed Jul 10 11:52:50 2019 +0200 Revert "ACPICA: Update table load object initialization" Revert commit c522ad0637ca ("ACPICA: Update table load object initialization") as it causes systems to hang on attempts to load OEM ACPI tables. Reported-by: Thomas Gleixner Signed-off-by: Rafael J. Wysocki commit 4c105769bf6de29856bf80a4045e6725301c58ce Author: Andrew Jeffery Date: Wed Jul 10 12:52:16 2019 +0930 pinctrl: aspeed: Strip moved macros and structs from private header Further cleanup from the SPDX fixup fallout for the recent ASPEED series. aspeed_g4_defconfig, aspeed_g5_defconfig and multi_v5_defconfig now compile. Smoke tested the g4 and g5 kernels under QEMU's palmetto-bmc and romulus-bmc machines respectively. Fixes: 35d8510ea3ad ("pinctrl: aspeed: Fix missed include") Signed-off-by: Andrew Jeffery Link: https://lore.kernel.org/r/20190710032216.4088-1-andrew@aj.id.au Signed-off-by: Linus Walleij commit a1cd6c8b8f03930faf110234fa8366c4ff25085d Author: Linus Walleij Date: Tue Jul 9 13:41:53 2019 +0200 pinctrl: aspeed: Fix missed include Some SPDX churn made my fixes drop an important include from the Aspeed pinctrl header. Fix it up. Cc: Andrew Jeffery Reported-by: Andrew Jeffery Signed-off-by: Linus Walleij commit 9bdd7bb3a8447fe841cd37ddd9e0a6974b06a0bb Author: Joe Perches Date: Tue Jul 9 22:04:15 2019 -0700 clocksource/drivers/npcm: Fix misuse of GENMASK macro Arguments are supposed to be ordered high then low. Signed-off-by: Joe Perches Signed-off-by: Thomas Gleixner Link: https://lkml.kernel.org/r/d6a9d49c9837d38816b71d783f5aed7235e8ca94.1562734889.git.joe@perches.com commit 20faba848752901de23a4d45a1174d64d2069dde Author: Joe Perches Date: Tue Jul 9 22:04:18 2019 -0700 irqchip/gic-v3-its: Fix misuse of GENMASK macro Arguments are supposed to be ordered high then low. Signed-off-by: Joe Perches Signed-off-by: Thomas Gleixner Acked-by: Marc Zyngier Link: https://lkml.kernel.org/r/ab5deb4fc3cd604cb620054770b7d00016d736bc.1562734889.git.joe@perches.com commit fa33cdbf3eceb0206a4f844fe91aeebcf6ff2b7a Author: Steven J. Magnani Date: Sun Jun 30 21:39:35 2019 -0500 udf: Fix incorrect final NOT_ALLOCATED (hole) extent length In some cases, using the 'truncate' command to extend a UDF file results in a mismatch between the length of the file's extents (specifically, due to incorrect length of the final NOT_ALLOCATED extent) and the information (file) length. The discrepancy can prevent other operating systems (i.e., Windows 10) from opening the file. Two particular errors have been observed when extending a file: 1. The final extent is larger than it should be, having been rounded up to a multiple of the block size. B. The final extent is not shorter than it should be, due to not having been updated when the file's information length was increased. [JK: simplified udf_do_extend_final_block(), fixed up some types] Fixes: 2c948b3f86e5 ("udf: Avoid IO in udf_clear_inode") CC: stable@vger.kernel.org Signed-off-by: Steven J. Magnani Link: https://lore.kernel.org/r/1561948775-5878-1-git-send-email-steve@digidescorp.com Signed-off-by: Jan Kara commit dc205a8d34228809dedab94a85a866cbb255248f Author: Santosh Shilimkar Date: Fri Jun 28 15:38:58 2019 -0700 rds: avoid version downgrade to legitimate newer peer connections Connections with legitimate tos values can get into usual connection race. It can result in consumer reject. We don't want tos value or protocol version to be demoted for such connections otherwise piers would end up different tos values which can results in no connection. Example a peer initiated connection with say tos 8 while usual connection racing can get downgraded to tos 0 which is not desirable. Patch fixes above issue introduced by commit commit d021fabf525f ("rds: rdma: add consumer reject") Reported-by: Yanjun Zhu Tested-by: Yanjun Zhu Signed-off-by: Santosh Shilimkar commit fc640d4cbe268479ba448542e2b17045c908b2b3 Author: Gerd Rausch Date: Fri Jun 28 17:41:16 2019 -0700 rds: Return proper "tos" value to user-space The proper "tos" value needs to be returned to user-space (sockopt RDS_INFO_CONNECTIONS). Fixes: 3eb450367d08 ("rds: add type of service(tos) infrastructure") Signed-off-by: Gerd Rausch Reviewed-by: Zhu Yanjun Signed-off-by: Santosh Shilimkar commit 8c6166cfc9cd48e93d9176561e50b63cef4330d5 Author: Gerd Rausch Date: Thu Jun 27 09:21:44 2019 -0700 rds: Accept peer connection reject messages due to incompatible version Prior to commit d021fabf525ff ("rds: rdma: add consumer reject") function "rds_rdma_cm_event_handler_cmn" would always honor a rejected connection attempt by issuing a "rds_conn_drop". The commit mentioned above added a "break", eliminating the "fallthrough" case and made the "rds_conn_drop" rather conditional: Now it only happens if a "consumer defined" reject (i.e. "rdma_reject") carries an integer-value of "1" inside "private_data": if (!conn) break; err = (int *)rdma_consumer_reject_data(cm_id, event, &len); if (!err || (err && ((*err) == RDS_RDMA_REJ_INCOMPAT))) { pr_warn("RDS/RDMA: conn <%pI6c, %pI6c> rejected, dropping connection\n", &conn->c_laddr, &conn->c_faddr); conn->c_proposed_version = RDS_PROTOCOL_COMPAT_VERSION; rds_conn_drop(conn); } rdsdebug("Connection rejected: %s\n", rdma_reject_msg(cm_id, event->status)); break; /* FALLTHROUGH */ A number of issues are worth mentioning here: #1) Previous versions of the RDS code simply rejected a connection by calling "rdma_reject(cm_id, NULL, 0);" So the value of the payload in "private_data" will not be "1", but "0". #2) Now the code has become dependent on host byte order and sizing. If one peer is big-endian, the other is little-endian, or there's a difference in sizeof(int) (e.g. ILP64 vs LP64), the *err check does not work as intended. #3) There is no check for "len" to see if the data behind *err is even valid. Luckily, it appears that the "rdma_reject(cm_id, NULL, 0)" will always carry 148 bytes of zeroized payload. But that should probably not be relied upon here. #4) With the added "break;", we might as well drop the misleading "/* FALLTHROUGH */" comment. This commit does _not_ address issue #2, as the sender would have to agree on a byte order as well. Here is the sequence of messages in this observed error-scenario: Host-A is pre-QoS changes (excluding the commit mentioned above) Host-B is post-QoS changes (including the commit mentioned above) #1 Host-B issues a connection request via function "rds_conn_path_transition" connection state transitions to "RDS_CONN_CONNECTING" #2 Host-A rejects the incompatible connection request (from #1) It does so by calling "rdma_reject(cm_id, NULL, 0);" #3 Host-B receives an "RDMA_CM_EVENT_REJECTED" event (from #2) But since the code is changed in the way described above, it won't drop the connection here, simply because "*err == 0". #4 Host-A issues a connection request #5 Host-B receives an "RDMA_CM_EVENT_CONNECT_REQUEST" event and ends up calling "rds_ib_cm_handle_connect". But since the state is already in "RDS_CONN_CONNECTING" (as of #1) it will end up issuing a "rdma_reject" without dropping the connection: if (rds_conn_state(conn) == RDS_CONN_CONNECTING) { /* Wait and see - our connect may still be succeeding */ rds_ib_stats_inc(s_ib_connect_raced); } goto out; #6 Host-A receives an "RDMA_CM_EVENT_REJECTED" event (from #5), drops the connection and tries again (goto #4) until it gives up. Tested-by: Zhu Yanjun Signed-off-by: Gerd Rausch Signed-off-by: Santosh Shilimkar commit a55207884708bf1d5b8c87a3c504502de77a5416 Author: Gerd Rausch Date: Fri Jun 28 17:31:19 2019 -0700 Revert "RDS: IB: split the mr registration and invalidation path" This reverts commit 56012459310a1dbcc55c2dbf5500a9f7571402cb. RDS kept spinning inside function "rds_ib_post_reg_frmr", waiting for "i_fastreg_wrs" to become incremented: while (atomic_dec_return(&ibmr->ic->i_fastreg_wrs) <= 0) { atomic_inc(&ibmr->ic->i_fastreg_wrs); cpu_relax(); } Looking at the original commit: commit 56012459310a ("RDS: IB: split the mr registration and invalidation path") In there, the "rds_ib_mr_cqe_handler" was changed in the following way: void rds_ib_mr_cqe_handler(struct rds_ib_connection *ic, struct ib_wc *wc) if (frmr->fr_inv) { frmr->fr_state = FRMR_IS_FREE; frmr->fr_inv = false; atomic_inc(&ic->i_fastreg_wrs); } else { atomic_inc(&ic->i_fastunreg_wrs); } It looks like it's got it exactly backwards: Function "rds_ib_post_reg_frmr" keeps track of the outstanding requests via "i_fastreg_wrs". Function "rds_ib_post_inv" keeps track of the outstanding requests via "i_fastunreg_wrs" (post original commit). It also sets: frmr->fr_inv = true; However the completion handler "rds_ib_mr_cqe_handler" adjusts "i_fastreg_wrs" when "fr_inv" had been true, and adjusts "i_fastunreg_wrs" otherwise. The original commit was done in the name of performance: to remove the performance bottleneck No performance benefit could be observed with a fixed-up version of the original commit measured between two Oracle X7 servers, both equipped with Mellanox Connect-X5 HCAs. The prudent course of action is to revert this commit. Signed-off-by: Gerd Rausch Signed-off-by: Santosh Shilimkar commit 616d37a070bb33ea387d0e93343acd8336a30886 Author: Santosh Shilimkar Date: Tue Jun 18 22:12:05 2019 -0700 rds: fix reordering with composite message notification RDS composite message(rdma + control) user notification needs to be triggered once the full message is delivered and such a fix was added as part of commit 941f8d55f6d61 ("RDS: RDMA: Fix the composite message user notification"). But rds_send_remove_from_sock is missing data part notify check and hence at times the user don't get notification which isn't desirable. One way is to fix the rds_send_remove_from_sock to check of that case but considering the ordering complexity with completion handler and rdma + control messages are always dispatched back to back in same send context, just delaying the signaled completion on rmda work request also gets the desired behaviour. i.e Notifying application only after RDMA + control message send completes. So patch updates the earlier fix with this approach. The delay signaling completions of rdma op till the control message send completes fix was done by Venkat Venkatsubra in downstream kernel. Reviewed-and-tested-by: Zhu Yanjun Reviewed-by: Gerd Rausch Signed-off-by: Santosh Shilimkar commit 1ff2f0fa450ea4e4f87793d9ed513098ec6e12be Author: Nathan Chancellor Date: Mon Jul 8 16:11:55 2019 -0700 net/mlx5e: Return in default case statement in tx_post_resync_params clang warns: drivers/net/ethernet/mellanox/mlx5/core/en_accel/ktls_tx.c:251:2: warning: variable 'rec_seq_sz' is used uninitialized whenever switch default is taken [-Wsometimes-uninitialized] default: ^~~~~~~ drivers/net/ethernet/mellanox/mlx5/core/en_accel/ktls_tx.c:255:46: note: uninitialized use occurs here skip_static_post = !memcmp(rec_seq, &rn_be, rec_seq_sz); ^~~~~~~~~~ drivers/net/ethernet/mellanox/mlx5/core/en_accel/ktls_tx.c:239:16: note: initialize the variable 'rec_seq_sz' to silence this warning u16 rec_seq_sz; ^ = 0 1 warning generated. This case statement was clearly designed to be one that should not be hit during runtime because of the WARN_ON statement so just return early to prevent copying uninitialized memory up into rn_be. Fixes: d2ead1f360e8 ("net/mlx5e: Add kTLS TX HW offload support") Link: https://github.com/ClangBuiltLinux/linux/issues/590 Signed-off-by: Nathan Chancellor Signed-off-by: David S. Miller commit cacf32e99788e91a3eaefafb0976deadf84f37d5 Author: David S. Miller Date: Tue Jul 9 21:35:08 2019 -0700 mlx5: Return -EINVAL when WARN_ON_ONCE triggers in mlx5e_tls_resync(). Return value was changes to 'int' from void but this return statement was not updated, or it slipped in via a merge. Fixes: b5d9a834f4fd ("net/tls: don't clear TX resync flag on error") Signed-off-by: David S. Miller commit 73a2b047c81046a7f734a5759ab5fdedbb6968fd Author: Alastair D'Silva Date: Wed Jun 5 13:15:45 2019 +0200 ocxl: Update for AFU descriptor template version 1.1 The OpenCAPI discovery and configuration specification has been updated and introduces version 1.1 of the AFU descriptor template, with new fields to better define the memory layout of an OpenCAPI adapter. The ocxl driver doesn't do much yet to support LPC memory but as we start seeing (non-LPC) AFU images using the new template, this patch updates the config space parsing code to avoid spitting a warning. Signed-off-by: Alastair D'Silva Signed-off-by: Frederic Barrat Reviewed-by: Christophe Lombard Acked-by: Andrew Donnellan Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20190605111545.19762-1-fbarrat@linux.ibm.com commit 4ba7f80f42563903b0e26d30175808db7d07e664 Author: Masahiro Yamada Date: Fri Jul 5 19:01:44 2019 +0900 powerpc/boot: pass CONFIG options in a simpler and more robust way Commit 5e9dcb6188a4 ("powerpc/boot: Expose Kconfig symbols to wrapper") was wrong, but commit e41b93a6be57 ("powerpc/boot: Fix build failures with -j 1") was also wrong. The correct dependency is: $(obj)/serial.o: $(obj)/autoconf.h However, I do not see the reason why we need to copy autoconf.h to arch/power/boot/. Nor do I see consistency in the way of passing CONFIG options. decompress.c references CONFIG_KERNEL_GZIP and CONFIG_KERNEL_XZ, which are passed via the command line. serial.c includes autoconf.h to reference a couple of CONFIG options, but this is fragile because we often forget to include "autoconf.h" from source files. In fact, it is already broken. ppc_asm.h references CONFIG_PPC_8xx, but utils.S is not given any way to access CONFIG options. So, CONFIG_PPC_8xx is never defined here. Pass $(LINUXINCLUDE) to make sure CONFIG options are accessible from all .c and .S files in arch/powerpc/boot/. I also removed the -traditional flag to make include/linux/kconfig.h work. This flag makes the preprocessor imitate the behavior of the pre-standard C compiler, but I do not understand why it is necessary. Signed-off-by: Masahiro Yamada Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20190705100144.28785-2-yamada.masahiro@socionext.com commit 9e005b761e7ad153dcf40a6cba1d681fe0830ac6 Author: Masahiro Yamada Date: Fri Jul 5 19:01:43 2019 +0900 powerpc/boot: add {get, put}_unaligned_be32 to xz_config.h The next commit will make the way of passing CONFIG options more robust. Unfortunately, it would uncover another hidden issue; without this commit, skiroot_defconfig would be broken like this: | WRAP arch/powerpc/boot/zImage.pseries | arch/powerpc/boot/wrapper.a(decompress.o): In function `bcj_powerpc.isra.10': | decompress.c:(.text+0x720): undefined reference to `get_unaligned_be32' | decompress.c:(.text+0x7a8): undefined reference to `put_unaligned_be32' | make[1]: *** [arch/powerpc/boot/Makefile;383: arch/powerpc/boot/zImage.pseries] Error 1 | make: *** [arch/powerpc/Makefile;295: zImage] Error 2 skiroot_defconfig is the only defconfig that enables CONFIG_KERNEL_XZ for ppc, which has never been correctly built before. I figured out the root cause in lib/decompress_unxz.c: | #ifdef CONFIG_PPC | # define XZ_DEC_POWERPC | #endif CONFIG_PPC is undefined here in the ppc bootwrapper because autoconf.h is not included except by arch/powerpc/boot/serial.c XZ_DEC_POWERPC is not defined, therefore, bcj_powerpc() is not compiled for the bootwrapper. With the next commit passing CONFIG_PPC correctly, we would realize that {get,put}_unaligned_be32 was missing. Unlike the other decompressors, the ppc bootwrapper duplicates all the necessary helpers in arch/powerpc/boot/. The other architectures define __KERNEL__ and pull in helpers for building the decompressors. If ppc bootwrapper had defined __KERNEL__, lib/xz/xz_private.h would have included : | #ifdef __KERNEL__ | # include | # include | # include However, doing so would cause tons of definition conflicts since the bootwrapper has duplicated everything. I just added copies of {get,put}_unaligned_be32, following the bootwrapper coding convention. Signed-off-by: Masahiro Yamada Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20190705100144.28785-1-yamada.masahiro@socionext.com commit 0fc12c022ad25532b66bf6f6c818ee1c1d63e702 Author: Michael Ellerman Date: Mon Jul 8 16:02:19 2019 +1000 powerpc/irq: Don't WARN continuously in arch_local_irq_restore() When CONFIG_PPC_IRQ_SOFT_MASK_DEBUG is enabled (uncommon), we have a series of WARN_ON's in arch_local_irq_restore(). These are "should never happen" conditions, but if they do happen they can flood the console and render the system unusable. So switch them to WARN_ON_ONCE(). Fixes: e2b36d591720 ("powerpc/64: Don't trace code that runs with the soft irq mask unreconciled") Fixes: 9b81c0211c24 ("powerpc/64s: make PACA_IRQ_HARD_DIS track MSR[EE] closely") Fixes: 7c0482e3d055 ("powerpc/irq: Fix another case of lazy IRQ state getting out of sync") Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20190708061046.7075-1-mpe@ellerman.id.au commit 86766756ac2b10ad23849becdc245ea903466616 Merge: 74acee309fb2 88bb346dd63b Author: Jiri Kosina Date: Wed Jul 10 01:40:23 2019 +0200 Merge branch 'for-5.3/uclogic' into for-linus commit 74acee309fb2a434dce215d44014e6f8e06975ae Merge: 4c12954965fd cca478617465 eca0f0a6c3fb dbcbabf7da92 6e2abc68585b Author: Jiri Kosina Date: Wed Jul 10 01:39:57 2019 +0200 Merge branches 'for-5.2/fixes', 'for-5.3/doc', 'for-5.3/ish', 'for-5.3/logitech' and 'for-5.3/wacom' into for-linus commit b78fa45d4edb92fd7b882b2ec25b936cad412670 Author: YueHaibing Date: Mon Jul 8 20:54:08 2019 +0800 nfsd: Make __get_nfsdfs_client() static Fix sparse warning: fs/nfsd/nfsctl.c:1221:22: warning: symbol '__get_nfsdfs_client' was not declared. Should it be static? Reported-by: Hulk Robot Signed-off-by: YueHaibing Signed-off-by: J. Bruce Fields commit 297e57a24f6e2d5a041822003816124e48164eef Author: YueHaibing Date: Mon Jul 8 15:29:33 2019 +0800 nfsd: Make two functions static Fix sparse warnings: fs/nfsd/nfs4state.c:1908:6: warning: symbol 'drop_client' was not declared. Should it be static? fs/nfsd/nfs4state.c:2518:6: warning: symbol 'force_expire_client' was not declared. Should it be static? Reported-by: Hulk Robot Signed-off-by: YueHaibing Signed-off-by: J. Bruce Fields commit 38195dd5e916f3e55aec585703f2432562c2db02 Merge: aec71d794731 ac59a471e937 Author: Jiri Kosina Date: Wed Jul 10 01:20:26 2019 +0200 Merge branch 'for-5.3/core' into for-linus commit f59d261180f3b66367962f1974090815ce710056 Author: Icenowy Zheng Date: Sun Jun 23 12:37:59 2019 +0800 dt-bindings: vendor-prefixes: add Sipeed Shenzhen Sipeed Technology Co., Ltd. is a company focused on development kits, which also contains rebranded Lichee Pi series. Add its vendor prefix binding. Signed-off-by: Icenowy Zheng Signed-off-by: Rob Herring commit 09d9ea4014d1c7715c072403a9e2d4e97f6084ec Author: Icenowy Zheng Date: Sun Jun 23 12:37:57 2019 +0800 dt-bindings: vendor-prefixes: add SoChip Shenzhen SoChip Technology Co., Ltd. is a hardware vendor that produces EVBs with Allwinner chips. There's also a SoC named S3 that is developed by Allwinner (based on Allwinner V3/V3s) but branded SoChip. Add the vendor prefix for SoChip. Signed-off-by: Icenowy Zheng Reviewed-by: Rob Herring Signed-off-by: Rob Herring commit f15d6358425af7976e146a07a47b75e4fe8ccd41 Author: Kefeng Wang Date: Sat Jun 22 11:45:57 2019 +0800 dt-bindings: 83xx-512x-pci: Drop cell-index property 28eac2b74cc7 ("powerpc/fsl: Remove cell-index from PCI nodes"), and for now it is still not used, drop it from doc. Cc: Kumar Gala Signed-off-by: Kefeng Wang Signed-off-by: Rob Herring commit 32eaeae0ef193b64a67177006bdf5d9130d83fd3 Author: Alex Deucher Date: Mon Jul 8 13:33:22 2019 -0500 drm/amdgpu/psp: add a mutex to protect access to the psp ring We need to serialize access to the psp ring if there are multiple callers at runtime. Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher commit 7f963d9f69bf28d639013630da30d7a4c95edd5d Author: Alex Deucher Date: Wed Jul 3 21:39:10 2019 -0500 drm/amdgpu/navi10: add uclk activity sensor Query the metrics table for the current uclk activity. Reviewed-by: Evan Quan Signed-off-by: Alex Deucher commit f54eeab4e7e066c6fd2f409f599f043c4ef98a6e Author: Alex Deucher Date: Mon Jul 8 13:44:59 2019 -0500 drm/amdgpu: properly guard the generic discovery code It's only available on navi and newer. Reviewed-by: Xiaojie Yuan Signed-off-by: Alex Deucher commit 405627871480a086fd81af189d48ae47d0639fe7 Author: Alex Deucher Date: Wed Jul 3 08:50:12 2019 -0500 drm/amdgpu: add missing documentation on new module parameters New parameters added for navi lack documentation. Reviewed-by: Xiaojie Yuan Signed-off-by: Alex Deucher commit 83145f110eb2ada9d54fcbcf416c02de126381c1 Author: Marek Olšák Date: Fri Jun 28 18:31:26 2019 -0400 drm/amdgpu: don't invalidate caches in RELEASE_MEM, only do the writeback This RELEASE_MEM use has the Release semantic, which means we should write back but not invalidate. Invalidations only make sense with the Acquire semantic (ACQUIRE_MEM), or when RELEASE_MEM is used to do the combined Acquire-Release semantic, which is a barrier, not a fence. The undesirable side effect of doing invalidations for the Release semantic is that it invalidates caches while shaders are running, because the Release can execute in the middle of the next IB. UMDs should use ACQUIRE_MEM at the beginning of IBs. Doing cache invalidations for a fence (like in this case) doesn't do anything for correctness. Signed-off-by: Marek Olšák Acked-by: Alex Deucher Signed-off-by: Alex Deucher commit 61daf52c4ddd433924687850fa04ed85c0d806dd Author: Geert Uytterhoeven Date: Mon Jun 17 16:36:12 2019 +0200 sparc64: Add missing newline at end of file "git diff" says: \ No newline at end of file after modifying the file. Signed-off-by: Geert Uytterhoeven Signed-off-by: David S. Miller commit 13990cf8a180cc070f0b1266140e799db8754289 Author: Amol Surati Date: Sun Jul 7 14:27:29 2019 +0530 ide: use BIT() macro for defining bit-flags The BIT() macro is available for defining the required bit-flags. Since it operates on an unsigned value and expands to an unsigned result, using it, instead of an expression like (1 << x), also fixes the problem of shifting a signed 32-bit value by 31 bits (e.g. 1 << 31). Signed-off-by: Amol Surati Signed-off-by: David S. Miller commit 08cc83cc7fd8e6c3670ff545ef2bbfbc01a02d87 Author: Vivien Didelot Date: Mon Jul 8 23:31:13 2019 -0400 net: dsa: add support for BRIDGE_MROUTER attribute This patch adds support for enabling or disabling the flooding of unknown multicast traffic on the CPU ports, depending on the value of the switchdev SWITCHDEV_ATTR_ID_BRIDGE_MROUTER attribute. The current behavior is kept unchanged but a user can now prevent the CPU conduit to be flooded with a lot of unregistered traffic that the network stack needs to filter in software with e.g.: echo 0 > /sys/class/net/br0/multicast_router Signed-off-by: Vivien Didelot Signed-off-by: David S. Miller commit fbc697796e358d1ed8ed25758b19bdb3a1f8e9f9 Author: David Ahern Date: Tue Jul 9 14:45:17 2019 -0700 pkt_sched: Include const.h Commit 9903c8dc7342 changed TC_ETF defines to use _BITUL instead of BIT but did not add the dependecy on linux/const.h. As a consequence, importing the uapi headers into iproute2 causes builds to fail. Add the dependency. Fixes: 9903c8dc7342 ("etf: Don't use BIT() in UAPI headers.") Cc: Vedang Patel Signed-off-by: David Ahern Signed-off-by: David S. Miller commit a22502a37599f813686e443ccfc21c9ea8167c41 Author: Ilias Apalodimas Date: Wed Jul 10 00:14:49 2019 +0300 net: netsec: remove static declaration for netsec_set_tx_de() On commit ba2b232108d3 ("net: netsec: add XDP support") a static declaration for netsec_set_tx_de() was added to make the diff easier to read. Now that the patch is merged let's move the functions around and get rid of that Signed-off-by: Ilias Apalodimas Signed-off-by: David S. Miller commit 4831539dce552b7d47a7a3f3cbc440669a3917e2 Author: Ilias Apalodimas Date: Wed Jul 10 00:14:48 2019 +0300 net: netsec: remove superfluous if statement While freeing tx buffers the memory has to be unmapped if the packet was an skb or was used for .ndo_xdp_xmit using the same arguments. Get rid of the unneeded extra 'else if' statement Signed-off-by: Ilias Apalodimas Signed-off-by: David S. Miller commit c099a408949c443cc7c83679af314ebfc805cd1f Merge: 2bb295f3a5e6 c9626a2cbdb2 Author: David S. Miller Date: Tue Jul 9 14:38:51 2019 -0700 Merge branch 'nf-hw-offload' Pablo Neira Ayuso says: ==================== netfilter: add hardware offload infrastructure This patchset adds support for Netfilter hardware offloads. This patchset reuses the existing block infrastructure, the netdev_ops->ndo_setup_tc() interface, TC_SETUP_CLSFLOWER classifier and the flow rule API. Patch #1 adds flow_block_cb_setup_simple(), most drivers do the same thing to set up flow blocks, to reduce the number of changes, consolidate codebase. Use _simple() postfix as requested by Jakub Kicinski. This new function resides in net/core/flow_offload.c Patch #2 renames TC_BLOCK_{UN}BIND to FLOW_BLOCK_{UN}BIND. Patch #3 renames TCF_BLOCK_BINDER_TYPE_* to FLOW_BLOCK_BINDER_TYPE_*. Patch #4 adds flow_block_cb_alloc() and flow_block_cb_free() helper functions, this is the first patch of the flow block API. Patch #5 adds the helper to deal with list operations in the flow block API. This includes flow_block_cb_lookup(), flow_block_cb_add() and flow_block_cb_remove(). Patch #6 adds flow_block_cb_priv(), flow_block_cb_incref() and flow_block_cb_decref() which completes the flow block API. Patch #7 updates the cls_api to use the flow block API from the new tcf_block_setup(). This infrastructure transports these objects via list (through the tc_block_offload object) back to the core for registration. CLS_API DRIVER TC_SETUP_BLOCK ----------> setup flow_block_cb object & it adds object to flow_block_offload->cb_list | CLS_API <-----------------------' registers list with flow blocks flow_block_cb & travels back to calls ->reoffload the core for registration drivers allocate and sets up (configure the blocks), then registration happens from the core (cls_api and netfilter). Patch #8 updates drivers to use the flow block API. Patch #9 removes the tcf block callback API, which is replaced by the flow block API. Patch #10 adds the flow_block_cb_is_busy() helper to check if the block is already used by a subsystem. This helper is invoked from drivers. Once drivers are updated to support for multiple subsystems, they can remove this check. Patch #11 rename tc structure and definitions for the block bind/unbind path. Patch #12 introduces basic netfilter hardware offload infrastructure for the ingress chain. This includes 5-tuple exact matching and accept / drop rule actions. Only basechains are supported at this stage, no .reoffload callback is implemented either. Default policy to "accept" is only supported for now. table netdev filter { chain ingress { type filter hook ingress device eth0 priority 0; flags offload; ip daddr 192.168.0.10 tcp dport 22 drop } } This patchset reuses the existing tcf block callback API and it places it in the flow block callback API in net/core/flow_offload.c. This series aims to address Jakub and Jiri's feedback, please see specific patches in this batch for changelog in this v4. ==================== Signed-off-by: David S. Miller commit c9626a2cbdb20e26587b3fad99960520a023432b Author: Pablo Neira Ayuso Date: Tue Jul 9 23:00:43 2019 +0200 netfilter: nf_tables: add hardware offload support This patch adds hardware offload support for nftables through the existing netdev_ops->ndo_setup_tc() interface, the TC_SETUP_CLSFLOWER classifier and the flow rule API. This hardware offload support is available for the NFPROTO_NETDEV family and the ingress hook. Each nftables expression has a new ->offload interface, that is used to populate the flow rule object that is attached to the transaction object. There is a new per-table NFT_TABLE_F_HW flag, that is set on to offload an entire table, including all of its chains. This patch supports for basic metadata (layer 3 and 4 protocol numbers), 5-tuple payload matching and the accept/drop actions; this also includes basechain hardware offload only. Signed-off-by: Pablo Neira Ayuso Signed-off-by: David S. Miller commit f9e30088d20016a224d8110d45356da253eaa26a Author: Pablo Neira Ayuso Date: Tue Jul 9 22:55:49 2019 +0200 net: flow_offload: rename tc_cls_flower_offload to flow_cls_offload And any other existing fields in this structure that refer to tc. Specifically: * tc_cls_flower_offload_flow_rule() to flow_cls_offload_flow_rule(). * TC_CLSFLOWER_* to FLOW_CLS_*. * tc_cls_common_offload to tc_cls_common_offload. Signed-off-by: Pablo Neira Ayuso Signed-off-by: David S. Miller commit 0d4fd02e7199fbf57c0d175dd1890c82cd4a6f4f Author: Pablo Neira Ayuso Date: Tue Jul 9 22:55:48 2019 +0200 net: flow_offload: add flow_block_cb_is_busy() and use it This patch adds a function to check if flow block callback is already in use. Call this new function from flow_block_cb_setup_simple() and from drivers. Signed-off-by: Pablo Neira Ayuso Signed-off-by: David S. Miller commit 722d36e6e29e50c640c9f5ce186b8d8709cae1a6 Author: Pablo Neira Ayuso Date: Tue Jul 9 22:55:47 2019 +0200 net: sched: remove tcf block API Unused, now replaced by flow block API. Signed-off-by: Pablo Neira Ayuso Signed-off-by: David S. Miller commit 955bcb6ea0df0d9ace89ac475405f1295ced5962 Author: Pablo Neira Ayuso Date: Tue Jul 9 22:55:46 2019 +0200 drivers: net: use flow block API This patch updates flow_block_cb_setup_simple() to use the flow block API. Several drivers are also adjusted to use it. This patch introduces the per-driver list of flow blocks to account for blocks that are already in use. Remove tc_block_offload alias. Signed-off-by: Pablo Neira Ayuso Signed-off-by: David S. Miller commit 59094b1e5094c7e50a3d2912202fd30b6a1dadf8 Author: Pablo Neira Ayuso Date: Tue Jul 9 22:55:45 2019 +0200 net: sched: use flow block API This patch adds tcf_block_setup() which uses the flow block API. This infrastructure takes the flow block callbacks coming from the driver and register/unregister to/from the cls_api core. Signed-off-by: Pablo Neira Ayuso Signed-off-by: David S. Miller commit 67bd0d5ea7974d9dc9c502c7b4096e16a80a553d Author: Pablo Neira Ayuso Date: Tue Jul 9 22:55:44 2019 +0200 net: flow_offload: add flow_block_cb_{priv, incref, decref}() This patch completes the flow block API to introduce: * flow_block_cb_priv() to access callback private data. * flow_block_cb_incref() to bump reference counter on this flow block. * flow_block_cb_decref() to decrement the reference counter. These functions are taken from the existing tcf_block_cb_priv(), tcf_block_cb_incref() and tcf_block_cb_decref(). Signed-off-by: Pablo Neira Ayuso Signed-off-by: David S. Miller commit da3eeb904ff432ec22cf7b4db17a47647428873a Author: Pablo Neira Ayuso Date: Tue Jul 9 22:55:43 2019 +0200 net: flow_offload: add list handling functions This patch adds the list handling functions for the flow block API: * flow_block_cb_lookup() allows drivers to look up for existing flow blocks. * flow_block_cb_add() adds a flow block to the per driver list to be registered by the core. * flow_block_cb_remove() to remove a flow block from the list of existing flow blocks per driver and to request the core to unregister this. The flow block API also annotates the netns this flow block belongs to. Signed-off-by: Pablo Neira Ayuso Signed-off-by: David S. Miller commit d63db30c8537ba45208c156d71125db73d0fe522 Author: Pablo Neira Ayuso Date: Tue Jul 9 22:55:42 2019 +0200 net: flow_offload: add flow_block_cb_alloc() and flow_block_cb_free() Add a new helper function to allocate flow_block_cb objects. Signed-off-by: Pablo Neira Ayuso Signed-off-by: David S. Miller commit 32f8c4093ac353a5f1b36cfed0ce0138faf8e15f Author: Pablo Neira Ayuso Date: Tue Jul 9 22:55:41 2019 +0200 net: flow_offload: rename TCF_BLOCK_BINDER_TYPE_* to FLOW_BLOCK_BINDER_TYPE_* Rename from TCF_BLOCK_BINDER_TYPE_* to FLOW_BLOCK_BINDER_TYPE_* and remove temporary tcf_block_binder_type alias. Signed-off-by: Pablo Neira Ayuso Signed-off-by: David S. Miller commit 9c0e189ec988f306331036bc3f71085582b24fdc Author: Pablo Neira Ayuso Date: Tue Jul 9 22:55:40 2019 +0200 net: flow_offload: rename TC_BLOCK_{UN}BIND to FLOW_BLOCK_{UN}BIND Rename from TC_BLOCK_{UN}BIND to FLOW_BLOCK_{UN}BIND and remove temporary tc_block_command alias. Signed-off-by: Pablo Neira Ayuso Signed-off-by: David S. Miller commit 4e95bc268b915c3a19ec8b9110f61e4ea41a1ed0 Author: Pablo Neira Ayuso Date: Tue Jul 9 22:55:39 2019 +0200 net: flow_offload: add flow_block_cb_setup_simple() Most drivers do the same thing to set up the flow block callbacks, this patch adds a helper function to do this. This preparation patch reduces the number of changes to adapt the existing drivers to use the flow block callback API. This new helper function takes a flow block list per-driver, which is set to NULL until this driver list is used. This patch also introduces the flow_block_command and flow_block_binder_type enumerations, which are renamed to use FLOW_BLOCK_* in follow up patches. There are three definitions (aliases) in order to reduce the number of updates in this patch, which go away once drivers are fully adapted to use this flow block API. Signed-off-by: Pablo Neira Ayuso Reviewed-by: Jakub Kicinski Signed-off-by: David S. Miller commit 4c73cbdff1119d088ed16d63def59ad32b11b18f Author: James Smart Date: Fri Jun 28 17:26:08 2019 -0700 nvme-fc: fix module unloads while lports still pending Current code allows the module to be unloaded even if there are pending data structures, such as localports and controllers on the localports, that have yet to hit their reference counting to remove them. Fix by having exit entrypoint explicitly delete every controller, which in turn will remove references on the remoteports and localports causing them to be deleted as well. The exit entrypoint, after initiating the deletes, will wait for the last localport to be deleted before continuing. Signed-off-by: James Smart Signed-off-by: Christoph Hellwig commit 2bb295f3a5e612b36ccf5986b529a8d4b426cf4f Merge: 03a49a14a78d d413779cdd93 Author: David S. Miller Date: Tue Jul 9 14:29:27 2019 -0700 Merge branch 'net-hisilicon-Add-support-for-HI13X1-to-hip04_eth' Jiangfeng Xiao says: ==================== net: hisilicon: Add support for HI13X1 to hip04_eth The main purpose of this patch series is to extend the hip04_eth driver to support HI13X1_GMAC. The offset and bitmap of some registers of HI13X1_GMAC are different from hip04_eth common soc. In addition, the definition of send descriptor and parsing descriptor are different from hip04_eth common soc. So the macro of the register offset is redefined to adapt the HI13X1_GMAC. Clean up the sparse warning by the way. Change since v1: * Add a cover letter. ==================== Signed-off-by: David S. Miller commit d413779cdd934cc3bd281a90df865f5d9bd958a8 Author: Jiangfeng Xiao Date: Tue Jul 9 11:31:11 2019 +0800 net: hisilicon: Add an tx_desc to adapt HI13X1_GMAC HI13X1 changed the offsets and bitmaps for tx_desc registers in the same peripheral device on different models of the hip04_eth. Signed-off-by: Jiangfeng Xiao Signed-off-by: David S. Miller commit 58f34098cf37cbd88e83a4ad8461fad37212559a Author: Jiangfeng Xiao Date: Tue Jul 9 11:31:10 2019 +0800 net: hisilicon: Add an rx_desc to adapt HI13X1_GMAC HI13X1 changed the offsets and bitmaps for rx_desc registers in the same peripheral device on different models of the hip04_eth. Signed-off-by: Jiangfeng Xiao Signed-off-by: David S. Miller commit b9162d20ed493bc0d5ea3016647d636628e1f9d5 Author: Jiangfeng Xiao Date: Tue Jul 9 11:31:09 2019 +0800 net: hisilicon: Offset buf address to adapt HI13X1_GMAC The buf unit size of HI13X1_GMAC is cache_line_size, which is 64, so the address we write to the buf register needs to be shifted right by 6 bits. The 31st bit of the PPE_CFG_CPU_ADD_ADDR register of HI13X1_GMAC indicates whether to release the buffer of the message, and the low indicates that it is valid. Signed-off-by: Jiangfeng Xiao Signed-off-by: David S. Miller commit 06ddc0d8d7fc43d872c3d1c9399050e40ddbec4d Author: Jiangfeng Xiao Date: Tue Jul 9 11:31:08 2019 +0800 net: hisilicon: Add group field to adapt HI13X1_GMAC In general, group is the same as the port, but some boards specify a special group for better load balancing of each processing unit. Signed-off-by: Jiangfeng Xiao Signed-off-by: David S. Miller commit bf96244074d9d0dc1b9ab0c9a6d95ae7b6ad628d Author: Jiangfeng Xiao Date: Tue Jul 9 11:31:07 2019 +0800 net: hisilicon: dt-bindings: Add an field of port-handle In general, group is the same as the port, but some boards specify a special group for better load balancing of each processing unit. Signed-off-by: Jiangfeng Xiao Signed-off-by: David S. Miller commit 24eca4b4c0052b5dda9cb8efc804b8c4c044cfd4 Author: Jiangfeng Xiao Date: Tue Jul 9 11:31:06 2019 +0800 net: hisilicon: HI13X1_GMAX need dreq reset at first HI13X1_GMAC delete request for soft reset at first, otherwise, the subsequent initialization will not take effect. Signed-off-by: Jiangfeng Xiao Signed-off-by: David S. Miller commit 0331f8550c504aea34c3ab9198f7324ee8b567b8 Author: Jiangfeng Xiao Date: Tue Jul 9 11:31:05 2019 +0800 net: hisilicon: HI13X1_GMAX skip write LOCAL_PAGE_REG HI13X1_GMAC changed the offsets and bitmaps for GE_TX_LOCAL_PAGE_REG registers in the same peripheral device on different models of the hip04_eth. With the default configuration, HI13X1_GMAC can also work without any writes to the GE_TX_LOCAL_PAGE_REG register. Signed-off-by: Jiangfeng Xiao Signed-off-by: David S. Miller commit a8edf5257449468de328f4f5d9c03be65b9828c9 Author: Jiangfeng Xiao Date: Tue Jul 9 11:31:04 2019 +0800 net: hisilicon: Cleanup for cast to restricted __be32 This patch fixes the following warning from sparse: hip04_eth.c:533:23: warning: cast to restricted __be16 hip04_eth.c:533:23: warning: cast to restricted __be16 hip04_eth.c:533:23: warning: cast to restricted __be16 hip04_eth.c:533:23: warning: cast to restricted __be16 hip04_eth.c:534:23: warning: cast to restricted __be32 hip04_eth.c:534:23: warning: cast to restricted __be32 hip04_eth.c:534:23: warning: cast to restricted __be32 hip04_eth.c:534:23: warning: cast to restricted __be32 hip04_eth.c:534:23: warning: cast to restricted __be32 hip04_eth.c:534:23: warning: cast to restricted __be32 Signed-off-by: Jiangfeng Xiao Signed-off-by: David S. Miller commit 148233ec83e42a8f5298bec43c15819db01076a7 Author: Jiangfeng Xiao Date: Tue Jul 9 11:31:03 2019 +0800 net: hisilicon: Cleanup for got restricted __be32 This patch fixes the following warning from sparse: hip04_eth.c:468:25: warning: incorrect type in assignment hip04_eth.c:468:25: expected unsigned int [usertype] send_addr hip04_eth.c:468:25: got restricted __be32 [usertype] hip04_eth.c:469:25: warning: incorrect type in assignment hip04_eth.c:469:25: expected unsigned int [usertype] send_size hip04_eth.c:469:25: got restricted __be32 [usertype] hip04_eth.c:470:19: warning: incorrect type in assignment hip04_eth.c:470:19: expected unsigned int [usertype] cfg hip04_eth.c:470:19: got restricted __be32 [usertype] hip04_eth.c:472:23: warning: incorrect type in assignment hip04_eth.c:472:23: expected unsigned int [usertype] wb_addr hip04_eth.c:472:23: got restricted __be32 [usertype] Signed-off-by: Jiangfeng Xiao Signed-off-by: David S. Miller commit 2ede8489c1a9a29f7849cd8810b533009b6fd198 Author: Jiangfeng Xiao Date: Tue Jul 9 11:31:02 2019 +0800 net: hisilicon: Add support for HI13X1 to hip04_eth Extend the hip04_eth driver to support HI13X1_GMAC. Enable it with CONFIG_HI13X1_GMAC option. Signed-off-by: Jiangfeng Xiao Signed-off-by: David S. Miller commit 37c15219599f7a4baa73f6e3432afc69ba7cc530 Author: Mikhail Skorzhinskii Date: Mon Jul 8 12:31:29 2019 +0200 nvme-tcp: don't use sendpage for SLAB pages According to commit a10674bf2406 ("tcp: detecting the misuse of .sendpage for Slab objects") and previous discussion, tcp_sendpage should not be used for pages that is managed by SLAB, as SLAB is not taking page reference counters into consideration. Signed-off-by: Mikhail Skorzhinskii Reviewed-by: Sagi Grimberg Signed-off-by: Christoph Hellwig commit 958f2a0f8121ae36a5cbff383ab94fadf1fba5eb Author: Mikhail Skorzhinskii Date: Thu Jul 4 09:59:18 2019 +0200 nvme-tcp: set the STABLE_WRITES flag when data digests are enabled There was a few false alarms sighted on target side about wrong data digest while performing high throughput load to XFS filesystem shared through NVMoF TCP. This flag tells the rest of the kernel to ensure that the data buffer does not change while the write is in flight. It incurs a performance penalty, so only enable it when it is actually needed, i.e. when we are calculating data digests. Although even with this change in place, ext2 users can steel experience false positives, as ext2 is not respecting this flag. This may be apply to vfat as well. Signed-off-by: Mikhail Skorzhinskii Signed-off-by: Mike Playle Reviewed-by: Sagi Grimberg Signed-off-by: Christoph Hellwig commit 5ba895033b8e8257451e6f85e6e516c3b3ce1a68 Author: Mikhail Skorzhinskii Date: Thu Jul 4 10:01:48 2019 +0200 nvmet: print a hint while rejecting NSID 0 or 0xffffffff Adding this hint for the sake of convenience. It was spotted that a few times people spent some time before understanding what is exactly wrong in configuration process. This should save a few time in such situations, especially for people who is not very confident with NVMe requirements. Signed-off-by: Mikhail Skorzhinskii Reviewed-by: Sagi Grimberg Signed-off-by: Christoph Hellwig commit 04e70bd4a0264a3d488a9eff6e116d7dc9a77967 Author: Hannes Reinecke Date: Thu Jul 4 08:10:47 2019 +0200 nvme-multipath: do not select namespaces which are about to be removed nvme_ns_remove() will first set the NVME_NS_REMOVING flag before removing it from the list at the very last step. So to avoid selecting a namespace in nvme_find_path() which is about to be removed check the NVME_NS_REMOVING flag, too, when selecting a new path. Signed-off-by: Hannes Reinecke Signed-off-by: Christoph Hellwig commit 03a49a14a78da6f782fa14c7149a32da0259cd1c Merge: 6ec3d4d2257e b8ef7020d6e5 Author: David S. Miller Date: Tue Jul 9 14:17:59 2019 -0700 Merge branch 'stmmac-hash-table' Biao Huang says: ==================== stmmac: fix out-of-boundary issue and add taller hash table support Fix mac address out-of-boundary issue in net-next tree. and resend the patch which was discussed in https://lore.kernel.org/patchwork/patch/1082117 but with no further progress. ==================== Signed-off-by: David S. Miller commit b8ef7020d6e552cfa5a29e7a411667f636d73185 Author: Biao Huang Date: Tue Jul 9 10:36:23 2019 +0800 net: stmmac: add support for hash table size 128/256 in dwmac4 1. get hash table size in hw feature reigster, and add support for taller hash table(128/256) in dwmac4. 2. only clear GMAC_PACKET_FILTER bits used in this function, to avoid side effect to functions of other bits. stmmac selftests output log with flow control on: ethtool -t eth0 The test result is PASS The test extra info: 1. MAC Loopback 0 2. PHY Loopback -95 3. MMC Counters 0 4. EEE -95 5. Hash Filter MC 0 6. Perfect Filter UC 0 7. MC Filter 0 8. UC Filter 0 9. Flow Control 0 Signed-off-by: Biao Huang Signed-off-by: David S. Miller commit efd58adf8f1fc8e9bd2b822d23eb3b603f3aec90 Author: Biao Huang Date: Tue Jul 9 10:36:22 2019 +0800 net: stmmac: dwmac4: mac address array boudary violation issue The mac address array size is GMAC_MAX_PERFECT_ADDRESSES, so the 'reg' should be less than it, or will affect other registers. Signed-off-by: Biao Huang Signed-off-by: David S. Miller commit 2032d074716a811440aa9cd2e971a0716646d6af Author: Hannes Reinecke Date: Thu Jul 4 08:10:46 2019 +0200 nvme-multipath: also check for a disabled path if there is a single sibling When we have a singular list in nvme_round_robin_path() we still need to check its validity. Signed-off-by: Hannes Reinecke Signed-off-by: Christoph Hellwig commit ca7ae5c966bd4c00626d6ba05d68219f3c1fba36 Author: Hannes Reinecke Date: Thu Jul 4 08:10:46 2019 +0200 nvme-multipath: factor out a nvme_path_is_disabled helper Factor our a common helper to check if a path has been disabled by something other than the per-namespace ANA state. Signed-off-by: Hannes Reinecke [hch: split from a bigger patch] Signed-off-by: Christoph Hellwig commit 81adb863349157c67ccec871e5ae5574600c50be Author: Bart Van Assche Date: Fri Jun 28 09:53:31 2019 -0700 nvme: set physical block size and optimal I/O size >From the NVMe 1.4 spec: NSFEAT bit 4 if set to 1: indicates that the fields NPWG, NPWA, NPDG, NPDA, and NOWS are defined for this namespace and should be used by the host for I/O optimization; [ ... ] Namespace Preferred Write Granularity (NPWG): This field indicates the smallest recommended write granularity in logical blocks for this namespace. This is a 0's based value. The size indicated should be less than or equal to Maximum Data Transfer Size (MDTS) that is specified in units of minimum memory page size. The value of this field may change if the namespace is reformatted. The size should be a multiple of Namespace Preferred Write Alignment (NPWA). Refer to section 8.25 for how this field is utilized to improve performance and endurance. [ ... ] Each Write, Write Uncorrectable, or Write Zeroes commands should address a multiple of Namespace Preferred Write Granularity (NPWG) (refer to Figure 245) and Stream Write Size (SWS) (refer to Figure 515) logical blocks (as expressed in the NLB field), and the SLBA field of the command should be aligned to Namespace Preferred Write Alignment (NPWA) (refer to Figure 245) for best performance. Signed-off-by: Bart Van Assche Reviewed-by: Hannes Reinecke Signed-off-by: Christoph Hellwig commit 6605bdd59c21bb34c8f14ac4d6f2d419185f3528 Author: Bart Van Assche Date: Fri Jun 28 09:53:29 2019 -0700 nvme: add I/O characteristics fields Several new fields have been introduced in version 1.4 of the NVMe spec at offsets that were defined as reserved in version 1.3d of the NVMe spec. Update the definition of the nvme_id_ns data structure such that it is in sync with version 1.4 of the NVMe spec. This change preserves backwards compatibility. Signed-off-by: Bart Van Assche Reviewed-by: Keith Busch Reviewed-by: Chaitanya Kulkarni Reviewed-by: Martin K. Petersen Reviewed-by: Hannes Reinecke Signed-off-by: Christoph Hellwig commit 9d05a96e298aadb36e3ec971fab8d416e6fb7331 Author: Bart Van Assche Date: Fri Jun 28 09:53:30 2019 -0700 nvmet: export I/O characteristics attributes in Identify Make the NVMe NAWUN, NAWUPF, NACWU, NPWG, NPWA, NPDG and NOWS attributes available to initator systems for the block backend. Signed-off-by: Bart Van Assche Reviewed-by: Martin K. Petersen Reviewed-by: Hannes Reinecke Signed-off-by: Christoph Hellwig commit 4c0181bf6cc81716102308dc47779ad1f5aeded2 Author: Tom Wu Date: Thu Jul 4 10:19:54 2019 +0000 nvme-trace: add delete completion and submission queue to admin cmds tracer The trace log for 'delete I/O submission queue' and 'delete I/O completion queue' command will look like as below: kworker/u49:1-3438 [003] .... 6693.070865: nvme_setup_cmd: nvme0: qid=0, cmdid=11, nsid=0, flags=0x0, meta=0x0, cmd=(nvme_admin_delete_sq sqid=1) kworker/u49:1-3438 [003] .... 6693.071171: nvme_setup_cmd: nvme0: qid=0, cmdid=8, nsid=0, flags=0x0, meta=0x0, cmd=(nvme_admin_delete_cq cqid=24) Signed-off-by: Tom Wu Reviewed-by: Max Gurtovoy Reviewed-by: Minwoo Im Reviewed-by: Israel Rukshin Signed-off-by: Christoph Hellwig commit 6ec3d4d2257e4101a8bbd809158093ef9a759144 Merge: a1cd4e4324af 14e5175e9e04 Author: David S. Miller Date: Tue Jul 9 14:07:20 2019 -0700 Merge branch 'tc-testing-Add-plugin-for-simple-traffic-generation' Lucas Bates says: ==================== tc-testing: Add plugin for simple traffic generation This series supersedes the previous submission that included a patch for test case verification using JSON output. It adds a new tdc plugin, scapyPlugin, as a way to send traffic to test tc filters and actions. The first patch makes a change to the TdcPlugin module that will allow tdc plugins to examine the test case currently being executed, so plugins can play a more active role in testing by accepting information or commands from the test case. This is required for scapyPlugin to work. The second patch adds scapyPlugin itself, and an example test case file to demonstrate how the scapy block works in the test cases. ==================== Signed-off-by: David S. Miller commit 14e5175e9e04a982ef044a0dcdf1484643df1d3a Author: Lucas Bates Date: Mon Jul 8 21:34:27 2019 -0400 tc-testing: introduce scapyPlugin for basic traffic The scapyPlugin allows for simple traffic generation in tdc to test various tc features. It was tested with scapy v2.4.2, but should work with any successive version. In order to use the plugin's functionality, scapy must be installed. This can be done with: pip3 install scapy or to install 2.4.2: pip3 install scapy==2.4.2 If the plugin is unable to import the scapy module, it will terminate the tdc run. The plugin makes use of a new key in the test case data, 'scapy'. This block contains three other elements: 'iface', 'count', and 'packet': "scapy": { "iface": "$DEV0", "count": 1, "packet": "Ether(type=0x800)/IP(src='16.61.16.61')/ICMP()" }, * iface is the name of the device on the host machine from which the packet(s) will be sent. Values contained within tdc_config.py's NAMES dict can be used here - this is useful if paired with nsPlugin * count is the number of copies of this packet to be sent * packet is a string detailing the different layers of the packet to be sent. If a property isn't explicitly set, scapy will set default values for you. Layers in the packet info are separated by slashes. For info about common TCP and IP properties, see: https://blogs.sans.org/pen-testing/files/2016/04/ScapyCheatSheet_v0.2.pdf Caution is advised when running tests using the scapy functionality, since the plugin blindly sends the packet as defined in the test case data. See creating-testcases/scapy-example.json for sample test cases; the first test is intended to pass while the second is intended to fail. Signed-off-by: Lucas Bates Signed-off-by: David S. Miller commit a7d50a0dd81b09dc13fa9e4b55765e8684bc8226 Author: Lucas Bates Date: Mon Jul 8 21:34:26 2019 -0400 tc-testing: Allow tdc plugins to see test case data Instead of only passing the test case name and ID, pass the entire current test case down to the plugins. This change allows plugins to start accepting commands and directives from the test cases themselves, for greater flexibility in testing. Signed-off-by: Lucas Bates Signed-off-by: David S. Miller commit 91f6d7985310a5dc420066004142c54da2c627d8 Author: Colin Ian King Date: Wed Jun 26 13:43:23 2019 +0100 nvme-trace: fix spelling mistake "spcecific" -> "specific" There are two spelling mistakes in trace_seq_printf messages, fix these. Signed-off-by: Colin Ian King Reviewed-by: Minwoo Im Signed-off-by: Christoph Hellwig commit 7637de311bd2124b298a072852448b940d8a34b9 Author: Christoph Hellwig Date: Wed Jul 3 09:54:44 2019 -0700 nvme-pci: limit max_hw_sectors based on the DMA max mapping size When running a NVMe device that is attached to a addressing challenged PCIe root port that requires bounce buffering, our request sizes can easily overflow the swiotlb bounce buffer size. Limit the maximum I/O size to the limit exposed by the DMA mapping subsystem. Signed-off-by: Christoph Hellwig Reported-by: Atish Patra Tested-by: Atish Patra Reviewed-by: Sagi Grimberg commit bfac8e9f55cf62a000b643a0081488badbe92d96 Author: Alan Mikhak Date: Mon Jul 8 10:05:11 2019 -0700 nvme-pci: check for NULL return from pci_alloc_p2pmem() Modify nvme_alloc_sq_cmds() to call pci_free_p2pmem() to free the memory it allocated using pci_alloc_p2pmem() in case pci_p2pmem_virt_to_bus() returns null. Makes sure not to call pci_free_p2pmem() if pci_alloc_p2pmem() returned NULL, which can happen if CONFIG_PCI_P2PDMA is not configured. The current implementation is not expected to leak since pci_p2pmem_virt_to_bus() is expected to fail only if pci_alloc_p2pmem() returns null. However, checking the return value of pci_alloc_p2pmem() is more explicit. Signed-off-by: Alan Mikhak Signed-off-by: Christoph Hellwig commit 0298d5435276e7795b0b939d74827f6e775e7009 Author: Alan Mikhak Date: Mon Jul 8 10:24:12 2019 -0700 nvme-pci: don't create a read hctx mapping without read queues Only request an IRQ mapping for read queues if at least one read queue is being allocted, as nvme_pci_map_queues() will later on ignore the unnecessary mapping request should nvme_dev_add() request such an IRQ mapping even though no read queues are being allocated. However, nvme_dev_add() can avoid making the request by checking the number of read queues without assuming. This would bring it more in line with nvme_setup_irqs() and nvme_calc_irq_sets(). Signed-off-by: Alan Mikhak Signed-off-by: Christoph Hellwig commit 4fe06923f5181d57178e01add4ba54e269c59e9e Author: Christoph Hellwig Date: Fri Jun 28 09:17:48 2019 +0200 nvme-pci: don't fall back to a 32-bit DMA mask Since Linux 5.0 drivers can safely set the largest DMA mask supported by the device, and don't need fallbacks to work around the dma mapping implementations. Signed-off-by: Christoph Hellwig Reviewed-by: Sagi Grimberg commit ecc606103837b98a2b665e8f14e533a6c72bbdc0 Author: Peter Zijlstra Date: Mon Jul 8 15:55:30 2019 -0500 x86/alternatives: Fix int3_emulate_call() selftest stack corruption KASAN shows the following splat during boot: BUG: KASAN: unknown-crash in unwind_next_frame+0x3f6/0x490 Read of size 8 at addr ffffffff84007db0 by task swapper/0 CPU: 0 PID: 0 Comm: swapper Tainted: G T 5.2.0-rc6-00013-g7457c0d #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1 04/01/2014 Call Trace: dump_stack+0x19/0x1b print_address_description+0x1b0/0x2b2 __kasan_report+0x10f/0x171 kasan_report+0x12/0x1c __asan_load8+0x54/0x81 unwind_next_frame+0x3f6/0x490 unwind_next_frame+0x1b/0x23 arch_stack_walk+0x68/0xa5 stack_trace_save+0x7b/0xa0 save_trace+0x3c/0x93 mark_lock+0x1ef/0x9b1 lock_acquire+0x122/0x221 __mutex_lock+0xb6/0x731 mutex_lock_nested+0x16/0x18 _vm_unmap_aliases+0x141/0x183 vm_unmap_aliases+0x14/0x16 change_page_attr_set_clr+0x15e/0x2f2 set_memory_4k+0x2a/0x2c check_bugs+0x11fd/0x1298 start_kernel+0x793/0x7eb x86_64_start_reservations+0x55/0x76 x86_64_start_kernel+0x87/0xaa secondary_startup_64+0xa4/0xb0 Memory state around the buggy address: ffffffff84007c80: 00 00 00 00 00 00 00 00 00 00 00 00 00 f1 f1 f1 ffffffff84007d00: f1 00 00 00 00 00 00 00 00 00 f2 f2 f2 f3 f3 f3 >ffffffff84007d80: f3 79 be 52 49 79 be 00 00 00 00 00 00 00 00 f1 It turns out that int3_selftest() is corrupting the stack. The problem is that the KASAN-ified version of int3_magic() is much less trivial than the C code appears. It clobbers several unexpected registers. So when the selftest's INT3 is converted to an emulated call to int3_magic(), the registers are clobbered and Bad Things happen when the function returns. Fix this by converting int3_magic() to the trivial ASM function it should be, avoiding all calling convention issues. Also add ASM_CALL_CONSTRAINT to the INT3 ASM, since it contains a 'CALL'. [peterz: cribbed changelog from josh] Fixes: 7457c0da024b ("x86/alternatives: Add int3_emulate_call() selftest") Reported-by: kernel test robot Debugged-by: Josh Poimboeuf Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Thomas Gleixner Reviewed-by: Josh Poimboeuf Cc: Linus Torvalds Cc: Andy Lutomirski Link: https://lkml.kernel.org/r/20190709125744.GB3402@hirez.programming.kicks-ass.net commit a4c0b3decb33fb4a2b5ecc6234a50680f0b21e7d Author: Jackie Liu Date: Mon Jul 8 13:41:12 2019 +0800 io_uring: fix io_sq_thread_stop running in front of io_sq_thread INFO: task syz-executor.5:8634 blocked for more than 143 seconds. Not tainted 5.2.0-rc5+ #3 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. syz-executor.5 D25632 8634 8224 0x00004004 Call Trace: context_switch kernel/sched/core.c:2818 [inline] __schedule+0x658/0x9e0 kernel/sched/core.c:3445 schedule+0x131/0x1d0 kernel/sched/core.c:3509 schedule_timeout+0x9a/0x2b0 kernel/time/timer.c:1783 do_wait_for_common+0x35e/0x5a0 kernel/sched/completion.c:83 __wait_for_common kernel/sched/completion.c:104 [inline] wait_for_common kernel/sched/completion.c:115 [inline] wait_for_completion+0x47/0x60 kernel/sched/completion.c:136 kthread_stop+0xb4/0x150 kernel/kthread.c:559 io_sq_thread_stop fs/io_uring.c:2252 [inline] io_finish_async fs/io_uring.c:2259 [inline] io_ring_ctx_free fs/io_uring.c:2770 [inline] io_ring_ctx_wait_and_kill+0x268/0x880 fs/io_uring.c:2834 io_uring_release+0x5d/0x70 fs/io_uring.c:2842 __fput+0x2e4/0x740 fs/file_table.c:280 ____fput+0x15/0x20 fs/file_table.c:313 task_work_run+0x17e/0x1b0 kernel/task_work.c:113 tracehook_notify_resume include/linux/tracehook.h:185 [inline] exit_to_usermode_loop arch/x86/entry/common.c:168 [inline] prepare_exit_to_usermode+0x402/0x4f0 arch/x86/entry/common.c:199 syscall_return_slowpath+0x110/0x440 arch/x86/entry/common.c:279 do_syscall_64+0x126/0x140 arch/x86/entry/common.c:304 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x412fb1 Code: 80 3b 7c 0f 84 c7 02 00 00 c7 85 d0 00 00 00 00 00 00 00 48 8b 05 cf a6 24 00 49 8b 14 24 41 b9 cb 2a 44 00 48 89 ee 48 89 df <48> 85 c0 4c 0f 45 c8 45 31 c0 31 c9 e8 0e 5b 00 00 85 c0 41 89 c7 RSP: 002b:00007ffe7ee6a180 EFLAGS: 00000293 ORIG_RAX: 0000000000000003 RAX: 0000000000000000 RBX: 0000000000000004 RCX: 0000000000412fb1 RDX: 0000001b2d920000 RSI: 0000000000000000 RDI: 0000000000000003 RBP: 0000000000000001 R08: 00000000f3a3e1f8 R09: 00000000f3a3e1fc R10: 00007ffe7ee6a260 R11: 0000000000000293 R12: 000000000075c9a0 R13: 000000000075c9a0 R14: 0000000000024c00 R15: 000000000075bf2c ============================================= There is an wrong logic, when kthread_park running in front of io_sq_thread. CPU#0 CPU#1 io_sq_thread_stop: int kthread(void *_create): kthread_park() __kthread_parkme(self); <<< Wrong kthread_stop() << wait for self->exited << clear_bit KTHREAD_SHOULD_PARK ret = threadfn(data); | |- io_sq_thread |- kthread_should_park() << false |- schedule() <<< nobody wake up stuck CPU#0 stuck CPU#1 So, use a new variable sqo_thread_started to ensure that io_sq_thread run first, then io_sq_thread_stop. Reported-by: syzbot+94324416c485d422fe15@syzkaller.appspotmail.com Suggested-by: Jens Axboe Signed-off-by: Jackie Liu Signed-off-by: Jens Axboe commit aa1fa28fc73ea6b740ee7b62bf3b07141883dbb8 Author: Jens Axboe Date: Fri Apr 19 13:38:09 2019 -0600 io_uring: add support for recvmsg() This is done through IORING_OP_RECVMSG. This opcode uses the same sqe->msg_flags that IORING_OP_SENDMSG added, and we pass in the msghdr struct in the sqe->addr field as well. We use MSG_DONTWAIT to force an inline fast path if recvmsg() doesn't block, and punt to async execution if it would have. Acked-by: David S. Miller Signed-off-by: Jens Axboe commit 0fa03c624d8fc9932d0f27c39a9deca6a37e0e17 Author: Jens Axboe Date: Fri Apr 19 13:34:07 2019 -0600 io_uring: add support for sendmsg() This is done through IORING_OP_SENDMSG. There's a new sqe->msg_flags for the flags argument, and the msghdr struct is passed in the sqe->addr field. We use MSG_DONTWAIT to force an inline fast path if sendmsg() doesn't block, and punt to async execution if it would have. Acked-by: David S. Miller Signed-off-by: Jens Axboe commit a1cd4e4324afa4d8a2d6d0ce16bc689d6bab02cc Author: Arnd Bergmann Date: Tue Jul 9 20:55:55 2019 +0200 net: dsa: vsc73xx: fix NET_DSA and OF dependencies The restructuring of the driver got the dependencies wrong: without CONFIG_NET_DSA we get this build failure: WARNING: unmet direct dependencies detected for NET_DSA_VITESSE_VSC73XX Depends on [n]: NETDEVICES [=y] && HAVE_NET_DSA [=y] && OF [=y] && NET_DSA [=n] Selected by [m]: - NET_DSA_VITESSE_VSC73XX_PLATFORM [=m] && NETDEVICES [=y] && HAVE_NET_DSA [=y] && HAS_IOMEM [=y] ERROR: "dsa_unregister_switch" [drivers/net/dsa/vitesse-vsc73xx-core.ko] undefined! ERROR: "dsa_switch_alloc" [drivers/net/dsa/vitesse-vsc73xx-core.ko] undefined! ERROR: "dsa_register_switch" [drivers/net/dsa/vitesse-vsc73xx-core.ko] undefined! Add the appropriate dependencies. Fixes: 95711cd5f0b4 ("net: dsa: vsc73xx: Split vsc73xx driver") Signed-off-by: Arnd Bergmann Signed-off-by: David S. Miller commit 21774222324e018f064d4fbb661e3c09c2bcaad0 Author: YueHaibing Date: Wed Jun 26 10:09:02 2019 +0800 nvme-pci: make nvme_dev_pm_ops static Fix sparse warning: drivers/nvme/host/pci.c:2926:25: warning: symbol 'nvme_dev_pm_ops' was not declared. Should it be static? Reported-by: Hulk Robot Signed-off-by: YueHaibing Reviewed-by: Minwoo Im Reviewed-by: Chaitanya Kulkarni Signed-off-by: Christoph Hellwig commit e0620bf858d3f5e7121d9e429cf7a8f04ab29bf7 Author: James Smart Date: Thu Jun 20 13:17:01 2019 -0700 nvme-fcloop: resolve warnings on RCU usage and sleep warnings With additional debugging enabled, seeing warnings for suspicious RCU usage or Sleeping function called from invalid context. These both map to allocation of a work structure which is currently GFP_KERNEL, meaning it can sleep. For the RCU warning, the sequence was sleeping while holding the RCU lock. Convert the allocation to GFP_ATOMIC. Signed-off-by: James Smart Reviewed-by: Minwoo Im Signed-off-by: Christoph Hellwig commit c38dbbfab1bc47b0f3a1eceea0fa45e44c477092 Author: James Smart Date: Thu Jun 20 13:07:00 2019 -0700 nvme-fcloop: fix inconsistent lock state warnings With extra debug on, inconsistent lock state warnings are being called out as the tfcp_req->reqlock is being taken out without irq, while some calling sequences have the sequence in a softirq state. Change the lock taking/release to raise/drop irq. Signed-off-by: James Smart Reviewed-by: Minwoo Im Signed-off-by: Christoph Hellwig commit 1cadfc5877f15a14a77f4161f3ce9f436a39116d Author: Claire Chang Date: Wed Jun 19 16:41:10 2019 +0800 dt-bindings: serial: add documentation for Rx in-band wakeup support To support Rx in-band wakeup, one must create an interrupt specifier with edge sensitivity on Rx pin and an addtional pinctrl to reconfigure Rx pin to normal GPIO in sleep state. Driver will switch to sleep mode pinctrl and enable irq wake before suspend and restore to default settings when resuming. Signed-off-by: Claire Chang Signed-off-by: Rob Herring commit 0488e2723babf8f09086fa3ce091984febe5fb28 Merge: 7715ff164713 433a06d7d74e Author: David S. Miller Date: Tue Jul 9 13:03:04 2019 -0700 Merge branch 'Armada-8040-SoC-in-orion-mdio-hang' Josua Mayer says: ==================== Fix hang of Armada 8040 SoC in orion-mdio With a modular kernel as configured by Debian a hang was observed with the Armada 8040 SoC in the Clearfog GT and Macchiatobin boards. The 8040 SoC actually requires four clocks to be enabled for the mdio interface to function. All 4 clocks are already specified in armada-cp110.dtsi. It has however been missed that the orion-mdio driver only supports enabling up to three clocks. This patch-set allows the orion-mdio driver to handle four clocks and adds a warning when more clocks are specified to prevent this particular oversight in the future. Changes since v1: - fixed condition for priting the warning (Andrew Lunn) - rephrased commit description for deferred probing (Andrew Lunn) - fixed compiler warnings (kbuild test robot) ==================== Signed-off-by: David S. Miller commit 433a06d7d74e677c40b1148c70c48677ff62fb6b Author: Josua Mayer Date: Tue Jul 9 15:01:01 2019 +0200 net: mvmdio: defer probe of orion-mdio if a clock is not ready Defer probing of the orion-mdio interface when getting a clock returns EPROBE_DEFER. This avoids locking up the Armada 8k SoC when mdio is used before all clocks have been enabled. Signed-off-by: Josua Mayer Reviewed-by: Andrew Lunn Signed-off-by: David S. Miller commit ea664b1bdc19f3884f9d2966b106b3ca8d253426 Author: Josua Mayer Date: Tue Jul 9 15:01:00 2019 +0200 net: mvmdio: print warning when orion-mdio has too many clocks Print a warning when device tree specifies more than the maximum of four clocks supported by orion-mdio. Because reading from mdio can lock up the Armada 8k when a required clock is not initialized, it is important to notify the user when a specified clock is ignored. Signed-off-by: Josua Mayer Reviewed-by: Andrew Lunn Signed-off-by: David S. Miller commit 4aabed699c400810981d3dda170f05fa4d782905 Author: Josua Mayer Date: Tue Jul 9 15:00:59 2019 +0200 net: mvmdio: allow up to four clocks to be specified for orion-mdio Allow up to four clocks to be specified and enabled for the orion-mdio interface, which are required by the Armada 8k and defined in armada-cp110.dtsi. Fixes a hang in probing the mvmdio driver that was encountered on the Clearfog GT 8K with all drivers built as modules, but also affects other boards such as the MacchiatoBIN. Cc: stable@vger.kernel.org Fixes: 96cb43423822 ("net: mvmdio: allow up to three clocks to be specified for orion-mdio") Reviewed-by: Andrew Lunn Signed-off-by: Josua Mayer Signed-off-by: David S. Miller commit 80785f5a22e9073e2ded5958feb7f220e066d17b Author: Josua Mayer Date: Tue Jul 9 15:00:58 2019 +0200 dt-bindings: allow up to four clocks for orion-mdio Armada 8040 needs four clocks to be enabled for MDIO accesses to work. Update the binding to allow the extra clock to be specified. Cc: stable@vger.kernel.org Fixes: 6d6a331f44a1 ("dt-bindings: allow up to three clocks for orion-mdio") Reviewed-by: Andrew Lunn Signed-off-by: Josua Mayer Signed-off-by: David S. Miller commit 7715ff1647139bc87aa20bd456ac4f143411b377 Author: Ilias Apalodimas Date: Tue Jul 9 15:35:53 2019 +0300 net: netsec: start using buffers if page_pool registration succeeded The current driver starts using page_pool buffers before calling xdp_rxq_info_reg_mem_model(). Start using the buffers after the registration succeeded, so we won't have to call page_pool_request_shutdown() in case of failure Fixes: 5c67bf0ec4d0 ("net: netsec: Use page_pool API") Signed-off-by: Ilias Apalodimas Signed-off-by: David S. Miller commit c3e78a3403dabcb7115c2fb7b538a1095d168cd5 Author: Arnaldo Carvalho de Melo Date: Tue Jul 9 16:36:45 2019 -0300 perf trace: Auto bump rlimit(MEMLOCK) for eBPF maps sake Circa v5.2 this started to fail: # perf trace -e /wb/augmented_raw_syscalls.o event syntax error: '/wb/augmented_raw_syscalls.o' \___ Operation not permitted (add -v to see detail) Run 'perf list' for a list of valid events Usage: perf trace [] [] or: perf trace [] -- [] or: perf trace record [] [] or: perf trace record [] -- [] -e, --event event/syscall selector. use 'perf list' to list available events # In verbose mode we some -EPERM when creating a BPF map: # perf trace -v -e /wb/augmented_raw_syscalls.o libbpf: failed to create map (name: '__augmented_syscalls__'): Operation not permitted libbpf: failed to load object '/wb/augmented_raw_syscalls.o' bpf: load objects failed: err=-1: (Operation not permitted) event syntax error: '/wb/augmented_raw_syscalls.o' \___ Operation not permitted (add -v to see detail) Run 'perf list' for a list of valid events Usage: perf trace [] [] or: perf trace [] -- [] or: perf trace record [] [] or: perf trace record [] -- [] -e, --event event/syscall selector. use 'perf list' to list available events # If we bumped 'ulimit -l 128' to get it from the 64k default to double that, it worked, so use the recently added rlimit__bump_memlock() helper: # perf trace -e /wb/augmented_raw_syscalls.o -e open*,*sleep sleep 1 0.000 ( 0.007 ms): sleep/28042 openat(dfd: CWD, filename: "/etc/ld.so.cache", flags: RDONLY|CLOEXEC) = 3 0.022 ( 0.004 ms): sleep/28042 openat(dfd: CWD, filename: "/lib64/libc.so.6", flags: RDONLY|CLOEXEC) = 3 0.201 ( 0.007 ms): sleep/28042 openat(dfd: CWD, filename: "", flags: RDONLY|CLOEXEC) = 3 0.241 (1000.421 ms): sleep/28042 nanosleep(rqtp: 0x7ffd6c3e6ed0) = 0 # Cc: Adrian Hunter Cc: Alexei Starovoitov Cc: Daniel Borkmann Cc: Jiri Olsa Cc: Namhyung Kim Link: https://lkml.kernel.org/n/tip-j6f2ioa6hj9dinzpjvlhcjoc@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit e9a83bd2322035ed9d7dcf35753d3f984d76c6a5 Merge: 7011b7e1b702 454f96f2b738 Author: Linus Torvalds Date: Tue Jul 9 12:34:26 2019 -0700 Merge tag 'docs-5.3' of git://git.lwn.net/linux Pull Documentation updates from Jonathan Corbet: "It's been a relatively busy cycle for docs: - A fair pile of RST conversions, many from Mauro. These create more than the usual number of simple but annoying merge conflicts with other trees, unfortunately. He has a lot more of these waiting on the wings that, I think, will go to you directly later on. - A new document on how to use merges and rebases in kernel repos, and one on Spectre vulnerabilities. - Various improvements to the build system, including automatic markup of function() references because some people, for reasons I will never understand, were of the opinion that :c:func:``function()`` is unattractive and not fun to type. - We now recommend using sphinx 1.7, but still support back to 1.4. - Lots of smaller improvements, warning fixes, typo fixes, etc" * tag 'docs-5.3' of git://git.lwn.net/linux: (129 commits) docs: automarkup.py: ignore exceptions when seeking for xrefs docs: Move binderfs to admin-guide Disable Sphinx SmartyPants in HTML output doc: RCU callback locks need only _bh, not necessarily _irq docs: format kernel-parameters -- as code Doc : doc-guide : Fix a typo platform: x86: get rid of a non-existent document Add the RCU docs to the core-api manual Documentation: RCU: Add TOC tree hooks Documentation: RCU: Rename txt files to rst Documentation: RCU: Convert RCU UP systems to reST Documentation: RCU: Convert RCU linked list to reST Documentation: RCU: Convert RCU basic concepts to reST docs: filesystems: Remove uneeded .rst extension on toctables scripts/sphinx-pre-install: fix out-of-tree build docs: zh_CN: submitting-drivers.rst: Remove a duplicated Documentation/ Documentation: PGP: update for newer HW devices Documentation: Add section about CPU vulnerabilities for Spectre Documentation: platform: Delete x86-laptop-drivers.txt docs: Note that :c:func: should no longer be used ... commit d8d9ec7dc5abbb3f11d866e983c4984f5c2de9d6 Author: Dag Moxnes Date: Tue Jul 9 13:50:26 2019 +0200 RDMA/core: Fix race when resolving IP address Use the neighbour lock when copying the MAC address from the neighbour data struct in dst_fetch_ha. When not using the lock, it is possible for the function to race with neigh_update(), causing it to copy an torn MAC address: rdma_resolve_addr() rdma_resolve_ip() addr_resolve() addr_resolve_neigh() fetch_ha() dst_fetch_ha() memcpy(dev_addr->dst_dev_addr, n->ha, MAX_ADDR_LEN) and net_ioctl() arp_ioctl() arp_rec_delete() arp_invalidate() neigh_update() __neigh_update() memcpy(&neigh->ha, lladdr, dev->addr_len) It is possible to provoke this error by calling rdma_resolve_addr() in a tight loop, while deleting the corresponding ARP entry in another tight loop. Fixes: 51d45974515c ("infiniband: addr: Consolidate code to fetch neighbour hardware address from dst.") Signed-off-by: Dag Moxnes Signed-off-by: Håkon Bugge Reviewed-by: Jason Gunthorpe Signed-off-by: Jason Gunthorpe commit d3280ce01e21a827daa50b0e9bdc8588c6f855d8 Author: Arnaldo Carvalho de Melo Date: Tue Jul 9 16:27:01 2019 -0300 perf test: Auto bump rlimit(MEMLOCK) for BPF test sake I noticed that the 'perf test bpf' was failing: # perf test bpf 41: BPF filter : 41.1: Basic BPF filtering : Skip 41.2: BPF pinning : Skip 41.3: BPF prologue generation : Skip 41.4: BPF relocation checker : Skip # ulimit -l 64 # Using verbose mode we get just a line bout -EPERF being returned from libbpf's bpf_load_program_xattr(), that ends up being used in 'perf test bpf' initial program loading capability query: Missing basic BPF support, skip this test: Operation not permitted Not that informative, but on a separate problem when creating BPF maps bumping rlimit(MEMLOCK) helped, so I tried it here as well, works: # ulimit -l 128 # perf test bpf 41: BPF filter : 41.1: Basic BPF filtering : Ok 41.2: BPF pinning : Ok 41.3: BPF prologue generation : Ok 41.4: BPF relocation checker : Ok # So use the recently added rlimit__bump_memlock() helper: # ulimit -l 64 # perf test bpf 41: BPF filter : 41.1: Basic BPF filtering : Ok 41.2: BPF pinning : Ok 41.3: BPF prologue generation : Ok 41.4: BPF relocation checker : Ok # ulimit -l 64 # I.e. the bumping of memlock is restricted to the 'perf test' instance, not changing the global value. Cc: Adrian Hunter Cc: Alexei Starovoitov Cc: Daniel Borkmann Cc: Jiri Olsa Cc: Namhyung Kim Link: https://lkml.kernel.org/n/tip-b9fubkhr4jm192lu7y8hgjvo@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 7011b7e1b702cc76f9e969b41d9a95969f2aecaa Merge: 9d22167f3430 4ca96aa99f3e Author: Linus Torvalds Date: Tue Jul 9 12:25:58 2019 -0700 Merge tag 'printk-for-5.3' of git://git.kernel.org/pub/scm/linux/kernel/git/pmladek/printk Pull printk updates from Petr Mladek: - distinguish different legacy clocks again - small clean up * tag 'printk-for-5.3' of git://git.kernel.org/pub/scm/linux/kernel/git/pmladek/printk: lib/vsprintf: Reinstate printing of legacy clock IDs vsprintf: fix data type of variable in string_nocheck() commit 9d22167f34305280c5dd57a74c21651da3c23015 Merge: 593c75463ab6 c5eaab1d131d Author: Linus Torvalds Date: Tue Jul 9 12:24:21 2019 -0700 Merge branch 'next-lsm' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security Pull capabilities update from James Morris: "Minor fixes for capabilities: - Update the commoncap.c code to utilize XATTR_SECURITY_PREFIX_LEN, from Carmeli tamir. - Make the capability hooks static, from Yue Haibing" * 'next-lsm' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security: security/commoncap: Use xattr security prefix len security: Make capability_hooks static commit de90573e30948459a37e32f432e65529573ff757 Merge: 12479f627f7c 2af6106ae949 Author: David S. Miller Date: Tue Jul 9 12:20:08 2019 -0700 Merge branch 'net-stmmac-Some-improvements-and-a-fix' Jose Abreu says: ==================== net: stmmac: Some improvements and a fix Some performace improvements (01/03 and 03/03) and a fix (02/03), all for -next. ==================== Signed-off-by: David S. Miller commit 2af6106ae949651d529c8c3f0734c3a7babd0d4b Author: Jose Abreu Date: Tue Jul 9 10:03:00 2019 +0200 net: stmmac: Introducing support for Page Pool Mapping and unmapping DMA region is an high bottleneck in stmmac driver, specially in the RX path. This commit introduces support for Page Pool API and uses it in all RX queues. With this change, we get more stable troughput and some increase of banwidth with iperf: - MAC1000 - 950 Mbps - XGMAC: 9.22 Gbps Changes from v3: - Use page_pool_destroy() (Ilias) Changes from v2: - Uncoditionally call page_pool_free() (Jesper) Changes from v1: - Use page_pool_get_dma_addr() (Jesper) - Add a comment (Jesper) - Add page_pool_free() call (Jesper) - Reintroduce sync_single_for_device (Arnd / Ilias) Signed-off-by: Jose Abreu Acked-by: Ilias Apalodimas Signed-off-by: David S. Miller commit 06a80a7d09cc3fbecbd44e225e825a37fb806836 Author: Jose Abreu Date: Tue Jul 9 10:02:59 2019 +0200 net: stmmac: Fix descriptors address being in > 32 bits address space Commit a993db88d17d ("net: stmmac: Enable support for > 32 Bits addressing in XGMAC"), introduced support for > 32 bits addressing in XGMAC but the conversion of descriptors to dma_addr_t was left out. As some devices assing coherent memory in regions > 32 bits we need to set lower and upper value of descriptors address when initializing DMA channels. Luckly, this was working for me because I was assigning CMA to < 4GB address space for performance reasons. Fixes: a993db88d17d ("net: stmmac: Enable support for > 32 Bits addressing in XGMAC") Signed-off-by: Jose Abreu Signed-off-by: David S. Miller commit d429b66e2ebcec7099e666bbf14395898f53370e Author: Jose Abreu Date: Tue Jul 9 10:02:58 2019 +0200 net: stmmac: Implement RX Coalesce Frames setting Add support for coalescing RX path by specifying number of frames which don't need to have interrupt on completion bit set. This is only available when RX Watchdog is enabled. Acked-by: Jakub Kicinski Signed-off-by: Jose Abreu Signed-off-by: David S. Miller commit 12479f627f7c2017e6fcd50b56c2537592674c50 Author: Michael Chan Date: Tue Jul 9 03:50:07 2019 -0400 bnxt_en: Add page_pool_destroy() during RX ring cleanup. Add page_pool_destroy() in bnxt_free_rx_rings() during normal RX ring cleanup, as Ilias has informed us that the following commit has been merged: 1da4bbeffe41 ("net: core: page_pool: add user refcnt and reintroduce page_pool_destroy") The special error handling code to call page_pool_free() can now be removed. bnxt_free_rx_rings() will always be called during normal shutdown or any error paths. Fixes: 322b87ca55f2 ("bnxt_en: add page_pool support") Cc: Ilias Apalodimas Cc: Andy Gospodarek Signed-off-by: Michael Chan Acked-by: Andy Gospodarek Signed-off-by: David S. Miller commit 216dcb059b767ef526499f3ed287e98b37af03c3 Merge: f108c887d089 6e52fca36c67 Author: David S. Miller Date: Tue Jul 9 12:12:14 2019 -0700 Merge branch 'net-sched-Introduce-tc-connection-tracking' Paul Blakey says: ==================== net/sched: Introduce tc connection tracking This patch series add connection tracking capabilities in tc sw datapath. It does so via a new tc action, called act_ct, and new tc flower classifier matching on conntrack state, mark and label. Usage is as follows: $ tc qdisc add dev ens1f0_0 ingress $ tc qdisc add dev ens1f0_1 ingress $ tc filter add dev ens1f0_0 ingress \ prio 1 chain 0 proto ip \ flower ip_proto tcp ct_state -trk \ action ct zone 2 pipe \ action goto chain 2 $ tc filter add dev ens1f0_0 ingress \ prio 1 chain 2 proto ip \ flower ct_state +trk+new \ action ct zone 2 commit mark 0xbb nat src addr 5.5.5.7 pipe \ action mirred egress redirect dev ens1f0_1 $ tc filter add dev ens1f0_0 ingress \ prio 1 chain 2 proto ip \ flower ct_zone 2 ct_mark 0xbb ct_state +trk+est \ action ct nat pipe \ action mirred egress redirect dev ens1f0_1 $ tc filter add dev ens1f0_1 ingress \ prio 1 chain 0 proto ip \ flower ip_proto tcp ct_state -trk \ action ct zone 2 pipe \ action goto chain 1 $ tc filter add dev ens1f0_1 ingress \ prio 1 chain 1 proto ip \ flower ct_zone 2 ct_mark 0xbb ct_state +trk+est \ action ct nat pipe \ action mirred egress redirect dev ens1f0_0 The pattern used in the design here closely resembles OvS, as the plan is to also offload OvS conntrack rules to tc. OvS datapath rules uses it's recirculation mechanism to send specific packets to conntrack, and return with the new conntrack state (ct_state) on some other recirc_id to be matched again (we use goto chain for this). This results in the following OvS datapath rules: recirc_id(0),in_port(ens1f0_0),ct_state(-trk),... actions:ct(zone=2),recirc(2) recirc_id(2),in_port(ens1f0_0),ct_state(+new+trk),ct_mark(0xbb),... actions:ct(commit,zone=2,nat(src=5.5.5.7),mark=0xbb),ens1f0_1 recirc_id(2),in_port(ens1f0_0),ct_state(+est+trk),ct_mark(0xbb),... actions:ct(zone=2,nat),ens1f0_1 recirc_id(1),in_port(ens1f0_1),ct_state(-trk),... actions:ct(zone=2),recirc(1) recirc_id(1),in_port(ens1f0_1),ct_state(+est+trk),... actions:ct(zone=2,nat),ens1f0_0 Changelog: See individual patches. ==================== Signed-off-by: David S. Miller commit 6e52fca36c67c608fd8590826e946e1d0da83261 Author: Paul Blakey Date: Tue Jul 9 10:30:51 2019 +0300 tc-tests: Add tc action ct tests Add 13 tests ensuring the command line is doing what is supposed to do. Signed-off-by: Marcelo Ricardo Leitner Signed-off-by: Marcelo Ricardo Leitner Signed-off-by: David S. Miller commit e0ace68af2acfe474bc89a3d9a2e24d700bf245d Author: Paul Blakey Date: Tue Jul 9 10:30:50 2019 +0300 net/sched: cls_flower: Add matching on conntrack info New matches for conntrack mark, label, zone, and state. Signed-off-by: Paul Blakey Signed-off-by: Marcelo Ricardo Leitner Signed-off-by: Yossi Kuperman Acked-by: Jiri Pirko Signed-off-by: David S. Miller commit 75a56758d6390ea6db523ad26ce378f34b907b0c Author: Paul Blakey Date: Tue Jul 9 10:30:49 2019 +0300 net/flow_dissector: add connection tracking dissection Retreives connection tracking zone, mark, label, and state from a SKB. Signed-off-by: Paul Blakey Signed-off-by: Marcelo Ricardo Leitner Acked-by: Jiri Pirko Signed-off-by: David S. Miller commit b57dc7c13ea90e09ae15f821d2583fa0231b4935 Author: Paul Blakey Date: Tue Jul 9 10:30:48 2019 +0300 net/sched: Introduce action ct Allow sending a packet to conntrack module for connection tracking. The packet will be marked with conntrack connection's state, and any metadata such as conntrack mark and label. This state metadata can later be matched against with tc classifers, for example with the flower classifier as below. In addition to committing new connections the user can optionally specific a zone to track within, set a mark/label and configure nat with an address range and port range. Usage is as follows: $ tc qdisc add dev ens1f0_0 ingress $ tc qdisc add dev ens1f0_1 ingress $ tc filter add dev ens1f0_0 ingress \ prio 1 chain 0 proto ip \ flower ip_proto tcp ct_state -trk \ action ct zone 2 pipe \ action goto chain 2 $ tc filter add dev ens1f0_0 ingress \ prio 1 chain 2 proto ip \ flower ct_state +trk+new \ action ct zone 2 commit mark 0xbb nat src addr 5.5.5.7 pipe \ action mirred egress redirect dev ens1f0_1 $ tc filter add dev ens1f0_0 ingress \ prio 1 chain 2 proto ip \ flower ct_zone 2 ct_mark 0xbb ct_state +trk+est \ action ct nat pipe \ action mirred egress redirect dev ens1f0_1 $ tc filter add dev ens1f0_1 ingress \ prio 1 chain 0 proto ip \ flower ip_proto tcp ct_state -trk \ action ct zone 2 pipe \ action goto chain 1 $ tc filter add dev ens1f0_1 ingress \ prio 1 chain 1 proto ip \ flower ct_zone 2 ct_mark 0xbb ct_state +trk+est \ action ct nat pipe \ action mirred egress redirect dev ens1f0_0 Signed-off-by: Paul Blakey Signed-off-by: Marcelo Ricardo Leitner Signed-off-by: Yossi Kuperman Acked-by: Jiri Pirko Changelog: V5->V6: Added CONFIG_NF_DEFRAG_IPV6 in handle fragments ipv6 case V4->V5: Reordered nf_conntrack_put() in tcf_ct_skb_nfct_cached() V3->V4: Added strict_start_type for act_ct policy V2->V3: Fixed david's comments: Removed extra newline after rcu in tcf_ct_params , and indent of break in act_ct.c V1->V2: Fixed parsing of ranges TCA_CT_NAT_IPV6_MAX as 'else' case overwritten ipv4 max Refactored NAT_PORT_MIN_MAX range handling as well Added ipv4/ipv6 defragmentation Removed extra skb pull push of nw offset in exectute nat Refactored tcf_ct_skb_network_trim after pull Removed TCA_ACT_CT define Signed-off-by: David S. Miller commit 593c75463ab6d6985cdc9916f3d1c28b5f6340cd Merge: 565eb5f8c5d3 b3d5f311d3cf Author: Linus Torvalds Date: Tue Jul 9 12:08:15 2019 -0700 Merge branch 'parisc-5.3-1' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux Pull parisc updates from Helge Deller: "Dynamic ftrace support by Sven Schnelle and a header guard fix by Denis Efremov" * 'parisc-5.3-1' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux: parisc: asm: psw.h: missing header guard parisc: add dynamic ftrace compiler.h: add CC_USING_PATCHABLE_FUNCTION_ENTRY parisc: use pr_debug() in kernel/module.c parisc: add WARN_ON() to clear_fixmap parisc: add spinlock to patch function parisc: add support for patching multiple words commit f108c887d08986ec86cf6ca299c8bdb9e631275c Merge: b14a260e33dd f60f315d339e Author: David S. Miller Date: Tue Jul 9 12:02:13 2019 -0700 Merge branch 'devlink-Introduce-PCI-PF-VF-ports-and-attributes' Parav Pandit says: ==================== devlink: Introduce PCI PF, VF ports and attributes This patchset carry forwards the work initiated in [1] and discussion futher concluded at [2]. To improve visibility of representor netdevice, its association with PF or VF, physical port, two new devlink port flavours are added as PCI PF and PCI VF ports. A sample eswitch view can be seen below, which will be futher extended to mdev subdevices of a PCI function in future. Patch-1 moves physical port's attribute to new structure Patch-2 enhances netlink response to consider port flavour Patch-3,4 extends devlink port attributes and port flavour Patch-5 extends mlx5 driver to register devlink ports for PF, VF and physical link. +---+ +---+ vf| | | | pf +-+-+ +-+-+ physical link <---------+ | | | | | | | | +-+-+ +-+-+ +-+-+ | 1 | | 2 | | 3 | +--+---+-----+---+------+---+--+ | physical vf pf | | port port port | | | | eswitch | | | +------------------------------+ [1] https://www.spinics.net/lists/netdev/msg555797.html [2] https://marc.info/?l=linux-netdev&m=155354609408485&w=2 Changelog: v5->v6: - Fixed port flavour check order for PCI PF vs other flavours in netlink response. - Changed 'physical' to 'phys'. v4->v5: - Split first patch to two patches to handle netlink response in separate patch. - Corrected typo 'otwerwise' to 'otherwise' in patches 3 and 4. v3->v4: - Addressed comments from Jiri. - Split first patch to two patches. - Renamed phys_port to physical to be consistent with pci_pf. - Removed port_number from __devlink_port_attrs_set and moved assignment to caller function. - Used capital letter while moving old comment to new structure. - Removed helper function is_devlink_phy_port_num_supported(). v2->v3: - Made port_number and split_port_number applicable only to physical port flavours. v1->v2: - Updated new APIs and mlx5 driver to drop port_number for PF, VF attributes - Updated port_number comment for its usage - Limited putting port_number to physical ports ==================== Reviewed-by: Jakub Kicinski Signed-off-by: David S. Miller commit f60f315d339e14633a51cd2d468500d08055b84b Author: Parav Pandit Date: Mon Jul 8 23:17:39 2019 -0500 net/mlx5e: Register devlink ports for physical link, PCI PF, VFs Register devlink port of physical port, PCI PF and PCI VF flavour for each PF, VF when a given devlink instance is in switchdev mode. Implement ndo_get_devlink_port callback API to make use of registered devlink ports. This eliminates ndo_get_phys_port_name() and ndo_get_port_parent_id() callbacks. Hence, remove them. An example output with 2 VFs, without a PF and single uplink port is below. $devlink port show pci/0000:06:00.0/65535: type eth netdev ens2f0 flavour physical pci/0000:05:00.0/1: type eth netdev eth1 flavour pcivf pfnum 0 vfnum 0 pci/0000:05:00.0/2: type eth netdev eth2 flavour pcivf pfnum 0 vfnum 1 Reviewed-by: Roi Dayan Acked-by: Jiri Pirko Signed-off-by: Parav Pandit Signed-off-by: David S. Miller commit e41b6bf3cdd474dc9c587cb55906b0256835bf6d Author: Parav Pandit Date: Mon Jul 8 23:17:38 2019 -0500 devlink: Introduce PCI VF port flavour and port attribute In an eswitch, PCI VF may have port which is normally represented using a representor netdevice. To have better visibility of eswitch port, its association with VF, and its representor netdevice, introduce a PCI VF port flavour. When devlink port flavour is PCI VF, fill up PCI VF attributes of the port. Extend port name creation using PCI PF and VF number scheme on best effort basis, so that vendor drivers can skip defining their own scheme. $ devlink port show pci/0000:05:00.0/0: type eth netdev eth0 flavour pcipf pfnum 0 pci/0000:05:00.0/1: type eth netdev eth1 flavour pcivf pfnum 0 vfnum 0 pci/0000:05:00.0/2: type eth netdev eth2 flavour pcivf pfnum 0 vfnum 1 Acked-by: Jiri Pirko Signed-off-by: Parav Pandit Signed-off-by: David S. Miller commit 98fd2d6563fe4a799934a2a74d632601cd089beb Author: Parav Pandit Date: Mon Jul 8 23:17:37 2019 -0500 devlink: Introduce PCI PF port flavour and port attribute In an eswitch, PCI PF may have port which is normally represented using a representor netdevice. To have better visibility of eswitch port, its association with PF and a representor netdevice, introduce a PCI PF port flavour and port attriute. When devlink port flavour is PCI PF, fill up PCI PF attributes of the port. Extend port name creation using PCI PF number on best effort basis. So that vendor drivers can skip defining their own scheme. $ devlink port show pci/0000:05:00.0/0: type eth netdev eth0 flavour pcipf pfnum 0 Acked-by: Jiri Pirko Signed-off-by: Parav Pandit Signed-off-by: David S. Miller commit a2c6b87dd08cdfc2d065d4ae369e4e747b521a7f Author: Parav Pandit Date: Mon Jul 8 23:17:36 2019 -0500 devlink: Return physical port fields only for applicable port flavours Physical port number and split group fields are applicable only to physical port flavours such as PHYSICAL, CPU and DSA. Hence limit returning those values in netlink response to such port flavours. Acked-by: Jiri Pirko Signed-off-by: Parav Pandit Signed-off-by: David S. Miller commit 378ef01b5f75e6c485b8f16b4f6a7842a312aa07 Author: Parav Pandit Date: Mon Jul 8 23:17:35 2019 -0500 devlink: Refactor physical port attributes To support additional devlink port flavours and to support few common and few different port attributes, move physical port attributes to a different structure. Acked-by: Jiri Pirko Signed-off-by: Parav Pandit Signed-off-by: David S. Miller commit f21ce913a82faa512b583640226d4ab39b38735e Author: Rob Herring Date: Tue Jun 18 14:06:49 2019 -0600 dt-bindings: arm: Convert RDA Micro board/soc bindings to json-schema Convert RDA Micro SoC bindings to DT schema format using json-schema. Cc: "Andreas Färber" Acked-by: Manivannan Sadhasivam Signed-off-by: Rob Herring commit 565eb5f8c5d379b6a6a3134c76b2fcfecdd007d3 Merge: b7d5c9239855 4eb5fec31e61 Author: Linus Torvalds Date: Tue Jul 9 11:52:34 2019 -0700 Merge branch 'x86-kdump-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x865 kdump updates from Thomas Gleixner: "Yet more kexec/kdump updates: - Properly support kexec when AMD's memory encryption (SME) is enabled - Pass reserved e820 ranges to the kexec kernel so both PCI and SME can work" * 'x86-kdump-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: fs/proc/vmcore: Enable dumping of encrypted memory when SEV was active x86/kexec: Set the C-bit in the identity map page table when SEV is active x86/kexec: Do not map kexec area as decrypted when SEV is active x86/crash: Add e820 reserved ranges to kdump kernel's e820 table x86/mm: Rework ioremap resource mapping determination x86/e820, ioport: Add a new I/O resource descriptor IORES_DESC_RESERVED x86/mm: Create a workarea in the kernel for SME early encryption x86/mm: Identify the end of the kernel area to be reserved commit b7d5c9239855f99762e8a547bea03a436e8a12e8 Merge: 608745f12462 8ff80fbe7e98 Author: Linus Torvalds Date: Tue Jul 9 11:35:38 2019 -0700 Merge branch 'x86-boot-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 boot updates from Thomas Gleixner: "Assorted updates to kexec/kdump: - Proper kexec support for 4/5-level paging and jumping from a 5-level to a 4-level paging kernel. - Make the EFI support for kexec/kdump more robust - Enforce that the GDT is properly aligned instead of getting the alignment by chance" * 'x86-boot-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/kdump/64: Restrict kdump kernel reservation to <64TB x86/kexec/64: Prevent kexec from 5-level paging to a 4-level only kernel x86/boot: Add xloadflags bits to check for 5-level paging support x86/boot: Make the GDT 8-byte aligned x86/kexec: Add the ACPI NVS region to the ident map x86/boot: Call get_rsdp_addr() after console_init() Revert "x86/boot: Disable RSDP parsing temporarily" x86/boot: Use efi_setup_data for searching RSDP on kexec-ed kernels x86/kexec: Add the EFI system tables and ACPI tables to the ident map commit 608745f12462e2d8d94d5cc5dc94bf0960a881e3 Merge: cdc5ffc41005 d1d59b817939 Author: Linus Torvalds Date: Tue Jul 9 11:15:52 2019 -0700 Merge branch 'perf-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull perf updates from Ingo Molnar: "The main changes in this cycle on the kernel side were: - CPU PMU and uncore driver updates to Intel Snow Ridge, IceLake, KabyLake, AmberLake and WhiskeyLake CPUs. - Rework the MSR probing infrastructure to make it more robust, make it work better on virtualized systems and to better expose it on sysfs. - Rework PMU attributes group support based on the feedback from Greg. The core sysfs patch that adds sysfs_update_groups() was acked by Greg. There's a lot of perf tooling changes as well, all around the place: - vendor updates to Intel, cs-etm (ARM), ARM64, s390, - various enhancements to Intel PT tooling support: - Improve CBR (Core to Bus Ratio) packets support. - Export power and ptwrite events to sqlite and postgresql. - Add support for decoding PEBS via PT packets. - Add support for samples to contain IPC ratio, collecting cycles information from CYC packets, showing the IPC info periodically - Allow using time ranges - lots of updates to perf pmu, perf stat, perf trace, eBPF support, perf record, perf diff, etc. - please see the shortlog and Git log for details" * 'perf-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (252 commits) tools arch x86: Sync asm/cpufeatures.h with the with the kernel tools build: Check if gettid() is available before providing helper perf jvmti: Address gcc string overflow warning for strncpy() perf python: Remove -fstack-protector-strong if clang doesn't have it perf annotate TUI browser: Do not use member from variable within its own initialization perf tests: Fix record+probe_libc_inet_pton.sh for powerpc64 perf evsel: Do not rely on errno values for precise_ip fallback perf thread: Allow references to thread objects after machine__exit() perf header: Assign proper ff->ph in perf_event__synthesize_features() tools arch kvm: Sync kvm headers with the kernel sources perf script: Allow specifying the files to process guest samples perf tools metric: Don't include duration_time in group perf list: Avoid extra : for --raw metrics perf vendor events intel: Metric fixes for SKX/CLX perf tools: Fix typos / broken sentences perf jevents: Add support for Hisi hip08 L3C PMU aliasing perf jevents: Add support for Hisi hip08 HHA PMU aliasing perf jevents: Add support for Hisi hip08 DDRC PMU aliasing perf pmu: Support more complex PMU event aliasing perf diff: Documentation -c cycles option ... commit b9411d73bd3eb5773d0ce02b8008ec21b7c447ce Author: Milan Broz Date: Tue Jul 9 15:22:14 2019 +0200 dm crypt: implement eboiv - encrypted byte-offset initialization vector This IV is used in some BitLocker devices with CBC encryption mode. IV is encrypted little-endian byte-offset (with the same key and cipher as the volume). Signed-off-by: Milan Broz Signed-off-by: Mike Snitzer commit 6028a7a5a3d604855728fd8da8f4708892b13764 Author: Milan Broz Date: Tue Jul 9 15:22:13 2019 +0200 dm crypt: remove obsolete comment about plumb IV The URL is no longer valid and the comment is obsolete anyway (the plumb IV was never used). Signed-off-by: Milan Broz Signed-off-by: Mike Snitzer commit 4a52ffc7ca6f03005ce10c67412752dd068f79a3 Author: Milan Broz Date: Tue Jul 9 15:22:12 2019 +0200 dm crypt: wipe private IV struct after key invalid flag is set If a private IV wipe function fails, the code does not set the key invalid flag. To fix this, move code to after the flag is set to prevent the device from resuming in an inconsistent state. Also, this allows using of a randomized key in private wipe function (to be used in a following commit). Signed-off-by: Milan Broz Signed-off-by: Mike Snitzer commit 131670c2625307551c23970ebcc0f8bc0fc9b4ef Author: Fuqian Huang Date: Fri Jun 28 10:47:34 2019 +0800 dm integrity: use kzalloc() instead of kmalloc() + memset() Signed-off-by: Fuqian Huang Signed-off-by: Mike Snitzer commit d370ad23a5553f9128da24e029993f4091bc04d7 Author: Pavel Begunkov Date: Thu Jun 20 20:50:50 2019 +0300 dm: update stale comment in end_clone_bio() Since commit a1ce35fa49852db60fc6e268 ("block: remove dead elevator code") blk_end_request() has been replaced with blk_mq_end_request(). So update comment to reference blk_mq_end_request() accordingly. Signed-off-by: Pavel Begunkov Signed-off-by: Mike Snitzer commit 7537dad791cdbaf856c05f9dd977556ccd830ef0 Author: Qu Wenruo Date: Tue Jun 18 13:39:38 2019 +0800 dm log writes: fix incorrect comment about the logged sequence example dm-log-writes records the sequence of completion, not submission, thus for the following sequence (W=write, C=complete): Wa,Wb,Wc,Cc,Ca,FLUSH,FUAd,Cb,CFLUSH,CFUAd The logged results in log device should be: c,a,b,flush,fua Fix the comment to give a better example. Signed-off-by: Qu Wenruo Signed-off-by: Mike Snitzer commit d4e6e83651777224c0259e01dde5eb078f9e6b1d Author: Zhengyuan Liu Date: Wed Jun 12 14:14:46 2019 +0800 dm log writes: use struct_size() to calculate size of pending_block Use struct_size() to avoid open-coded equivalent that is prone to a type mistake. Signed-off-by: Zhengyuan Liu Signed-off-by: Mike Snitzer commit 9c81c99b242f1241e18573d1ce29f7479c168e38 Author: Zhengyuan Liu Date: Wed Jun 12 14:14:45 2019 +0800 dm crypt: use struct_size() when allocating encryption context Use struct_size() to avoid open-coded equivalent that is prone to a type mistake. Signed-off-by: Zhengyuan Liu Signed-off-by: Mike Snitzer commit cdc5ffc4100549654e19e6f068cf1fc0871a85c2 Merge: 3b99107f0e02 120357ea176e Author: Linus Torvalds Date: Tue Jul 9 10:59:26 2019 -0700 Merge tag 'for-5.3/libata-20190708' of git://git.kernel.dk/linux-block Pull libata updates from Jens Axboe: "These are the changes that are reviewed, tested, and queued up for this merge window. This contains: - Removal of redundant memset after dmam_alloc_coherent (Fuqian) - Expand blacklist check for ST1000LM024, making it independent of firmware version (Hans) - Request sense fix (Tejun) - ahci_sunxi FIFO fix (Uenal)" * tag 'for-5.3/libata-20190708' of git://git.kernel.dk/linux-block: drivers: ata: ahci_sunxi: Increased SATA/AHCI DMA TX/RX FIFOs libata: Drop firmware version check from the ST1000LM024 quirk ata: sata_sil24: Remove call to memset after dmam_alloc_coherent ata:sata_qstor: Remove call to memset after dmam_alloc_coherent ata: sata_nv: Remove call to memset after dmam_alloc_coherent ata: pdc_adma: Remove call to memset after dmam_alloc_coherent ata: libahci: Remove call to memset after dmam_alloc_coherent ata: acard-ahci: Remove call to memset after dmam_alloc_coherent libata: don't request sense data on !ZAC ATA devices commit 4975223b8156c14f0537dcde1554f050fb4d29bf Author: Arnaldo Carvalho de Melo Date: Tue Jul 9 14:49:26 2019 -0300 perf tools: Introduce rlimit__bump_memlock() helper Just like the BPF guys did when faced with failures with map creation, etc, i.e. their solution is: tools/testing/selftests/bpf/bpf_rlimit.h For perf use this function in 'perf test' and in 'perf trace'. Make it bump to 4 times the current value, if it fails twice the current value and if it still fails, warn that things like BPF map creation may fail, to help in diagnosing the problem. Cc: Adrian Hunter Cc: Alexei Starovoitov Cc: Daniel Borkmann Cc: Jiri Olsa Cc: Namhyung Kim Link: https://lkml.kernel.org/n/tip-muvqef2i7n6pzqbmu7tn2d2y@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 5f1c56b34e81e2d63f345f7ad6c5c7971c3c314d Author: Milan Broz Date: Wed May 22 13:29:44 2019 +0200 dm integrity: always set version on superblock update The new integrity bitmap mode uses the dirty flag. The dirty flag should not be set in older superblock versions. The current code sets it unconditionally, even if the superblock was already formatted without bitmap in older system. Fix this by moving the version check to one common place and check version on every superblock write. Signed-off-by: Milan Broz Signed-off-by: Mike Snitzer commit 3b99107f0e0298e6fe0787f75b8f3d8306dfb230 Merge: 0415052db4f9 c9b3007feca0 Author: Linus Torvalds Date: Tue Jul 9 10:45:06 2019 -0700 Merge tag 'for-5.3/block-20190708' of git://git.kernel.dk/linux-block Pull block updates from Jens Axboe: "This is the main block updates for 5.3. Nothing earth shattering or major in here, just fixes, additions, and improvements all over the map. This contains: - Series of documentation fixes (Bart) - Optimization of the blk-mq ctx get/put (Bart) - null_blk removal race condition fix (Bob) - req/bio_op() cleanups (Chaitanya) - Series cleaning up the segment accounting, and request/bio mapping (Christoph) - Series cleaning up the page getting/putting for bios (Christoph) - block cgroup cleanups and moving it to where it is used (Christoph) - block cgroup fixes (Tejun) - Series of fixes and improvements to bcache, most notably a write deadlock fix (Coly) - blk-iolatency STS_AGAIN and accounting fixes (Dennis) - Series of improvements and fixes to BFQ (Douglas, Paolo) - debugfs_create() return value check removal for drbd (Greg) - Use struct_size(), where appropriate (Gustavo) - Two lighnvm fixes (Heiner, Geert) - MD fixes, including a read balance and corruption fix (Guoqing, Marcos, Xiao, Yufen) - block opal shadow mbr additions (Jonas, Revanth) - sbitmap compare-and-exhange improvemnts (Pavel) - Fix for potential bio->bi_size overflow (Ming) - NVMe pull requests: - improved PCIe suspent support (Keith Busch) - error injection support for the admin queue (Akinobu Mita) - Fibre Channel discovery improvements (James Smart) - tracing improvements including nvmetc tracing support (Minwoo Im) - misc fixes and cleanups (Anton Eidelman, Minwoo Im, Chaitanya Kulkarni)" - Various little fixes and improvements to drivers and core" * tag 'for-5.3/block-20190708' of git://git.kernel.dk/linux-block: (153 commits) blk-iolatency: fix STS_AGAIN handling block: nr_phys_segments needs to be zero for REQ_OP_WRITE_ZEROES blk-mq: simplify blk_mq_make_request() blk-mq: remove blk_mq_put_ctx() sbitmap: Replace cmpxchg with xchg block: fix .bi_size overflow block: sed-opal: check size of shadow mbr block: sed-opal: ioctl for writing to shadow mbr block: sed-opal: add ioctl for done-mark of shadow mbr block: never take page references for ITER_BVEC direct-io: use bio_release_pages in dio_bio_complete block_dev: use bio_release_pages in bio_unmap_user block_dev: use bio_release_pages in blkdev_bio_end_io iomap: use bio_release_pages in iomap_dio_bio_end_io block: use bio_release_pages in bio_map_user_iov block: use bio_release_pages in bio_unmap_user block: optionally mark pages dirty in bio_release_pages block: move the BIO_NO_PAGE_REF check into bio_release_pages block: skd_main.c: Remove call to memset after dma_alloc_coherent block: mtip32xx: Remove call to memset after dma_alloc_coherent ... commit 0415052db4f92b7e272fc15802ad8b8be672deea Merge: 4b4704520d97 33ee09cd59ce Author: Linus Torvalds Date: Tue Jul 9 10:28:47 2019 -0700 Merge tag 'devprop-5.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull device properties framework updates from Rafael Wysocki: "These add helpers for counting items in a property array and extend the "software nodes" support to be more convenient for representing device properties supplied by drivers and make the intel_cht_int33fe driver use that. Specifics: - Add helpers to count items in a property array (Andy Shevchenko). - Extend "software nodes" support to be more convenient for representing device properties supplied by drivers (Heikki Krogerus). - Add device_find_child_by_name() helper to the driver core (Heikki Krogerus). - Extend device connection code to also look for references provided via fwnode pointers (Heikki Krogerus). - Start to register proper struct device objects for USB Type-C muxes and orientation switches (Heikki Krogerus). - Update the intel_cht_int33fe driver to describe devices in a more general way with the help of "software nodes" (Heikki Krogerus)" * tag 'devprop-5.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: device property: Add helpers to count items in an array platform/x86: intel_cht_int33fe: Replacing the old connections with references platform/x86: intel_cht_int33fe: Supply fwnodes for the external dependencies platform/x86: intel_cht_int33fe: Provide fwnode for the USB connector platform/x86: intel_cht_int33fe: Provide software nodes for the devices platform/x86: intel_cht_int33fe: Remove unused fusb302 device property platform/x86: intel_cht_int33fe: Register max17047 in its own function usb: typec: Registering real device entries for the muxes device connection: Find connections also by checking the references device property: Introduce fwnode_find_reference() ACPI / property: Don't limit named child node matching to data nodes driver core: Add helper device_find_child_by_name() software node: Add software_node_get_reference_args() software node: Use kobject name when finding child nodes by name software node: Add support for static node descriptors software node: Simplify software_node_release() function software node: Allow node creation without properties commit 4b4704520d97b74e045154fc3b844b73ae4e7ebd Merge: cf2d213e49fd 64372c0b7dcb Author: Linus Torvalds Date: Tue Jul 9 10:21:39 2019 -0700 Merge tag 'acpi-5.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull ACPI updates from Rafael Wysocki: "These update the ACPICA code in the kernel to upstream revision 20190703, fix up the handling of GPEs in ACPICA, allow some more ACPI code to be built on ARM64 platforms, allow BGRT to be overridden, fix minor issues and clean up assorted pieces of ACPI code. Specifics: - Update the ACPICA code in the kernel to upstream revision 20190703 including: - Initial/default namespace creation simplification (Bob Moore). - Object initialization sequence update (Bob Moore). - Removal of legacy module-level (dead) code (Erik Schmauss). - Table load object initialization update (Erik Schmauss, Nikolaus Voss). - Fix GPE enabling issue in ACPICA causing premature wakeups from suspend-to-idle to occur (Rafael Wysocki). - Allow ACPI AC and battery drivers to be built on non-X86 (Ard Biesheuvel). - Fix address space handler removal in the ACPI PMIC driver for Intel platforms (Andy Shevchenko). - Allow BGRT to be overridden via initrd or configfs (Andrea Oliveri). - Fix object resolution on table loads via configfs (Nikolaus Voss). - Clean up assorted pieces of ACPI code and tools (Colin Ian King, Liguang Zhang, Masahiro Yamada). - Fix documentation build warning, convert the extcon document to ReST and add it to the ACPI documentation (Mauro Carvalho Chehab, Qian Cai)" * tag 'acpi-5.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: ACPI / APEI: Remove needless __ghes_check_estatus() calls ACPICA: Update version to 20190703 ACPICA: Update table load object initialization ACPICA: Update for object initialization sequence ACPICA: remove legacy module-level code due to deprecation ACPICA: Namespace: simplify creation of the initial/default namespace ACPI / PMIC: intel: Drop double removal of address space handler ACPI: APD: remove redundant assignment to pointer clk docs: extcon: convert it to ReST and move to ACPI dir ACPI: Make AC and battery drivers available on !X86 ACPICA: Clear status of GPEs on first direct enable ACPI: configfs: Resolve objects on host-directed table loads ACPI: tables: Allow BGRT to be overridden ACPI: OSL: Make a W=1 kernel-doc warning go away ACPI: tools: Exclude tools/* from .gitignore patterns commit cf2d213e49fdf47e4c10dc629a3659e0026a54b8 Merge: 4cdd5f9186bb 586a07dca8c5 Author: Linus Torvalds Date: Tue Jul 9 10:05:22 2019 -0700 Merge tag 'pm-5.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull power management updates from Rafael Wysocki: "These update PCI and ACPI power management (improved handling of ACPI power resources and PCIe link delays, fixes related to corner cases, hibernation handling rework), fix and extend the operating performance points (OPP) framework, add new cpufreq drivers for Raspberry Pi and imx8m chips, update some other cpufreq drivers, clean up assorted pieces of PM code and documentation and update tools. Specifics: - Improve the handling of shared ACPI power resources in the PCI bus type layer (Mika Westerberg). - Make the PCI layer take link delays required by the PCIe spec into account as appropriate and avoid polling devices in D3cold for PME (Mika Westerberg). - Fix some corner case issues in ACPI device power management and in the PCI bus type layer, optimiza and clean up the handling of runtime-suspended PCI devices during system-wide transitions to sleep states (Rafael Wysocki). - Rework hibernation handling in the ACPI core and the PCI bus type to resume runtime-suspended devices before hibernation (which allows some functional problems to be avoided) and fix some ACPI power management issues related to hiberation (Rafael Wysocki). - Extend the operating performance points (OPP) framework to support a wider range of devices (Rajendra Nayak, Stehpen Boyd). - Fix issues related to genpd_virt_devs and issues with platforms using the set_opp() callback in the OPP framework (Viresh Kumar, Dmitry Osipenko). - Add new cpufreq driver for Raspberry Pi (Nicolas Saenz Julienne). - Add new cpufreq driver for imx8m and imx7d chips (Leonard Crestez). - Fix and clean up the pcc-cpufreq, brcmstb-avs-cpufreq, s5pv210, and armada-37xx cpufreq drivers (David Arcari, Florian Fainelli, Paweł Chmiel, YueHaibing). - Clean up and fix the cpufreq core (Viresh Kumar, Daniel Lezcano). - Fix minor issue in the ACPI system sleep support code and export one function from it (Lenny Szubowicz, Dexuan Cui). - Clean up assorted pieces of PM code and documentation (Kefeng Wang, Andy Shevchenko, Bart Van Assche, Greg Kroah-Hartman, Fuqian Huang, Geert Uytterhoeven, Mathieu Malaterre, Rafael Wysocki). - Update the pm-graph utility to v5.4 (Todd Brandt). - Fix and clean up the cpupower utility (Abhishek Goel, Nick Black)" * tag 'pm-5.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: (57 commits) ACPI: PM: Make acpi_sleep_state_supported() non-static PM: sleep: Drop dev_pm_skip_next_resume_phases() ACPI: PM: Unexport acpi_device_get_power() Documentation: ABI: power: Add missing newline at end of file ACPI: PM: Drop unused function and function header ACPI: PM: Introduce "poweroff" callbacks for ACPI PM domain and LPSS ACPI: PM: Simplify and fix PM domain hibernation callbacks PCI: PM: Simplify bus-level hibernation callbacks PM: ACPI/PCI: Resume all devices during hibernation cpufreq: Avoid calling cpufreq_verify_current_freq() from handle_update() cpufreq: Consolidate cpufreq_update_current_freq() and __cpufreq_get() kernel: power: swap: use kzalloc() instead of kmalloc() followed by memset() cpufreq: Don't skip frequency validation for has_target() drivers PCI: PM/ACPI: Refresh all stale power state data in pci_pm_complete() PCI / ACPI: Add _PR0 dependent devices ACPI / PM: Introduce concept of a _PR0 dependent device PCI / ACPI: Use cached ACPI device state to get PCI device power state ACPI: PM: Allow transitions to D0 to occur in special cases ACPI: PM: Avoid evaluating _PS3 on transitions from D3hot to D3cold cpufreq: Use has_target() instead of !setpolicy ... commit 4cdd5f9186bbe80306e76f11da7ecb0b9720433c Merge: 2d41ef5432b7 0dcb4efb1095 Author: Linus Torvalds Date: Tue Jul 9 09:59:43 2019 -0700 Merge tag 'sound-5.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound updates from Takashi Iwai: "Many updates in this development cycle are found in ASoC where it got a wide range of changes for the continued refactoring. Some highlights are below. ASoC: - Continued refactoring work by Morimoto-san toward the full componentization; the changes are seen allover the places - Support for force disconnecting muxes in DAPM - Continued development of ASoC Intel SOF stuff - New drivers for Cirrus Logic CS47L35, CS47L85 and CS47L90, Conexant CX2072X, Realtek RT1011 and RT1308 HD-audio: - More fixes and adjustments for ASoC SOF HD-audio - Fix for resume problem on some Realtek codecs USB-audio: - A few fixes for the issues reported by syzbot USB fuzzer - Fix for UAC2 extension unit parser - Quirks for Line6 Helix, Emgaic Unitor 8 FireWire: - Lots of code refactoring and fixes in most of its components" * tag 'sound-5.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (626 commits) ALSA: firewire-lib: code refactoring for local variables ALSA: firewire-lib: code refactoring for post operation to data block counter ALSA: firewire-lib: code refactoring for error path of parser for CIP header ALSA: firewire-lib: fix different data block counter between probed event and transferred isochronous packet ALSA: firewire-lib: fix initial value of data block count for IR context without CIP_DBC_IS_END_EVENT ALSA: firewire-lib/fireface: fix initial value of data block counter for IR context with CIP_NO_HEADER ALSA: firewire-lib: fix invalid length of rx packet payload for tracepoint events ALSA: usb-audio: fix Line6 Helix audio format rates firewire-motu: fix wrong reference count for stream functionality at error path of rawmidi interface ALSA: firewire-digi00x: fix wrong reference count for stream functionality at error path of rawmidi interface ALSA: dice: fix wrong reference count for stream functionality at error path of rawmidi interface ALSA: oxfw: fix wrong reference count for stream functionality at error path of rawmidi interface ALSA: fireworks: fix wrong reference count for stream functionality at error path of rawmidi interface ALSA: bebob: fix wrong reference count for stream functionality at error path of rawmidi interface ASoC: SOF: Intel: implement runtime idle for CNL/APL ASoC: SOF: add runtime idle callback ASoC: hdac_hdmi: report codec link up/down status to bus ASoC: SOF: debug: fix possible memory leak in sof_dfsentry_write() ASoC: sunxi: sun50i-codec-analog: Add earpiece ASoC: rt5665: remove redundant assignment to variable idx ... commit 2d41ef5432b76ae90dc0db93026f1d981f874ec4 Merge: ed63b9c87360 732146a3f1dc Author: Linus Torvalds Date: Tue Jul 9 09:55:45 2019 -0700 Merge tag 'fbdev-v5.3' of git://github.com/bzolnier/linux Pull fbdev updates from Bartlomiej Zolnierkiewicz: - remove fbdev notifier usage for fbcon (as prep work to clean up the fbcon locking), add locking checks in vt/console code and make assorted cleanups in fbdev and backlight code (Daniel Vetter) - add COMPILE_TEST support to atmel_lcdfb, da8xx-fb, gbefb, imxfb, pvr2fb and pxa168fb drivers (me) - fix DMA API abuse in au1200fb and jz4740_fb drivers (Christoph Hellwig) - add check for new BGRT status field rotation bits in efifb driver (Hans de Goede) - mark expected switch fall-throughs in s3c-fb driver (Gustavo A. R. Silva) - remove fbdev mxsfb driver in favour of the drm version (Fabio Estevam) - remove broken rfbi code from omap2fb driver (me) - misc fixes (Arnd Bergmann, Shobhit Kukreti, Wei Yongjun, me) - misc cleanups (Gustavo A. R. Silva, Colin Ian King, me) * tag 'fbdev-v5.3' of git://github.com/bzolnier/linux: (62 commits) video: fbdev: imxfb: fix a typo in imxfb_probe() video: fbdev: s3c-fb: Mark expected switch fall-throughs video: fbdev: s3c-fb: fix sparse warnings about using incorrect types video: fbdev: don't print error message on framebuffer_alloc() failure video: fbdev: intelfb: return -ENOMEM on framebuffer_alloc() failure video: fbdev: s3c-fb: return -ENOMEM on framebuffer_alloc() failure vga_switcheroo: Depend upon fbcon being built-in, if enabled video: fbdev: omap2: remove rfbi video: fbdev: atmel_lcdfb: remove redundant initialization to variable ret video: fbdev-MMP: Use struct_size() in devm_kzalloc() video: fbdev: controlfb: fix warnings about comparing pointer to 0 efifb: BGRT: Add check for new BGRT status field rotation bits jz4740_fb: fix DMA API abuse video: fbdev: pvr2fb: fix link error for pvr2fb_pci_exit video: fbdev: s3c-fb: add COMPILE_TEST support video: fbdev: imxfb: fix sparse warnings about using incorrect types video: fbdev: pvr2fb: fix build warning when compiling as module fbcon: Export fbcon_update_vcs backlight: simplify lcd notifier staging/olpc_dcon: Add drm conversion to TODO ... commit ed63b9c873601ca113da5c7b1745e3946493e9f3 Merge: 947fbd4ca9fb f81cbfc4f82a Author: Linus Torvalds Date: Tue Jul 9 09:47:22 2019 -0700 Merge tag 'media/v5.3-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media Pull media updates from Mauro Carvalho Chehab: - new Atmel microship ISC driver - coda has gained support for mpeg2 and mpeg4 - cxusb gained support for analog TV - rockchip staging driver was split into two separate staging drivers - added a new staging driver for Allegro DVT video IP core - added a new staging driver for Amlogic Meson video decoder - lots of improvements and cleanups * tag 'media/v5.3-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: (398 commits) media: allegro: use new v4l2_m2m_ioctl_try_encoder_cmd funcs media: doc-rst: Fix typos media: radio-raremono: change devm_k*alloc to k*alloc media: stv0297: fix frequency range limit media: rc: Prefer KEY_NUMERIC_* for number buttons on remotes media: dvb_frontend: split dvb_frontend_handle_ioctl function media: mceusb: disable "nonsensical irdata" messages media: rc: remove redundant dev_err message media: cec-notifier: add new notifier functions media: cec: add struct cec_connector_info support media: cec-notifier: rename variables, check kstrdup and n->conn_name media: MAINTAINERS: Add maintainers for Media Controller media: staging: media: tegra-vde: Defer dmabuf's unmapping media: staging: media: tegra-vde: Add IOMMU support media: hdpvr: fix locking and a missing msleep media: v4l2: Test type instead of cfg->type in v4l2_ctrl_new_custom() media: atmel: atmel-isc: fix i386 build error media: v4l2-ctrl: Move compound control initialization media: hantro: Use vb2_get_buffer media: pci: cx88: Change the type of 'missed' to u64 ... commit 947fbd4ca9fb38f320b076e68cfccab977c5ea01 Merge: 6b04014f3f15 d8655e7630da Author: Linus Torvalds Date: Tue Jul 9 09:43:20 2019 -0700 Merge tag 'please-pull-for_5.3' of git://git.kernel.org/pub/scm/linux/kernel/git/ras/ras Pull EDAC updates from Tony Luck: "All the bits that Boris had queued in his tree plus four patches to add support for Intel Icelake Xeon and then fix a few corner cases" * tag 'please-pull-for_5.3' of git://git.kernel.org/pub/scm/linux/kernel/git/ras/ras: EDAC: Fix global-out-of-bounds write when setting edac_mc_poll_msec EDAC, skx, i10nm: Fix source ID register offset EDAC, i10nm: Check ECC enabling status per channel EDAC, i10nm: Add Intel additional Ice-Lake support EDAC: Make edac_debugfs_create_x*() return void EDAC/aspeed: Remove set but not used variable 'np' EDAC/ie31200: Reformat PCI device table EDAC/ie31200: Add Intel Coffee Lake CPU support EDAC/sifive: Add EDAC platform driver for SiFive SoCs EDAC/sb_edac: Remove redundant update of tad_base arm64: dts: stratix10: Add SDMMC EDAC node EDAC/altera: Add Stratix10 SDMMC support arm64: dts: stratix10: Add OCRAM EDAC node EDAC/altera: Add Stratix10 OCRAM ECC support EDAC/sysfs: Drop device references properly EDAC/sysfs: Fix memory leak when creating a csrow object commit af3366308ea4c5473dfa5d2ace66b45cd3b1aec0 Author: Andy Shevchenko Date: Tue Jul 9 19:13:59 2019 +0300 tools: PCI: Fix installation when `make tools/pci_install` The commit c9a707875053 ("tools pci: Do not delete pcitest.sh in 'make clean'") fixed a `make tools clean` issue and simultaneously brought a regression to the installation process: for script in .../tools/pci/pcitest.sh; do \ install $script .../usr/usr/bin; \ done install: cannot stat '.../tools/pci/pcitest.sh': No such file or directory Update the install commands to fix the remaining issue. Signed-off-by: Andy Shevchenko Signed-off-by: Lorenzo Pieralisi Acked-by: Kishon Vijay Abraham I Cc: Jean-Jacques Hiblot Cc: Kishon Vijay Abraham I Cc: Lorenzo Pieralisi Cc: Arnaldo Carvalho de Melo commit 381ed79c8655a40268ee7391f716edd90c5c3a97 Author: YueHaibing Date: Fri Jun 14 23:40:44 2019 +0800 PCI: dwc: pci-dra7xx: Fix compilation when !CONFIG_GPIOLIB If CONFIG_GPIOLIB is not selected the compilation results in the following build errors: drivers/pci/controller/dwc/pci-dra7xx.c: In function dra7xx_pcie_probe: drivers/pci/controller/dwc/pci-dra7xx.c:777:10: error: implicit declaration of function devm_gpiod_get_optional; did you mean devm_regulator_get_optional? [-Werror=implicit-function-declaration] reset = devm_gpiod_get_optional(dev, NULL, GPIOD_OUT_HIGH); drivers/pci/controller/dwc/pci-dra7xx.c:778:45: error: ‘GPIOD_OUT_HIGH’ undeclared (first use in this function); did you mean ‘GPIOF_INIT_HIGH’? reset = devm_gpiod_get_optional(dev, NULL, GPIOD_OUT_HIGH); ^~~~~~~~~~~~~~ GPIOF_INIT_HIGH Fix them by including the appropriate header file. Reported-by: Hulk Robot Signed-off-by: YueHaibing [lorenzo.pieralisi@arm.com: commit log] Signed-off-by: Lorenzo Pieralisi Acked-by: Kishon Vijay Abraham I commit 6b04014f3f151ed62878327813859e76e8e23d78 Merge: c6b6cebbc597 d95c3885865b Author: Linus Torvalds Date: Tue Jul 9 09:21:02 2019 -0700 Merge tag 'iommu-updates-v5.3' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu Pull iommu updates from Joerg Roedel: - Make the dma-iommu code more generic so that it can be used outside of the ARM context with other IOMMU drivers. Goal is to make use of it on x86 too. - Generic IOMMU domain support for the Intel VT-d driver. This driver now makes more use of common IOMMU code to allocate default domains for the devices it handles. - An IOMMU fault reporting API to userspace. With that the IOMMU fault handling can be done in user-space, for example to forward the faults to a VM. - Better handling for reserved regions requested by the firmware. These can be 'relaxed' now, meaning that those don't prevent a device being attached to a VM. - Suspend/Resume support for the Renesas IOMMU driver. - Added support for dumping SVA related fields of the DMAR table in the Intel VT-d driver via debugfs. - A pile of smaller fixes and cleanups. * tag 'iommu-updates-v5.3' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu: (90 commits) iommu/omap: No need to check return value of debugfs_create functions iommu/arm-smmu-v3: Invalidate ATC when detaching a device iommu/arm-smmu-v3: Fix compilation when CONFIG_CMA=n iommu/vt-d: Cleanup unused variable iommu/amd: Flush not present cache in iommu_map_page iommu/amd: Only free resources once on init error iommu/amd: Move gart fallback to amd_iommu_init iommu/amd: Make iommu_disable safer iommu/io-pgtable: Support non-coherent page tables iommu/io-pgtable: Replace IO_PGTABLE_QUIRK_NO_DMA with specific flag iommu/io-pgtable-arm: Add support to use system cache iommu/arm-smmu-v3: Increase maximum size of queues iommu/vt-d: Silence a variable set but not used iommu/vt-d: Remove an unused variable "length" iommu: Fix integer truncation iommu: Add padding to struct iommu_fault iommu/vt-d: Consolidate domain_init() to avoid duplication iommu/vt-d: Cleanup after delegating DMA domain to generic iommu iommu/vt-d: Fix suspicious RCU usage in probe_acpi_namespace_devices() iommu/vt-d: Allow DMA domain attaching to rmrr locked device ... commit c6b6cebbc597aaf7d941f781b5fc114c58cc3352 Merge: 98537ee92fb1 26ac56506b0e Author: Linus Torvalds Date: Tue Jul 9 09:17:59 2019 -0700 Merge tag 'spi-v5.3' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi Pull spi updates from Mark Brown: "For the most part this is a quiet release for SPI, though there's several of the more widely used drivers that have had some fairly substantial development done on them, mainly improving performance and adding support for some more obscure use cases. Summary: - Support for configuring a minimum time for chip select to be deasserted between transfers from Martin Sperl. - A rework of the ACPI device instantiation code from Ard Biesheuvel. - Fairly substantial development on the AT91 USART, BCM2835 and Tegra114 drivers. - New driver for Socionext SynQuacer" * tag 'spi-v5.3' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: (58 commits) spi: pxa2xx: Add support for Intel Elkhart Lake spi: atmel-quadspi: fix resume call spi: atmel-quadspi: void return type for atmel_qspi_init() spi: pxa2xx: Set minimum transfer speed spi: stm32-qspi: remove signal sensitive on completion dt-bindings: spi: stm32-qspi: add dma properties spi: uniphier: fix zero-length transfer spi: uniphier: fix timeout error spi/acpi: avoid spurious matches during slave enumeration spi: spi-stm32-qspi: Remove CR_FTHRES_MASK usage spi: fix ctrl->num_chipselect constraint spi: spi-synquacer: Fixed build on architectures missing readsl/writesl series spi/acpi: fix incorrect ACPI parent check spi: don't open code list_for_each_entry_safe_reverse() spi: No need to assign dummy value in spi_unregister_controller() spi: Add a prototype for exported spi_set_cs_timing() spi/acpi: enumerate all SPI slaves in the namespace spi: qup: fix PIO/DMA transfers. spi: Use struct_size() helper spi: mediatek: add SPI_LSB_FIRST support ... commit 98537ee92fb1b17a7f36dcbc8d2e4087af300da6 Merge: 12a5146bda2f 0ed4513c9a32 Author: Linus Torvalds Date: Tue Jul 9 09:15:03 2019 -0700 Merge tag 'regulator-v5.3' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator Pull regulator updates from Mark Brown: "A couple of new features in the core, the most interesting one being support for complex regulator coupling configurations initially targeted at nVidia Tegra SoCs, and some new drivers but otherwise quite a quiet release. Summary: - Core support for gradual ramping of voltages for devices that can't manage large changes in hardware from Bartosz Golaszewski. - Core support for systems that have complex coupling requirements best described via code, contributed by Dmitry Osipenko. - New drivers for Dialog SLG51000, Qualcomm PM8005 and ST Microelectronics STM32-Booster" * tag 'regulator-v5.3' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator: (52 commits) regulator: max77650: use vsel_step regulator: implement selector stepping regulator: max77650: add MODULE_ALIAS() regulator: max77620: remove redundant assignment to variable ret dt-bindings: regulator: add support for the stm32-booster regulator: add support for the stm32-booster regulator: s2mps11: Adjust supported buck voltages to real values regulator: s2mps11: Fix buck7 and buck8 wrong voltages gpio: Fix return value mismatch of function gpiod_get_from_of_node() regulator: core: Expose some of core functions needed by couplers regulator: core: Introduce API for regulators coupling customization regulator: s2mps11: Add support for disabling S2MPS11 regulators in suspend regulator: s2mps11: Reduce number of rdev_get_id() calls regulator: qcom_spmi: Do NULL check for lvs regulator: qcom_spmi: Fix math of spmi_regulator_set_voltage_time_sel regulator: da9061/62: Adjust LDO voltage selection minimum value regulator: s2mps11: Fix ERR_PTR dereference on GPIO lookup failure regulator: qcom_spmi: add PMS405 SPMI regulator dt-bindings: qcom_spmi: Document pms405 support arm64: dts: msm8998-mtp: Add pm8005_s1 regulator ... commit 12a5146bda2f21728bdd475f10e5785fc62c9c29 Merge: 2ec98f567888 aaccf3863ce2 Author: Linus Torvalds Date: Tue Jul 9 09:11:22 2019 -0700 Merge tag 'regmap-v5.3' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap Pull regmap updates from Mark Brown: "This is a relatively busy release for regmap, though not busy in the grand scheme of things, with the addition of support for I3C from Vitor Soares and a few small fixes and cleanups" * tag 'regmap-v5.3' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap: regmap: select CONFIG_REGMAP while REGMAP_SCCB is set regmap: lzo: Switch to bitmap_zalloc() regmap: fix bulk writes on paged registers regmap: add i3c bus support regmap: debugfs: Fix memory leak in regmap_debugfs_init commit 671f9a3e2e24cdeb2d2856abee7422f093e23e29 Author: Anup Patel Date: Fri Jun 28 13:36:21 2019 -0700 RISC-V: Setup initial page tables in two stages Currently, the setup_vm() does initial page table setup in one-shot very early before enabling MMU. Due to this, the setup_vm() has to map all possible kernel virtual addresses since it does not know size and location of RAM. This means we have kernel mappings for non-existent RAM and any buggy driver (or kernel) code doing out-of-bound access to RAM will not fault and cause underterministic behaviour. Further, the setup_vm() creates PMD mappings (i.e. 2M mappings) for RV64 systems. This means for PAGE_OFFSET=0xffffffe000000000 (i.e. MAXPHYSMEM_128GB=y), the setup_vm() will require 129 pages (i.e. 516 KB) of memory for initial page tables which is never freed. The memory required for initial page tables will further increase if we chose a lower value of PAGE_OFFSET (e.g. 0xffffff0000000000) This patch implements two-staged initial page table setup, as follows: 1. Early (i.e. setup_vm()): This stage maps kernel image and DTB in a early page table (i.e. early_pg_dir). The early_pg_dir will be used only by boot HART so it can be freed as-part of init memory free-up. 2. Final (i.e. setup_vm_final()): This stage maps all possible RAM banks in the final page table (i.e. swapper_pg_dir). The boot HART will start using swapper_pg_dir at the end of setup_vm_final(). All non-boot HARTs directly use the swapper_pg_dir created by boot HART. We have following advantages with this new approach: 1. Kernel mappings for non-existent RAM don't exists anymore. 2. Memory consumed by initial page tables is now indpendent of the chosen PAGE_OFFSET. 3. Memory consumed by initial page tables on RV64 system is 2 pages (i.e. 8 KB) which has significantly reduced and these pages will be freed as-part of the init memory free-up. The patch also provides a foundation for implementing strict kernel mappings where we protect kernel text and rodata using PTE permissions. Suggested-by: Mike Rapoport Signed-off-by: Anup Patel [paul.walmsley@sifive.com: updated to apply; fixed a checkpatch warning] Signed-off-by: Paul Walmsley commit 2ec98f567888501df0140c858af5f5ea10216a6f Merge: 96407298ff6e 9b3b623804a6 Author: Linus Torvalds Date: Tue Jul 9 09:07:00 2019 -0700 Merge tag 'gpio-v5.3-1' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio Pull GPIO updates from Linus Walleij: "This is the big slew of GPIO changes for the v5.3 kernel cycle. This is mostly incremental work this time. Three important things: - The FMC subsystem is deleted through my tree. This happens through GPIO as its demise was discussed in relation to a patch decoupling its GPIO implementation from the standard way of handling GPIO. As it turns out, that is not the only subsystem it reimplements and the authors think it is better do scratch it and start over using the proper kernel subsystems than try to polish the rust shiny. See the commit (ACKed by the maintainers) for details. - Arnd made a small devres patch that was ACKed by Greg and goes into the device core. - SPDX header change colissions may happen, because at times I've seen that quite a lot changed during the -rc:s in regards to SPDX. (It is good stuff, tglx has me convinced, and it is worth the occasional pain.) Apart from this is is nothing controversial or problematic. Summary: Core: - When a gpio_chip request GPIOs from itself, it can now fully control the line characteristics, both machine and consumer flags. This makes a lot of sense, but took some time before I figured out that this is how it has to work. - Several smallish documentation fixes. New drivers: - The PCA953x driver now supports the TI TCA9539. - The DaVinci driver now supports the K3 AM654 SoCs. Driver improvements: - Major overhaul and hardening of the OMAP driver by Russell King. - Starting to move some drivers to the new API passing irq_chip along with the gpio_chip when adding the gpio_chip instead of adding it separately. Unrelated: - Delete the FMC subsystem" * tag 'gpio-v5.3-1' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio: (87 commits) Revert "gpio: tegra: Clean-up debugfs initialisation" gpiolib: Use spinlock_t instead of struct spinlock gpio: stp-xway: allow compile-testing gpio: stp-xway: get rid of the #include dependency gpio: stp-xway: improve module clock error handling gpio: stp-xway: simplify error handling in xway_stp_probe() gpiolib: Clarify use of non-sleeping functions gpiolib: Fix references to gpiod_[gs]et_*value_cansleep() variants gpiolib: Document new gpio_chip.init_valid_mask field Documentation: gpio: Fix reference to gpiod_get_array() gpio: pl061: drop duplicate printing of device name gpio: altera: Pass irqchip when adding gpiochip gpio: siox: Use devm_ managed gpiochip gpio: siox: Add struct device *dev helper variable gpio: siox: Pass irqchip when adding gpiochip drivers: gpio: amd-fch: make resource struct const devres: allow const resource arguments gpio: ath79: Pass irqchip when adding gpiochip gpio: tegra: Clean-up debugfs initialisation gpio: siox: Switch to IRQ_TYPE_NONE ... commit 96407298ff6ef59c4554833d47d29c775d1e7652 Merge: 8a3367cc8005 ede2001569c3 Author: Linus Torvalds Date: Tue Jul 9 09:04:31 2019 -0700 Merge tag 'i3c/for-5.3' of git://git.kernel.org/pub/scm/linux/kernel/git/i3c/linux Pull ic3 updates from Boris Brezillon: - Drop support for 10-bit I2C addresses - Add support for limited bus mode - Fix the Cadence DT binding doc - Use struct_size() to allocate a DEFSLVS packet * tag 'i3c/for-5.3' of git://git.kernel.org/pub/scm/linux/kernel/git/i3c/linux: i3c: master: Use struct_size() helper dt-bindings: i3c: cdns: Use correct cells for I2C device i3c: dw: add limited bus mode support i3c: add mixed limited bus mode i3c: fix i2c and i3c scl rate by bus mode dt-bindings: i3c: Document dropped support for I2C 10 bit devices i3c: Drop support for I2C 10 bit addresing commit 8a3367cc8005842efcefc0cb5c29780370818572 Merge: 6e2bbb688aa6 2605085fba22 Author: Linus Torvalds Date: Tue Jul 9 08:59:39 2019 -0700 Merge tag 'leds-for-5.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/j.anaszewski/linux-leds Pull LED updates from Jacek Anaszewski: - Add a new LED common module for ti-lmu driver family - Modify MFD ti-lmu bindings - add ti,brightness-resolution - add the ramp up/down property - Add regulator support for LM36274 driver to lm363x-regulator.c - New LED class drivers with DT bindings: - leds-spi-byte - leds-lm36274 - leds-lm3697 (move the support from MFD to LED subsystem) - Simplify getting the I2C adapter of a client: - leds-tca6507 - leds-pca955x - Convert LED documentation to ReST * tag 'leds-for-5.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/j.anaszewski/linux-leds: dt: leds-lm36274.txt: fix a broken reference to ti-lmu.txt docs: leds: convert to ReST leds: leds-tca6507: simplify getting the adapter of a client leds: leds-pca955x: simplify getting the adapter of a client leds: lm36274: Introduce the TI LM36274 LED driver dt-bindings: leds: Add LED bindings for the LM36274 regulator: lm363x: Add support for LM36274 mfd: ti-lmu: Add LM36274 support to the ti-lmu dt-bindings: mfd: Add lm36274 bindings to ti-lmu leds: max77650: Remove set but not used variable 'parent' leds: avoid flush_work in atomic context leds: lm3697: Introduce the lm3697 driver mfd: ti-lmu: Remove support for LM3697 dt-bindings: ti-lmu: Modify dt bindings for the LM3697 leds: TI LMU: Add common code for TI LMU devices leds: spi-byte: add single byte SPI LED driver dt-bindings: leds: Add binding for spi-byte LED. dt-bindings: mfd: LMU: Add ti,brightness-resolution dt-bindings: mfd: LMU: Add the ramp up/down property commit 6e2bbb688aa6d05073dd1dd0b836d9becec195c1 Merge: 5ad18b2e60b7 3d25025ce9c2 Author: Linus Torvalds Date: Tue Jul 9 08:57:45 2019 -0700 Merge tag 'pwm/for-5.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/thierry.reding/linux-pwm Pull pwm updates from Thierry Reding: "This set of changes contains a new driver for SiFive SoCs as well as enhancements to the core (device links are used to track dependencies between PWM providers and consumers, support for PWM controllers via ACPI, sysfs will now suspend/resume PWMs that it has claimed) and various existing drivers" * tag 'pwm/for-5.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/thierry.reding/linux-pwm: (37 commits) pwm: fsl-ftm: Make sure to unlock mutex on failure pwm: fsl-ftm: Use write protection for prescaler & polarity pwm: fsl-ftm: More relaxed permissions for updating period pwm: atmel-hlcdc: Add compatible for SAM9X60 HLCDC's PWM pwm: bcm2835: Improve precision of PWM leds: pwm: Support ACPI via firmware-node framework pwm: Add support referencing PWMs from ACPI pwm: rcar: Remove suspend/resume support pwm: sysfs: Add suspend/resume support pwm: Add power management descriptions pwm: meson: Add documentation to the driver pwm: meson: Add support PWM_POLARITY_INVERSED when disabling pwm: meson: Don't cache struct pwm_state internally pwm: meson: Read the full hardware state in meson_pwm_get_state() pwm: meson: Simplify the calculation of the pre-divider and count pwm: meson: Move pwm_set_chip_data() to meson_pwm_request() pwm: meson: Add the per-channel register offsets and bits in a struct pwm: meson: Add the meson_pwm_channel data to struct meson_pwm pwm: meson: Pass struct pwm_device to meson_pwm_calc() pwm: meson: Don't duplicate the polarity internally ... commit 0df5c39b3e4204b3ed0079d0fa14f3001c6285fe Author: Darrick J. Wong Date: Mon Jul 8 19:36:17 2019 -0700 xfs: bump INUMBERS cursor correctly in xfs_inumbers_walk There's a subtle unit conversion error when we increment the INUMBERS cursor at the end of xfs_inumbers_walk. If there's an inode chunk at the very end of the AG /and/ the AG size is a perfect power of two, the startino of that last chunk (which is in units of AG inodes) will be 63 less than (1 << agino_log). If we add XFS_INODES_PER_CHUNK to the startino, we end up with a startino that's larger than (1 << agino_log) and when we convert that back to fs inode units we'll rip off that upper bit and wind up back at the start of the AG. Fix this by converting to units of fs inodes before adding XFS_INODES_PER_CHUNK so that we'll harmlessly end up pointing to the next AG. Signed-off-by: Darrick J. Wong Reviewed-by: Brian Foster commit 62a92ba97a31c544802bbf13d3a998e86796d548 Author: Chuck Lever Date: Wed Jun 19 10:34:09 2019 -0400 NFS: Record task, client ID, and XID in xdr_status trace points When triggering an nfs_xdr_status trace point, record the task ID and XID of the failing RPC to better pinpoint the problem. This feels like a bit of a layering violation. Suggested-by: Trond Myklebust Signed-off-by: Chuck Lever Signed-off-by: Anna Schumaker commit 7d4006c161ad8cded95f80f43b5fecc36e781497 Author: Chuck Lever Date: Wed Jun 19 10:34:03 2019 -0400 NFS: Update symbolic flags displayed by trace events Add missing symbolic flag names and display flags variables in hexadecimal to improve observability. Signed-off-by: Chuck Lever Signed-off-by: Anna Schumaker commit 38a638a72a349c6afb48ca1612b4e58bbe168ff8 Author: Chuck Lever Date: Wed Jun 19 10:33:58 2019 -0400 NFS: Display symbolic status code names in trace log For improved readability, add nfs_show_status() call-sites in the generic NFS trace points so that the symbolic status code name is displayed. Signed-off-by: Chuck Lever Signed-off-by: Anna Schumaker commit 96650e2effa2dbc9d5002fed0c2f8a72de082918 Author: Chuck Lever Date: Wed Jun 19 10:33:53 2019 -0400 NFS: Fix show_nfs_errors macros again I noticed that NFS status values stopped working again. trace_print_symbols_seq() takes an unsigned long. Passing a negative errno or negative NFSERR value just confuses it, and since we're using C macros here and not static inline functions, all bets are off due to implicit type conversion. Straight-line the calling conventions so that error codes are stored in the trace record as positive values in an unsigned long field, mapped to symbolic as an unsigned long, and displayed as a negative value, to continue to enable grepping on "error=-". It's often the case that an error value that is positive is a byte count but when it's negative, it's an error (e.g. nfs4_write). Fix those cases so that the value that is eventually stored in the error field is a positive NFS status or errno, or zero. Signed-off-by: Chuck Lever Signed-off-by: Anna Schumaker commit c5833f0dc4cef778a718ad7d00df38e199045997 Author: Chuck Lever Date: Wed Jun 19 10:33:47 2019 -0400 NFS4: Add a trace event to record invalid CB sequence IDs Help debug NFSv4 callback failures. Signed-off-by: Chuck Lever Signed-off-by: Anna Schumaker commit 675dd90ad0932f2c03912a5252458d792bd7033a Author: Chuck Lever Date: Wed Jun 19 10:33:42 2019 -0400 xprtrdma: Modernize ops->connect Adapt and apply changes that were made to the TCP socket connect code. See the following commits for details on the purpose of these changes: Commit 7196dbb02ea0 ("SUNRPC: Allow changing of the TCP timeout parameters on the fly") Commit 3851f1cdb2b8 ("SUNRPC: Limit the reconnect backoff timer to the max RPC message timeout") Commit 02910177aede ("SUNRPC: Fix reconnection timeouts") Some common transport code is moved to xprt.c to satisfy the code duplication police. Signed-off-by: Chuck Lever Signed-off-by: Anna Schumaker commit 5828cebad1c8d535f3c194439e394e92a2273fb2 Author: Chuck Lever Date: Wed Jun 19 10:33:36 2019 -0400 xprtrdma: Remove rpcrdma_req::rl_buffer Clean up. There is only one remaining function, rpcrdma_buffer_put(), that uses this field. Its caller can supply a pointer to the correct rpcrdma_buffer, enabling the removal of an 8-byte pointer field from a frequently-allocated shared data structure. Signed-off-by: Chuck Lever Signed-off-by: Anna Schumaker commit 6a6c6def42469ce08023458ba439a8207fe87ae4 Author: Chuck Lever Date: Wed Jun 19 10:33:31 2019 -0400 xprtrdma: Refactor chunk encoding Clean up. Move the "not present" case into the individual chunk encoders. This improves code organization and readability. The reason for the original organization was to optimize for the case where there there are no chunks. The optimization turned out to be inconsequential, so let's err on the side of code readability. Signed-off-by: Chuck Lever Signed-off-by: Anna Schumaker commit 9ef33ef5b628037b694a433f8af014a04bb38126 Author: Chuck Lever Date: Wed Jun 19 10:33:26 2019 -0400 xprtrdma: Streamline rpcrdma_post_recvs rb_lock is contended between rpcrdma_buffer_create, rpcrdma_buffer_put, and rpcrdma_post_recvs. Commit e340c2d6ef2a ("xprtrdma: Reduce the doorbell rate (Receive)") causes rpcrdma_post_recvs to take the rb_lock repeatedly when it determines more Receives are needed. Streamline this code path so it takes the lock just once in most cases to build the Receive chain that is about to be posted. Signed-off-by: Chuck Lever Signed-off-by: Anna Schumaker commit 379d1bc5be373c920bcda16b9894ae99505ea127 Author: Chuck Lever Date: Wed Jun 19 10:33:20 2019 -0400 xprtrdma: Simplify rpcrdma_rep_create Clean up. Commit 7c8d9e7c8863 ("xprtrdma: Move Receive posting to Receive handler") reduced the number of rpcrdma_rep_create call sites to one. After that commit, the backchannel code no longer invokes it. Therefore the free list logic added by commit d698c4a02ee0 ("xprtrdma: Fix backchannel allocation of extra rpcrdma_reps") is no longer necessary, and in fact adds some extra overhead that we can do without. Simply post any newly created reps. They will get added back to the rb_recv_bufs list when they subsequently complete. Signed-off-by: Chuck Lever Signed-off-by: Anna Schumaker commit 0ab115237025f5e379620bbcd56a02697d07b002 Author: Chuck Lever Date: Wed Jun 19 10:33:15 2019 -0400 xprtrdma: Wake RPCs directly in rpcrdma_wc_send path Eliminate a context switch in the path that handles RPC wake-ups when a Receive completion has to wait for a Send completion. Signed-off-by: Chuck Lever Signed-off-by: Anna Schumaker commit d8099feda4833bab96b1bf312e9e6aad6b771570 Author: Chuck Lever Date: Wed Jun 19 10:33:10 2019 -0400 xprtrdma: Reduce context switching due to Local Invalidation Since commit ba69cd122ece ("xprtrdma: Remove support for FMR memory registration"), FRWR is the only supported memory registration mode. We can take advantage of the asynchronous nature of FRWR's LOCAL_INV Work Requests to get rid of the completion wait by having the LOCAL_INV completion handler take care of DMA unmapping MRs and waking the upper layer RPC waiter. This eliminates two context switches when local invalidation is necessary. As a side benefit, we will no longer need the per-xprt deferred completion work queue. Signed-off-by: Chuck Lever Signed-off-by: Anna Schumaker commit 40088f0e9b62d7fa033918b54ef45f8bf7d1ad1c Author: Chuck Lever Date: Wed Jun 19 10:33:04 2019 -0400 xprtrdma: Add mechanism to place MRs back on the free list When a marshal operation fails, any MRs that were already set up for that request are recycled. Recycling releases MRs and creates new ones, which is expensive. Since commit f2877623082b ("xprtrdma: Chain Send to FastReg WRs") was merged, recycling FRWRs is unnecessary. This is because before that commit, frwr_map had already posted FAST_REG Work Requests, so ownership of the MRs had already been passed to the NIC and thus dealing with them had to be delayed until they completed. Since that commit, however, FAST_REG WRs are posted at the same time as the Send WR. This means that if marshaling fails, we are certain the MRs are safe to simply unmap and place back on the free list because neither the Send nor the FAST_REG WRs have been posted yet. The kernel still has ownership of the MRs at this point. This reduces the total number of MRs that the xprt has to create under heavy workloads and makes the marshaling logic less brittle. Signed-off-by: Chuck Lever Signed-off-by: Anna Schumaker commit 847568942f93e0af77e4bb8a098899f310cb3a88 Author: Chuck Lever Date: Wed Jun 19 10:32:59 2019 -0400 xprtrdma: Remove fr_state Now that both the Send and Receive completions are handled in process context, it is safe to DMA unmap and return MRs to the free or recycle lists directly in the completion handlers. Doing this means rpcrdma_frwr no longer needs to track the state of each MR, meaning that a VALID or FLUSHED MR can no longer appear on an xprt's MR free list. Thus there is no longer a need to track the MR's registration state in rpcrdma_frwr. Signed-off-by: Chuck Lever Signed-off-by: Anna Schumaker commit 5809ea4f7c39bf38e3f85ec185b776da9d81717c Author: Chuck Lever Date: Wed Jun 19 10:32:54 2019 -0400 xprtrdma: Remove the RPCRDMA_REQ_F_PENDING flag Commit 9590d083c1bb ("xprtrdma: Use xprt_pin_rqst in rpcrdma_reply_handler") pins incoming RPC/RDMA replies so they can be left in the pending requests queue while they are being processed without introducing a race between ->buf_free and the transport's reply handler. Therefore RPCRDMA_REQ_F_PENDING is no longer necessary. Signed-off-by: Chuck Lever Signed-off-by: Anna Schumaker commit 05eb06d86685e7d9dac60e6bbb46d7f4c30b056e Author: Chuck Lever Date: Wed Jun 19 10:32:48 2019 -0400 xprtrdma: Fix occasional transport deadlock Under high I/O workloads, I've noticed that an RPC/RDMA transport occasionally deadlocks (IOPS goes to zero, and doesn't recover). Diagnosis shows that the sendctx queue is empty, but when sendctxs are returned to the queue, the xprt_write_space wake-up never occurs. The wake-up logic in rpcrdma_sendctx_put_locked is racy. I noticed that both EMPTY_SCQ and XPRT_WRITE_SPACE are implemented via an atomic bit. Just one of those is sufficient. Removing EMPTY_SCQ in favor of the generic bit mechanism makes the deadlock un-reproducible. Without EMPTY_SCQ, rpcrdma_buffer::rb_flags is no longer used and is therefore removed. Unfortunately this patch does not apply cleanly to stable. If needed, someone will have to port it and test it. Fixes: 2fad659209d5 ("xprtrdma: Wait on empty sendctx queue") Signed-off-by: Chuck Lever Signed-off-by: Anna Schumaker commit 1310051c720a83c5717658bcbff710b260f2bff9 Author: Chuck Lever Date: Wed Jun 19 10:32:43 2019 -0400 xprtrdma: Replace use of xdr_stream_pos in rpcrdma_marshal_req This is a latent bug. xdr_stream_pos works by subtracting xdr_stream::nwords from xdr_buf::len. But xdr_stream::nwords is not initialized by xdr_init_encode(). It works today only because all fields in rpcrdma_req::rl_stream are initialized to zero by rpcrdma_req_create, making the subtraction in xdr_stream_pos always a no-op. I found this issue via code inspection. It was introduced by commit 39f4cd9e9982 ("xprtrdma: Harden chunk list encoding against send buffer overflow"), but the code has changed enough since then that this fix can't be automatically applied to stable. Signed-off-by: Chuck Lever Signed-off-by: Anna Schumaker commit 6c395f66e98c895cf3ebf87c0b2fc63b6a57a196 Author: Zhang Rui Date: Tue Jul 9 21:19:12 2019 +0800 drivers: thermal: processor_thermal_device: Fix build warning As a system sleep callback, proc_thermal_resume() should be defined only if CONFIG_PM_SLEEP is defined. This fixes a build warning when CONFIG_PM_SLEEP is not set, drivers/thermal/intel/int340x_thermal/processor_thermal_device.c:446:12: error: 'proc_thermal_resume' defined but not used [-Werror=unused-function] static int proc_thermal_resume(struct device *dev) Fixes: aaba9791fbb4 ("drivers: thermal: processor_thermal: Read PPCC on resume") Reported-by: Arnd Bergmann Signed-off-by: Zhang Rui commit 323fd749821daab0f327ec86d707c4542963cdb0 Author: Leo Yan Date: Mon Jul 8 22:39:36 2019 +0800 perf intel-pt: Fix potential NULL pointer dereference found by the smatch tool Based on the following report from Smatch, fix the potential NULL pointer dereference check. tools/perf/util/intel-pt.c:3200 intel_pt_process_auxtrace_info() error: we previously assumed 'session->itrace_synth_opts' could be null (see line 3196) tools/perf/util/intel-pt.c:3206 intel_pt_process_auxtrace_info() warn: variable dereferenced before check 'session->itrace_synth_opts' (see line 3200) tools/perf/util/intel-pt.c 3196 if (session->itrace_synth_opts && session->itrace_synth_opts->set) { 3197 pt->synth_opts = *session->itrace_synth_opts; 3198 } else { 3199 itrace_synth_opts__set_default(&pt->synth_opts, 3200 session->itrace_synth_opts->default_no_sample); ^^^^^^^^^^^^^^^^^^^^^^^^^^ 3201 if (!session->itrace_synth_opts->default_no_sample && 3202 !session->itrace_synth_opts->inject) { 3203 pt->synth_opts.branches = false; 3204 pt->synth_opts.callchain = true; 3205 } 3206 if (session->itrace_synth_opts) ^^^^^^^^^^^^^^^^^^^^^^^^^^ 3207 pt->synth_opts.thread_stack = 3208 session->itrace_synth_opts->thread_stack; 3209 } 'session->itrace_synth_opts' is impossible to be a NULL pointer in intel_pt_process_auxtrace_info(), thus this patch removes the NULL test for 'session->itrace_synth_opts'. Signed-off-by: Leo Yan Acked-by: Adrian Hunter Cc: Alexander Shishkin Cc: Andi Kleen Cc: Jiri Olsa Cc: Mathieu Poirier Cc: Namhyung Kim Cc: Suzuki Poulouse Cc: linux-arm-kernel@lists.infradead.org Link: http://lkml.kernel.org/r/20190708143937.7722-4-leo.yan@linaro.org Signed-off-by: Arnaldo Carvalho de Melo commit 1d481458816d9424c8a05833ce0ebe72194a350e Author: Leo Yan Date: Mon Jul 8 22:39:35 2019 +0800 perf intel-bts: Fix potential NULL pointer dereference found by the smatch tool Based on the following report from Smatch, fix the potential NULL pointer dereference check. tools/perf/util/intel-bts.c:898 intel_bts_process_auxtrace_info() error: we previously assumed 'session->itrace_synth_opts' could be null (see line 894) tools/perf/util/intel-bts.c:899 intel_bts_process_auxtrace_info() warn: variable dereferenced before check 'session->itrace_synth_opts' (see line 898) tools/perf/util/intel-bts.c 894 if (session->itrace_synth_opts && session->itrace_synth_opts->set) { 895 bts->synth_opts = *session->itrace_synth_opts; 896 } else { 897 itrace_synth_opts__set_default(&bts->synth_opts, 898 session->itrace_synth_opts->default_no_sample); ^^^^^^^^^^^^^^^^^^^^^^^^^^ 899 if (session->itrace_synth_opts) ^^^^^^^^^^^^^^^^^^^^^^^^^^ 900 bts->synth_opts.thread_stack = 901 session->itrace_synth_opts->thread_stack; 902 } 'session->itrace_synth_opts' is impossible to be a NULL pointer in intel_bts_process_auxtrace_info(), thus this patch removes the NULL test for 'session->itrace_synth_opts'. Signed-off-by: Leo Yan Acked-by: Adrian Hunter Cc: Alexander Shishkin Cc: Andi Kleen Cc: Jiri Olsa Cc: Mathieu Poirier Cc: Namhyung Kim Cc: Suzuki Poulouse Cc: linux-arm-kernel@lists.infradead.org Link: http://lkml.kernel.org/r/20190708143937.7722-3-leo.yan@linaro.org Signed-off-by: Arnaldo Carvalho de Melo commit 9d49169c5958e429ffa6874fbef734ae7502ad65 Author: Song Liu Date: Thu Jun 20 18:44:38 2019 -0700 perf script: Assume native_arch for pipe mode In pipe mode, session->header.env.arch is not populated until the events are processed. Therefore, the following command crashes: perf record -o - | perf script (gdb) bt It fails when we try to compare env.arch against uts.machine: if (!strcmp(uts.machine, session->header.env.arch) || (!strcmp(uts.machine, "x86_64") && !strcmp(session->header.env.arch, "i386"))) native_arch = true; In pipe mode, it is tricky to find env.arch at this stage. To keep it simple, let's just assume native_arch is always true for pipe mode. Reported-by: David Carrillo Cisneros Signed-off-by: Song Liu Tested-by: Arnaldo Carvalho de Melo Cc: Andi Kleen Cc: Jiri Olsa Cc: Namhyung Kim Cc: kernel-team@fb.com Cc: stable@vger.kernel.org #v5.1+ Fixes: 3ab481a1cfe1 ("perf script: Support insn output for normal samples") Link: http://lkml.kernel.org/r/20190621014438.810342-1-songliubraving@fb.com Signed-off-by: Arnaldo Carvalho de Melo commit 1334bb94cd8a21217cb0c186925f9bc9d47adafc Author: Adrian Hunter Date: Mon Jul 8 08:52:32 2019 +0300 perf scripts python: export-to-sqlite.py: Fix DROP VIEW power_events_view Drop power_events_view before its dependent tables. SQLite does not seem to mind but the fix was needed for PostgreSQL (export-to-postgresql.py script), so do the same fix for the SQLite. It is more logical and keeps the 2 scripts following the same approach. Signed-off-by: Adrian Hunter Cc: Jiri Olsa Fixes: 5130c6e55531 ("perf scripts python: export-to-sqlite.py: Export Intel PT power and ptwrite events") Link: http://lkml.kernel.org/r/20190708055232.5032-3-adrian.hunter@intel.com Signed-off-by: Arnaldo Carvalho de Melo commit d8d051df9f906232715282cc0570c94273b197bc Author: Adrian Hunter Date: Mon Jul 8 08:52:31 2019 +0300 perf scripts python: export-to-postgresql.py: Fix DROP VIEW power_events_view PostgreSQL can error if power_events_view is not dropped before its dependent tables e.g. Exception: Query failed: ERROR: cannot drop table mwait because other objects depend on it DETAIL: view power_events_view depends on table mwait Signed-off-by: Adrian Hunter Cc: Jiri Olsa Fixes: aba44287a224 ("perf scripts python: export-to-postgresql.py: Export Intel PT power and ptwrite events") Link: http://lkml.kernel.org/r/20190708055232.5032-2-adrian.hunter@intel.com Signed-off-by: Arnaldo Carvalho de Melo commit ceb75476db1617a88cc29b09839acacb69aa076e Author: Leo Yan Date: Mon Jul 8 22:39:34 2019 +0800 perf hists browser: Fix potential NULL pointer dereference found by the smatch tool Based on the following report from Smatch, fix the potential NULL pointer dereference check. tools/perf/ui/browsers/hists.c:641 hist_browser__run() error: we previously assumed 'hbt' could be null (see line 625) tools/perf/ui/browsers/hists.c:3088 perf_evsel__hists_browse() error: we previously assumed 'browser->he_selection' could be null (see line 2902) tools/perf/ui/browsers/hists.c:3272 perf_evsel_menu__run() error: we previously assumed 'hbt' could be null (see line 3260) This patch firstly validating the pointers before access them, so can fix potential NULL pointer dereference. Signed-off-by: Leo Yan Acked-by: Jiri Olsa Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Andi Kleen Cc: Mathieu Poirier Cc: Namhyung Kim Cc: Suzuki Poulouse Cc: linux-arm-kernel@lists.infradead.org Link: http://lkml.kernel.org/r/20190708143937.7722-2-leo.yan@linaro.org Signed-off-by: Arnaldo Carvalho de Melo commit 0702f23c983b8a921853c33a9f59b9cf0975d36e Author: Leo Yan Date: Mon Jul 8 22:39:37 2019 +0800 perf cs-etm: Fix potential NULL pointer dereference found by the smatch tool Based on the following report from Smatch, fix the potential NULL pointer dereference check. tools/perf/util/cs-etm.c:2545 cs_etm__process_auxtrace_info() error: we previously assumed 'session->itrace_synth_opts' could be null (see line 2541) tools/perf/util/cs-etm.c 2541 if (session->itrace_synth_opts && session->itrace_synth_opts->set) { 2542 etm->synth_opts = *session->itrace_synth_opts; 2543 } else { 2544 itrace_synth_opts__set_default(&etm->synth_opts, 2545 session->itrace_synth_opts->default_no_sample); ^^^^^^^^^^^^^^^^^^^^^^^^^^ 2546 etm->synth_opts.callchain = false; 2547 } 'session->itrace_synth_opts' is impossible to be a NULL pointer in cs_etm__process_auxtrace_info(), thus this patch removes the NULL test for 'session->itrace_synth_opts'. Signed-off-by: Leo Yan Reviewed-by: Mathieu Poirier Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Andi Kleen Cc: Jiri Olsa Cc: Namhyung Kim Cc: Suzuki Poulouse Cc: linux-arm-kernel@lists.infradead.org Link: http://lkml.kernel.org/r/20190708143937.7722-5-leo.yan@linaro.org Signed-off-by: Arnaldo Carvalho de Melo commit 72de3fd97f15d75657dd5389e26801cbf8af0f9a Author: Luke Mujica Date: Wed Jul 3 15:25:09 2019 -0700 perf parse-events: Remove unused variable: error Remove the 'error' variable because it is declared but not used in parse-events.y or in the generated parse-events.c. Signed-off-by: Luke Mujica Cc: Alexander Shishkin Cc: Ian Rogers Cc: Jiri Olsa Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Stephane Eranian Link: http://lkml.kernel.org/r/20190703222509.109616-2-lukemujica@google.com Signed-off-by: Arnaldo Carvalho de Melo commit 34c9af571e51466fbcc423fb955277c82f03ce92 Author: Luke Mujica Date: Wed Jul 3 15:25:08 2019 -0700 perf parse-events: Remove unused variable 'i' Remove the 'int i' because it is declared but not used in parse-events.y or in the generated parse-events.c. Signed-off-by: Luke Mujica Cc: Alexander Shishkin Cc: Ian Rogers Cc: Jiri Olsa Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Stephane Eranian Link: http://lkml.kernel.org/r/20190703222509.109616-1-lukemujica@google.com Signed-off-by: Arnaldo Carvalho de Melo commit acc7bfb3db9744c4a18c96fd6536069e8647cb11 Author: Arnaldo Carvalho de Melo Date: Thu Jul 4 12:20:21 2019 -0300 perf metricgroup: Add missing list_del_init() when flushing egroups list So that at the end each of the entries have its list node struct cleared and the egroup list head ends emptied. Cc: Adrian Hunter Cc: Andi Kleen Cc: Jiri Olsa Cc: Namhyung Kim Link: https://lkml.kernel.org/n/tip-dxzj1ah350fy9ec0xbhb15b6@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit e56fbc9dc79ce0fdc49ffadd062214ddd02f65b6 Author: Arnaldo Carvalho de Melo Date: Thu Jul 4 12:13:46 2019 -0300 perf tools: Use list_del_init() more thorougly To allow for destructors to check if they're operating on a object still in a list, and to avoid going from use after free list entries into still valid, or even also other already removed from list entries. Cc: Adrian Hunter Cc: Jiri Olsa Cc: Namhyung Kim Link: https://lkml.kernel.org/n/tip-deh17ub44atyox3j90e6rksu@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit d8f9da240495b50766239410f9b0c715ca506a67 Author: Arnaldo Carvalho de Melo Date: Thu Jul 4 12:06:20 2019 -0300 perf tools: Use zfree() where applicable In places where the equivalent was already being done, i.e.: free(a); a = NULL; And in placs where struct members are being freed so that if we have some erroneous reference to its struct, then accesses to freed members will result in segfaults, which we can detect faster than use after free to areas that may still have something seemingly valid. Cc: Adrian Hunter Cc: Jiri Olsa Cc: Namhyung Kim Link: https://lkml.kernel.org/n/tip-jatyoofo5boc1bsvoig6bb6i@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 7f7c536f23e6afaa5d5d4b0e0958b0be8922491f Author: Arnaldo Carvalho de Melo Date: Thu Jul 4 11:32:27 2019 -0300 tools lib: Adopt zalloc()/zfree() from tools/perf Eroding a bit more the tools/perf/util/util.h hodpodge header. Cc: Adrian Hunter Cc: Jiri Olsa Cc: Namhyung Kim Link: https://lkml.kernel.org/n/tip-natazosyn9rwjka25tvcnyi0@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit e5653eb82ddc71ad8ffcbb3c74dd6f0c0230ab4c Author: Arnaldo Carvalho de Melo Date: Fri Jul 5 14:16:15 2019 -0300 perf tools: Move get_current_dir_name() cond prototype out of util.h And in a separate header, so that we erode util.h a bit more. Cc: Adrian Hunter Cc: Jiri Olsa Cc: Namhyung Kim Link: https://lkml.kernel.org/n/tip-xpzvuu9d0gei9jl9bkzgobln@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 245aec7f7f4ca95b924f005d604bab9d838b5eb1 Author: Arnaldo Carvalho de Melo Date: Fri Jul 5 13:59:06 2019 -0300 perf namespaces: Move the conditional setns() prototype to namespaces.h Out of util.h, to reduce its scope, and since we have a namespaces.h header, much better to have it there, where it is related to. Cc: Adrian Hunter Cc: Jiri Olsa Cc: Namhyung Kim Link: https://lkml.kernel.org/n/tip-zlu81bbtccuzygh7m8nmgybc@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 215a0d305c5651928eb67c96bcedd0a6c297dfce Author: Arnaldo Carvalho de Melo Date: Thu Jul 4 11:21:24 2019 -0300 perf tools: Add missing headers, mostly stdlib.h Part of the erosion of util/util.h, that will lose its include stdlib.h, we need to add it to places where it is needed but was getting it indirectly. Cc: Adrian Hunter Cc: Jiri Olsa Cc: Namhyung Kim Link: https://lkml.kernel.org/n/tip-1imnqezw99ahc07fjeb51qby@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit b3b3eb9dadfcb6c706f5fa97bc841d4e069af3de Author: Masahiro Yamada Date: Sat Jul 6 00:14:31 2019 +0900 scripts/tags.sh: remove unused environment variables from comments This script has no reference to ${ARCH}, ${src}, ${obj}. Signed-off-by: Masahiro Yamada commit d1db881d9bf16f2c51bdef8f0dfc2e4088a76bbf Author: Masahiro Yamada Date: Sat Jul 6 00:14:30 2019 +0900 scripts/tags.sh: drop SUBARCH support for ARM Our goal is to have more and more sub-architectures to join the ARM multi-platform, and support them in a single configuration. Remove the ARM SUBARCH support because it is ugly. Signed-off-by: Masahiro Yamada commit 7c8e90ddf02f139a90bc29c04302e9914818f0c8 Author: Wen Yang Date: Mon Jul 8 14:19:04 2019 +0800 irqchip/renesas-rza1: Prevent use-after-free in rza1_irqc_probe() The gic_node is still being used in the rza1_irqc_parse_map() call after the of_node_put() call, which may result in use-after-free. Fixes: a644ccb819bc ("irqchip: Add Renesas RZ/A1 Interrupt Controller driver") Signed-off-by: Wen Yang Signed-off-by: Thomas Gleixner Reviewed-by: Geert Uytterhoeven Link: https://lkml.kernel.org/r/1562566745-7447-3-git-send-email-wen.yang99@zte.com.cn commit 390d57728d8e6f7283030cb20d3b5459771a32f1 Author: Jason Gunthorpe Date: Tue Jul 9 09:44:47 2019 -0300 RDMA/core: Make rdma_counter.h compile stand alone 5.4-rc1 will have new compile time debugging to test that headers can be compiled stand alone. Many rdma headers are already broken and excluded from the mechanism, however to avoid compile failures during the merge window fix enough so that the newly added header compiles clean. Fixes: 413d3347503b ("RDMA/counter: Add set/clear per-port auto mode support") Reported-by: Stephen Rothwell Signed-off-by: Jason Gunthorpe Signed-off-by: Mark Zhang commit 43c78d88036e47949a5af2fac0067e7ebaaf7dd0 Author: Masahiro Yamada Date: Mon Jul 1 09:58:45 2019 +0900 kbuild: compile-test kernel headers to ensure they are self-contained The headers in include/ are globally used in the kernel source tree to provide common APIs. They are included from external modules, too. It will be useful to make as many headers self-contained as possible so that we do not have to rely on a specific include order. There are more than 4000 headers in include/. In my rough analysis, 70% of them are already self-contained. With efforts, most of them can be self-contained. For now, we must exclude more than 1000 headers just because they cannot be compiled as standalone units. I added them to header-test-. The blacklist was mostly generated by a script, so the reason of the breakage should be checked later. Signed-off-by: Masahiro Yamada Tested-by: Jani Nikula Reviewed-by: Joel Fernandes (Google) commit 1cbec37b3f9cff074a67bef4fc34b30a09958a0a Author: Jiri Slaby Date: Tue Jul 9 08:34:02 2019 +0200 x86/entry/32: Fix ENDPROC of common_spurious common_spurious is currently ENDed erroneously. common_interrupt is used in its ENDPROC. So fix this mistake. Found by my asm macros rewrite patchset. Fixes: f8a8fe61fec8 ("x86/irq: Seperate unused system vectors from spurious entry again") Signed-off-by: Jiri Slaby Signed-off-by: Thomas Gleixner Link: https://lkml.kernel.org/r/20190709063402.19847-1-jslaby@suse.cz commit fc50e0ba9bcac92ff177ff3ac64644108b6d8dd8 Author: Arnaldo Carvalho de Melo Date: Wed Jul 3 16:12:51 2019 -0300 perf evsel: perf_evsel__name(NULL) is valid, no need to check evsel It'll return "unknown", no need to open code it. Cc: Adrian Hunter Cc: Jiri Olsa Cc: Leo Yan Cc: Namhyung Kim Link: https://lkml.kernel.org/n/tip-4okvjmm18arjrcyfhuahgfxm@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit f3c8d90757724982e5f07cd77d315eb64ca145ac Author: Leo Yan Date: Tue Jul 2 18:34:17 2019 +0800 perf session: Fix potential NULL pointer dereference found by the smatch tool Based on the following report from Smatch, fix the potential NULL pointer dereference check. tools/perf/util/session.c:1252 dump_read() error: we previously assumed 'evsel' could be null (see line 1249) tools/perf/util/session.c 1240 static void dump_read(struct perf_evsel *evsel, union perf_event *event) 1241 { 1242 struct read_event *read_event = &event->read; 1243 u64 read_format; 1244 1245 if (!dump_trace) 1246 return; 1247 1248 printf(": %d %d %s %" PRIu64 "\n", event->read.pid, event->read.tid, 1249 evsel ? perf_evsel__name(evsel) : "FAIL", 1250 event->read.value); 1251 1252 read_format = evsel->attr.read_format; ^^^^^^^ 'evsel' could be NULL pointer, for this case this patch directly bails out without dumping read_event. Signed-off-by: Leo Yan Acked-by: Jiri Olsa Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Alexey Budankov Cc: Alexios Zavras Cc: Andi Kleen Cc: Changbin Du Cc: David S. Miller Cc: Davidlohr Bueso Cc: Eric Saint-Etienne Cc: Jin Yao Cc: Konstantin Khlebnikov Cc: Mathieu Poirier Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Rasmus Villemoes Cc: Song Liu Cc: Suzuki Poulouse Cc: Thomas Gleixner Cc: Thomas Richter Cc: linux-arm-kernel@lists.infradead.org Link: http://lkml.kernel.org/r/20190702103420.27540-9-leo.yan@linaro.org Signed-off-by: Arnaldo Carvalho de Melo commit 40978e9bf2137223993e70921de2731201788049 Author: Arnaldo Carvalho de Melo Date: Wed Jul 3 16:02:09 2019 -0300 perf inject: The tool->read() call may pass a NULL evsel, handle it Check first, as machines__deliver_event() may have perf_evlist__id2evsel() returning NULL. This was found while checking a report from Leo Yan that used the smatch tool to find places where a pointer is checked before use and then, later in the same function gets used without checking. Cc: Adrian Hunter Cc: Jiri Olsa Cc: Leo Yan Cc: Namhyung Kim Link: https://lkml.kernel.org/n/tip-muvb8xqyh0gysgfjfq35w642@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 363bbaef63ffebcc745239fe80a953ebb5ac9ec9 Author: Leo Yan Date: Tue Jul 2 18:34:16 2019 +0800 perf map: Fix potential NULL pointer dereference found by smatch tool Based on the following report from Smatch, fix the potential NULL pointer dereference check. tools/perf/util/map.c:479 map__fprintf_srccode() error: we previously assumed 'state' could be null (see line 466) tools/perf/util/map.c 465 /* Avoid redundant printing */ 466 if (state && 467 state->srcfile && 468 !strcmp(state->srcfile, srcfile) && 469 state->line == line) { 470 free(srcfile); 471 return 0; 472 } 473 474 srccode = find_sourceline(srcfile, line, &len); 475 if (!srccode) 476 goto out_free_line; 477 478 ret = fprintf(fp, "|%-8d %.*s", line, len, srccode); 479 state->srcfile = srcfile; ^^^^^^^ 480 state->line = line; ^^^^^^^ This patch validates 'state' pointer before access its elements. Signed-off-by: Leo Yan Acked-by: Jiri Olsa Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Alexey Budankov Cc: Alexios Zavras Cc: Andi Kleen Cc: Changbin Du Cc: David S. Miller Cc: Davidlohr Bueso Cc: Eric Saint-Etienne Cc: Jin Yao Cc: Konstantin Khlebnikov Cc: Mathieu Poirier Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Rasmus Villemoes Cc: Song Liu Cc: Suzuki Poulouse Cc: Thomas Gleixner Cc: Thomas Richter Cc: linux-arm-kernel@lists.infradead.org Fixes: dd2e18e9ac20 ("perf tools: Support 'srccode' output") Link: http://lkml.kernel.org/r/20190702103420.27540-8-leo.yan@linaro.org Signed-off-by: Arnaldo Carvalho de Melo commit 7a6d49dc8cad8fa1f3d63994102af8f9ae9c859f Author: Leo Yan Date: Tue Jul 2 18:34:14 2019 +0800 perf trace: Fix potential NULL pointer dereference found by the smatch tool Based on the following report from Smatch, fix the potential NULL pointer dereference check. tools/perf/builtin-trace.c:1044 thread_trace__new() error: we previously assumed 'ttrace' could be null (see line 1041). tools/perf/builtin-trace.c 1037 static struct thread_trace *thread_trace__new(void) 1038 { 1039 struct thread_trace *ttrace = zalloc(sizeof(struct thread_trace)); 1040 1041 if (ttrace) 1042 ttrace->files.max = -1; 1043 1044 ttrace->syscall_stats = intlist__new(NULL); ^^^^^^^^ 1045 1046 return ttrace; 1047 } Signed-off-by: Leo Yan Acked-by: Jiri Olsa Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Alexey Budankov Cc: Alexios Zavras Cc: Andi Kleen Cc: Changbin Du Cc: David S. Miller Cc: Davidlohr Bueso Cc: Eric Saint-Etienne Cc: Jin Yao Cc: Konstantin Khlebnikov Cc: Mathieu Poirier Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Rasmus Villemoes Cc: Song Liu Cc: Suzuki Poulouse Cc: Thomas Gleixner Cc: Thomas Richter Cc: linux-arm-kernel@lists.infradead.org Link: http://lkml.kernel.org/r/20190702103420.27540-6-leo.yan@linaro.org [ Just made it look like other tools/perf constructors, same end result ] Signed-off-by: Arnaldo Carvalho de Melo commit 600c787dbf6521d8d07ee717ab7606d5070103ea Author: Leo Yan Date: Tue Jul 2 18:34:13 2019 +0800 perf annotate: Fix dereferencing freed memory found by the smatch tool Based on the following report from Smatch, fix the potential dereferencing freed memory check. tools/perf/util/annotate.c:1125 disasm_line__parse() error: dereferencing freed memory 'namep' tools/perf/util/annotate.c 1100 static int disasm_line__parse(char *line, const char **namep, char **rawp) 1101 { 1102 char tmp, *name = ltrim(line); [...] 1114 *namep = strdup(name); 1115 1116 if (*namep == NULL) 1117 goto out_free_name; [...] 1124 out_free_name: 1125 free((void *)namep); ^^^^^ 1126 *namep = NULL; ^^^^^^ 1127 return -1; 1128 } If strdup() fails to allocate memory space for *namep, we don't need to free memory with pointer 'namep', which is resident in data structure disasm_line::ins::name; and *namep is NULL pointer for this failure, so it's pointless to assign NULL to *namep again. Committer note: Freeing namep, which is the address of the first entry of the 'struct ins' that is the first member of struct disasm_line would in fact free that disasm_line instance, if it was allocated via malloc/calloc, which, later, would a dereference of freed memory. Signed-off-by: Leo Yan Acked-by: Jiri Olsa Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Alexey Budankov Cc: Alexios Zavras Cc: Andi Kleen Cc: Changbin Du Cc: David S. Miller Cc: Davidlohr Bueso Cc: Eric Saint-Etienne Cc: Jin Yao Cc: Konstantin Khlebnikov Cc: Mathieu Poirier Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Rasmus Villemoes Cc: Song Liu Cc: Suzuki Poulouse Cc: Thomas Gleixner Cc: Thomas Richter Cc: linux-arm-kernel@lists.infradead.org Link: http://lkml.kernel.org/r/20190702103420.27540-5-leo.yan@linaro.org Signed-off-by: Arnaldo Carvalho de Melo commit 111442cfc8abdeaa7ec1407f07ef7b3e5f76654e Author: Leo Yan Date: Tue Jul 2 18:34:12 2019 +0800 perf top: Fix potential NULL pointer dereference detected by the smatch tool Based on the following report from Smatch, fix the potential NULL pointer dereference check. tools/perf/builtin-top.c:109 perf_top__parse_source() warn: variable dereferenced before check 'he' (see line 103) tools/perf/builtin-top.c:233 perf_top__show_details() warn: variable dereferenced before check 'he' (see line 228) tools/perf/builtin-top.c 101 static int perf_top__parse_source(struct perf_top *top, struct hist_entry *he) 102 { 103 struct perf_evsel *evsel = hists_to_evsel(he->hists); ^^^^ 104 struct symbol *sym; 105 struct annotation *notes; 106 struct map *map; 107 int err = -1; 108 109 if (!he || !he->ms.sym) 110 return -1; This patch moves the values assignment after validating pointer 'he'. Signed-off-by: Leo Yan Acked-by: Jiri Olsa Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Alexey Budankov Cc: Alexios Zavras Cc: Andi Kleen Cc: Changbin Du Cc: David S. Miller Cc: Davidlohr Bueso Cc: Eric Saint-Etienne Cc: Jin Yao Cc: Konstantin Khlebnikov Cc: Mathieu Poirier Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Rasmus Villemoes Cc: Song Liu Cc: Suzuki Poulouse Cc: Thomas Gleixner Cc: Thomas Richter Cc: linux-arm-kernel@lists.infradead.org Link: http://lkml.kernel.org/r/20190702103420.27540-4-leo.yan@linaro.org Signed-off-by: Arnaldo Carvalho de Melo commit c74b05030edb3b52f4208d8415b8c933bc509a29 Author: Leo Yan Date: Tue Jul 2 18:34:11 2019 +0800 perf stat: Fix use-after-freed pointer detected by the smatch tool Based on the following report from Smatch, fix the use-after-freed pointer. tools/perf/builtin-stat.c:1353 add_default_attributes() warn: passing freed memory 'str'. The pointer 'str' has been freed but later it is still passed into the function parse_events_print_error(). This patch fixes this use-after-freed issue. Signed-off-by: Leo Yan Acked-by: Jiri Olsa Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Alexey Budankov Cc: Alexios Zavras Cc: Andi Kleen Cc: Changbin Du Cc: Davidlohr Bueso Cc: David S. Miller Cc: Eric Saint-Etienne Cc: Jin Yao Cc: Konstantin Khlebnikov Cc: linux-arm-kernel@lists.infradead.org Cc: Mathieu Poirier Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Rasmus Villemoes Cc: Song Liu Cc: Suzuki Poulouse Cc: Thomas Gleixner Cc: Thomas Richter Link: http://lkml.kernel.org/r/20190702103420.27540-3-leo.yan@linaro.org Signed-off-by: Arnaldo Carvalho de Melo commit 4e4cf62b37da5ff45c904a3acf242ab29ed5881d Author: Numfor Mbiziwo-Tiapo Date: Tue Jul 2 10:37:15 2019 -0700 perf test mmap-thread-lookup: Initialize variable to suppress memory sanitizer warning Running the 'perf test' command after building perf with a memory sanitizer causes a warning that says: WARNING: MemorySanitizer: use-of-uninitialized-value... in mmap-thread-lookup.c Initializing the go variable to 0 silences this harmless warning. Committer warning: This was harmless, just a simple test writing whatever was at that sizeof(int) memory area just to signal another thread blocked reading that file created with pipe(). Initialize it tho so that we don't get this warning. Signed-off-by: Numfor Mbiziwo-Tiapo Cc: Alexander Shishkin Cc: Ian Rogers Cc: Jiri Olsa Cc: Mark Drayton Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Song Liu Cc: Stephane Eranian Link: http://lkml.kernel.org/r/20190702173716.181223-1-nums@google.com Signed-off-by: Arnaldo Carvalho de Melo commit f6b6aefee70aa5261deec7feab80c249bf58397f Author: Bjorn Helgaas Date: Thu May 30 08:05:58 2019 -0500 PCI: Fix typos and whitespace errors Fix typos in drivers/pci. Comment and whitespace changes only. Signed-off-by: Bjorn Helgaas Reviewed-by: Rafael J. Wysocki Reviewed-by: Randy Dunlap commit a2059825986a1c8143fd6698774fa9d83733bb11 Author: Josh Poimboeuf Date: Mon Jul 8 11:52:26 2019 -0500 x86/speculation: Enable Spectre v1 swapgs mitigations The previous commit added macro calls in the entry code which mitigate the Spectre v1 swapgs issue if the X86_FEATURE_FENCE_SWAPGS_* features are enabled. Enable those features where applicable. The mitigations may be disabled with "nospectre_v1" or "mitigations=off". There are different features which can affect the risk of attack: - When FSGSBASE is enabled, unprivileged users are able to place any value in GS, using the wrgsbase instruction. This means they can write a GS value which points to any value in kernel space, which can be useful with the following gadget in an interrupt/exception/NMI handler: if (coming from user space) swapgs mov %gs:, %reg1 // dependent load or store based on the value of %reg // for example: mov %(reg1), %reg2 If an interrupt is coming from user space, and the entry code speculatively skips the swapgs (due to user branch mistraining), it may speculatively execute the GS-based load and a subsequent dependent load or store, exposing the kernel data to an L1 side channel leak. Note that, on Intel, a similar attack exists in the above gadget when coming from kernel space, if the swapgs gets speculatively executed to switch back to the user GS. On AMD, this variant isn't possible because swapgs is serializing with respect to future GS-based accesses. NOTE: The FSGSBASE patch set hasn't been merged yet, so the above case doesn't exist quite yet. - When FSGSBASE is disabled, the issue is mitigated somewhat because unprivileged users must use prctl(ARCH_SET_GS) to set GS, which restricts GS values to user space addresses only. That means the gadget would need an additional step, since the target kernel address needs to be read from user space first. Something like: if (coming from user space) swapgs mov %gs:, %reg1 mov (%reg1), %reg2 // dependent load or store based on the value of %reg2 // for example: mov %(reg2), %reg3 It's difficult to audit for this gadget in all the handlers, so while there are no known instances of it, it's entirely possible that it exists somewhere (or could be introduced in the future). Without tooling to analyze all such code paths, consider it vulnerable. Effects of SMAP on the !FSGSBASE case: - If SMAP is enabled, and the CPU reports RDCL_NO (i.e., not susceptible to Meltdown), the kernel is prevented from speculatively reading user space memory, even L1 cached values. This effectively disables the !FSGSBASE attack vector. - If SMAP is enabled, but the CPU *is* susceptible to Meltdown, SMAP still prevents the kernel from speculatively reading user space memory. But it does *not* prevent the kernel from reading the user value from L1, if it has already been cached. This is probably only a small hurdle for an attacker to overcome. Thanks to Dave Hansen for contributing the speculative_smap() function. Thanks to Andrew Cooper for providing the inside scoop on whether swapgs is serializing on AMD. [ tglx: Fixed the USER fence decision and polished the comment as suggested by Dave Hansen ] Signed-off-by: Josh Poimboeuf Signed-off-by: Thomas Gleixner Reviewed-by: Dave Hansen commit 18ec54fdd6d18d92025af097cd042a75cf0ea24c Author: Josh Poimboeuf Date: Mon Jul 8 11:52:25 2019 -0500 x86/speculation: Prepare entry code for Spectre v1 swapgs mitigations Spectre v1 isn't only about array bounds checks. It can affect any conditional checks. The kernel entry code interrupt, exception, and NMI handlers all have conditional swapgs checks. Those may be problematic in the context of Spectre v1, as kernel code can speculatively run with a user GS. For example: if (coming from user space) swapgs mov %gs:, %reg mov (%reg), %reg1 When coming from user space, the CPU can speculatively skip the swapgs, and then do a speculative percpu load using the user GS value. So the user can speculatively force a read of any kernel value. If a gadget exists which uses the percpu value as an address in another load/store, then the contents of the kernel value may become visible via an L1 side channel attack. A similar attack exists when coming from kernel space. The CPU can speculatively do the swapgs, causing the user GS to get used for the rest of the speculative window. The mitigation is similar to a traditional Spectre v1 mitigation, except: a) index masking isn't possible; because the index (percpu offset) isn't user-controlled; and b) an lfence is needed in both the "from user" swapgs path and the "from kernel" non-swapgs path (because of the two attacks described above). The user entry swapgs paths already have SWITCH_TO_KERNEL_CR3, which has a CR3 write when PTI is enabled. Since CR3 writes are serializing, the lfences can be skipped in those cases. On the other hand, the kernel entry swapgs paths don't depend on PTI. To avoid unnecessary lfences for the user entry case, create two separate features for alternative patching: X86_FEATURE_FENCE_SWAPGS_USER X86_FEATURE_FENCE_SWAPGS_KERNEL Use these features in entry code to patch in lfences where needed. The features aren't enabled yet, so there's no functional change. Signed-off-by: Josh Poimboeuf Signed-off-by: Thomas Gleixner Reviewed-by: Dave Hansen commit 013c66edf207ddb78422b8b636f56c87939c9e34 Author: Ross Zwisler Date: Mon Jul 1 09:52:08 2019 -0600 Revert "x86/build: Move _etext to actual end of .text" This reverts commit 392bef709659abea614abfe53cf228e7a59876a4. Per the discussion here: https://lkml.kernel.org/r/201906201042.3BF5CD6@keescook the above referenced commit breaks kernel compilation with old GCC toolchains as well as current versions of the Gold linker. Revert it to fix the regression and to keep the ability to compile the kernel with these tools. Signed-off-by: Ross Zwisler Signed-off-by: Thomas Gleixner Reviewed-by: Guenter Roeck Cc: Cc: "H. Peter Anvin" Cc: Borislav Petkov Cc: Kees Cook Cc: Johannes Hirte Cc: Klaus Kusche Cc: samitolvanen@google.com Cc: Guenter Roeck Link: https://lkml.kernel.org/r/20190701155208.211815-1-zwisler@google.com Signed-off-by: Ingo Molnar commit 39ca5fb4920a96eeab478be2cfa6a2369fef6b02 Author: Sebastian Andrzej Siewior Date: Mon Jul 1 19:33:54 2019 +0200 x86/ldt: Initialize the context lock for init_mm The mutex mm->context->lock for init_mm is not initialized for init_mm. This wasn't a problem because it remained unused. This changed however since commit 4fc19708b165c ("x86/alternatives: Initialize temporary mm for patching") Initialize the mutex for init_mm. Fixes: 4fc19708b165c ("x86/alternatives: Initialize temporary mm for patching") Signed-off-by: Sebastian Andrzej Siewior Signed-off-by: Thomas Gleixner Reviewed-by: Nadav Amit Cc: Peter Zijlstra Cc: Andy Lutomirski Link: https://lkml.kernel.org/r/20190701173354.2pe62hhliok2afea@linutronix.de Signed-off-by: Ingo Molnar commit e55a73251da335873a6e87d68fb17e5aabb8978e Author: Josh Poimboeuf Date: Thu Jun 27 20:50:47 2019 -0500 bpf: Fix ORC unwinding in non-JIT BPF code Objtool previously ignored ___bpf_prog_run() because it didn't understand the jump table. This resulted in the ORC unwinder not being able to unwind through non-JIT BPF code. Now that objtool knows how to read jump tables, remove the whitelist and annotate the jump table so objtool can recognize it. Also add an additional "const" to the jump table definition to clarify that the text pointers are constant. Otherwise GCC sets the section writable flag and the assembler spits out warnings. Fixes: d15d356887e7 ("perf/x86: Make perf callchains work without CONFIG_FRAME_POINTER") Reported-by: Song Liu Signed-off-by: Josh Poimboeuf Signed-off-by: Thomas Gleixner Acked-by: Alexei Starovoitov Cc: Peter Zijlstra Cc: Kairui Song Cc: Steven Rostedt Cc: Borislav Petkov Cc: Daniel Borkmann Link: https://lkml.kernel.org/r/881939122b88f32be4c374d248c09d7527a87e35.1561685471.git.jpoimboe@redhat.com Signed-off-by: Ingo Molnar commit 87b512def792579641499d9bef1d640994ea9c18 Author: Josh Poimboeuf Date: Thu Jun 27 20:50:46 2019 -0500 objtool: Add support for C jump tables Objtool doesn't know how to read C jump tables, so it has to whitelist functions which use them, causing missing ORC unwinder data for such functions, e.g. ___bpf_prog_run(). C jump tables are very similar to GCC switch jump tables, which objtool already knows how to read. So adding support for C jump tables is easy. It just needs to be able to find the tables and distinguish them from other data. To allow the jump tables to be found, create an __annotate_jump_table macro which can be used to annotate them. The annotation is done by placing the jump table in an .rodata..c_jump_table section. The '.rodata' prefix ensures that the data will be placed in the rodata section by the vmlinux linker script. The double periods are part of an existing convention which distinguishes kernel sections from GCC sections. Signed-off-by: Josh Poimboeuf Signed-off-by: Thomas Gleixner Cc: Peter Zijlstra Cc: Song Liu Cc: Kairui Song Cc: Steven Rostedt Cc: Borislav Petkov Cc: Alexei Starovoitov Cc: Daniel Borkmann Link: https://lkml.kernel.org/r/0ba2ca30442b16b97165992381ce643dc27b3d1a.1561685471.git.jpoimboe@redhat.com Signed-off-by: Ingo Molnar commit d1d59b817939821bee149e870ce7723f61ffb512 Merge: 552a031ba12a 686cbe9e5d88 Author: Ingo Molnar Date: Tue Jul 9 13:22:03 2019 +0200 Merge tag 'perf-urgent-for-mingo-5.3-20190708-2' of git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux into perf/core Pull perf/urgent fixes from Arnaldo Carvalho de Melo: core: Arnaldo Carvalho de Melo: - Allow references to thread objects after__machine_exit(), fixing a bug with 'perf sched lat' where that happens, i.e. after perf_session__delete() we still have references to threads that were in a linked list whose head was freed in perf_session__delete(), causing a segfault, fix it. Jiri Olsa: - Do not rely on errno values for precise_ip fallback, fixing the default use case for 'perf record' on some AMD servers, when no events are specified and we try to use "cycles:P", i.e. with the maximum precision level. BPF: Song Liu: - Assign proper ff->ph in perf_event__synthesize_features(), fixing a bug when using pipe mode, i.e. 'perf record -o -'. tools headers: Arnaldo Carvalho de Melo: - Sync kvm headers with the kernel sources perf tests: Seeteena Thoufeek: - Fix record+probe_libc_inet_pton.sh for powerpc64, where without the debuginfo package for the 'ping' utility we can't resolve its symbols, so admit getting "[unknown]" for that backtrace line. perf python: Arnaldo Carvalho de Melo: - Remove -fstack-protector-strong if clang doesn't have it, fixing the build with clang on fedora:30, oracleline:7, centos:7. perf jvmti: Jiri Olsa: - Address gcc string overflow warning for strncpy() build: Arnaldo Carvalho de Melo: - Check if gettid() is available before providing helper, as recent versions of glibc started to provide gettid(). Signed-off-by: Arnaldo Carvalho de Melo Signed-off-by: Ingo Molnar commit f28a1f16135c9c6366f3d3f20f2e58aefc99afa0 Author: Christoph Hellwig Date: Mon Jul 8 10:51:01 2019 -0700 m68k: Don't select ARCH_HAS_DMA_PREP_COHERENT for nommu or coldfire M68k only provides the arch_dma_prep_coherent symbol when an mmu is enabled and not on the coldfire platform. Fix the Kconfig symbol selection up to match this. Fixes: 69878ef47562 ("m68k: Implement arch_dma_prep_coherent()") Reported-by: Guenter Roeck Signed-off-by: Christoph Hellwig Signed-off-by: Geert Uytterhoeven commit 5ad18b2e60b75c7297a998dea702451d33a052ed Merge: 92c1d6522135 318759b4737c Author: Linus Torvalds Date: Mon Jul 8 21:48:15 2019 -0700 Merge branch 'siginfo-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace Pull force_sig() argument change from Eric Biederman: "A source of error over the years has been that force_sig has taken a task parameter when it is only safe to use force_sig with the current task. The force_sig function is built for delivering synchronous signals such as SIGSEGV where the userspace application caused a synchronous fault (such as a page fault) and the kernel responded with a signal. Because the name force_sig does not make this clear, and because the force_sig takes a task parameter the function force_sig has been abused for sending other kinds of signals over the years. Slowly those have been fixed when the oopses have been tracked down. This set of changes fixes the remaining abusers of force_sig and carefully rips out the task parameter from force_sig and friends making this kind of error almost impossible in the future" * 'siginfo-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace: (27 commits) signal/x86: Move tsk inside of CONFIG_MEMORY_FAILURE in do_sigbus signal: Remove the signal number and task parameters from force_sig_info signal: Factor force_sig_info_to_task out of force_sig_info signal: Generate the siginfo in force_sig signal: Move the computation of force into send_signal and correct it. signal: Properly set TRACE_SIGNAL_LOSE_INFO in __send_signal signal: Remove the task parameter from force_sig_fault signal: Use force_sig_fault_to_task for the two calls that don't deliver to current signal: Explicitly call force_sig_fault on current signal/unicore32: Remove tsk parameter from __do_user_fault signal/arm: Remove tsk parameter from __do_user_fault signal/arm: Remove tsk parameter from ptrace_break signal/nds32: Remove tsk parameter from send_sigtrap signal/riscv: Remove tsk parameter from do_trap signal/sh: Remove tsk parameter from force_sig_info_fault signal/um: Remove task parameter from send_sigtrap signal/x86: Remove task parameter from send_sigtrap signal: Remove task parameter from force_sig_mceerr signal: Remove task parameter from force_sig signal: Remove task parameter from force_sigsegv ... commit 92c1d6522135050cb377a18cc6e30d08dfb87efb Merge: df2a40f549e6 99c8b231ae6c Author: Linus Torvalds Date: Mon Jul 8 21:35:12 2019 -0700 Merge branch 'for-5.3' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup Pull cgroup updates from Tejun Heo: "Documentation updates and the addition of cgroup_parse_float() which will be used by new controllers including blk-iocost" * 'for-5.3' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup: docs: cgroup-v1: convert docs to ReST and rename to *.rst cgroup: Move cgroup_parse_float() implementation out of CONFIG_SYSFS cgroup: add cgroup_parse_float() commit df2a40f549e6b73aad98b0c03f400c00d284816b Merge: 2b49350b16fa be69d00d9769 Author: Linus Torvalds Date: Mon Jul 8 21:10:01 2019 -0700 Merge branch 'for-5.3' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq Pull workqueue updates from Tejun Heo: "Just a couple cleanup patches. No functional changes." * 'for-5.3' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq: workqueue: Remove GPF argument from alloc_workqueue_attrs() workqueue: Make alloc/apply/free_workqueue_attrs() static commit 2b49350b16fa3171136d7cf351ac7e9e6673b8f2 Merge: 4d2fa8b44b89 5ccd3bd992cf Author: Linus Torvalds Date: Mon Jul 8 21:08:34 2019 -0700 Merge tag 'for-linus' of git://git.armlinux.org.uk/~rmk/linux-arm Pull ARM updates from Russell King: - Add a "cut here" to make it clearer where oops dumps should be cut from - we already have a marker for the end of the dumps. - Add logging severity to show_pte() - Drop unnecessary common-page-size linker flag - Errata workarounds for Cortex A12 857271, Cortex A17 857272 and Cortex A7 814220. - Remove some unused variables that had started to provoke a compiler warning. * tag 'for-linus' of git://git.armlinux.org.uk/~rmk/linux-arm: ARM: 8863/1: stm32: select ARM errata 814220 ARM: 8862/1: errata: 814220-B-Cache maintenance by set/way operations can execute out of order ARM: 8865/1: mm: remove unused variables ARM: 8864/1: Add workaround for I-Cache line size mismatch between CPU cores ARM: 8861/1: errata: Workaround errata A12 857271 / A17 857272 ARM: 8860/1: VDSO: Drop implicit common-page-size linker flag ARM: arrange show_pte() to issue severity-based messages ARM: add "8<--- cut here ---" to kernel dumps commit 4c6d80e1144bdf48cae6b602ae30d41f3e5c76a9 Author: Norbert Manthey Date: Fri Jul 5 15:06:00 2019 +0200 pstore: Fix double-free in pstore_mkfile() failure path The pstore_mkfile() function is passed a pointer to a struct pstore_record. On success it consumes this 'record' pointer and references it from the created inode. On failure, however, it may or may not free the record. There are even two different code paths which return -ENOMEM -- one of which does and the other doesn't free the record. Make the behaviour deterministic by never consuming and freeing the record when returning failure, allowing the caller to do the cleanup consistently. Signed-off-by: Norbert Manthey Link: https://lore.kernel.org/r/1562331960-26198-1-git-send-email-nmanthey@amazon.de Fixes: 83f70f0769ddd ("pstore: Do not duplicate record metadata") Fixes: 1dfff7dd67d1a ("pstore: Pass record contents instead of copying") Cc: stable@vger.kernel.org [kees: also move "private" allocation location, rename inode cleanup label] Signed-off-by: Kees Cook commit fa1af7583e8012c471ee45d5b1703123fe45a9f3 Author: Greg Kroah-Hartman Date: Wed Jun 12 17:20:33 2019 +0200 pstore: no need to check return value of debugfs_create functions When calling debugfs functions, there is no need to ever check the return value. The function can work or not, but the code logic should never do something different based on this. Cc: Kees Cook Cc: Anton Vorontsov Cc: Colin Cross Cc: Tony Luck Cc: linux-kernel@vger.kernel.org Signed-off-by: Greg Kroah-Hartman Signed-off-by: Kees Cook commit 1614e92179abe91283fc397c37f6244fe0019072 Author: Douglas Anderson Date: Wed May 8 08:48:31 2019 -0700 pstore/ram: Improve backward compatibility with older Chromebooks When you try to run an upstream kernel on an old ARM-based Chromebook you'll find that console-ramoops doesn't work. Old ARM-based Chromebooks, before ("ramoops: support upstream {console,pmsg,ftrace}-size properties") used to create a "ramoops" node at the top level that looked like: / { ramoops { compatible = "ramoops"; reg = <...>; record-size = <...>; dump-oops; }; }; ...and these Chromebooks assumed that the downstream kernel would make console_size / pmsg_size match the record size. The above ramoops node was added by the firmware so it's not easy to make any changes. Let's match the expected behavior, but only for those using the old backward-compatible way of working where ramoops is right under the root node. NOTE: if there are some out-of-tree devices that had ramoops at the top level, left everything but the record size as 0, and somehow doesn't want this behavior, we can try to add more conditions here. Signed-off-by: Douglas Anderson Signed-off-by: Kees Cook commit 4d2fa8b44b891f0da5ceda3e5a1402ccf0ab6f26 Merge: 8b68150883ca f3880a23564e Author: Linus Torvalds Date: Mon Jul 8 20:57:08 2019 -0700 Merge branch 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 Pull crypto updates from Herbert Xu: "Here is the crypto update for 5.3: API: - Test shash interface directly in testmgr - cra_driver_name is now mandatory Algorithms: - Replace arc4 crypto_cipher with library helper - Implement 5 way interleave for ECB, CBC and CTR on arm64 - Add xxhash - Add continuous self-test on noise source to drbg - Update jitter RNG Drivers: - Add support for SHA204A random number generator - Add support for 7211 in iproc-rng200 - Fix fuzz test failures in inside-secure - Fix fuzz test failures in talitos - Fix fuzz test failures in qat" * 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6: (143 commits) crypto: stm32/hash - remove interruptible condition for dma crypto: stm32/hash - Fix hmac issue more than 256 bytes crypto: stm32/crc32 - rename driver file crypto: amcc - remove memset after dma_alloc_coherent crypto: ccp - Switch to SPDX license identifiers crypto: ccp - Validate the the error value used to index error messages crypto: doc - Fix formatting of new crypto engine content crypto: doc - Add parameter documentation crypto: arm64/aes-ce - implement 5 way interleave for ECB, CBC and CTR crypto: arm64/aes-ce - add 5 way interleave routines crypto: talitos - drop icv_ool crypto: talitos - fix hash on SEC1. crypto: talitos - move struct talitos_edesc into talitos.h lib/scatterlist: Fix mapping iterator when sg->offset is greater than PAGE_SIZE crypto/NX: Set receive window credits to max number of CRBs in RxFIFO crypto: asymmetric_keys - select CRYPTO_HASH where needed crypto: serpent - mark __serpent_setkey_sbox noinline crypto: testmgr - dynamically allocate crypto_shash crypto: testmgr - dynamically allocate testvec_config crypto: talitos - eliminate unneeded 'done' functions at build time ... commit 8b68150883ca466a23e90902dd4113b22e692f04 Merge: 0f75ef6a9cff 650b29dbdf2c Author: Linus Torvalds Date: Mon Jul 8 20:28:59 2019 -0700 Merge branch 'next-integrity' of git://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity Pull integrity updates from Mimi Zohar: "Bug fixes, code clean up, and new features: - IMA policy rules can be defined in terms of LSM labels, making the IMA policy dependent on LSM policy label changes, in particular LSM label deletions. The new environment, in which IMA-appraisal is being used, frequently updates the LSM policy and permits LSM label deletions. - Prevent an mmap'ed shared file opened for write from also being mmap'ed execute. In the long term, making this and other similar changes at the VFS layer would be preferable. - The IMA per policy rule template format support is needed for a couple of new/proposed features (eg. kexec boot command line measurement, appended signatures, and VFS provided file hashes). - Other than the "boot-aggregate" record in the IMA measuremeent list, all other measurements are of file data. Measuring and storing the kexec boot command line in the IMA measurement list is the first buffer based measurement included in the measurement list" * 'next-integrity' of git://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity: integrity: Introduce struct evm_xattr ima: Update MAX_TEMPLATE_NAME_LEN to fit largest reasonable definition KEXEC: Call ima_kexec_cmdline to measure the boot command line args IMA: Define a new template field buf IMA: Define a new hook to measure the kexec boot command line arguments IMA: support for per policy rule template formats integrity: Fix __integrity_init_keyring() section mismatch ima: Use designated initializers for struct ima_event_data ima: use the lsm policy update notifier LSM: switch to blocking policy update notifiers x86/ima: fix the Kconfig dependency for IMA_ARCH_POLICY ima: Make arch_policy_entry static ima: prevent a file already mmap'ed write to be mmap'ed execute x86/ima: check EFI SetupMode too commit b14a260e33ddb4536088a799f24f321593201a64 Merge: 3cab2afb149c 5c4b4608fe10 Author: David S. Miller Date: Mon Jul 8 20:21:10 2019 -0700 Merge branch 'nfp-tls-fixes-for-initial-TLS-support' Jakub Kicinski says: ==================== nfp: tls: fixes for initial TLS support This series brings various fixes to nfp tls offload recently added to net-next. First 4 patches revolve around device mailbox communication, trying to make it more reliable. Next patch fixes statistical counter. Patch 6 improves the TX resync if device communication failed. Patch 7 makes sure we remove keys from memory after talking to FW. Patch 8 adds missing tls context initialization, we fill in the context information from various places based on the configuration and looks like we missed the init in the case of where TX is offloaded, but RX wasn't initialized yet. Patches 9 and 10 make the nfp driver undo TLS state changes if we need to drop the frame (e.g. due to DMA mapping error). Last but not least TLS fallback should not adjust socket memory after skb_orphan_partial(). This code will go away once we forbid orphaning of skbs in need of crypto, but that's "real" -next material, so lets do a quick fix. ==================== Signed-off-by: David S. Miller commit 5c4b4608fe100838c62591877101128467e56c00 Author: Jakub Kicinski Date: Mon Jul 8 19:53:18 2019 -0700 net/tls: fix socket wmem accounting on fallback with netem netem runs skb_orphan_partial() which "disconnects" the skb from normal TCP write memory accounting. We should not adjust sk->sk_wmem_alloc on the fallback path for such skbs. Fixes: e8f69799810c ("net/tls: Add generic NIC offload infrastructure") Signed-off-by: Jakub Kicinski Reviewed-by: Dirk van der Merwe Signed-off-by: David S. Miller commit 5a4cea280c01ba0ef3deda85c14fd1321eff3270 Author: Jakub Kicinski Date: Mon Jul 8 19:53:17 2019 -0700 nfp: tls: undo TLS sequence tracking when dropping the frame If driver has to drop the TLS frame it needs to undo the TCP sequence tracking changes, otherwise device will receive segments out of order and drop them. Signed-off-by: Jakub Kicinski Reviewed-by: Dirk van der Merwe Signed-off-by: David S. Miller commit c8d3928ea7e7e536e2b3d79742d0018ac587b776 Author: Jakub Kicinski Date: Mon Jul 8 19:53:16 2019 -0700 nfp: tls: avoid one of the ifdefs for TLS Move the #ifdef CONFIG_TLS_DEVICE a little so we can eliminate the other one. Signed-off-by: Jakub Kicinski Reviewed-by: Dirk van der Merwe Signed-off-by: David S. Miller commit ab232e61e728a08a2cb4ebb439d7d2aa75df89c9 Author: Jakub Kicinski Date: Mon Jul 8 19:53:15 2019 -0700 net/tls: add missing prot info init Turns out TLS_TX in HW offload mode does not initialize tls_prot_info. Since commit 9cd81988cce1 ("net/tls: use version from prot") we actually use this field on the datapath. Luckily we always compare it to TLS 1.3, and assume 1.2 otherwise. So since zero is not equal to 1.3, everything worked fine. Fixes: 9cd81988cce1 ("net/tls: use version from prot") Signed-off-by: Jakub Kicinski Reviewed-by: Dirk van der Merwe Signed-off-by: David S. Miller commit c3b64911331219a3ff6bb6aeb844d92612a8e821 Author: Jakub Kicinski Date: Mon Jul 8 19:53:14 2019 -0700 nfp: tls: don't leave key material in freed FW cmsg skbs Make sure the contents of the skb which carried key material to the FW is cleared. Signed-off-by: Jakub Kicinski Reviewed-by: Dirk van der Merwe Signed-off-by: David S. Miller commit b5d9a834f4fd1b6abfa527ec351c871084dd23a3 Author: Dirk van der Merwe Date: Mon Jul 8 19:53:13 2019 -0700 net/tls: don't clear TX resync flag on error Introduce a return code for the tls_dev_resync callback. When the driver TX resync fails, kernel can retry the resync again until it succeeds. This prevents drivers from attempting to offload TLS packets if the connection is known to be out of sync. We don't worry about the RX resync since they will be retried naturally as more encrypted records get received. Signed-off-by: Dirk van der Merwe Reviewed-by: Jakub Kicinski Signed-off-by: David S. Miller commit 427545b3046326cd7b4dbbd7869f08737df2ad2b Author: Jakub Kicinski Date: Mon Jul 8 19:53:12 2019 -0700 nfp: tls: count TSO segments separately for the TLS offload Count the number of successfully submitted TLS segments, not skbs. This will make it easier to compare the TLS encryption count against other counters. Signed-off-by: Jakub Kicinski Reviewed-by: Dirk van der Merwe Signed-off-by: David S. Miller commit f6dfa31509a03817fa7830b7fd4214f7f48df938 Author: Dirk van der Merwe Date: Mon Jul 8 19:53:11 2019 -0700 nfp: ccm: increase message limits Increase the batch limit to consume small message bursts more effectively. Practically, the effect on the 'add' messages is not significant since the mailbox is sized such that the 'add' messages are still limited to the same order of magnitude that it was originally set for. Furthermore, increase the queue size limit to 1024 entries. This further improves the handling of bursts of small control messages. Signed-off-by: Dirk van der Merwe Reviewed-by: Jakub Kicinski Signed-off-by: David S. Miller commit 53601c68b8541672e026c0596a9dd8a86d96d7ab Author: Jakub Kicinski Date: Mon Jul 8 19:53:10 2019 -0700 nfp: tls: use unique connection ids instead of 4-tuple for TX Connection 4 tuple reuse is slightly problematic - TLS socket and context do not get destroyed until all the associated skbs left the system and all references are released. This leads to stale connection entry in the device preventing addition of new one if the 4 tuple is reused quickly enough. Instead of using read 4 tuple as the key use a unique ID. Set the protocol to TCP and port to 0 to ensure no collisions with real connections. Signed-off-by: Jakub Kicinski Reviewed-by: Dirk van der Merwe Signed-off-by: David S. Miller commit ff8869d5ed4e798c6dad89809689cb9d2e2ab2f8 Author: Jakub Kicinski Date: Mon Jul 8 19:53:09 2019 -0700 nfp: tls: move setting ipver_vlan to a helper Long lines are ugly. No functional changes. Signed-off-by: Jakub Kicinski Reviewed-by: Dirk van der Merwe Signed-off-by: David S. Miller commit 0f93242d96ff5a04fe02c4978e8dddb014235971 Author: Jakub Kicinski Date: Mon Jul 8 19:53:08 2019 -0700 nfp: tls: ignore queue limits for delete commands We need to do our best not to drop delete commands, otherwise we will have stale entries in the connection table. Ignore the control message queue limits for delete commands. Signed-off-by: Jakub Kicinski Reviewed-by: Dirk van der Merwe Signed-off-by: David S. Miller commit 3cab2afb149ceedd324d14c6562224fb925252a6 Author: Xin Long Date: Tue Jul 9 00:59:40 2019 +0800 sctp: remove rcu_read_lock from sctp_bind_addr_state sctp_bind_addr_state() is called either in packet rcv path or by sctp_copy_local_addr_list(), which are under rcu_read_lock. So there's no need to call it again in sctp_bind_addr_state(). Signed-off-by: Xin Long Signed-off-by: David S. Miller commit 6c6fbad6576fb19f93770feabcf2d0a30b4ae0e2 Merge: ccf355e52a32 e55f4b8bf462 Author: David S. Miller Date: Mon Jul 8 20:16:25 2019 -0700 Merge branch 'sctp-tidyup' Xin Long says: ==================== sctp: tidy up some ep and asoc feature flags This patchset is to remove some unnecessary feature flags from sctp_assocation and move some others to the right places. ==================== Signed-off-by: David S. Miller commit e55f4b8bf4622103badac8694cdabceec06f9b38 Author: Xin Long Date: Tue Jul 9 00:57:07 2019 +0800 sctp: rename sp strm_interleave to ep intl_enable Like other endpoint features, strm_interleave should be moved to sctp_endpoint and renamed to intl_enable. Signed-off-by: Xin Long Signed-off-by: David S. Miller commit da1f6d4de7b743c86cb49015ea05b184fea1388c Author: Xin Long Date: Tue Jul 9 00:57:06 2019 +0800 sctp: rename asoc intl_enable to asoc peer.intl_capable To keep consistent with other asoc features, we move intl_enable to peer.intl_capable in asoc. Signed-off-by: Xin Long Signed-off-by: David S. Miller commit 1c13475368b697d4fc9c0630b5d4ee51d5ca0790 Author: Xin Long Date: Tue Jul 9 00:57:05 2019 +0800 sctp: remove prsctp_enable from asoc Like reconf_enable, prsctp_enable should also be removed from asoc, as asoc->peer.prsctp_capable has taken its job. Signed-off-by: Xin Long Signed-off-by: David S. Miller commit a96701fb3534c45bd6fe5e6f6d3a91e3acc19b59 Author: Xin Long Date: Tue Jul 9 00:57:04 2019 +0800 sctp: remove reconf_enable from asoc asoc's reconf support is actually decided by the 4-shakehand negotiation, not something that users can set by sockopt. asoc->peer.reconf_capable is working for this. So remove it from asoc. Signed-off-by: Xin Long Signed-off-by: David S. Miller commit c8320ccdd47ebf31e516286b594d1cc36cbaf551 Author: Joe Perches Date: Thu Jul 4 16:57:48 2019 -0700 nfsd: Fix misuse of strlcpy Probable cut&paste typo - use the correct field size. (Not currently a practical problem since these two fields have the same size, but we should fix it anyway.) Signed-off-by: Joe Perches Signed-off-by: J. Bruce Fields commit ccf355e52a3265624b7acadd693c849d599e9b9f Author: Fuqian Huang Date: Mon Jul 8 20:34:17 2019 +0800 net: phy: Make use of linkmode_mod_bit helper linkmode_mod_bit is introduced as a helper function to set/clear bits in a linkmode. Replace the if else code structure with a call to the helper linkmode_mod_bit. Signed-off-by: Fuqian Huang Signed-off-by: David S. Miller commit 0f75ef6a9cff49ff612f7ce0578bced9d0b38325 Merge: c84ca912b079 7a1ade847596 Author: Linus Torvalds Date: Mon Jul 8 19:56:57 2019 -0700 Merge tag 'keys-acl-20190703' of git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs Pull keyring ACL support from David Howells: "This changes the permissions model used by keys and keyrings to be based on an internal ACL by the following means: - Replace the permissions mask internally with an ACL that contains a list of ACEs, each with a specific subject with a permissions mask. Potted default ACLs are available for new keys and keyrings. ACE subjects can be macroised to indicate the UID and GID specified on the key (which remain). Future commits will be able to add additional subject types, such as specific UIDs or domain tags/namespaces. Also split a number of permissions to give finer control. Examples include splitting the revocation permit from the change-attributes permit, thereby allowing someone to be granted permission to revoke a key without allowing them to change the owner; also the ability to join a keyring is split from the ability to link to it, thereby stopping a process accessing a keyring by joining it and thus acquiring use of possessor permits. - Provide a keyctl to allow the granting or denial of one or more permits to a specific subject. Direct access to the ACL is not granted, and the ACL cannot be viewed" * tag 'keys-acl-20190703' of git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs: keys: Provide KEYCTL_GRANT_PERMISSION keys: Replace uid/gid/perm permissions checking with an ACL commit 88e2f2846d901e1d61e99ac1d06544d41f478430 Merge: af144a983402 6fb8dbca8e9e Author: David S. Miller Date: Mon Jul 8 19:50:13 2019 -0700 Merge branch 'Add-MPLS-actions-to-TC' John Hurley says: ==================== Add MPLS actions to TC This patchset introduces a new TC action module that allows the manipulation of the MPLS headers of packets. The code impliments functionality including push, pop, and modify. Also included are tests for the new funtionality. Note that these will require iproute2 changes to be submitted soon. NOTE: these patches are applied to net-next along with the patch: [PATCH net 1/1] net: openvswitch: fix csum updates for MPLS actions This patch has been accepted into net but, at time of posting, is not yet in net-next. v6-v7: - add extra tests for setting max/min and exceeding range of fields - patch 5 (Roman Mashak) v5-v6: - add CONFIG_NET_ACT_MPLS to tc-testing config file - patch 5 (Davide Caratti) v4-v5: - move mpls_hdr() call to after skb_ensure_writable - patch 3 (Willem de Bruijn) - move mpls_dec_ttl to helper - patch 4 (Willem de Bruijn) - add iproute2 usage example to commit msg - patch 4 (David Ahern) - align label validation with mpls core code - patch 4 (David Ahern) - improve extack message for no proto in mpls pop - patch 4 (David Ahern) v3-v4: - refactor and reuse OvS code (Cong Wang) - use csum API rather than skb_post*rscum to update skb->csum (Cong Wang) - remove unnecessary warning (Cong Wang) - add comments to uapi attributes (David Ahern) - set strict type policy check for TCA_MPLS_UNSPEC (David Ahern) - expand/improve extack messages (David Ahern) - add option to manually set BOS v2-v3: - remove a few unnecessary line breaks (Jiri Pirko) - retract hw offload patch from set (resubmit with driver changes) (Jiri) v1->v2: - ensure TCA_ID_MPLS does not conflict with TCA_ID_CTINFO (Davide Caratti) ==================== Signed-off-by: David S. Miller commit 6fb8dbca8e9e6de79ce25272eadd9cd96e05debf Author: John Hurley Date: Sun Jul 7 15:01:58 2019 +0100 tc-tests: actions: add MPLS tests Add a new series of selftests to verify the functionality of act_mpls in TC. Signed-off-by: John Hurley Reviewed-by: Simon Horman Acked-by: Jakub Kicinski Signed-off-by: David S. Miller commit 2a2ea50870baa3fb4de0872c5b60828138654ca7 Author: John Hurley Date: Sun Jul 7 15:01:57 2019 +0100 net: sched: add mpls manipulation actions to TC Currently, TC offers the ability to match on the MPLS fields of a packet through the use of the flow_dissector_key_mpls struct. However, as yet, TC actions do not allow the modification or manipulation of such fields. Add a new module that registers TC action ops to allow manipulation of MPLS. This includes the ability to push and pop headers as well as modify the contents of new or existing headers. A further action to decrement the TTL field of an MPLS header is also provided with a new helper added to support this. Examples of the usage of the new action with flower rules to push and pop MPLS labels are: tc filter add dev eth0 protocol ip parent ffff: flower \ action mpls push protocol mpls_uc label 123 \ action mirred egress redirect dev eth1 tc filter add dev eth0 protocol mpls_uc parent ffff: flower \ action mpls pop protocol ipv4 \ action mirred egress redirect dev eth1 Signed-off-by: John Hurley Reviewed-by: Jakub Kicinski Reviewed-by: Simon Horman Reviewed-by: Willem de Bruijn Acked-by: Cong Wang Signed-off-by: David S. Miller commit d27cf5c59a12f66425df29cd81f61aa73ef14ac1 Author: John Hurley Date: Sun Jul 7 15:01:56 2019 +0100 net: core: add MPLS update core helper and use in OvS Open vSwitch allows the updating of an existing MPLS header on a packet. In preparation for supporting similar functionality in TC, move this to a common skb helper function. Signed-off-by: John Hurley Reviewed-by: Jakub Kicinski Reviewed-by: Simon Horman Reviewed-by: Willem de Bruijn Acked-by: Cong Wang Signed-off-by: David S. Miller commit ed246cee09b9865145a2e1e34f63ec0e31dd83a5 Author: John Hurley Date: Sun Jul 7 15:01:55 2019 +0100 net: core: move pop MPLS functionality from OvS to core helper Open vSwitch provides code to pop an MPLS header to a packet. In preparation for supporting this in TC, move the pop code to an skb helper that can be reused. Remove the, now unused, update_ethertype static function from OvS. Signed-off-by: John Hurley Reviewed-by: Jakub Kicinski Reviewed-by: Simon Horman Reviewed-by: Willem de Bruijn Acked-by: Cong Wang Signed-off-by: David S. Miller commit 8822e270d697010e6a4fd42a319dbefc33db91e1 Author: John Hurley Date: Sun Jul 7 15:01:54 2019 +0100 net: core: move push MPLS functionality from OvS to core helper Open vSwitch provides code to push an MPLS header to a packet. In preparation for supporting this in TC, move the push code to an skb helper that can be reused. Signed-off-by: John Hurley Reviewed-by: Jakub Kicinski Reviewed-by: Simon Horman Reviewed-by: Willem de Bruijn Acked-by: Cong Wang Signed-off-by: David S. Miller commit af144a983402f7fd324ce556d9f9011a8b3e01fe Merge: 6413139dfc64 e858faf556d4 Author: David S. Miller Date: Mon Jul 8 19:48:57 2019 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net Two cases of overlapping changes, nothing fancy. Signed-off-by: David S. Miller commit 6413139dfc641aaaa30580b59696a5f7ea274194 Author: Willem de Bruijn Date: Sun Jul 7 05:51:55 2019 -0400 skbuff: increase verbosity when dumping skb data skb_warn_bad_offload and netdev_rx_csum_fault trigger on hard to debug issues. Dump more state and the header. Optionally dump the entire packet and linear segment. This is required to debug checksum bugs that may include bytes past skb_tail_pointer(). Both call sites call this function inside a net_ratelimit() block. Limit full packet log further to a hard limit of can_dump_full (5). Based on an earlier patch by Cong Wang, see link below. Changes v1 -> v2 - dump frag_list only on full_pkt Link: https://patchwork.ozlabs.org/patch/1000841/ Signed-off-by: Willem de Bruijn Signed-off-by: David S. Miller commit 59c820b2317f0ffe1ab9b5d2c0515cdbfe714e6e Author: Willem de Bruijn Date: Sun Jul 7 05:34:45 2019 -0400 ipv6: elide flowlabel check if no exclusive leases exist Processes can request ipv6 flowlabels with cmsg IPV6_FLOWINFO. If not set, by default an autogenerated flowlabel is selected. Explicit flowlabels require a control operation per label plus a datapath check on every connection (every datagram if unconnected). This is particularly expensive on unconnected sockets multiplexing many flows, such as QUIC. In the common case, where no lease is exclusive, the check can be safely elided, as both lease request and check trivially succeed. Indeed, autoflowlabel does the same even with exclusive leases. Elide the check if no process has requested an exclusive lease. fl6_sock_lookup previously returns either a reference to a lease or NULL to denote failure. Modify to return a real error and update all callers. On return NULL, they can use the label and will elide the atomic_dec in fl6_sock_release. This is an optimization. Robust applications still have to revert to requesting leases if the fast path fails due to an exclusive lease. Changes RFC->v1: - use static_key_false_deferred to rate limit jump label operations - call static_key_deferred_flush to stop timers on exit - move decrement out of RCU context - defer optimization also if opt data is associated with a lease - updated all fp6_sock_lookup callers, not just udp Signed-off-by: Willem de Bruijn Signed-off-by: David S. Miller commit c84ca912b07901be528e5184fd254fca1dddf2ac Merge: c236b6dd48dc a58946c158a0 Author: Linus Torvalds Date: Mon Jul 8 19:36:47 2019 -0700 Merge tag 'keys-namespace-20190627' of git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs Pull keyring namespacing from David Howells: "These patches help make keys and keyrings more namespace aware. Firstly some miscellaneous patches to make the process easier: - Simplify key index_key handling so that the word-sized chunks assoc_array requires don't have to be shifted about, making it easier to add more bits into the key. - Cache the hash value in the key so that we don't have to calculate on every key we examine during a search (it involves a bunch of multiplications). - Allow keying_search() to search non-recursively. Then the main patches: - Make it so that keyring names are per-user_namespace from the point of view of KEYCTL_JOIN_SESSION_KEYRING so that they're not accessible cross-user_namespace. keyctl_capabilities() shows KEYCTL_CAPS1_NS_KEYRING_NAME for this. - Move the user and user-session keyrings to the user_namespace rather than the user_struct. This prevents them propagating directly across user_namespaces boundaries (ie. the KEY_SPEC_* flags will only pick from the current user_namespace). - Make it possible to include the target namespace in which the key shall operate in the index_key. This will allow the possibility of multiple keys with the same description, but different target domains to be held in the same keyring. keyctl_capabilities() shows KEYCTL_CAPS1_NS_KEY_TAG for this. - Make it so that keys are implicitly invalidated by removal of a domain tag, causing them to be garbage collected. - Institute a network namespace domain tag that allows keys to be differentiated by the network namespace in which they operate. New keys that are of a type marked 'KEY_TYPE_NET_DOMAIN' are assigned the network domain in force when they are created. - Make it so that the desired network namespace can be handed down into the request_key() mechanism. This allows AFS, NFS, etc. to request keys specific to the network namespace of the superblock. This also means that the keys in the DNS record cache are thenceforth namespaced, provided network filesystems pass the appropriate network namespace down into dns_query(). For DNS, AFS and NFS are good, whilst CIFS and Ceph are not. Other cache keyrings, such as idmapper keyrings, also need to set the domain tag - for which they need access to the network namespace of the superblock" * tag 'keys-namespace-20190627' of git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs: keys: Pass the network namespace into request_key mechanism keys: Network namespace domain tag keys: Garbage collect keys for which the domain has been removed keys: Include target namespace in match criteria keys: Move the user and user-session keyrings to the user_namespace keys: Namespace keyring names keys: Add a 'recurse' flag for keyring searches keys: Cache the hash value to avoid lots of recalculation keys: Simplify key description management commit e858faf556d4e14c750ba1e8852783c6f9520a0e Author: Christoph Paasch Date: Sat Jul 6 16:13:07 2019 -0700 tcp: Reset bytes_acked and bytes_received when disconnecting If an app is playing tricks to reuse a socket via tcp_disconnect(), bytes_acked/received needs to be reset to 0. Otherwise tcp_info will report the sum of the current and the old connection.. Cc: Eric Dumazet Fixes: 0df48c26d841 ("tcp: add tcpi_bytes_acked to tcp_info") Fixes: bdd1f9edacb5 ("tcp: add tcpi_bytes_received to tcp_info") Signed-off-by: Christoph Paasch Signed-off-by: Eric Dumazet Signed-off-by: David S. Miller commit ee4f56f46ab7a795dc8f7ecdfa11b616a5754b50 Author: Vincent Bernat Date: Sat Jul 6 23:01:08 2019 +0200 bonding: fix value exported by Netlink for peer_notif_delay IFLA_BOND_PEER_NOTIF_DELAY was set to the value of downdelay instead of peer_notif_delay. After this change, the correct value is exported. Fixes: 07a4ddec3ce9 ("bonding: add an option to specify a delay between peer notifications") Signed-off-by: Vincent Bernat Signed-off-by: David S. Miller commit 333f7909a8573145811c4ab7d8c9092301707721 Author: Al Viro Date: Fri Jul 5 20:14:16 2019 +0100 coallocate socket_wq with socket itself socket->wq is assign-once, set when we are initializing both struct socket it's in and struct socket_wq it points to. As the matter of fact, the only reason for separate allocation was the ability to RCU-delay freeing of socket_wq. RCU-delaying the freeing of socket itself gets rid of that need, so we can just fold struct socket_wq into the end of struct socket and simplify the life both for sock_alloc_inode() (one allocation instead of two) and for tun/tap oddballs, where we used to embed struct socket and struct socket_wq into the same structure (now - embedding just the struct socket). Note that reference to struct socket_wq in struct sock does remain a reference - that's unchanged. Signed-off-by: Al Viro Signed-off-by: David S. Miller commit 6d7855c54e1e269275d7c504f8f62a0b7a5b3f18 Author: Al Viro Date: Fri Jul 5 20:13:22 2019 +0100 sockfs: switch to ->free_inode() we do have an RCU-delayed part there already (freeing the wq), so it's not like the pipe situation; moreover, it might be worth considering coallocating wq with the rest of struct sock_alloc. ->sk_wq in struct sock would remain a pointer as it is, but the object it normally points to would be coallocated with struct socket... Signed-off-by: Al Viro Signed-off-by: David S. Miller commit 272d28bdae1189791df4d118432bfae3feb53fe3 Author: Wolfram Sang Date: Mon Jun 10 11:51:56 2019 +0200 of: unittest: simplify getting the adapter of a client We have a dedicated pointer for that, so use it. Much easier to read and less computation involved. Reported-by: Peter Rosin Signed-off-by: Wolfram Sang Signed-off-by: Rob Herring commit c236b6dd48dcf2ae6ed14b9068830eccc3e181e6 Merge: d44a62742dec 3b8c4a08a471 Author: Linus Torvalds Date: Mon Jul 8 19:19:37 2019 -0700 Merge tag 'keys-request-20190626' of git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs Pull request_key improvements from David Howells: "These are all request_key()-related, including a fix and some improvements: - Fix the lack of a Link permission check on a key found by request_key(), thereby enabling request_key() to link keys that don't grant this permission to the target keyring (which must still grant Write permission). Note that the key must be in the caller's keyrings already to be found. - Invalidate used request_key authentication keys rather than revoking them, so that they get cleaned up immediately rather than hanging around till the expiry time is passed. - Move the RCU locks outwards from the keyring search functions so that a request_key_rcu() can be provided. This can be called in RCU mode, so it can't sleep and can't upcall - but it can be called from LOOKUP_RCU pathwalk mode. - Cache the latest positive result of request_key*() temporarily in task_struct so that filesystems that make a lot of request_key() calls during pathwalk can take advantage of it to avoid having to redo the searching. This requires CONFIG_KEYS_REQUEST_CACHE=y. It is assumed that the key just found is likely to be used multiple times in each step in an RCU pathwalk, and is likely to be reused for the next step too. Note that the cleanup of the cache is done on TIF_NOTIFY_RESUME, just before userspace resumes, and on exit" * tag 'keys-request-20190626' of git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs: keys: Kill off request_key_async{,_with_auxdata} keys: Cache result of request_key*() temporarily in task_struct keys: Provide request_key_rcu() keys: Move the RCU locks outwards from the keyring search functions keys: Invalidate used request_key authentication keys keys: Fix request_key() lack of Link perm check on found key commit 17ccf9e31e0d650b36fdc06eb7b09757523111c7 Merge: 7650b1a9bd69 bf0bdd1343ef Author: David S. Miller Date: Mon Jul 8 19:14:38 2019 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next Daniel Borkmann says: ==================== pull-request: bpf-next 2019-07-09 The following pull-request contains BPF updates for your *net-next* tree. The main changes are: 1) Lots of libbpf improvements: i) addition of new APIs to attach BPF programs to tracing entities such as {k,u}probes or tracepoints, ii) improve specification of BTF-defined maps by eliminating the need for data initialization for some of the members, iii) addition of a high-level API for setting up and polling perf buffers for BPF event output helpers, all from Andrii. 2) Add "prog run" subcommand to bpftool in order to test-run programs through the kernel testing infrastructure of BPF, from Quentin. 3) Improve verifier for BPF sockaddr programs to support 8-byte stores for user_ip6 and msg_src_ip6 members given clang tends to generate such stores, from Stanislav. 4) Enable the new BPF JIT zero-extension optimization for further riscv64 ALU ops, from Luke. 5) Fix a bpftool json JIT dump crash on powerpc, from Jiri. 6) Fix an AF_XDP race in generic XDP's receive path, from Ilya. 7) Various smaller fixes from Ilya, Yue and Arnd. ==================== Signed-off-by: David S. Miller commit d44a62742decca5ae5688a562584dc0fe9fc63f6 Merge: 7c0f89634892 45e0f30c30bb Author: Linus Torvalds Date: Mon Jul 8 19:02:11 2019 -0700 Merge tag 'keys-misc-20190619' of git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs Pull misc keyring updates from David Howells: "These are some miscellaneous keyrings fixes and improvements: - Fix a bunch of warnings from sparse, including missing RCU bits and kdoc-function argument mismatches - Implement a keyctl to allow a key to be moved from one keyring to another, with the option of prohibiting key replacement in the destination keyring. - Grant Link permission to possessors of request_key_auth tokens so that upcall servicing daemons can more easily arrange things such that only the necessary auth key is passed to the actual service program, and not all the auth keys a daemon might possesss. - Improvement in lookup_user_key(). - Implement a keyctl to allow keyrings subsystem capabilities to be queried. The keyutils next branch has commits to make available, document and test the move-key and capabilities code: https://git.kernel.org/pub/scm/linux/kernel/git/dhowells/keyutils.git/log They're currently on the 'next' branch" * tag 'keys-misc-20190619' of git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs: keys: Add capability-checking keyctl function keys: Reuse keyring_index_key::desc_len in lookup_user_key() keys: Grant Link permission to possessers of request_key auth keys keys: Add a keyctl to move a key between keyrings keys: Hoist locking out of __key_link_begin() keys: Break bits out of key_unlink() keys: Change keyring_serialise_link_sem to a mutex keys: sparse: Fix kdoc mismatches keys: sparse: Fix incorrect RCU accesses keys: sparse: Fix key_fs[ug]id_changed() commit 7c0f89634892693fc0b46f25e0a6d57bd6dd5698 Merge: 61fc5771f5e7 ea74a685ad81 Author: Linus Torvalds Date: Mon Jul 8 18:59:56 2019 -0700 Merge tag 'selinux-pr-20190702' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux Pull selinux updates from Paul Moore: "Like the audit pull request this is a little early due to some upcoming vacation plans and uncertain network access while I'm away. Also like the audit PR, the list of patches here is pretty minor, the highlights include: - Explicitly use __le variables to make sure "sparse" can verify proper byte endian handling. - Remove some BUG_ON()s that are no longer needed. - Allow zero-byte writes to the "keycreate" procfs attribute without requiring key:create to make it easier for userspace to reset the keycreate label. - Consistently log the "invalid_context" field as an untrusted string in the AUDIT_SELINUX_ERR audit records" * tag 'selinux-pr-20190702' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux: selinux: format all invalid context as untrusted selinux: fix empty write to keycreate file selinux: remove some no-op BUG_ONs selinux: provide __le variables explicitly commit 61fc5771f5e729a2ce235af42f69c8506725e84a Merge: 884922591e2b 839d05e41385 Author: Linus Torvalds Date: Mon Jul 8 18:55:42 2019 -0700 Merge tag 'audit-pr-20190702' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit Pull audit updates from Paul Moore: "This pull request is a bit early, but with some vacation time coming up I wanted to send this out now just in case the remote Internet Gods decide not to smile on me once the merge window opens. The patchset for v5.3 is pretty minor this time, the highlights include: - When the audit daemon is sent a signal, ensure we deliver information about the sender even when syscall auditing is not enabled/supported. - Add the ability to filter audit records based on network address family. - Tighten the audit field filtering restrictions on string based fields. - Cleanup the audit field filtering verification code. - Remove a few BUG() calls from the audit code" * tag 'audit-pr-20190702' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit: audit: remove the BUG() calls in the audit rule comparison functions audit: enforce op for string fields audit: add saddr_fam filter field audit: re-structure audit field valid checks audit: deliver signal_info regarless of syscall commit 884922591e2b58fd7f1018701f957446d1ffac4d Merge: 222a21d29521 166a2809d65b Author: Linus Torvalds Date: Mon Jul 8 18:47:42 2019 -0700 Merge tag 'tpmdd-next-20190625' of git://git.infradead.org/users/jjs/linux-tpmdd Pull tpm updates from Jarkko Sakkinen: "This contains two critical bug fixes and support for obtaining TPM events triggered by ExitBootServices(). For the latter I have to give a quite verbose explanation not least because I had to revisit all the details myself to remember what was going on in Matthew's patches. The preboot software stack maintains an event log that gets entries every time something gets hashed to any of the PCR registers. What gets hashed could be a component to be run or perhaps log of some actions taken just to give couple of coarse examples. In general, anything relevant for the boot process that the preboot software does gets hashed and a log entry with a specific event type [1]. The main application for this is remote attestation and the reason why it is useful is nicely put in the very first section of [1]: "Attestation is used to provide information about the platform’s state to a challenger. However, PCR contents are difficult to interpret; therefore, attestation is typically more useful when the PCR contents are accompanied by a measurement log. While not trusted on their own, the measurement log contains a richer set of information than do the PCR contents. The PCR contents are used to provide the validation of the measurement log." Because EFI_TCG2_PROTOCOL.GetEventLog() is not available after calling ExitBootServices(), Linux EFI stub copies the event log to a custom configuration table. Unfortunately, ExitBootServices() also generates events and obviously these events do not get copied to that table. Luckily firmware does this for us by providing a configuration table identified by EFI_TCG2_FINAL_EVENTS_TABLE_GUID. This essentially contains necessary changes to provide the full event log for the use the user space that is concatenated from these two partial event logs [2]" [1] https://trustedcomputinggroup.org/resource/pc-client-specific-platform-firmware-profile-specification/ [2] The final concatenation is done in drivers/char/tpm/eventlog/efi.c * tag 'tpmdd-next-20190625' of git://git.infradead.org/users/jjs/linux-tpmdd: tpm: Don't duplicate events from the final event log in the TCG2 log Abstract out support for locating an EFI config table tpm: Fix TPM 1.2 Shutdown sequence to prevent future TPM operations efi: Attempt to get the TCG2 event log in the boot stub tpm: Append the final event log to the TPM event log tpm: Reserve the TPM final events table tpm: Abstract crypto agile event size calculations tpm: Actually fail on TPM errors during "get random" commit 222a21d29521d144f3dd7a0bc4d4020e448f0126 Merge: 8faef7125d02 eb876fbc248e Author: Linus Torvalds Date: Mon Jul 8 18:28:44 2019 -0700 Merge branch 'x86-topology-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 topology updates from Ingo Molnar: "Implement multi-die topology support on Intel CPUs and expose the die topology to user-space tooling, by Len Brown, Kan Liang and Zhang Rui. These changes should have no effect on the kernel's existing understanding of topologies, i.e. there should be no behavioral impact on cache, NUMA, scheduler, perf and other topologies and overall system performance" * 'x86-topology-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: perf/x86/intel/rapl: Cosmetic rename internal variables in response to multi-die/pkg support perf/x86/intel/uncore: Cosmetic renames in response to multi-die/pkg support hwmon/coretemp: Cosmetic: Rename internal variables to zones from packages thermal/x86_pkg_temp_thermal: Cosmetic: Rename internal variables to zones from packages perf/x86/intel/cstate: Support multi-die/package perf/x86/intel/rapl: Support multi-die/package perf/x86/intel/uncore: Support multi-die/package topology: Create core_cpus and die_cpus sysfs attributes topology: Create package_cpus sysfs attribute hwmon/coretemp: Support multi-die/package powercap/intel_rapl: Update RAPL domain name and debug messages thermal/x86_pkg_temp_thermal: Support multi-die/package powercap/intel_rapl: Support multi-die/package powercap/intel_rapl: Simplify rapl_find_package() x86/topology: Define topology_logical_die_id() x86/topology: Define topology_die_id() cpu/topology: Export die_id x86/topology: Create topology_max_die_per_package() x86/topology: Add CPUID.1F multi-die/package support commit 9f7546570bcb20debfaa97bcf720fa0fcb8fc05a Author: Nishka Dasgupta Date: Sat Jul 6 18:51:30 2019 +0530 hwmon: (ina3221) Add of_node_put() before return Each iteration of for_each_child_of_node puts the previous node, but in the case of a return from the middle of the loop, there is no put, thus causing a memory leak. Hence add an of_node_put before the return. Issue found with Coccinelle. Signed-off-by: Nishka Dasgupta Link: https://lore.kernel.org/r/20190706132130.3129-1-nishkadg.linux@gmail.com Signed-off-by: Guenter Roeck commit 277c628fa5acf363b73cdd3793700dc575a988c0 Author: Christian Schneider Date: Tue Jul 2 15:23:38 2019 +0200 hwmon: (gpio-fan) fix sysfs notifications and udev events for gpio-fan alarms sysfs_notify() and kobject_uevent() are passed the wrong device. fan_data->hwmon_dev needs to be passed, so that sysfs notification goes to right place and generated uevent has the right information Signed-off-by: Christian Schneider Signed-off-by: Guenter Roeck commit f2173fa2246e906602c6286c7dade68109d68976 Author: Christian Schneider Date: Tue Jul 2 15:23:37 2019 +0200 hwmon: (gpio-fan) move fan_alarm_init after devm_hwmon_device_register_with_groups This makes it possible to use the hwmon_dev in fan_alarm_notify(). Otherwise it would be possible, that a interupt arrives and fan_alarm_notify() is executed, before hwmon_dev is initialized. Signed-off-by: Christian Schneider Signed-off-by: Guenter Roeck commit 7a1d220ccb0cc2b808eb176fb05bf55a38179f3f Author: Guenter Roeck Date: Sun Jun 30 15:40:34 2019 -0700 hwmon: (lm90) Introduce function to update configuration register The code to update the configuration register is repeated several times. Move it into a separate function. At the same time, un-inline lm90_select_remote_channel() and leave it up to the compiler to decide what to do with it. Also remove the 'client' argument from lm90_select_remote_channel() and from lm90_write_convrate() and take it from struct lm90_data instead where needed. This patch reduces code size by more than 800 bytes on x86_64. Cc: Boyang Yu Signed-off-by: Guenter Roeck commit b849e5d18c366eae8185837bd7c4adbd27213fe2 Author: Guenter Roeck Date: Sun Jun 30 15:14:19 2019 -0700 hwmon: (lm90) Cache configuration register value The configuration register does not change on its own. Yet, it is read in various locations, modified, and written back. Simplify and optimize the code by caching its value and by only writing it back when needed. Cc: Boyang Yu Signed-off-by: Guenter Roeck commit 62456189f3292c62f87aef363f204886dc1d4b48 Author: Boyang Yu Date: Fri Jun 28 19:06:36 2019 +0000 hwmon: (lm90) Fix max6658 sporadic wrong temperature reading max6658 may report unrealistically high temperature during the driver initialization, for which, its overtemp alarm pin also gets asserted. For certain devices implementing overtemp protection based on that pin, it may further trigger a reset to the device. By reproducing the problem, the wrong reading is found to be coincident with changing the conversion rate. To mitigate this issue, set the stop bit before changing the conversion rate and unset it thereafter. After such change, the wrong reading is not reproduced. Apply this change only to the max6657 kind for now, controlled by flag LM90_PAUSE_ON_CONFIG. Signed-off-by: Boyang Yu Signed-off-by: Guenter Roeck commit a653acf00d07430bbb0af06a4f5cc2073bbefde7 Author: amy.shih Date: Mon Jun 17 08:10:00 2019 +0000 hwmon: (nct7904) Changes comments in probe function. Linux style for comments is the C89 "/* ... */" style, changes the comments to Linux style. Signed-off-by: amy.shih Signed-off-by: Guenter Roeck commit b3e26067874700fb38aeddf2da9844afb36f1a94 Author: amy.shih Date: Mon Jun 17 08:08:50 2019 +0000 hwmon: (nct7904) Add error handling in probe function. When register read and write operations return errors, needs to add error handling. Signed-off-by: amy.shih Signed-off-by: Guenter Roeck commit 7199ff7d74003b5aad1e6328bf6128cd8ceea735 Author: Masahiro Yamada Date: Mon Jul 1 09:58:44 2019 +0900 kheaders: include only headers into kheaders_data.tar.xz Currently, kheaders_data.tar.xz contains some build scripts as well as headers. None of them is needed in the header archive. For ARCH=x86, this commit excludes the following from the archive: arch/x86/include/asm/Kbuild arch/x86/include/uapi/asm/Kbuild include/asm-generic/Kbuild include/config/auto.conf include/config/kernel.release include/config/tristate.conf include/uapi/asm-generic/Kbuild include/uapi/Kbuild kernel/gen_kheaders.sh This change is actually motivated for the planned header compile-testing because it will generate more build artifacts, which should not be included in the archive. Signed-off-by: Masahiro Yamada Reviewed-by: Joel Fernandes (Google) commit b60b7c2ea9b7f854d457fefd592c77f621a86580 Author: Masahiro Yamada Date: Mon Jul 1 09:58:43 2019 +0900 kheaders: remove meaningless -R option of 'ls' The -R option of 'ls' is supposed to be used for directories. -R, --recursive list subdirectories recursively Since 'find ... -type f' only matches to regular files, we do not expect directories passed to the 'ls' command here. Giving -R is harmless at least, but unneeded. Signed-off-by: Masahiro Yamada Reviewed-by: Joel Fernandes (Google) commit 1e21cbfada87f697a2a7c450542a7d28925abee6 Author: Masahiro Yamada Date: Mon Jul 1 09:58:42 2019 +0900 kbuild: support header-test-pattern-y In my view, most of headers can be self-contained. So, it would be tedious to add every header to header-test-y explicitly. We usually end up with "all headers with some exceptions". There are two types in exceptions: [1] headers that are never compiled as standalone units For examples, include/linux/compiler-gcc.h is not intended for direct inclusion. We should always exclude such ones. [2] headers that are conditionally compiled as standalone units Some headers can be compiled only for particular architectures. For example, include/linux/arm-cci.h can be compiled only for arm/arm64 because it requires to exist. Clang can compile include/soc/nps/mtm.h only for arc because it contains an arch-specific register in inline assembler. So, you can write Makefile like this: header-test- += linux/compiler-gcc.h header-test-$(CONFIG_ARM) += linux/arm-cci.h header-test-$(CONFIG_ARM64) += linux/arm-cci.h header-test-$(CONFIG_ARC) += soc/nps/mtm.h The new syntax header-test-pattern-y will be useful to specify "the rest". The typical usage is like this: header-test-pattern-y += */*.h This will add all the headers in sub-directories to the test coverage, excluding $(header-test-). In this regards, header-test-pattern-y behaves like a weaker variant of header-test-y. Caveat: The patterns in header-test-pattern-y are prefixed with $(srctree)/$(src)/ but not $(objtree)/$(obj)/. Stale generated headers are often left over when you traverse the git history without cleaning. Wildcard patterns for $(objtree) may match to stale headers, which could fail to compile. One pitfall is $(srctree)/$(src)/ and $(objtree)/$(obj)/ point to the same directory for in-tree building. So, header-test-pattern-y should be used with care since it can potentially match to stale headers. Caveat2: You could use wildcard for header-test-. For example, header-test- += asm-generic/% ... will exclude headers in asm-generic directory. Unfortunately, the wildcard character is '%' instead of '*' here because this is evaluated by $(filter-out ...) whereas header-test-pattern-y is evaluated by $(wildcard ...). This is a kludge, but seems useful in some places... Signed-off-by: Masahiro Yamada Tested-by: Jani Nikula commit c93a0368aaa2962e6c89da20f79b8789b42e3387 Author: Masahiro Yamada Date: Mon Jul 1 09:58:41 2019 +0900 kbuild: do not create wrappers for header-test-y header-test-y does not work with headers in sub-directories. For example, you may want to write a Makefile, like this: include/linux/Kbuild: header-test-y += mtd/nand.h This entry will create a wrapper include/linux/mtd/nand.hdrtest.c with the following content: #include "mtd/nand.h" To make this work, we need to add $(srctree)/include/linux to the header search path. It would be tedious to add ccflags-y. Instead, we could change the *.hdrtest.c rule to wrap: #include "nand.h" This works for in-tree build since #include "..." searches in the relative path from the header with this directive. For O=... build, we need to add $(srctree)/include/linux/mtd to the header search path, which will be even more tedious. After all, I thought it would be handier to compile headers directly without creating wrappers. I added a new build rule to compile %.h into %.h.s The target is %.h.s instead of %.h.o because it is slightly faster. Also, as for GCC, an empty assembly is smaller than an empty object. I wrote the build rule: $(CC) $(c_flags) -S -o $@ -x c /dev/null -include $< instead of: $(CC) $(c_flags) -S -o $@ -x c $< Both work fine with GCC, but the latter is bad for Clang. This comes down to the difference in the -Wunused-function policy. GCC does not warn about unused 'static inline' functions at all. Clang does not warn about the ones in included headers, but does about the ones in the source. So, we should handle headers as headers, not as source files. In fact, this has been hidden since commit abb2ea7dfd82 ("compiler, clang: suppress warning for unused static inline functions"), but we should not rely on that. Signed-off-by: Masahiro Yamada Acked-by: Jani Nikula Tested-by: Jani Nikula commit 8faef7125d02c0bbd7a1ceb4e3b599a9b8c42e58 Merge: da1770238597 d97ee99bf225 Author: Linus Torvalds Date: Mon Jul 8 17:49:45 2019 -0700 Merge branch 'x86-platform-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 platform updayes from Ingo Molnar: "Most of the commits add ACRN hypervisor guest support, plus two cleanups" * 'x86-platform-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/jailhouse: Mark jailhouse_x2apic_available() as __init x86/platform/geode: Drop includes x86/acrn: Use HYPERVISOR_CALLBACK_VECTOR for ACRN guest upcall vector x86: Add support for Linux guests on an ACRN hypervisor x86/Kconfig: Add new X86_HV_CALLBACK_VECTOR config symbol commit da1770238597a4619b7845583881543ca81270cd Merge: 3431a940bb6c 46938cc8ab91 Author: Linus Torvalds Date: Mon Jul 8 17:34:44 2019 -0700 Merge branch 'x86-paravirt-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 paravirt updates from Ingo Molnar: "A handful of paravirt patching code enhancements to make it more robust against patching failures, and related cleanups and not so related cleanups - by Thomas Gleixner and myself" * 'x86-paravirt-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/paravirt: Rename paravirt_patch_site::instrtype to paravirt_patch_site::type x86/paravirt: Standardize 'insn_buff' variable names x86/paravirt: Match paravirt patchlet field definition ordering to initialization ordering x86/paravirt: Replace the paravirt patch asm magic x86/paravirt: Unify the 32/64 bit paravirt patching code x86/paravirt: Detect over-sized patching bugs in paravirt_patch_call() x86/paravirt: Detect over-sized patching bugs in paravirt_patch_insns() x86/paravirt: Remove bogus extern declarations commit 3431a940bb6c3969240d91314d654ebac7e12b09 Merge: 5b7a2095232d 711486fd1859 Author: Linus Torvalds Date: Mon Jul 8 17:28:57 2019 -0700 Merge branch 'x86-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 AVX512 status update from Ingo Molnar: "This adds a new ABI that the main scheduler probably doesn't want to deal with but HPC job schedulers might want to use: the AVX512_elapsed_ms field in the new /proc//arch_status task status file, which allows the user-space job scheduler to cluster such tasks, to avoid turbo frequency drops" * 'x86-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: Documentation/filesystems/proc.txt: Add arch_status file x86/process: Add AVX-512 usage elapsed time to /proc/pid/arch_status proc: Add /proc//arch_status commit 5b7a2095232d026d4537c4be54040c0f10525b5b Merge: 6cfcdad7630d 53b7607382b0 Author: Linus Torvalds Date: Mon Jul 8 17:27:24 2019 -0700 Merge branch 'x86-cleanups-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 cleanups from Ingo Molnar: "Misc small cleanups: removal of superfluous code and coding style cleanups mostly" * 'x86-cleanups-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/kexec: Make variable static and config dependent x86/defconfigs: Remove useless UEVENT_HELPER_PATH x86/amd_nb: Make hygon_nb_misc_ids static x86/tsc: Move inline keyword to the beginning of function declarations x86/io_delay: Define IO_DELAY macros in C instead of Kconfig x86/io_delay: Break instead of fallthrough in switch statement commit 6cfcdad7630de2b2eb09740bdc6ee921de8c785e Merge: c83b5d321b58 2ef085bd110c Author: Linus Torvalds Date: Mon Jul 8 17:25:53 2019 -0700 Merge branch 'x86-cache-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 cache resource control update from Ingo Molnar: "Two cleanup patches" * 'x86-cache-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/resctrl: Cleanup cbm_ensure_valid() x86/resctrl: Use _ASM_BX to avoid ifdeffery commit c83b5d321b58794b8469d57990dc3884cbcd289e Merge: a1aab6f3d295 87b61864d7ab Author: Linus Torvalds Date: Mon Jul 8 17:24:44 2019 -0700 Merge branch 'x86-build-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 build updates from Ingo Molnar: "Two kbuild enhancements by Masahiro Yamada" * 'x86-build-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/build: Remove redundant 'clean-files += capflags.c' x86/build: Add 'set -e' to mkcapflags.sh to delete broken capflags.c commit a1aab6f3d295f078c008893ee7fa2c011626c46f Merge: dad1c12ed831 7457c0da024b Author: Linus Torvalds Date: Mon Jul 8 16:59:34 2019 -0700 Merge branch 'x86-asm-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 asm updates from Ingo Molnar: "Most of the changes relate to Peter Zijlstra's cleanup of ptregs handling, in particular the i386 part is now much simplified and standardized - no more partial ptregs stack frames via the esp/ss oddity. This simplifies ftrace, kprobes, the unwinder, ptrace, kdump and kgdb. There's also a CR4 hardening enhancements by Kees Cook, to make the generic platform functions such as native_write_cr4() less useful as ROP gadgets that disable SMEP/SMAP. Also protect the WP bit of CR0 against similar attacks. The rest is smaller cleanups/fixes" * 'x86-asm-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/alternatives: Add int3_emulate_call() selftest x86/stackframe/32: Allow int3_emulate_push() x86/stackframe/32: Provide consistent pt_regs x86/stackframe, x86/ftrace: Add pt_regs frame annotations x86/stackframe, x86/kprobes: Fix frame pointer annotations x86/stackframe: Move ENCODE_FRAME_POINTER to asm/frame.h x86/entry/32: Clean up return from interrupt preemption path x86/asm: Pin sensitive CR0 bits x86/asm: Pin sensitive CR4 bits Documentation/x86: Fix path to entry_32.S x86/asm: Remove unused TASK_TI_flags from asm-offsets.c commit bf0bdd1343efbbf65b4d53aef1fce14acbd79d50 Author: Ilya Maximets Date: Wed Jul 3 15:09:16 2019 +0300 xdp: fix race on generic receive path Unlike driver mode, generic xdp receive could be triggered by different threads on different CPU cores at the same time leading to the fill and rx queue breakage. For example, this could happen while sending packets from two processes to the first interface of veth pair while the second part of it is open with AF_XDP socket. Need to take a lock for each generic receive to avoid race. Fixes: c497176cb2e4 ("xsk: add Rx receive functions and poll support") Signed-off-by: Ilya Maximets Acked-by: Magnus Karlsson Tested-by: William Tu Signed-off-by: Daniel Borkmann commit dad1c12ed831a7a89cc01e5582cd0b81a4be7f19 Merge: 090bc5a2a914 af24bde8df20 Author: Linus Torvalds Date: Mon Jul 8 16:39:53 2019 -0700 Merge branch 'sched-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull scheduler updates from Ingo Molnar: - Remove the unused per rq load array and all its infrastructure, by Dietmar Eggemann. - Add utilization clamping support by Patrick Bellasi. This is a refinement of the energy aware scheduling framework with support for boosting of interactive and capping of background workloads: to make sure critical GUI threads get maximum frequency ASAP, and to make sure background processing doesn't unnecessarily move to cpufreq governor to higher frequencies and less energy efficient CPU modes. - Add the bare minimum of tracepoints required for LISA EAS regression testing, by Qais Yousef - which allows automated testing of various power management features, including energy aware scheduling. - Restructure the former tsk_nr_cpus_allowed() facility that the -rt kernel used to modify the scheduler's CPU affinity logic such as migrate_disable() - introduce the task->cpus_ptr value instead of taking the address of &task->cpus_allowed directly - by Sebastian Andrzej Siewior. - Misc optimizations, fixes, cleanups and small enhancements - see the Git log for details. * 'sched-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (33 commits) sched/uclamp: Add uclamp support to energy_compute() sched/uclamp: Add uclamp_util_with() sched/cpufreq, sched/uclamp: Add clamps for FAIR and RT tasks sched/uclamp: Set default clamps for RT tasks sched/uclamp: Reset uclamp values on RESET_ON_FORK sched/uclamp: Extend sched_setattr() to support utilization clamping sched/core: Allow sched_setattr() to use the current policy sched/uclamp: Add system default clamps sched/uclamp: Enforce last task's UCLAMP_MAX sched/uclamp: Add bucket local max tracking sched/uclamp: Add CPU's clamp buckets refcounting sched/fair: Rename weighted_cpuload() to cpu_runnable_load() sched/debug: Export the newly added tracepoints sched/debug: Add sched_overutilized tracepoint sched/debug: Add new tracepoint to track PELT at se level sched/debug: Add new tracepoints to track PELT at rq level sched/debug: Add a new sched_trace_*() helper functions sched/autogroup: Make autogroup_path() always available sched/wait: Deduplicate code with do-while sched/topology: Remove unused 'sd' parameter from arch_scale_cpu_capacity() ... commit 7650b1a9bd693d133a3ec0548ba63e828f34e3ec Merge: faf5577f2498 2800f2485417 Author: David S. Miller Date: Mon Jul 8 16:37:30 2019 -0700 Merge branch 'mp-inner-L3' Stephen Suryaputra says: ==================== net: Multipath hashing on inner L3 This series extends commit 363887a2cdfe ("ipv4: Support multipath hashing on inner IP pkts for GRE tunnel") to include support when the outer L3 is IPv6 and to consider the case where the inner L3 is different version from the outer L3, such as IPv6 tunneled by IPv4 GRE or vice versa. It also includes kselftest scripts to test the use cases. v2: Clarify the commit messages in the commits in this series to use the term tunneled by IPv4 GRE or by IPv6 GRE so that it's clear which one is the inner and which one is the outer (per David Miller). ==================== Signed-off-by: David S. Miller commit 2800f2485417a80633285503c782dd9416df85e4 Author: Stephen Suryaputra Date: Sat Jul 6 10:55:19 2019 -0400 selftests: forwarding: Test multipath hashing on inner IP pkts for GRE tunnel Add selftest scripts for multipath hashing on inner IP pkts when there is a single GRE tunnel but there are multiple underlay routes to reach the other end of the tunnel. Four cases are covered in these scripts: - IPv4 inner, IPv4 outer - IPv6 inner, IPv4 outer - IPv4 inner, IPv6 outer - IPv6 inner, IPv6 outer Reviewed-by: Ido Schimmel Signed-off-by: Stephen Suryaputra Signed-off-by: David S. Miller commit d8f74f0975d8360ab15312697585837c989c406b Author: Stephen Suryaputra Date: Sat Jul 6 10:55:18 2019 -0400 ipv6: Support multipath hashing on inner IP pkts Make the same support as commit 363887a2cdfe ("ipv4: Support multipath hashing on inner IP pkts for GRE tunnel") for outer IPv6. The hashing considers both IPv4 and IPv6 pkts when they are tunneled by IPv6 GRE. Signed-off-by: Stephen Suryaputra Signed-off-by: David S. Miller commit 828b2b442145cbe94fe3ca0e34a47f64b0f322ef Author: Stephen Suryaputra Date: Sat Jul 6 10:55:17 2019 -0400 ipv4: Multipath hashing on inner L3 needs to consider inner IPv6 pkts Commit 363887a2cdfe ("ipv4: Support multipath hashing on inner IP pkts for GRE tunnel") supports multipath policy value of 2, Layer 3 or inner Layer 3 if present, but it only considers inner IPv4. There is a use case of IPv6 is tunneled by IPv4 GRE, thus add the ability to hash on inner IPv6 addresses. Fixes: 363887a2cdfe ("ipv4: Support multipath hashing on inner IP pkts for GRE tunnel") Signed-off-by: Stephen Suryaputra Signed-off-by: David S. Miller commit faf5577f2498cea23011b5c785ef853ded22700b Author: Wen Yang Date: Sat Jul 6 12:23:41 2019 +0800 net: pasemi: fix an use-after-free in pasemi_mac_phy_init() The phy_dn variable is still being used in of_phy_connect() after the of_node_put() call, which may result in use-after-free. Fixes: 1dd2d06c0459 ("net: Rework pasemi_mac driver to use of_mdio infrastructure") Signed-off-by: Wen Yang Cc: "David S. Miller" Cc: Thomas Gleixner Cc: Luis Chamberlain Cc: Michael Ellerman Cc: netdev@vger.kernel.org Cc: linux-kernel@vger.kernel.org Signed-off-by: David S. Miller commit 090bc5a2a91499c1fd64b78d125daa6ca5531d38 Merge: e1928328699a 6e4f929ea8b2 Author: Linus Torvalds Date: Mon Jul 8 16:31:06 2019 -0700 Merge branch 'ras-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull RAS updates from Ingo Molnar: "Boris is on vacation so I'm sending the RAS bits this time. The main changes were: - Various RAS/CEC improvements and fixes by Borislav Petkov: - error insertion fixes - offlining latency fix - memory leak fix - additional sanity checks - cleanups - debug output improvements - More SMCA enhancements by Yazen Ghannam: - make banks truly per-CPU which they are in the hardware - don't over-cache certain registers - make the number of MCA banks per-CPU variable The long term goal with these changes is to support future heterogenous SMCA extensions. - Misc fixes and improvements" * 'ras-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/mce: Do not check return value of debugfs_create functions x86/MCE: Determine MCA banks' init state properly x86/MCE: Make the number of MCA banks a per-CPU variable x86/MCE/AMD: Don't cache block addresses on SMCA systems x86/MCE: Make mce_banks a per-CPU array x86/MCE: Make struct mce_banks[] static RAS/CEC: Add copyright RAS/CEC: Add CONFIG_RAS_CEC_DEBUG and move CEC debug features there RAS/CEC: Dump the different array element sections RAS/CEC: Rename count_threshold to action_threshold RAS/CEC: Sanity-check array on every insertion RAS/CEC: Fix potential memory leak RAS/CEC: Do not set decay value on error RAS/CEC: Check count_threshold unconditionally RAS/CEC: Fix pfn insertion commit ef86ea982bb5a31cda1f2989b6e477bb53a1031b Author: Wen Yang Date: Sat Jul 6 11:38:41 2019 +0800 net: axienet: fix a potential double free in axienet_probe() There is a possible use-after-free issue in the axienet_probe(): 1701: np = of_parse_phandle(pdev->dev.of_node, "axistream-connected", 0); 1702: if (np) { ... 1787: of_node_put(np); ---> released here 1788: lp->eth_irq = platform_get_irq(pdev, 0); 1789: } else { ... 1801: } 1802: if (IS_ERR(lp->dma_regs)) { ... 1805: of_node_put(np); ---> double released here 1806: goto free_netdev; 1807: } We solve this problem by removing the unnecessary of_node_put(). Fixes: 28ef9ebdb64c ("net: axienet: make use of axistream-connected attribute optional") Signed-off-by: Wen Yang Cc: Anirudha Sarangi Cc: John Linn Cc: "David S. Miller" Cc: Michal Simek Cc: Robert Hancock Cc: netdev@vger.kernel.org Cc: linux-arm-kernel@lists.infradead.org Cc: linux-kernel@vger.kernel.org Reviewed-by: Robert Hancock Signed-off-by: David S. Miller commit a57caf8c527f63459c1c70eb3cf55ac373adb88e Author: Denis Efremov Date: Mon Jul 8 19:14:23 2019 +0300 sunrpc/cache: remove the exporting of cache_seq_next The function cache_seq_next is declared static and marked EXPORT_SYMBOL_GPL, which is at best an odd combination. Because the function is not used outside of the net/sunrpc/cache.c file it is defined in, this commit removes the EXPORT_SYMBOL_GPL() marking. Fixes: d48cf356a130 ("SUNRPC: Remove non-RCU protected lookup") Signed-off-by: Denis Efremov Signed-off-by: J. Bruce Fields commit e1928328699a582a540b105e5f4c160832a7fdcb Merge: 46f1ec23a469 9156e545765e Author: Linus Torvalds Date: Mon Jul 8 16:12:03 2019 -0700 Merge branch 'locking-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull locking updates from Ingo Molnar: "The main changes in this cycle are: - rwsem scalability improvements, phase #2, by Waiman Long, which are rather impressive: "On a 2-socket 40-core 80-thread Skylake system with 40 reader and writer locking threads, the min/mean/max locking operations done in a 5-second testing window before the patchset were: 40 readers, Iterations Min/Mean/Max = 1,807/1,808/1,810 40 writers, Iterations Min/Mean/Max = 1,807/50,344/151,255 After the patchset, they became: 40 readers, Iterations Min/Mean/Max = 30,057/31,359/32,741 40 writers, Iterations Min/Mean/Max = 94,466/95,845/97,098" There's a lot of changes to the locking implementation that makes it similar to qrwlock, including owner handoff for more fair locking. Another microbenchmark shows how across the spectrum the improvements are: "With a locking microbenchmark running on 5.1 based kernel, the total locking rates (in kops/s) on a 2-socket Skylake system with equal numbers of readers and writers (mixed) before and after this patchset were: # of Threads Before Patch After Patch ------------ ------------ ----------- 2 2,618 4,193 4 1,202 3,726 8 802 3,622 16 729 3,359 32 319 2,826 64 102 2,744" The changes are extensive and the patch-set has been through several iterations addressing various locking workloads. There might be more regressions, but unless they are pathological I believe we want to use this new implementation as the baseline going forward. - jump-label optimizations by Daniel Bristot de Oliveira: the primary motivation was to remove IPI disturbance of isolated RT-workload CPUs, which resulted in the implementation of batched jump-label updates. Beyond the improvement of the real-time characteristics kernel, in one test this patchset improved static key update overhead from 57 msecs to just 1.4 msecs - which is a nice speedup as well. - atomic64_t cross-arch type cleanups by Mark Rutland: over the last ~10 years of atomic64_t existence the various types used by the APIs only had to be self-consistent within each architecture - which means they became wildly inconsistent across architectures. Mark puts and end to this by reworking all the atomic64 implementations to use 's64' as the base type for atomic64_t, and to ensure that this type is consistently used for parameters and return values in the API, avoiding further problems in this area. - A large set of small improvements to lockdep by Yuyang Du: type cleanups, output cleanups, function return type and othr cleanups all around the place. - A set of percpu ops cleanups and fixes by Peter Zijlstra. - Misc other changes - please see the Git log for more details" * 'locking-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (82 commits) locking/lockdep: increase size of counters for lockdep statistics locking/atomics: Use sed(1) instead of non-standard head(1) option locking/lockdep: Move mark_lock() inside CONFIG_TRACE_IRQFLAGS && CONFIG_PROVE_LOCKING x86/jump_label: Make tp_vec_nr static x86/percpu: Optimize raw_cpu_xchg() x86/percpu, sched/fair: Avoid local_clock() x86/percpu, x86/irq: Relax {set,get}_irq_regs() x86/percpu: Relax smp_processor_id() x86/percpu: Differentiate this_cpu_{}() and __this_cpu_{}() locking/rwsem: Guard against making count negative locking/rwsem: Adaptive disabling of reader optimistic spinning locking/rwsem: Enable time-based spinning on reader-owned rwsem locking/rwsem: Make rwsem->owner an atomic_long_t locking/rwsem: Enable readers spinning on writer locking/rwsem: Clarify usage of owner's nonspinaable bit locking/rwsem: Wake up almost all readers in wait queue locking/rwsem: More optimal RT task handling of null owner locking/rwsem: Always release wait_lock before waking up tasks locking/rwsem: Implement lock handoff to prevent lock starvation locking/rwsem: Make rwsem_spin_on_owner() return owner state ... commit bc2d8afecbec33bd4549ce1ef904383fde21d385 Author: Ilya Leoshkevich Date: Wed Jul 3 13:50:34 2019 +0200 selftests/bpf: fix test_reuseport_array on s390 Fix endianness issue: passing a pointer to 64-bit fd as a 32-bit key does not work on big-endian architectures. So cast fd to 32-bits when necessary. Signed-off-by: Ilya Leoshkevich Signed-off-by: Daniel Borkmann commit d4117d63a30876a3654f587c3a419db63d8b529d Author: Kweh Hock Leong Date: Sat Jul 6 01:33:27 2019 +0800 net: stmmac: enable clause 45 mdio support DWMAC4 is capable to support clause 45 mdio communication. This patch enable the feature on stmmac_mdio_write() and stmmac_mdio_read() by following phy_write_mmd() and phy_read_mmd() mdiobus read write implementation format. Reviewed-by: Li, Yifan Signed-off-by: Kweh Hock Leong Signed-off-by: Ong Boon Leong Signed-off-by: Voon Weifeng Reviewed-by: Andrew Lunn Signed-off-by: David S. Miller commit 765e33f5211ab620c117ff1ee0c4f38c10f7a973 Author: Michael Kelley Date: Thu May 30 00:14:00 2019 +0000 Drivers: hv: vmbus: Break out ISA independent parts of mshyperv.h Break out parts of mshyperv.h that are ISA independent into a separate file in include/asm-generic. This move facilitates ARM64 code reusing these definitions and avoids code duplication. No functionality or behavior is changed. Signed-off-by: Michael Kelley Reviewed-by: Vitaly Kuznetsov Signed-off-by: Sasha Levin commit 44e3725943b706d3625ad91b1a1069a18fd0775c Author: Taehee Yoo Date: Sat Jul 6 01:05:46 2019 +0900 net: openvswitch: use netif_ovs_is_port() instead of opencode Use netif_ovs_is_port() function instead of open code. This patch doesn't change logic. Signed-off-by: Taehee Yoo Signed-off-by: David S. Miller commit f714ecc9cf16a63066badbc85bfbfff9af85a8b7 Author: Jesper Dangaard Brouer Date: Fri Jul 5 14:57:55 2019 +0200 MAINTAINERS: Add page_pool maintainer entry In this release cycle the number of NIC drivers using page_pool will likely reach 4 drivers. It is about time to add a maintainer entry. Add myself and Ilias. Signed-off-by: Jesper Dangaard Brouer Acked-by: Ilias Apalodimas Signed-off-by: David S. Miller commit 11aef3c6da1712fa3847599196f78f406814d2f1 Merge: 3f4957eb6cfb f406324e500e Author: David S. Miller Date: Mon Jul 8 15:50:06 2019 -0700 Merge branch 'mvpp2-cls-ether' Maxime Chevallier says: ==================== net: mvpp2: Add classification based on the ETHER flow This series adds support for classification of the ETHER flow in the mvpp2 driver. The first patch allows detecting when a user specifies a flow_type that isn't supported by the driver, while the second adds support for this flow_type by adding the mapping between the ETHER_FLOW enum value and the relevant classifier flow entries. ==================== Signed-off-by: David S. Miller commit f406324e500eea5078a78df376e9496d4001b942 Author: Maxime Chevallier Date: Fri Jul 5 14:09:13 2019 +0200 net: mvpp2: cls: Add support for ETHER_FLOW Users can specify classification actions based on the 'ether' flow type. In that case, this will apply to all ethernet traffic, superseeding flows such as 'udp4' or 'tcp6'. Add support for this flow type in the PPv2 classifier, by mapping the ETHER_FLOW value to the corresponding entries in the classifier. Signed-off-by: Maxime Chevallier Signed-off-by: David S. Miller commit f4f1ba18195dfb10838b4a221a942a2a7d218ca9 Author: Maxime Chevallier Date: Fri Jul 5 14:09:12 2019 +0200 net: mvpp2: cls: Report an error for unsupported flow types Add a missing check to detect flow types that we don't support, so that user can be informed of this. Signed-off-by: Maxime Chevallier Signed-off-by: David S. Miller commit 46f1ec23a46940846f86a91c46f7119d8a8b5de1 Merge: 223cea6a4f05 83086d654dd0 Author: Linus Torvalds Date: Mon Jul 8 15:45:14 2019 -0700 Merge branch 'core-rcu-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull RCU updates from Ingo Molnar: "The changes in this cycle are: - RCU flavor consolidation cleanups and optmizations - Documentation updates - Miscellaneous fixes - SRCU updates - RCU-sync flavor consolidation - Torture-test updates - Linux-kernel memory-consistency-model updates, most notably the addition of plain C-language accesses" * 'core-rcu-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (61 commits) tools/memory-model: Improve data-race detection tools/memory-model: Change definition of rcu-fence tools/memory-model: Expand definition of barrier tools/memory-model: Do not use "herd" to refer to "herd7" tools/memory-model: Fix comment in MP+poonceonces.litmus Documentation: atomic_t.txt: Explain ordering provided by smp_mb__{before,after}_atomic() rcu: Don't return a value from rcu_assign_pointer() rcu: Force inlining of rcu_read_lock() rcu: Fix irritating whitespace error in rcu_assign_pointer() rcu: Upgrade sync_exp_work_done() to smp_mb() rcutorture: Upper case solves the case of the vanishing NULL pointer torture: Suppress propagating trace_printk() warning rcutorture: Dump trace buffer for callback pipe drain failures torture: Add --trust-make to suppress "make clean" torture: Make --cpus override idleness calculations torture: Run kernel build in source directory torture: Add function graph-tracing cheat sheet torture: Capture qemu output rcutorture: Tweak kvm options rcutorture: Add trivial RCU implementation ... commit cecaa76b2919aac2aa584ce476e9fcd5b084add5 Author: Frank de Brabander Date: Fri Jul 5 13:43:14 2019 +0200 selftests: txring_overwrite: fix incorrect test of mmap() return value If mmap() fails it returns MAP_FAILED, which is defined as ((void *) -1). The current if-statement incorrectly tests if *ring is NULL. Fixes: 358be656406d ("selftests/net: add txring_overwrite") Signed-off-by: Frank de Brabander Acked-by: Willem de Bruijn Signed-off-by: David S. Miller commit 3f4957eb6cfbdb16b77df4e11691912dcfc7aca7 Merge: 1a2d405c0081 e226121fcc26 Author: David S. Miller Date: Mon Jul 8 15:35:17 2019 -0700 Merge branch 'vsock-virtio-fixes' Stefano Garzarella says: ==================== vsock/virtio: several fixes in the .probe() and .remove() During the review of "[PATCH] vsock/virtio: Initialize core virtio vsock before registering the driver", Stefan pointed out some possible issues in the .probe() and .remove() callbacks of the virtio-vsock driver. This series tries to solve these issues: - Patch 1 adds RCU critical sections to avoid use-after-free of 'the_virtio_vsock' pointer. - Patch 2 stops workers before to call vdev->config->reset(vdev) to be sure that no one is accessing the device. - Patch 3 moves the works flush at the end of the .remove() to avoid use-after-free of 'vsock' object. v3: - Patch 1: use rcu_dereference_protected() to get the_virtio_vosck value in the virtio_vsock_probe() [Jason] v2: https://patchwork.kernel.org/cover/11022343/ v1: https://patchwork.kernel.org/cover/10964733/ Before this series the guest crashes in a few second. After this series the test runs (~12h) without issues. Tested on an SMP guest (-smp 4 -monitor tcp:127.0.0.1:1234,server,nowait) with these scripts to stress the .probe()/.remove() path: - guest while true; do cat /dev/urandom | nc-vsock -l 4321 > /dev/null & cat /dev/urandom | nc-vsock -l 5321 > /dev/null & cat /dev/urandom | nc-vsock -l 6321 > /dev/null & cat /dev/urandom | nc-vsock -l 7321 > /dev/null & wait done - host while true; do cat /dev/urandom | nc-vsock 3 4321 > /dev/null & cat /dev/urandom | nc-vsock 3 5321 > /dev/null & cat /dev/urandom | nc-vsock 3 6321 > /dev/null & cat /dev/urandom | nc-vsock 3 7321 > /dev/null & sleep 2 echo "device_del v1" | nc 127.0.0.1 1234 sleep 1 echo "device_add vhost-vsock-pci,id=v1,guest-cid=3" | nc 127.0.0.1 1234 sleep 1 done ==================== Signed-off-by: David S. Miller commit e226121fcc26e69c721a435aa9348a2f452e4d3e Author: Stefano Garzarella Date: Fri Jul 5 13:04:54 2019 +0200 vsock/virtio: fix flush of works during the .remove() This patch moves the flush of works after vdev->config->del_vqs(vdev), because we need to be sure that no workers run before to free the 'vsock' object. Since we stopped the workers using the [tx|rx|event]_run flags, we are sure no one is accessing the device while we are calling vdev->config->reset(vdev), so we can safely move the workers' flush. Before the vdev->config->del_vqs(vdev), workers can be scheduled by VQ callbacks, so we must flush them after del_vqs(), to avoid use-after-free of 'vsock' object. Suggested-by: Michael S. Tsirkin Signed-off-by: Stefano Garzarella Signed-off-by: David S. Miller commit b917507e5ad983085d29069369778b16aa03a0a8 Author: Stefano Garzarella Date: Fri Jul 5 13:04:53 2019 +0200 vsock/virtio: stop workers during the .remove() Before to call vdev->config->reset(vdev) we need to be sure that no one is accessing the device, for this reason, we add new variables in the struct virtio_vsock to stop the workers during the .remove(). This patch also add few comments before vdev->config->reset(vdev) and vdev->config->del_vqs(vdev). Suggested-by: Stefan Hajnoczi Suggested-by: Michael S. Tsirkin Signed-off-by: Stefano Garzarella Signed-off-by: David S. Miller commit 0deab087b16abb755dca6da5d3685375f8ff8c85 Author: Stefano Garzarella Date: Fri Jul 5 13:04:52 2019 +0200 vsock/virtio: use RCU to avoid use-after-free on the_virtio_vsock Some callbacks used by the upper layers can run while we are in the .remove(). A potential use-after-free can happen, because we free the_virtio_vsock without knowing if the callbacks are over or not. To solve this issue we move the assignment of the_virtio_vsock at the end of .probe(), when we finished all the initialization, and at the beginning of .remove(), before to release resources. For the same reason, we do the same also for the vdev->priv. We use RCU to be sure that all callbacks that use the_virtio_vsock ended before freeing it. This is not required for callbacks that use vdev->priv, because after the vdev->config->del_vqs() we are sure that they are ended and will no longer be invoked. We also take the mutex during the .remove() to avoid that .probe() can run while we are resetting the device. Signed-off-by: Stefano Garzarella Signed-off-by: David S. Miller commit 1a2d405c0081e466cc56309652de3ce8467b3812 Merge: 31d166642c7c ff2d339375d0 Author: David S. Miller Date: Mon Jul 8 15:30:13 2019 -0700 Merge branch 'b53-docs' Benedikt Spranger says: ==================== Document the configuration of b53 this is the third round to document the configuration of a b53 supported switch. v3..v2: - fix a typo - improve b53 configuration in DSA_TAG_PROTO_NONE showcase. - grade up from RFC to patch for mainline inclusion. v1..v2: - split out generic parts of the configuration. - target comments by Andrew Lunn and Florian Fainelli. - make changes visible to build system ==================== Signed-off-by: David S. Miller commit ff2d339375d0162e322d96cfacba0ac8467a15c9 Author: Benedikt Spranger Date: Fri Jul 5 11:57:19 2019 +0200 Documentation: net: dsa: b53: Describe b53 configuration Document the different needs of documentation for the b53 driver. Signed-off-by: Benedikt Spranger Reviewed-by: Florian Fainelli Signed-off-by: David S. Miller commit 58dd7a8d9d02ee07d7aee450c5515cfe3ef8db21 Author: Benedikt Spranger Date: Fri Jul 5 11:57:18 2019 +0200 Documentation: net: dsa: Describe DSA switch configuration Document DSA tagged and VLAN based switch configuration by showcases. Signed-off-by: Benedikt Spranger Reviewed-by: Andrew Lunn Reviewed-by: Florian Fainelli Signed-off-by: David S. Miller commit caa2b557841c8cedc1d4862cd31cf76ee940d105 Author: Arnd Bergmann Date: Mon Jul 8 14:52:39 2019 +0200 power: reset: nvmem-reboot-mode: add CONFIG_OF dependency Without CONFIG_OF, we get a build failure in the reboot-mode implementation: drivers/power/reset/reboot-mode.c: In function 'reboot_mode_register': drivers/power/reset/reboot-mode.c:72:2: error: implicit declaration of function 'for_each_property_of_node'; did you mean 'for_each_child_of_node'? [-Werror=implicit-function-declaration] for_each_property_of_node(np, prop) { Add a Kconfig dependency like we have for the other users of CONFIG_REBOOT_MODE. Fixes: 7a78a7f7695b ("power: reset: nvmem-reboot-mode: use NVMEM as reboot mode write interface") Signed-off-by: Arnd Bergmann Signed-off-by: Sebastian Reichel commit 31d166642c7c601c65eccf0ff2e0afe9a0538be2 Author: Wei Yongjun Date: Fri Jul 5 08:26:25 2019 +0000 nfp: tls: fix error return code in nfp_net_tls_add() Fix to return negative error code -EINVAL from the error handling case instead of 0, as done elsewhere in this function. Fixes: 1f35a56cf586 ("nfp: tls: add/delete TLS TX connections") Signed-off-by: Wei Yongjun Acked-by: Jakub Kicinski Signed-off-by: David S. Miller commit 107d3ce60119fe1c03f07841795f54cc729a5441 Merge: aa6be2b95d4e 322b87ca55f2 Author: David S. Miller Date: Mon Jul 8 15:15:25 2019 -0700 Merge branch 'bnxt_en-XDP_REDIRECT' Michael Chan says: ==================== bnxt_en: Add XDP_REDIRECT support. This patch series adds XDP_REDIRECT support by Andy Gospodarek. ==================== Signed-off-by: David S. Miller commit 322b87ca55f2f3936ec9f9de438ef9b2115b5c9b Author: Andy Gospodarek Date: Mon Jul 8 17:53:04 2019 -0400 bnxt_en: add page_pool support This removes contention over page allocation for XDP_REDIRECT actions by adding page_pool support per queue for the driver. The performance for XDP_REDIRECT actions scales linearly with the number of cores performing redirect actions when using the page pools instead of the standard page allocator. v2: Fix up the error path from XDP registration, noted by Ilias Apalodimas. Signed-off-by: Andy Gospodarek Signed-off-by: Michael Chan Signed-off-by: David S. Miller commit f18c2b77b2e4eec2313d519ba125bd6a069513cf Author: Andy Gospodarek Date: Mon Jul 8 17:53:03 2019 -0400 bnxt_en: optimized XDP_REDIRECT support This adds basic support for XDP_REDIRECT in the bnxt_en driver. Next patch adds the more optimized page pool support. Signed-off-by: Andy Gospodarek Signed-off-by: Michael Chan Signed-off-by: David S. Miller commit c1ba92a86db24dc9ca2648473d4820979a0d8a4c Author: Michael Chan Date: Mon Jul 8 17:53:02 2019 -0400 bnxt_en: Refactor __bnxt_xmit_xdp(). __bnxt_xmit_xdp() is used by XDP_TX and ethtool loopback packet transmit. Refactor it so that it can be re-used by the XDP_REDIRECT logic. Restructure the TX interrupt handler logic to cleanly separate XDP_TX logic in preparation for XDP_REDIRECT. Acked-by: Andy Gospodarek Signed-off-by: Michael Chan Signed-off-by: David S. Miller commit 52c0609258658ff35b85c654c568a50abd602ac6 Author: Andy Gospodarek Date: Mon Jul 8 17:53:01 2019 -0400 bnxt_en: rename some xdp functions Renaming bnxt_xmit_xdp to __bnxt_xmit_xdp to get ready for XDP_REDIRECT support and reduce confusion/namespace collision. Signed-off-by: Andy Gospodarek Signed-off-by: Michael Chan Signed-off-by: David S. Miller commit aa6be2b95d4ecfd0e3a433fc3270da98fffab115 Merge: 49db9228b8d8 9ed4050c0d75 Author: David S. Miller Date: Mon Jul 8 14:58:04 2019 -0700 Merge branch 'cpsw-Add-XDP-support' Ivan Khoronzhuk says: ==================== net: ethernet: ti: cpsw: Add XDP support This patchset adds XDP support for TI cpsw driver and base it on page_pool allocator. It was verified on af_xdp socket drop, af_xdp l2f, ebpf XDP_DROP, XDP_REDIRECT, XDP_PASS, XDP_TX. It was verified with following configs enabled: CONFIG_JIT=y CONFIG_BPFILTER=y CONFIG_BPF_SYSCALL=y CONFIG_XDP_SOCKETS=y CONFIG_BPF_EVENTS=y CONFIG_HAVE_EBPF_JIT=y CONFIG_BPF_JIT=y CONFIG_CGROUP_BPF=y Link on previous v7: https://lkml.org/lkml/2019/7/4/715 Also regular tests with iperf2 were done in order to verify impact on regular netstack performance, compared with base commit: https://pastebin.com/JSMT0iZ4 v8..v9: - fix warnings on arm64 caused by typos in type casting v7..v8: - corrected dma calculation based on headroom instead of hard start - minor comment changes v6..v7: - rolled back to v4 solution but with small modification - picked up patch: https://www.spinics.net/lists/netdev/msg583145.html - added changes related to netsec fix and cpsw v5..v6: - do changes that is rx_dev while redirect/flush cycle is kept the same - dropped net: ethernet: ti: davinci_cpdma: return handler status - other changes desc in patches v4..v5: - added two plreliminary patches: net: ethernet: ti: davinci_cpdma: allow desc split while down net: ethernet: ti: cpsw_ethtool: allow res split while down - added xdp alocator refcnt on xdp level, avoiding page pool refcnt - moved flush status as separate argument for cpdma_chan_process - reworked cpsw code according to last changes to allocator - added missed statistic counter v3..v4: - added page pool user counter - use same pool for ndevs in dual mac - restructured page pool create/destroy according to the last changes in API v2..v3: - each rxq and ndev has its own page pool v1..v2: - combined xdp_xmit functions - used page allocation w/o refcnt juggle - unmapped page for skb netstack - moved rxq/page pool allocation to open/close pair - added several preliminary patches: net: page_pool: add helper function to retrieve dma addresses net: page_pool: add helper function to unmap dma addresses net: ethernet: ti: cpsw: use cpsw as drv data net: ethernet: ti: cpsw_ethtool: simplify slave loops ==================== Signed-off-by: David S. Miller commit 9ed4050c0d75768066a07cf66eef4f8dc9d79b52 Author: Ivan Khoronzhuk Date: Tue Jul 9 00:34:32 2019 +0300 net: ethernet: ti: cpsw: add XDP support Add XDP support based on rx page_pool allocator, one frame per page. Page pool allocator is used with assumption that only one rx_handler is running simultaneously. DMA map/unmap is reused from page pool despite there is no need to map whole page. Due to specific of cpsw, the same TX/RX handler can be used by 2 network devices, so special fields in buffer are added to identify an interface the frame is destined to. Thus XDP works for both interfaces, that allows to test xdp redirect between two interfaces easily. Also, each rx queue have own page pools, but common for both netdevs. XDP prog is common for all channels till appropriate changes are added in XDP infrastructure. Also, once page_pool recycling becomes part of skb netstack some simplifications can be added, like removing page_pool_release_page() before skb receive. In order to keep rx_dev while redirect, that can be somehow used in future, do flush in rx_handler, that allows to keep rx dev the same while redirect. It allows to conform with tracing rx_dev pointed by Jesper. Also, there is probability, that XDP generic code can be extended to support multi ndev drivers like this one, using same rx queue for several ndevs, based on switchdev for instance or else. In this case, driver can be modified like exposed here: https://lkml.org/lkml/2019/7/3/243 Acked-by: Jesper Dangaard Brouer Signed-off-by: Ivan Khoronzhuk Signed-off-by: David S. Miller commit 608ef6202fb56520877ed56c1783c213ae6d1b8c Author: Ivan Khoronzhuk Date: Tue Jul 9 00:34:31 2019 +0300 net: ethernet: ti: cpsw_ethtool: allow res split while down That's possible to set channel num while interfaces are down. When interface gets up it should resplit budget. This resplit can happen after phy is up but only if speed is changed, so should be set before this, for this allow it to happen while changing number of channels, when interfaces are down. Signed-off-by: Ivan Khoronzhuk Signed-off-by: David S. Miller commit 962fb618909ef64e0c89af5b79ba0fed910b78e3 Author: Ivan Khoronzhuk Date: Tue Jul 9 00:34:30 2019 +0300 net: ethernet: ti: davinci_cpdma: allow desc split while down That's possible to set ring params while interfaces are down. When interface gets up it uses number of descs to fill rx queue and on later on changes to create rx pools. Usually, this resplit can happen after phy is up, but it can be needed before this, so allow it to happen while setting number of rx descs, when interfaces are down. Also, if no dependency on intf state, move it to cpdma layer, where it should be. Signed-off-by: Ivan Khoronzhuk Signed-off-by: David S. Miller commit 6670acacd59eb72acfe5d69c966b5d2724cc521b Author: Ivan Khoronzhuk Date: Tue Jul 9 00:34:29 2019 +0300 net: ethernet: ti: davinci_cpdma: add dma mapped submit In case if dma mapped packet needs to be sent, like with XDP page pool, the "mapped" submit can be used. This patch adds dma mapped submit based on regular one. Signed-off-by: Ivan Khoronzhuk Signed-off-by: David S. Miller commit 1da4bbeffe41ba318812d7590955faee8636668b Author: Ivan Khoronzhuk Date: Tue Jul 9 00:34:28 2019 +0300 net: core: page_pool: add user refcnt and reintroduce page_pool_destroy Jesper recently removed page_pool_destroy() (from driver invocation) and moved shutdown and free of page_pool into xdp_rxq_info_unreg(), in-order to handle in-flight packets/pages. This created an asymmetry in drivers create/destroy pairs. This patch reintroduce page_pool_destroy and add page_pool user refcnt. This serves the purpose to simplify drivers error handling as driver now drivers always calls page_pool_destroy() and don't need to track if xdp_rxq_info_reg_mem_model() was unsuccessful. This could be used for a special cases where a single RX-queue (with a single page_pool) provides packets for two net_device'es, and thus needs to register the same page_pool twice with two xdp_rxq_info structures. This patch is primarily to ease API usage for drivers. The recently merged netsec driver, actually have a bug in this area, which is solved by this API change. This patch is a modified version of Ivan Khoronzhuk's original patch. Link: https://lore.kernel.org/netdev/20190625175948.24771-2-ivan.khoronzhuk@linaro.org/ Fixes: 5c67bf0ec4d0 ("net: netsec: Use page_pool API") Signed-off-by: Jesper Dangaard Brouer Reviewed-by: Ilias Apalodimas Acked-by: Jesper Dangaard Brouer Reviewed-by: Saeed Mahameed Signed-off-by: Ivan Khoronzhuk Signed-off-by: David S. Miller commit 5b8010ba70d5aa5b321d3e69b5b31cc3db857d5e Author: Anson Huang Date: Mon Jul 8 11:03:08 2019 +0800 cpufreq: imx-cpufreq-dt: Add i.MX8MN support i.MX8MN is a new SoC of i.MX8M series, it also uses speed grading and market segment fuses for OPP definitions, add support for this SoC. Signed-off-by: Anson Huang Acked-by: Viresh Kumar Signed-off-by: Rafael J. Wysocki commit 18c49926c4bf4915e5194d1de3299c0537229f9f Author: Viresh Kumar Date: Fri Jul 5 16:21:24 2019 +0530 cpufreq: Add QoS requests for userspace constraints This implements QoS requests to manage userspace configuration of min and max frequency. Reviewed-by: Matthias Kaehlcke Reviewed-by: Ulf Hansson Signed-off-by: Viresh Kumar Tested-by: syzbot Signed-off-by: Rafael J. Wysocki commit c57b25bdf7cd374af106992356536bf5df7c255b Author: Viresh Kumar Date: Thu Jul 4 13:06:22 2019 +0530 cpufreq: intel_pstate: Reuse refresh_frequency_limits() The implementation of intel_pstate_update_max_freq() is quite similar to refresh_frequency_limits(), lets reuse it. Finding minimum of policy->user_policy.max and policy->cpuinfo.max_freq in intel_pstate_update_max_freq() is redundant as cpufreq_set_policy() will call the ->verify() callback of intel-pstate driver, which will do this comparison anyway and so dropping it from intel_pstate_update_max_freq() doesn't harm. Signed-off-by: Viresh Kumar Signed-off-by: Rafael J. Wysocki commit 67d874c3b2c69d65274fa5ce44ba939788d5729d Author: Viresh Kumar Date: Mon Jul 8 16:27:52 2019 +0530 cpufreq: Register notifiers with the PM QoS framework Register notifiers for min/max frequency constraints with the PM QoS framework. The constraints are also taken into consideration in cpufreq_set_policy(). This also relocates cpufreq_policy_put_kobj() as it is required to be called from cpufreq_policy_alloc() now. refresh_frequency_limits() is updated to avoid calling cpufreq_set_policy() for inactive policies and handle_update() is updated to have proper locking in place. No constraints are added until now though. Reviewed-by: Matthias Kaehlcke Reviewed-by: Ulf Hansson Signed-off-by: Viresh Kumar Tested-by: Pavel Machek Signed-off-by: Rafael J. Wysocki commit 775f1f7eacede583ec25ed56e58c4483f2b29265 Author: Max Filippov Date: Mon Nov 5 17:16:21 2018 -0800 xtensa: virt: add defconfig and DTS Add defconfig and DTS for a virt board. Defconfig enables PCIe host and a number of virtio devices. DTS routes legacy PCI IRQs to the first four level-triggered external IRQ lines. CPU core with edge-triggered IRQs among the first four may need a custom DTS to work correctly. Signed-off-by: Max Filippov commit 5c68b8231e9c361fc3dc96997ea377b31c4dbd3e Author: Masahiro Yamada Date: Thu May 30 19:39:27 2019 +0900 of/fdt: pass early_init_dt_reserve_memory_arch() with bool type nomap The third argument 'nomap' of early_init_dt_reserve_memory_arch() is bool. It is preferred to pass it with a bool type parameter. Signed-off-by: Masahiro Yamada Reviewed-by: Frank Rowand Signed-off-by: Rob Herring commit 15ffe5e1acf5fe1512e98b20702e46ce9f25e2f7 Author: Christoph Hellwig Date: Mon Jul 8 12:55:27 2019 -0700 dma-mapping: mark dma_alloc_need_uncached as __always_inline Without the __always_inline at least i386 configs that have CONFIG_OPTIMIZE_INLINING set seem fail to inline dma_alloc_need_uncached, leading to a linker error because of undefined symbols. Reported-by: Randy Dunlap Signed-off-by: Christoph Hellwig Acked-by: Randy Dunlap # build-tested commit 454f96f2b738374da4b0a703b1e2e7aed82c4486 Author: Mauro Carvalho Chehab Date: Sat Jul 6 13:28:42 2019 -0300 docs: automarkup.py: ignore exceptions when seeking for xrefs When using the automarkup extension with: make pdfdocs without passing an specific book, the code will raise an exception: File "/devel/v4l/docs/Documentation/sphinx/automarkup.py", line 86, in auto_markup node.parent.replace(node, markup_funcs(name, app, node)) File "/devel/v4l/docs/Documentation/sphinx/automarkup.py", line 59, in markup_funcs 'function', target, pxref, lit_text) File "/devel/v4l/docs/sphinx_2.0/lib/python3.7/site-packages/sphinx/domains/c.py", line 308, in resolve_xref contnode, target) File "/devel/v4l/docs/sphinx_2.0/lib/python3.7/site-packages/sphinx/util/nodes.py", line 450, in make_refnode '#' + targetid) File "/devel/v4l/docs/sphinx_2.0/lib/python3.7/site-packages/sphinx/builders/latex/__init__.py", line 159, in get_relative_uri return self.get_target_uri(to, typ) File "/devel/v4l/docs/sphinx_2.0/lib/python3.7/site-packages/sphinx/builders/latex/__init__.py", line 152, in get_target_uri raise NoUri sphinx.environment.NoUri This happens because not all references will belong to a single PDF/LaTeX document. Better to just ignore those than breaking Sphinx build. Fixes: d74b0d31ddde ("Docs: An initial automarkup extension for sphinx") Signed-off-by: Mauro Carvalho Chehab [jc: Narrowed the "except" and tweaked the comment] Signed-off-by: Jonathan Corbet commit 66f2a122c68d8f13e5db978b6b7571aaf0e53a19 Author: Matthew Wilcox (Oracle) Date: Tue Jul 2 13:54:38 2019 -0400 docs: Move binderfs to admin-guide The documentation is more appropriate for the administrator than for the internal kernel API section it is currently in. Signed-off-by: Matthew Wilcox (Oracle) Acked-by: Christian Brauner Signed-off-by: Jonathan Corbet commit d88590dc262f90d260e97b85ca50c992931457d4 Author: Geert Uytterhoeven Date: Mon Jun 24 14:46:20 2019 +0200 of/platform: Drop superfluous cast in of_device_make_bus_id() There is no need to cast "u64" to "unsigned long long" before printing it, as both types have been made identical on all architectures many years ago. Signed-off-by: Geert Uytterhoeven Signed-off-by: Rob Herring commit 7a54f78d9387b75d8e64bac18e84cd65f639121f Author: Parav Pandit Date: Thu Jul 4 16:04:01 2019 +0300 IB/core: Work on the caller socket net namespace in nldev_newlink() While creating new RDMA devices based on netdevice name, consider the net namespace of the caller skb's socket similar to rest of the doit() callbacks and nldev_dellink() which deletes the RDMA device created using nldev_newlink(). Fixes: 3856ec4b93c94 ("RDMA/core: Add RDMA_NLDEV_CMD_NEWLINK/DELLINK support") Signed-off-by: Parav Pandit Signed-off-by: Leon Romanovsky Reviewed-by: Jason Gunthorpe Signed-off-by: Jason Gunthorpe commit dd006fc434e107ef90f7de0db9907cbc1c521645 Author: Yang Wei Date: Mon Jul 8 22:57:39 2019 +0800 nfc: fix potential illegal memory access The frags_q is not properly initialized, it may result in illegal memory access when conn_info is NULL. The "goto free_exit" should be replaced by "goto exit". Signed-off-by: Yang Wei Signed-off-by: David S. Miller commit 49db9228b8d83cbdef44b4757a393990f48b6d85 Author: Arnd Bergmann Date: Mon Jul 8 14:48:23 2019 +0200 macb: fix build warning for !CONFIG_OF When CONFIG_OF is disabled, we get a harmless warning about the newly added variable: drivers/net/ethernet/cadence/macb_main.c:48:39: error: 'mgmt' defined but not used [-Werror=unused-variable] static struct sifive_fu540_macb_mgmt *mgmt; Move the variable closer to its use inside of the #ifdef. Fixes: c218ad559020 ("macb: Add support for SiFive FU540-C000") Signed-off-by: Arnd Bergmann Signed-off-by: David S. Miller commit 0287f9ed1693fff26a2d568a9d3f74c2b198540c Author: Arnd Bergmann Date: Mon Jul 8 14:43:39 2019 +0200 gve: fix unused variable/label warnings On unusual page sizes, we get harmless warnings: drivers/net/ethernet/google/gve/gve_rx.c:283:6: error: unused variable 'pagecount' [-Werror,-Wunused-variable] drivers/net/ethernet/google/gve/gve_rx.c:336:1: error: unused label 'have_skb' [-Werror,-Wunused-label] Change the preprocessor #if to regular if() to avoid this. Fixes: f5cedc84a30d ("gve: Add transmit and receive support") Signed-off-by: Arnd Bergmann Signed-off-by: David S. Miller commit bdce1290493caa3f8119f24b5dacc3fb7ca27389 Author: Konstantin Taranov Date: Thu Jun 27 16:06:43 2019 +0200 RDMA/rxe: Fill in wc byte_len with IB_WC_RECV_RDMA_WITH_IMM Calculate the correct byte_len on the receiving side when a work completion is generated with IB_WC_RECV_RDMA_WITH_IMM opcode. According to the IBA byte_len must indicate the number of written bytes, whereas it was always equal to zero for the IB_WC_RECV_RDMA_WITH_IMM opcode, even though data was transferred. Fixes: 8700e3e7c485 ("Soft RoCE driver") Signed-off-by: Konstantin Taranov Signed-off-by: Jason Gunthorpe commit 96e2fd733b9af304edcf30ef922dcaa4d3e1bfa6 Author: Leon Romanovsky Date: Mon Jul 8 13:59:05 2019 +0300 RDMA/mlx5: Set RDMA DIM to be enabled by default Enable RDMA DIM by default for better user experience. Signed-off-by: Leon Romanovsky Signed-off-by: Jason Gunthorpe commit f8fc8cd9c612c31f92b19b72f619fa043ec76e5e Author: Yamin Friedman Date: Mon Jul 8 13:59:04 2019 +0300 RDMA/nldev: Added configuration of RDMA dynamic interrupt moderation to netlink Added parameter in ib_device for enabling dynamic interrupt moderation so that it can be configured in userspace using rdma tool. In order to set adaptive-moderation for an ib device the command is: rdma dev set [DEV] adaptive-moderation [on|off] Please set on/off. rdma dev show 0: mlx5_0: node_type ca fw 16.26.0055 node_guid 248a:0703:00a5:29d0 sys_image_guid 248a:0703:00a5:29d0 adaptive-moderation on rdma resource show cq dev mlx5_0 cqn 0 cqe 1023 users 4 poll-ctx UNBOUND_WORKQUEUE adaptive-moderation off comm [ib_core] Signed-off-by: Yamin Friedman Reviewed-by: Sagi Grimberg Signed-off-by: Leon Romanovsky Signed-off-by: Jason Gunthorpe commit da6629793aa6944db6c8a908ca1a52d87f1489aa Author: Yamin Friedman Date: Mon Jul 8 13:59:03 2019 +0300 RDMA/core: Provide RDMA DIM support for ULPs Added the interface in the infiniband driver that applies the rdma_dim adaptive moderation. There is now a special function for allocating an ib_cq that uses rdma_dim. Performance improvement (ConnectX-5 100GbE, x86) running FIO benchmark over NVMf between two equal end-hosts with 56 cores across a Mellanox switch using null_blk device: READS without DIM: blk size | BW | IOPS | 99th percentile latency | 99.99th latency 512B | 3.8GiB/s | 7.7M | 1401 usec | 2442 usec 4k | 7.0GiB/s | 1.8M | 4817 usec | 6587 usec 64k | 10.7GiB/s| 175k | 9896 usec | 10028 usec IO WRITES without DIM: blk size | BW | IOPS | 99th percentile latency | 99.99th latency 512B | 3.6GiB/s | 7.5M | 1434 usec | 2474 usec 4k | 6.3GiB/s | 1.6M | 938 usec | 1221 usec 64k | 10.7GiB/s| 175k | 8979 usec | 12780 usec IO READS with DIM: blk size | BW | IOPS | 99th percentile latency | 99.99th latency 512B | 4GiB/s | 8.2M | 816 usec | 889 usec 4k | 10.1GiB/s| 2.65M| 3359 usec | 5080 usec 64k | 10.7GiB/s| 175k | 9896 usec | 10028 usec IO WRITES with DIM: blk size | BW | IOPS | 99th percentile latency | 99.99th latency 512B | 3.9GiB/s | 8.1M | 799 usec | 922 usec 4k | 9.6GiB/s | 2.5M | 717 usec | 1004 usec 64k | 10.7GiB/s| 176k | 8586 usec | 12256 usec The rdma_dim algorithm was designed to measure the effectiveness of moderation on the flow in a general way and thus should be appropriate for all RDMA storage protocols. rdma_dim is configured to be the default option based on performance improvement seen after extensive tests. Signed-off-by: Yamin Friedman Reviewed-by: Max Gurtovoy Reviewed-by: Sagi Grimberg Signed-off-by: Saeed Mahameed Signed-off-by: Leon Romanovsky Signed-off-by: Jason Gunthorpe commit f4915455dcf07c4f237d6160a4b6adb0575d2909 Author: Yamin Friedman Date: Mon Jul 8 13:59:02 2019 +0300 linux/dim: Implement RDMA adaptive moderation (DIM) RDMA DIM implements a different algorithm from net DIM and is based on completions which is how we can implement interrupt moderation in RDMA. The algorithm optimizes for number of completions and ratio between completions and events. In order to avoid long latencies, the implementation performs fast reduction of moderation level when the traffic changes. Signed-off-by: Yamin Friedman Reviewed-by: Max Gurtovoy Reviewed-by: Sagi Grimberg Signed-off-by: Saeed Mahameed Signed-off-by: Leon Romanovsky Signed-off-by: Jason Gunthorpe commit 2ef38e380ea6a80fed5be21e9f7af31c02dea09e Merge: 89705e927001 398c2b05bbee Author: Jason Gunthorpe Date: Mon Jul 8 14:58:59 2019 -0300 Merge tag 'blk-dim-v2' into rdma.git for-next Generic DIM From: Tal Gilboa and Yamin Fridman Implement net DIM over a generic DIM library, add RDMA DIM dim.h lib exposes an implementation of the DIM algorithm for dynamically-tuned interrupt moderation for networking interfaces. We want a similar functionality for other protocols, which might need to optimize interrupts differently. Main motivation here is DIM for NVMf storage protocol. Current DIM implementation prioritizes reducing interrupt overhead over latency. Also, in order to reduce DIM's own overhead, the algorithm might take some time to identify it needs to change profiles. While this is acceptable for networking, it might not work well on other scenarios. Here we propose a new structure to DIM. The idea is to allow a slightly modified functionality without the risk of breaking Net DIM behavior for netdev. We verified there are no degradations in current DIM behavior with the modified solution. Suggested solution: - Common logic is implemented in lib/dim/dim.c - Net DIM (existing) logic is implemented in lib/dim/net_dim.c, which uses the common logic in dim.c - Any new DIM logic will be implemented in "lib/dim/new_dim.c". This new implementation will expose modified versions of profiles, dim_step() and dim_decision(). - DIM API is declared in include/linux/dim.h for all implementations. Pros for this solution are: - Zero impact on existing net_dim implementation and usage - Relatively more code reuse (compared to two separate solutions) - Increased extensibility Required for dependencies in the next series. Signed-off-by: Jason Gunthorpe commit 4993e5b37e8bcb55ac90f76eb6d2432647273747 Author: Jose Abreu Date: Mon Jul 8 14:26:28 2019 +0200 net: stmmac: Re-work the queue selection for TSO packets Ben Hutchings says: "This is the wrong place to change the queue mapping. stmmac_xmit() is called with a specific TX queue locked, and accessing a different TX queue results in a data race for all of that queue's state. I think this commit should be reverted upstream and in all stable branches. Instead, the driver should implement the ndo_select_queue operation and override the queue mapping there." Fixes: c5acdbee22a1 ("net: stmmac: Send TSO packets always from Queue 0") Suggested-by: Ben Hutchings Signed-off-by: Jose Abreu Signed-off-by: David S. Miller commit 5f65ae344f1493c9c6f0a1748da4ce3af71ab541 Author: Arnd Bergmann Date: Mon Jul 8 15:52:08 2019 +0200 drm/amd/display: avoid 64-bit division On 32-bit architectures, dividing a 64-bit integer in the kernel leads to a link error: ERROR: "__udivdi3" [drivers/gpu/drm/amd/amdgpu/amdgpu.ko] undefined! ERROR: "__divdi3" [drivers/gpu/drm/amd/amdgpu/amdgpu.ko] undefined! Change the two recently introduced instances to a multiply+shift operation that is also much cheaper on 32-bit architectures. We can do that here, since both of them are really 32-bit numbers that change a few percent. Fixes: bedbbe6af4be ("drm/amd/display: Move link functions from dc to dc_link") Fixes: f18bc4e53ad6 ("drm/amd/display: update calculated bounding box logic for NV") Acked-by: Slava Abramov Tested-by: Slava Abramov Signed-off-by: Arnd Bergmann Signed-off-by: Alex Deucher commit 223cea6a4f0552b86fb25e3b8bbd00469816cd7a Merge: 2f0f6503e375 993773d11d45 Author: Linus Torvalds Date: Mon Jul 8 12:23:00 2019 -0700 Merge branch 'x86-pti-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 pti updates from Thomas Gleixner: "The speculative paranoia departement delivers a few more plugs for possible (probably theoretical) spectre/mds leaks" * 'x86-pti-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/tls: Fix possible spectre-v1 in do_get_thread_area() x86/ptrace: Fix possible spectre-v1 in ptrace_get_debugreg() x86/speculation/mds: Eliminate leaks by trace_hardirqs_on() commit 05cfee98c8a5187c41978967d34ab5ef0353c0f8 Author: Martin Habets Date: Mon Jul 8 12:07:11 2019 +0100 sfc: Remove 'PCIE error reporting unavailable' This is only at notice level but it was pointed out that no other driver does this. Also there is no action the user can take as it is really a property of the server. Signed-off-by: Martin Habets Signed-off-by: David S. Miller commit 2f0f6503e37551eb8d8d5e4d27c78d28a30fed5a Merge: 13324c42c140 e44252f4fe79 Author: Linus Torvalds Date: Mon Jul 8 12:16:40 2019 -0700 Merge branch 'x86-timers-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 timer updates from Thomas Gleixner: "A rather large series consolidating the HPET code, which was triggered by the attempt to bolt HPET NMI watchdog support on to the existing maze with the usual duct tape and super glue approach. This mainly removes two separate partially redundant storage layers and consolidates them into a single one which provides a consistent view of the different HPET channels and their usage and allows to integrate HPET NMI watchdog support (if it turns out to be feasible) in a non intrusive way" * 'x86-timers-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (29 commits) x86/hpet: Use channel for legacy clockevent storage x86/hpet: Use common init for legacy clockevent x86/hpet: Carve out shareable parts of init_one_hpet_msi_clockevent() x86/hpet: Consolidate clockevent functions x86/hpet: Wrap legacy clockevent in hpet_channel x86/hpet: Use cached info instead of extra flags x86/hpet: Move clockevents into channels x86/hpet: Rename variables to prepare for switching to channels x86/hpet: Add function to select a /dev/hpet channel x86/hpet: Add mode information to struct hpet_channel x86/hpet: Use cached channel data x86/hpet: Introduce struct hpet_base and struct hpet_channel x86/hpet: Coding style cleanup x86/hpet: Clean up comments x86/hpet: Make naming consistent x86/hpet: Remove not required includes x86/hpet: Decapitalize and rename EVT_TO_HPET_DEV x86/hpet: Simplify counter validation x86/hpet: Separate counter check out of clocksource register code x86/hpet: Shuffle code around for readability sake ... commit 47cfb90406e1d8de4007e781155884ff10bb40d3 Merge: bfb204129a5a 0ef1efd1354d Author: David S. Miller Date: Mon Jul 8 12:13:38 2019 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next Pablo Neira Ayuso says: ==================== Netfilter/IPVS updates for net-next The following patchset contains Netfilter/IPVS updates for net-next: 1) Move bridge keys in nft_meta to nft_meta_bridge, from wenxu. 2) Support for bridge pvid matching, from wenxu. 3) Support for bridge vlan protocol matching, also from wenxu. 4) Add br_vlan_get_pvid_rcu(), to fetch the bridge port pvid from packet path. 5) Prefer specific family extension in nf_tables. 6) Autoload specific family extension in case it is missing. 7) Add synproxy support to nf_tables, from Fernando Fernandez Mancera. 8) Support for GRE encapsulation in IPVS, from Vadim Fedorenko. 9) ICMP handling for GRE encapsulation, from Julian Anastasov. 10) Remove unused parameter in nf_queue, from Florian Westphal. 11) Replace seq_printf() by seq_puts() in nf_log, from Markus Elfring. 12) Rename nf_SYNPROXY.h => nf_synproxy.h before this header becomes public. ==================== Signed-off-by: David S. Miller commit 173da95d936fe3121d201565ff754988f72b6f56 Author: Alex Deucher Date: Mon Jul 8 14:01:30 2019 -0500 drm/amdgpu/psp11: simplify the ucode register logic Split it between navi10 and newer and everything before navi10. Reviewed-by: Xiaojie Yuan Signed-off-by: Alex Deucher commit ee8a84c60bcc1f1615bd9cb3edfe501e26cdc85b Author: Mathieu Desnoyers Date: Sun Jun 30 09:56:13 2019 -0400 rseq/selftests: Fix Thumb mode build failure on arm32 Using ".arm .inst" for the arm signature introduces build issues for programs compiled in Thumb mode because the assembler stays in the arm mode for the rest of the inline assembly. Revert to using a ".word" to express the signature as data instead. The choice of signature is a valid trap instruction on arm32 little endian, where both code and data are little endian. ARMv6+ big endian (BE8) generates mixed endianness code vs data: little-endian code and big-endian data. The data value of the signature needs to have its byte order reversed to generate the trap instruction. Prior to ARMv6, -mbig-endian generates big-endian code and data (which match), so the endianness of the data representation of the signature should not be reversed. However, the choice between BE32 and BE8 is done by the linker, so we cannot know whether code and data endianness will be mixed before the linker is invoked. So rather than try to play tricks with the linker, the rseq signature is simply data (not a trap instruction) prior to ARMv6 on big endian. This is why the signature is expressed as data (.word) rather than as instruction (.inst) in assembler. Because a ".word" is used to emit the signature, it will be interpreted as a literal pool by a disassembler, not as an actual instruction. Considering that the signature is not meant to be executed except in scenarios where the program execution is completely bogus, this should not be an issue. Signed-off-by: Mathieu Desnoyers Acked-by: Will Deacon CC: Peter Zijlstra CC: Thomas Gleixner CC: Joel Fernandes CC: Catalin Marinas CC: Dave Watson CC: Will Deacon CC: Shuah Khan CC: Andi Kleen CC: linux-kselftest@vger.kernel.org CC: "H . Peter Anvin" CC: Chris Lameter CC: Russell King CC: Michael Kerrisk CC: "Paul E . McKenney" CC: Paul Turner CC: Boqun Feng CC: Josh Triplett CC: Steven Rostedt CC: Ben Maurer CC: linux-api@vger.kernel.org CC: Andy Lutomirski CC: Andrew Morton CC: Linus Torvalds CC: Carlos O'Donell CC: Florian Weimer Signed-off-by: Shuah Khan commit 13324c42c1401ad838208ee1e98f3821fce1cd86 Merge: ab2486a9ee32 049331f277fe Author: Linus Torvalds Date: Mon Jul 8 11:59:59 2019 -0700 Merge branch 'x86-cpu-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 CPU feature updates from Thomas Gleixner: "Updates for x86 CPU features: - Support for UMWAIT/UMONITOR, which allows to use MWAIT and MONITOR instructions in user space to save power e.g. in HPC workloads which spin wait on synchronization points. The maximum time a MWAIT can halt in userspace is controlled by the kernel and can be adjusted by the sysadmin. - Speed up the MTRR handling code on CPUs which support cache self-snooping correctly. On those CPUs the wbinvd() invocations can be omitted which speeds up the MTRR setup by a factor of 50. - Support for the new x86 vendor Zhaoxin who develops processors based on the VIA Centaur technology. - Prevent 'cat /proc/cpuinfo' from affecting isolated NOHZ_FULL CPUs by sending IPIs to retrieve the CPU frequency and use the cached values instead. - The addition and late revert of the FSGSBASE support. The revert was required as it turned out that the code still has hard to diagnose issues. Yet another engineering trainwreck... - Small fixes, cleanups, improvements and the usual new Intel CPU family/model addons" * 'x86-cpu-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (41 commits) x86/fsgsbase: Revert FSGSBASE support selftests/x86/fsgsbase: Fix some test case bugs x86/entry/64: Fix and clean up paranoid_exit x86/entry/64: Don't compile ignore_sysret if 32-bit emulation is enabled selftests/x86: Test SYSCALL and SYSENTER manually with TF set x86/mtrr: Skip cache flushes on CPUs with cache self-snooping x86/cpu/intel: Clear cache self-snoop capability in CPUs with known errata Documentation/ABI: Document umwait control sysfs interfaces x86/umwait: Add sysfs interface to control umwait maximum time x86/umwait: Add sysfs interface to control umwait C0.2 state x86/umwait: Initialize umwait control values x86/cpufeatures: Enumerate user wait instructions x86/cpu: Disable frequency requests via aperfmperf IPI for nohz_full CPUs x86/acpi/cstate: Add Zhaoxin processors support for cache flush policy in C3 ACPI, x86: Add Zhaoxin processors support for NONSTOP TSC x86/cpu: Create Zhaoxin processors architecture support file x86/cpu: Split Tremont based Atoms from the rest Documentation/x86/64: Add documentation for GS/FS addressing mode x86/elf: Enumerate kernel FSGSBASE capability in AT_HWCAP2 x86/cpu: Enable FSGSBASE on 64bit by default and add a chicken bit ... commit f8a7976b75f608687bf01b59518777642ff7c4e2 Author: Alex Deucher Date: Fri Jul 5 15:39:39 2019 -0500 drm/amdgpu: properly guard DC support in navi code Need to add appropriate ifdef. Acked-by: Leo Li Reviewed-by: Nicholas Kazlauskas Signed-off-by: Alex Deucher commit de48ebdd5b0a582f870778271ad9dbfa663d65cc Author: Arnd Bergmann Date: Mon Jul 8 16:07:59 2019 +0200 drm/amd/powerplay: vega20: fix uninitialized variable use If smu_get_current_rpm() fails, we can't use the output, as that may be uninitialized: drivers/gpu/drm/amd/amdgpu/../powerplay/vega20_ppt.c:3023:8: error: variable 'current_rpm' is used uninitialized whenever '?:' condition is false [-Werror,-Wsometimes-uninitialized] ret = smu_get_current_rpm(smu, ¤t_rpm); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/gpu/drm/amd/amdgpu/../powerplay/inc/amdgpu_smu.h:735:3: note: expanded from macro 'smu_get_current_rpm' ((smu)->funcs->get_current_rpm ? (smu)->funcs->get_current_rpm((smu), (speed)) : 0) ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/gpu/drm/amd/amdgpu/../powerplay/vega20_ppt.c:3024:12: note: uninitialized use occurs here percent = current_rpm * 100 / pptable->FanMaximumRpm; ^~~~~~~~~~~ drivers/gpu/drm/amd/amdgpu/../powerplay/vega20_ppt.c:3023:8: note: remove the '?:' if its condition is always true ret = smu_get_current_rpm(smu, ¤t_rpm); ^ drivers/gpu/drm/amd/amdgpu/../powerplay/inc/amdgpu_smu.h:735:3: note: expanded from macro 'smu_get_current_rpm' ((smu)->funcs->get_current_rpm ? (smu)->funcs->get_current_rpm((smu), (speed)) : 0) ^ drivers/gpu/drm/amd/amdgpu/../powerplay/vega20_ppt.c:3020:22: note: initialize the variable 'current_rpm' to silence this warning uint32_t current_rpm; Propagate the error code in that case. Fixes: ee0db82027ee ("drm/amd/powerplay: move PPTable_t uses into asic level") Signed-off-by: Arnd Bergmann Signed-off-by: Alex Deucher commit c602b36fe245f2114153f6690d1222ce1a51e942 Author: Arnd Bergmann Date: Mon Jul 8 15:53:18 2019 +0200 drm/amd/display: dcn20: include linux/delay.h Without this header, we get a compiler error in some configurations: .../dc/dcn20/dcn20_hwseq.c: In function 'dcn20_hwss_wait_for_blank_complete': .../dc/dcn20/dcn20_hwseq.c:1493:3: error: implicit declaration of function 'udelay' [-Werror=implicit-function-declaration] Note: the use of udelay itself may be problematic, as can occupy the CPU for 200ms in a busy-loop here. Fixes: 7ed4e6352c16 ("drm/amd/display: Add DCN2 HW Sequencer and Resource") Signed-off-by: Arnd Bergmann Signed-off-by: Alex Deucher commit d155bef0636e019418ef5a69cafce129cc202b78 Author: Arnd Bergmann Date: Mon Jul 8 16:41:43 2019 +0200 amdgpu: make pmu support optional When CONFIG_PERF_EVENTS is disabled, we cannot compile the pmu portion of the amdgpu driver: drivers/gpu/drm/amd/amdgpu/amdgpu_pmu.c:48:38: error: no member named 'hw' in 'struct perf_event' struct hw_perf_event *hwc = &event->hw; ~~~~~ ^ drivers/gpu/drm/amd/amdgpu/amdgpu_pmu.c:51:13: error: no member named 'attr' in 'struct perf_event' if (event->attr.type != event->pmu->type) ~~~~~ ^ ... Use conditional compilation for this file. Fixes: 9c7c85f7ea1f ("drm/amdgpu: add pmu counters") Signed-off-by: Arnd Bergmann Signed-off-by: Alex Deucher commit 985863d00a8feb597a38df38f8fc2f70e980156f Author: Nathan Chancellor Date: Wed Jul 3 22:52:18 2019 -0700 drm/amd/powerplay: Zero initialize current_rpm in vega20_get_fan_speed_percent clang warns (trimmed for brevity): drivers/gpu/drm/amd/amdgpu/../powerplay/vega20_ppt.c:3023:8: warning: variable 'current_rpm' is used uninitialized whenever '?:' condition is false [-Wsometimes-uninitialized] ret = smu_get_current_rpm(smu, ¤t_rpm); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ smu_get_current_rpm expands to a ternary operator conditional on smu->funcs->get_current_rpm being not NULL. When this is false, current_rpm will be uninitialized. Zero initialize current_rpm to avoid using random stack values if that ever happens. Fixes: ee0db82027ee ("drm/amd/powerplay: move PPTable_t uses into asic level") Link: https://github.com/ClangBuiltLinux/linux/issues/588 Signed-off-by: Nathan Chancellor Signed-off-by: Alex Deucher commit 68c3bd95018130d1cb34e77f6ba283b19cbb61ea Author: Nathan Chancellor Date: Wed Jul 3 22:52:15 2019 -0700 drm/amd/powerplay: Zero initialize freq in smu_v11_0_get_current_clk_freq clang warns (trimmed for brevity): drivers/gpu/drm/amd/amdgpu/../powerplay/smu_v11_0.c:1098:10: warning: variable 'freq' is used uninitialized whenever '?:' condition is false [-Wsometimes-uninitialized] ret = smu_get_current_clk_freq_by_table(smu, clk_id, &freq); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ If get_current_clk_freq_by_table is ever NULL, freq will fail to be properly initialized. Zero initialize it to avoid using uninitialized stack values. smu_get_current_clk_freq_by_table expands to a ternary operator conditional on smu->funcs->get_current_clk_freq_by_table being not NULL. When this is false, freq will be uninitialized. Zero initialize freq to avoid using random stack values if that ever happens. Fixes: e36182490dec ("drm/amd/powerplay: fix dpm freq unit error (10KHz -> Mhz)") Link: https://github.com/ClangBuiltLinux/linux/issues/585 Signed-off-by: Nathan Chancellor Signed-off-by: Alex Deucher commit d693e8e349a8fca2539b22af47cfbc37c4fb1528 Author: Nathan Chancellor Date: Wed Jul 3 22:52:13 2019 -0700 drm/amd/powerplay: Use memset to initialize metrics structs clang warns: drivers/gpu/drm/amd/amdgpu/../powerplay/navi10_ppt.c:601:33: warning: suggest braces around initialization of subobject [-Wmissing-braces] static SmuMetrics_t metrics = {0}; ^ {} drivers/gpu/drm/amd/amdgpu/../powerplay/navi10_ppt.c:905:26: warning: suggest braces around initialization of subobject [-Wmissing-braces] SmuMetrics_t metrics = {0}; ^ {} 2 warnings generated. One way to fix these warnings is to add additional braces like clang suggests; however, there has been a bit of push back from some maintainers[1][2], who just prefer memset as it is unambiguous, doesn't depend on a particular compiler version[3], and properly initializes all subobjects. Do that here so there are no more warnings. [1]: https://lore.kernel.org/lkml/022e41c0-8465-dc7a-a45c-64187ecd9684@amd.com/ [2]: https://lore.kernel.org/lkml/20181128.215241.702406654469517539.davem@davemloft.net/ [3]: https://lore.kernel.org/lkml/20181116150432.2408a075@redhat.com/ Fixes: 98e1a543c7b1 ("drm/amd/powerplay: add function get current clock freq interface for navi10") Fixes: ab43c4bf1cc8 ("drm/amd/powerplay: fix fan speed show error (for hwmon pwm)") Link: https://github.com/ClangBuiltLinux/linux/issues/583 Signed-off-by: Nathan Chancellor Signed-off-by: Alex Deucher commit f19367da96077ceaeeb5cebb97c4b6cf58b60802 Author: Nathan Chancellor Date: Wed Jul 3 22:52:12 2019 -0700 drm/amdgpu/mes10.1: Fix header guard clang warns: In file included from drivers/gpu/drm/amd/amdgpu/nv.c:53: drivers/gpu/drm/amd/amdgpu/../amdgpu/mes_v10_1.h:24:9: warning: '__MES_V10_1_H__' is used as a header guard here, followed by #define of a different macro [-Wheader-guard] #ifndef __MES_V10_1_H__ ^~~~~~~~~~~~~~~ drivers/gpu/drm/amd/amdgpu/../amdgpu/mes_v10_1.h:25:9: note: '__MES_v10_1_H__' is defined here; did you mean '__MES_V10_1_H__'? #define __MES_v10_1_H__ ^~~~~~~~~~~~~~~ __MES_V10_1_H__ 1 warning generated. Capitalize the V. Fixes: 886f82aa7a1d ("drm/amdgpu/mes10.1: add ip block mes10.1 (v2)") Link: https://github.com/ClangBuiltLinux/linux/issues/582 Signed-off-by: Nathan Chancellor Signed-off-by: Alex Deucher commit e5aa29ce23ba7a3dc0cb534cb71de444c223188d Author: Kevin Wang Date: Thu Jul 4 10:56:18 2019 +0800 drm/amd/powerplay: add temperature sensor support for navi10 the hwmon interface need temperature sensor type support. 1. SENSOR_HOTSPOT_TEMP 2. SENSOR_EDGE_TEMP(SENSOR_GPU_TEMP) 3. SENSOR_MEM_TEMP Signed-off-by: Kevin Wang Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher commit 71cc9ef3f694ccd70ae929ad827da8b630b269c9 Author: Flora Cui Date: Mon Jun 24 16:48:33 2019 +0800 drm/amdgpu: fix scheduler timeout calc scheduler timeout is in jiffies v2: move timeout check to amdgpu_device_get_job_timeout_settings after parsing the value v3: add lockup_timeout param check. 0: keep default value. negative: infinity timeout. v4: refactor codes. Signed-off-by: Flora Cui Reviewed-by: Feifei Xu Signed-off-by: Alex Deucher commit e5eaa7cc0c0359cfe17b0027a6ac5eda7a9635db Author: Philip Yang Date: Tue Jul 2 18:39:45 2019 -0400 drm/amdgpu: Prepare for hmm_range_register API change (v2) An upcoming change in the hmm_range_register API requires passing in a pointer to an hmm_mirror instead of mm_struct. To access the hmm_mirror we need pass bo instead of ttm to amdgpu_ttm_tt_get_user_pages because mirror is part of amdgpu_mn structure, which is accessible from bo. v2: fix building without CONFIG_HMM_MIRROR (Arnd) Signed-off-by: Philip Yang Signed-off-by: Felix Kuehling Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher commit bfb204129a5adeb8eb62d693e97047ae6c8f37fd Author: Ilias Apalodimas Date: Mon Jul 8 10:25:41 2019 +0300 net: netsec: Sync dma for device on buffer allocation cd1973a9215a ("net: netsec: Sync dma for device on buffer allocation") was merged on it's v1 instead of the v3. Merge the proper patch version Signed-off-by: Ilias Apalodimas Signed-off-by: David S. Miller commit 053bc5764bb0a84ef0b26a8e4ddd3e2f4b4f8215 Author: Sebastian Andrzej Siewior Date: Thu Jul 4 17:38:01 2019 +0200 watchdog: ie6xx_wdt: Use spinlock_t instead of struct spinlock For spinlocks the type spinlock_t should be used instead of "struct spinlock". Use spinlock_t for spinlock's definition. Cc: Wim Van Sebroeck Cc: Guenter Roeck Cc: linux-watchdog@vger.kernel.org Signed-off-by: Sebastian Andrzej Siewior Reviewed-by: Guenter Roeck Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit ab2486a9ee3243c8342549f58a13cdfa9abb497a Merge: 0d37dde70655 7891bc0ab739 Author: Linus Torvalds Date: Mon Jul 8 11:45:26 2019 -0700 Merge branch 'x86-fpu-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 FPU updates from Thomas Gleixner: "A small set of updates for the FPU code: - Make the no387/nofxsr command line options useful by restricting them to 32bit and actually clearing all dependencies to prevent random crashes and malfunction. - Simplify and cleanup the kernel_fpu_*() helpers" * 'x86-fpu-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/fpu: Inline fpu__xstate_clear_all_cpu_caps() x86/fpu: Make 'no387' and 'nofxsr' command line options useful x86/fpu: Remove the fpu__save() export x86/fpu: Simplify kernel_fpu_begin() x86/fpu: Simplify kernel_fpu_end() commit 0d37dde70655be73575d011be1bffaf0e3b16ea9 Merge: 0902d5011cfa 7f0a5e075583 Author: Linus Torvalds Date: Mon Jul 8 11:42:09 2019 -0700 Merge branch 'x86-entry-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 vsyscall updates from Thomas Gleixner: "Further hardening of the legacy vsyscall by providing support for execute only mode and switching the default to it. This prevents a certain class of attacks which rely on the vsyscall page being accessible at a fixed address in the canonical kernel address space" * 'x86-entry-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: selftests/x86: Add a test for process_vm_readv() on the vsyscall page x86/vsyscall: Add __ro_after_init to global variables x86/vsyscall: Change the default vsyscall mode to xonly selftests/x86/vsyscall: Verify that vsyscall=none blocks execution x86/vsyscall: Document odd SIGSEGV error code for vsyscalls x86/vsyscall: Show something useful on a read fault x86/vsyscall: Add a new vsyscall=xonly mode Documentation/admin: Remove the vsyscall=native documentation commit 8d209eb0b167ac6998ef330150a3960032a31c50 Author: Ken Sloat Date: Fri Jun 14 12:53:22 2019 +0000 watchdog: atmel: atmel-sama5d4-wdt: Disable watchdog on system suspend Currently, the atmel-sama5d4-wdt continues to run after system suspend. Unless the system resumes within the watchdog timeout period so the userspace can kick it, the system will be reset. This change disables the watchdog on suspend if it is active and re-enables on resume. These actions occur during the late and early phases of suspend and resume respectively to minimize chances where a lock could occur while the watchdog is disabled. Signed-off-by: Ken Sloat Acked-by: Alexandre Belloni Reviewed-by: Guenter Roeck Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit d0173278935a9c7ea268cc8baa8b669ecb57c0e3 Author: Guenter Roeck Date: Thu Jun 20 09:28:46 2019 -0700 watchdog: convert remaining drivers to use SPDX license identifier This gets rid of the unnecessary license boilerplate, and avoids having to deal with individual patches one by one. No functional changes. Reviewed-by: Jerry Hoemann Acked-by: Sylvain Lemieux Reviewed-by: Matthias Brugger Acked-by: William Breathitt Gray Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 3265c3d8f70f0cb98dc7a7a3865200a7b19f654b Author: Simon Horman Date: Mon Jun 17 11:09:53 2019 +0200 dt-bindings: watchdog: Rename bindings documentation file For consistency with the naming of (most) other documentation files for DT bindings for Renesas IP blocks rename the Renesas WDT documentation file from renesas-wdt.txt to renesas,wdt.txt. Signed-off-by: Simon Horman Reviewed-by: Niklas Söderlund Reviewed-by: Guenter Roeck Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 64079cf9f2b2f93779c1d9772d0e1f5c04bd4d22 Author: Greg Kroah-Hartman Date: Tue Jun 18 17:58:30 2019 +0200 watchdog: mei_wdt: no need to check return value of debugfs_create functions When calling debugfs functions, there is no need to ever check the return value. The function can work or not, but the code logic should never do something different based on this. Cc: Tomas Winkler Cc: Wim Van Sebroeck Cc: Guenter Roeck Cc: linux-watchdog@vger.kernel.org Signed-off-by: Greg Kroah-Hartman Reviewed-by: Guenter Roeck Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 1dbb3bb8de88dbca78556684e79a0f10f7da3d00 Author: Greg Kroah-Hartman Date: Tue Jun 18 17:58:09 2019 +0200 watchdog: bcm_kona_wdt: no need to check return value of debugfs_create functions When calling debugfs functions, there is no need to ever check the return value. The function can work or not, but the code logic should never do something different based on this. Cc: Wim Van Sebroeck Cc: Guenter Roeck Cc: Florian Fainelli Cc: Ray Jui Cc: Scott Branden Cc: bcm-kernel-feedback-list@broadcom.com Cc: linux-watchdog@vger.kernel.org Signed-off-by: Greg Kroah-Hartman Reviewed-by: Guenter Roeck Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 3bd41e595b09ecce472432bbdaf7544d2a94a417 Author: Jerry Hoemann Date: Wed Jun 12 18:02:37 2019 -0600 docs: watchdog: Fix build error. make htmldocs fails due to missing blank line following header. Signed-off-by: Jerry Hoemann Reviewed-by: Mauro Carvalho Chehab Reviewed-by: Guenter Roeck Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 74665686f0e27496ea8aa47221282707f57dc178 Author: Mauro Carvalho Chehab Date: Wed Jun 12 14:53:01 2019 -0300 docs: watchdog: convert docs to ReST and rename to *.rst Convert those documents and prepare them to be part of the kernel API book, as most of the stuff there are related to the Kernel interfaces. Still, in the future, it would make sense to split the docs, as some of the stuff is clearly focused on sysadmin tasks. The conversion is actually: - add blank lines and identation in order to identify paragraphs; - fix tables markups; - add some lists markups; - mark literal blocks; - adjust title markups. At its new index.rst, let's add a :orphan: while this is not linked to the main index.rst file, in order to avoid build warnings. Signed-off-by: Mauro Carvalho Chehab Reviewed-by: Guenter Roeck Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 0902d5011cfaabd6a09326299ef77e1c8735fb89 Merge: 927ba67a63c7 f8a8fe61fec8 Author: Linus Torvalds Date: Mon Jul 8 11:22:57 2019 -0700 Merge branch 'x86-apic-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x96 apic updates from Thomas Gleixner: "Updates for the x86 APIC interrupt handling and APIC timer: - Fix a long standing issue with spurious interrupts which was caused by the big vector management rework a few years ago. Robert Hodaszi provided finally enough debug data and an excellent initial failure analysis which allowed to understand the underlying issues. This contains a change to the core interrupt management code which is required to handle this correctly for the APIC/IO_APIC. The core changes are NOOPs for most architectures except ARM64. ARM64 is not impacted by the change as confirmed by Marc Zyngier. - Newer systems allow to disable the PIT clock for power saving causing panic in the timer interrupt delivery check of the IO/APIC when the HPET timer is not enabled either. While the clock could be turned on this would cause an endless whack a mole game to chase the proper register in each affected chipset. These systems provide the relevant frequencies for TSC, CPU and the local APIC timer via CPUID and/or MSRs, which allows to avoid the PIT/HPET based calibration. As the calibration code is the only usage of the legacy timers on modern systems and is skipped anyway when the frequencies are known already, there is no point in setting up the PIT and actually checking for the interrupt delivery via IO/APIC. To achieve this on a wide variety of platforms, the CPUID/MSR based frequency readout has been made more robust, which also allowed to remove quite some workarounds which turned out to be not longer required. Thanks to Daniel Drake for analysis, patches and verification" * 'x86-apic-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/irq: Seperate unused system vectors from spurious entry again x86/irq: Handle spurious interrupt after shutdown gracefully x86/ioapic: Implement irq_get_irqchip_state() callback genirq: Add optional hardware synchronization for shutdown genirq: Fix misleading synchronize_irq() documentation genirq: Delay deactivation in free_irq() x86/timer: Skip PIT initialization on modern chipsets x86/apic: Use non-atomic operations when possible x86/apic: Make apic_bsp_setup() static x86/tsc: Set LAPIC timer period to crystal clock frequency x86/apic: Rename 'lapic_timer_frequency' to 'lapic_timer_period' x86/tsc: Use CPUID.0x16 to calculate missing crystal frequency commit 927ba67a63c72ee87d655e30183d1576c3717d3e Merge: 2a1ccd31420a 9176ab1b8480 Author: Linus Torvalds Date: Mon Jul 8 11:06:29 2019 -0700 Merge branch 'timers-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull timer updates from Thomas Gleixner: "The timer and timekeeping departement delivers: Core: - The consolidation of the VDSO code into a generic library including the conversion of x86 and ARM64. Conversion of ARM and MIPS are en route through the relevant maintainer trees and should end up in 5.4. This gets rid of the unnecessary different copies of the same code and brings all architectures on the same level of VDSO functionality. - Make the NTP user space interface more robust by restricting the TAI offset to prevent undefined behaviour. Includes a selftest. - Validate user input in the compat settimeofday() syscall to catch invalid values which would be turned into valid values by a multiplication overflow - Consolidate the time accessors - Small fixes, improvements and cleanups all over the place Drivers: - Support for the NXP system counter, TI davinci timer - Move the Microsoft HyperV clocksource/events code into the drivers/clocksource directory so it can be shared between x86 and ARM64. - Overhaul of the Tegra driver - Delay timer support for IXP4xx - Small fixes, improvements and cleanups as usual" * 'timers-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (71 commits) time: Validate user input in compat_settimeofday() timer: Document TIMER_PINNED clocksource/drivers: Continue making Hyper-V clocksource ISA agnostic clocksource/drivers: Make Hyper-V clocksource ISA agnostic MAINTAINERS: Fix Andy's surname and the directory entries of VDSO hrtimer: Use a bullet for the returns bullet list arm64: vdso: Fix compilation with clang older than 8 arm64: compat: Fix __arch_get_hw_counter() implementation arm64: Fix __arch_get_hw_counter() implementation lib/vdso: Make delta calculation work correctly MAINTAINERS: Add entry for the generic VDSO library arm64: compat: No need for pre-ARMv7 barriers on an ARMv8 system arm64: vdso: Remove unnecessary asm-offsets.c definitions vdso: Remove superfluous #ifdef __KERNEL__ in vdso/datapage.h clocksource/drivers/davinci: Add support for clocksource clocksource/drivers/davinci: Add support for clockevents clocksource/drivers/tegra: Set up maximum-ticks limit properly clocksource/drivers/tegra: Cycles can't be 0 clocksource/drivers/tegra: Restore base address before cleanup clocksource/drivers/tegra: Add verbose definition for 1MHz constant ... commit c2eac35bc2717abd585a3eede879d75461685bc7 Author: Rasmus Villemoes Date: Wed Jun 5 14:06:44 2019 +0000 watchdog: make the device time out at open_deadline when open_timeout is used When the watchdog device is not open by userspace, the kernel takes care of pinging it. When the open_timeout feature is in use, we should ensure that the hardware fires close to open_timeout seconds after the kernel has assumed responsibility for the device. To do this, simply reuse the logic that is already in place for ensuring the same thing when userspace is responsible for regularly pinging the device: - When watchdog_active(wdd), this patch doesn't change anything. - When !watchdog_active(wdd), the "virtual timeout" should be taken to be ->open_deadline". When the open_timeout feature is not used or the device has been opened at least once, ->open_deadline is KTIME_MAX, and the arithmetic ends up returning keepalive_interval as we used to. This has been tested on a Wandboard with various combinations of open_timeout and timeout-sec properties for the on-board watchdog by booting with 'init=/bin/sh', timestamping the lines on the serial console, and comparing the timestamp of the 'imx2-wdt 20bc000.wdog: timeout nnn sec' line with the timestamp of the 'U-Boot SPL ...' line (which appears just after reset). Suggested-by: Guenter Roeck Signed-off-by: Rasmus Villemoes Reviewed-by: Guenter Roeck Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 487e4e08221debb1ccf9cb2c249fac379b74cbb2 Author: Rasmus Villemoes Date: Wed Jun 5 14:06:43 2019 +0000 watchdog: introduce CONFIG_WATCHDOG_OPEN_TIMEOUT This allows setting a default value for the watchdog.open_timeout commandline parameter via Kconfig. Some BSPs allow remote updating of the kernel image and root file system, but updating the bootloader requires physical access. Hence, if one has a firmware update that requires relaxing the watchdog.open_timeout a little, the value used must be baked into the kernel image itself and cannot come from the u-boot environment via the kernel command line. Being able to set the initial value in .config doesn't change the fact that the value on the command line, if present, takes precedence, and is of course immensely useful for development purposes while one has console acccess, as well as usable in the cases where one can make a permanent update of the kernel command line. Signed-off-by: Rasmus Villemoes Reviewed-by: Guenter Roeck Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 4d1c6a0ec2d98e51f950127bf9299531caac53e1 Author: Rasmus Villemoes Date: Wed Jun 5 14:06:41 2019 +0000 watchdog: introduce watchdog.open_timeout commandline parameter The watchdog framework takes care of feeding a hardware watchdog until userspace opens /dev/watchdogN. If that never happens for some reason (buggy init script, corrupt root filesystem or whatnot) but the kernel itself is fine, the machine stays up indefinitely. This patch allows setting an upper limit for how long the kernel will take care of the watchdog, thus ensuring that the watchdog will eventually reset the machine. A value of 0 (the default) means infinite timeout, preserving the current behaviour. This is particularly useful for embedded devices where some fallback logic is implemented in the bootloader (e.g., use a different root partition, boot from network, ...). There is already handle_boot_enabled serving a similar purpose. However, such a binary choice is unsuitable if the hardware watchdog cannot be programmed by the bootloader to provide a timeout long enough for userspace to get up and running. Many of the embedded devices we see use external (gpio-triggered) watchdogs with a fixed timeout of the order of 1-2 seconds. The open timeout only applies for the first open from userspace. Should userspace need to close the watchdog device, with the intention of re-opening it shortly, the application can emulate the open timeout feature by combining the nowayout feature with an appropriate WDIOC_SETTIMEOUT immediately prior to closing the device. Signed-off-by: Rasmus Villemoes Reviewed-by: Guenter Roeck Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 8c21ead3ea5d896946fb5d85b52b0be757e9bef4 Author: Anson Huang Date: Mon May 27 15:03:15 2019 +0800 dt-bindings: watchdog: move i.MX system controller watchdog binding to SCU i.MX system controller watchdog depends on SCU driver to support interrupt function, so it needs to be subnode of SCU node in DT, binding doc should be moved to fsl,scu.txt as well. Signed-off-by: Anson Huang Reviewed-by: Rob Herring Reviewed-by: Guenter Roeck Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 8009ce956c3d28022af6b122e50213ad830fc902 Author: Richard Weinberger Date: Wed May 15 21:52:34 2019 +0200 ubifs: Don't leak orphans on memory during commit If an orphan has child orphans (xattrs), and due to a commit the parent orpahn cannot get free()'ed immediately, put also all child orphans on the erase list. Otherwise UBIFS will free() them only upon unmount and we waste memory. Fixes: 988bec41318f ("ubifs: orphan: Handle xattrs like files") Signed-off-by: Richard Weinberger commit ee1438ce5dc4d67dd8dd1ff51583122a61f5bd9e Author: Richard Weinberger Date: Wed May 15 22:31:13 2019 +0200 ubifs: Check link count of inodes when killing orphans. O_TMPFILE files can change their link count back to non-zero. This corner case needs to get addressed in the orphans subsystem too. Fixes: 474b93704f32 ("ubifs: Implement O_TMPFILE") Reported-by: Lars Persson Signed-off-by: Richard Weinberger commit 2a1ccd31420a7b1acd6ca37b2bec2d723aa093e4 Merge: e0e86b111bca 3a1d24ca9573 Author: Linus Torvalds Date: Mon Jul 8 11:01:13 2019 -0700 Merge branch 'irq-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull irq updates from Thomas Gleixner: "The irq departement provides the usual mixed bag: Core: - Further improvements to the irq timings code which aims to predict the next interrupt for power state selection to achieve better latency/power balance - Add interrupt statistics to the core NMI handlers - The usual small fixes and cleanups Drivers: - Support for Renesas RZ/A1, Annapurna Labs FIC, Meson-G12A SoC and Amazon Gravition AMR/GIC interrupt controllers. - Rework of the Renesas INTC controller driver - ACPI support for Socionext SoCs - Enhancements to the CSKY interrupt controller - The usual small fixes and cleanups" * 'irq-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (39 commits) irq/irqdomain: Fix comment typo genirq: Update irq stats from NMI handlers irqchip/gic-pm: Remove PM_CLK dependency irqchip/al-fic: Introduce Amazon's Annapurna Labs Fabric Interrupt Controller Driver dt-bindings: interrupt-controller: Add Amazon's Annapurna Labs FIC softirq: Use __this_cpu_write() in takeover_tasklets() irqchip/mbigen: Stop printing kernel addresses irqchip/gic: Add dependency for ARM_GIC_MAX_NR genirq/affinity: Remove unused argument from [__]irq_build_affinity_masks() genirq/timings: Add selftest for next event computation genirq/timings: Add selftest for irqs circular buffer genirq/timings: Add selftest for circular array genirq/timings: Encapsulate storing function genirq/timings: Encapsulate timings push genirq/timings: Optimize the period detection speed genirq/timings: Fix timings buffer inspection genirq/timings: Fix next event index function irqchip/qcom: Use struct_size() in devm_kzalloc() irqchip/irq-csky-mpintc: Remove unnecessary loop in interrupt handler dt-bindings: interrupt-controller: Update csky mpintc ... commit 15f7d7fc5542f6cb429a069dd77b57ddccbe11e3 Author: Anson Huang Date: Mon May 27 15:03:17 2019 +0800 watchdog: imx_sc: Add pretimeout support i.MX system controller watchdog can support pretimeout IRQ via general SCU MU IRQ, it depends on IMX_SCU and driver MUST be probed after SCU IPC ready, then enable corresponding SCU IRQ group and register SCU IRQ notifier, when watchdog pretimeout IRQ fires, SCU MU IRQ will be handled and watchdog pretimeout notifier will be called to handle the event. Signed-off-by: Anson Huang Reviewed-by: Guenter Roeck Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit eeabb9866e4ccce55d875cad140f9bf7c7ba1d66 Author: Michele Dionisio Date: Wed May 15 23:02:02 2019 +0200 ubifs: Add support for zstd compression. zstd shows a good compression rate and is faster than lzo, also on slow ARM cores. Cc: Sebastian Andrzej Siewior Signed-off-by: Michele Dionisio [rw: rewrote commit message] Signed-off-by: Richard Weinberger commit 817aa094842dfc3a6b98c9582d4a647827f66201 Author: Sascha Hauer Date: Tue May 14 10:33:22 2019 +0200 ubifs: support offline signed images HMACs can only be generated on the system the UBIFS image is running on. To support offline signed images we add a PKCS#7 signature to the UBIFS image which can be created by mkfs.ubifs. Both the master node and the superblock need to be authenticated, during normal runtime both are protected with HMACs. For offline signature support however only a single signature is desired. We add a signature covering the superblock node directly behind it. To protect the master node a hash of the master node is added to the superblock which is used when the master node doesn't contain a HMAC. Transition to a read/write filesystem is also supported. During transition first the master node is rewritten with a HMAC (implicitly, it is written anyway as the FS is marked dirty). Afterwards the superblock is rewritten with a HMAC. Once after the image has been mounted read/write it is HMAC only, the signature is no longer required or even present on the filesystem. In an offline signed image the master node is authenticated by the superblock. In a transition to r/w we have to make sure that the master node is rewritten before the superblock node. In this case the master node gets a HMAC and its authenticity no longer depends on the superblock node. There are some cases in which the current code first writes the superblock node though, so with this patch writing of the superblock node is delayed until the master node is written. Signed-off-by: Sascha Hauer Signed-off-by: Richard Weinberger commit 8ba0a2ab84b23b541a5d2ef25d759c94880e7457 Author: Liu Song Date: Fri Aug 24 09:15:45 2018 +0800 ubifs: remove unnecessary check in ubifs_log_start_commit In ubifs_log_start_commit, the value of c->lhead_offs is zero or set to zero by code bellow. /* Switch to the next log LEB */ if (c->lhead_offs) { c->lhead_lnum = ubifs_next_log_lnum(c, c->lhead_lnum); ubifs_assert(c->lhead_lnum != c->ltail_lnum); c->lhead_offs = 0; } The value of 'len' can not exceed 'max_len' which assigned value by code bellow. max_len = UBIFS_CS_NODE_SZ + c->jhead_cnt * UBIFS_REF_NODE_SZ; The value of c->lhead_offs changed by code bellow and cannot exceed 'max_len'. c->lhead_offs += len; if (c->lhead_offs == c->leb_size) { c->lhead_lnum = ubifs_next_log_lnum(c, c->lhead_lnum); c->lhead_offs = 0; } Usually, the size of PEB is between 64KB and 256KB. So the value of c->lhead_offs is far less than c->leb_size. The check 'if (c->lhead_offs == c->leb_size)' could never to be true. Signed-off-by: Liu Song Reviewed-by: Jiang Biao Signed-off-by: Richard Weinberger commit 7d8c811bf9ed513a586b18a28b788dd10fbe1128 Author: Liu Song Date: Mon Aug 20 11:54:30 2018 +0800 ubifs: Fix typo of output in get_cs_sqnum "Not a CS node" makes more sense than "Node a CS node". Signed-off-by: Liu Song Reviewed-by: Jiang Biao Signed-off-by: Richard Weinberger commit d5cf9473a3f3b2bdd09c4a70ac9da037cdfc1f47 Author: Liu Song Date: Mon Aug 6 10:49:06 2018 +0800 ubifs: Simplify redundant code cbuf's size can be simply assigned. Signed-off-by: Liu Song Reviewed-by: Jiang Biao Signed-off-by: Richard Weinberger commit e0e86b111bca6bbf746c03ec5cf3e6a61fa3f8e9 Merge: 568521d058aa caa759323c73 Author: Linus Torvalds Date: Mon Jul 8 10:39:56 2019 -0700 Merge branch 'smp-hotplug-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull SMP/hotplug updates from Thomas Gleixner: "A small set of updates for SMP and CPU hotplug: - Abort disabling secondary CPUs in the freezer when a wakeup is pending instead of evaluating it only after all CPUs have been offlined. - Remove the shared annotation for the strict per CPU cfd_data in the smp function call core code. - Remove the return values of smp_call_function() and on_each_cpu() as they are unconditionally 0. Fixup the few callers which actually bothered to check the return value" * 'smp-hotplug-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: smp: Remove smp_call_function() and on_each_cpu() return values smp: Do not mark call_function_data as shared cpu/hotplug: Abort disabling secondary CPUs if wakeup is pending cpu/hotplug: Fix notify_cpu_starting() reference in bringup_wait_for_ap() commit b836005b4f95cccdc1f53849a31cac2dc375f4b7 Author: Yoshihiro Shimoda Date: Wed Jun 5 14:04:00 2019 +0900 watchdog: renesas_wdt: Add a few cycles delay According to the hardware manual of R-Car Gen2 and Gen3, software should wait a few RLCK cycles as following: - Delay 2 cycles before setting watchdog counter. - Delay 3 cycles before disabling module clock. So, this patch adds such delays. Signed-off-by: Yoshihiro Shimoda Reviewed-by: Geert Uytterhoeven Reviewed-by: Wolfram Sang Reviewed-by: Niklas Söderlund Reviewed-by: Simon Horman Reviewed-by: Guenter Roeck Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 1a4aaf9f11f9937e93fe9907e6c2320a10a9f269 Author: Mans Rullgard Date: Tue May 28 10:09:47 2019 +0100 watchdog: gpio: add support for nowayout option Add support for the nowayout option in the gpio watchdog driver. Signed-off-by: Mans Rullgard Reviewed-by: Guenter Roeck Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 568521d058aaab18f01ac39d7a6ef00b75e5cc79 Merge: 6b3775479006 ede7c247abfa Author: Linus Torvalds Date: Mon Jul 8 10:36:07 2019 -0700 Merge branch 'core-rslib-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull Reed-Solomon library updates from Thomas Gleixner: "A cleanup and fixes series from Ferdinand Blomqvist who analyzed the original Reed-Solomon library from Phil Karn on which the kernel implementation is based on. This comes with a test module which verifies all the various corner cases for correctness" * 'core-rslib-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: rslib: Make some functions static rslib: Fix remaining decoder flaws rslib: Update documentation rslib: Fix handling of of caller provided syndrome rslib: decode_rs: Code cleanup rslib: decode_rs: Fix length parameter check rslib: Fix decoding of shortened codes rslib: Add tests for the encoder and decoder commit 6b37754790067c9b25cf75fbf72b69edd6d7fffd Merge: 1758feddb0f9 d5f34153e526 Author: Linus Torvalds Date: Mon Jul 8 10:34:39 2019 -0700 Merge branch 'core-debugobjects-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull debugobjects updates from Thomas Gleixner: "A set of updates for debugobjects: - A series of changes to make debugobjects more scalable by introducing per cpu pools and reducing the number of lock acquisitions - debugfs cleanup" * 'core-debugobjects-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: debugobjects: Move printk out of db->lock critical sections debugobjects: Less aggressive freeing of excess debug objects debugobjects: Reduce number of pool_lock acquisitions in fill_pool() debugobjects: Percpu pool lookahead freeing/allocation debugobjects: Add percpu free pools debugobjects: No need to check return value of debugfs_create() commit 89705e92700170888236555fe91b45e4c1bb0985 Author: Danit Goldberg Date: Fri Jul 5 19:21:57 2019 +0300 IB/mlx5: Report correctly tag matching rendezvous capability Userspace expects the IB_TM_CAP_RC bit to indicate that the device supports RC transport tag matching with rendezvous offload. However the firmware splits this into two capabilities for eager and rendezvous tag matching. Only if the FW supports both modes should userspace be told the tag matching capability is available. Cc: # 4.13 Fixes: eb761894351d ("IB/mlx5: Fill XRQ capabilities") Signed-off-by: Danit Goldberg Reviewed-by: Yishai Hadas Reviewed-by: Artemy Kovalyov Signed-off-by: Leon Romanovsky Signed-off-by: Jason Gunthorpe commit a3a400da206bd0cf426571633da51547d44f4f42 Author: Mauro Carvalho Chehab Date: Fri Jun 28 09:30:28 2019 -0300 docs: infiniband: add it to the driver-api bookset While this contains some uAPI stuff, it was intended to be read by a kernel doc. So, let's not move it to a different dir, but, instead, just add it to the driver-api bookset. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jason Gunthorpe commit bacfa94b08027b9f66ede7044972e3b066766b3e Author: Richard Weinberger Date: Tue May 14 22:31:08 2019 +0200 ubifs: Correctly use tnc_next() in search_dh_cookie() Commit c877154d307f fixed an uninitialized variable and optimized the function to not call tnc_next() in the first iteration of the loop. While this seemed perfectly legit and wise, it turned out to be illegal. If the lookup function does not find an exact match it will rewind the cursor by 1. The rewinded cursor will not match the name hash we are looking for and this results in a spurious -ENOENT. So we need to move to the next entry in case of an non-exact match, but not if the match was exact. While we are here, update the documentation to avoid further confusion. Cc: Hyunchul Lee Cc: Geert Uytterhoeven Fixes: c877154d307f ("ubifs: Fix uninitialized variable in search_dh_cookie()") Fixes: 781f675e2d7e ("ubifs: Fix unlink code wrt. double hash lookups") Signed-off-by: Richard Weinberger commit 1758feddb0f9751debdc865fefde94b45907c948 Merge: 278ecbf027c3 499723d12063 Author: Linus Torvalds Date: Mon Jul 8 10:06:12 2019 -0700 Merge tag 's390-5.3-1' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux Pull s390 updates from Vasily Gorbik: - Improve stop_machine wait logic: replace cpu_relax_yield call in generic stop_machine function with a weak stop_machine_yield function. This is overridden on s390, which yields the current cpu to the neighbouring cpu after a couple of retries, instead of blindly giving up the cpu to the hipervisor. This significantly improves stop_machine performance on s390 in overcommitted scenarios. This includes common code changes which have been Acked by Peter Zijlstra and Thomas Gleixner. - Improve jump label transformation speed: transform jump labels without using stop_machine. - Refactoring of the vfio-ccw cp handling, simplifying the code and avoiding unneeded allocating/copying. - Various vfio-ccw fixes (ccw translation, state machine). - Add support for vfio-ap queue interrupt control in the guest. This includes s390 kvm changes which have been Acked by Christian Borntraeger. - Add protected virtualization support for virtio-ccw. - Enforce both CONFIG_SMP and CONFIG_HOTPLUG_CPU, which allows to remove some code which most likely isn't working at all, besides that s390 didn't even compile for !CONFIG_SMP. - Support for special flagged EP11 CPRBs for zcrypt. - Handle PCI devices with no support for new MIO instructions. - Avoid KASAN false positives in reworked stack unwinder. - Couple of fixes for the QDIO layer. - Convert s390 specific documentation to ReST format. - Let s390 crypto modules return -ENODEV instead of -EOPNOTSUPP if hardware is missing. This way our modules behave like most other modules and which is also what systemd's systemd-modules-load.service expects. - Replace defconfig with performance_defconfig, so there is one config file less to maintain. - Remove the SCLP call home device driver, which was never useful. - Cleanups all over the place. * tag 's390-5.3-1' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux: (83 commits) docs: s390: s390dbf: typos and formatting, update crash command docs: s390: unify and update s390dbf kdocs at debug.c docs: s390: restore important non-kdoc parts of s390dbf.rst vfio-ccw: Fix the conversion of Format-0 CCWs to Format-1 s390/pci: correctly handle MIO opt-out s390/pci: deal with devices that have no support for MIO instructions s390: ap: kvm: Enable PQAP/AQIC facility for the guest s390: ap: implement PAPQ AQIC interception in kernel vfio: ap: register IOMMU VFIO notifier s390: ap: kvm: add PQAP interception for AQIC s390/unwind: cleanup unused READ_ONCE_TASK_STACK s390/kasan: avoid false positives during stack unwind s390/qdio: don't touch the dsci in tiqdio_add_input_queues() s390/qdio: (re-)initialize tiqdio list entries s390/dasd: Fix a precision vs width bug in dasd_feature_list() s390/cio: introduce driver_override on the css bus vfio-ccw: make convert_ccw0_to_ccw1 static vfio-ccw: Remove copy_ccw_from_iova() vfio-ccw: Factor out the ccw0-to-ccw1 transition vfio-ccw: Copy CCW data outside length calculation ... commit d6d5f19e21d98c0607ff029e4e2e508d4cdd1d5a Author: Max Filippov Date: Sun May 12 20:28:25 2019 -0700 xtensa: abstract 'entry' and 'retw' in assembly code Provide abi_entry, abi_entry_default, abi_ret and abi_ret_default macros that allocate aligned stack frame in windowed and call0 ABIs. Provide XTENSA_SPILL_STACK_RESERVE macro that specifies required stack frame size when register spilling is involved. Replace all uses of 'entry' and 'retw' with the above macros. This makes most of the xtensa assembly code ready for XEA3 and call0 ABI. Signed-off-by: Max Filippov commit 278ecbf027c3c559deb225f0cf53a23b7672dacf Merge: dfd437a25792 69878ef47562 Author: Linus Torvalds Date: Mon Jul 8 10:00:58 2019 -0700 Merge tag 'm68k-for-v5.3-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/linux-m68k Pull m68k updates from Geert Uytterhoeven: - switch to using the generic remapping DMA allocator - defconfig updates * tag 'm68k-for-v5.3-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/linux-m68k: m68k: Implement arch_dma_prep_coherent() m68k: Use the generic dma coherent remap allocator m68k: defconfig: Update defconfigs for v5.2-rc1 commit dfd437a257924484b144ee750e60affc95562c6d Merge: 0ecfebd2b524 0c61efd322b7 Author: Linus Torvalds Date: Mon Jul 8 09:54:55 2019 -0700 Merge tag 'arm64-upstream' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux Pull arm64 updates from Catalin Marinas: - arm64 support for syscall emulation via PTRACE_SYSEMU{,_SINGLESTEP} - Wire up VM_FLUSH_RESET_PERMS for arm64, allowing the core code to manage the permissions of executable vmalloc regions more strictly - Slight performance improvement by keeping softirqs enabled while touching the FPSIMD/SVE state (kernel_neon_begin/end) - Expose a couple of ARMv8.5 features to user (HWCAP): CondM (new XAFLAG and AXFLAG instructions for floating point comparison flags manipulation) and FRINT (rounding floating point numbers to integers) - Re-instate ARM64_PSEUDO_NMI support which was previously marked as BROKEN due to some bugs (now fixed) - Improve parking of stopped CPUs and implement an arm64-specific panic_smp_self_stop() to avoid warning on not being able to stop secondary CPUs during panic - perf: enable the ARM Statistical Profiling Extensions (SPE) on ACPI platforms - perf: DDR performance monitor support for iMX8QXP - cache_line_size() can now be set from DT or ACPI/PPTT if provided to cope with a system cache info not exposed via the CPUID registers - Avoid warning on hardware cache line size greater than ARCH_DMA_MINALIGN if the system is fully coherent - arm64 do_page_fault() and hugetlb cleanups - Refactor set_pte_at() to avoid redundant READ_ONCE(*ptep) - Ignore ACPI 5.1 FADTs reported as 5.0 (infer from the 'arm_boot_flags' introduced in 5.1) - CONFIG_RANDOMIZE_BASE now enabled in defconfig - Allow the selection of ARM64_MODULE_PLTS, currently only done via RANDOMIZE_BASE (and an erratum workaround), allowing modules to spill over into the vmalloc area - Make ZONE_DMA32 configurable * tag 'arm64-upstream' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux: (54 commits) perf: arm_spe: Enable ACPI/Platform automatic module loading arm_pmu: acpi: spe: Add initial MADT/SPE probing ACPI/PPTT: Add function to return ACPI 6.3 Identical tokens ACPI/PPTT: Modify node flag detection to find last IDENTICAL x86/entry: Simplify _TIF_SYSCALL_EMU handling arm64: rename dump_instr as dump_kernel_instr arm64/mm: Drop [PTE|PMD]_TYPE_FAULT arm64: Implement panic_smp_self_stop() arm64: Improve parking of stopped CPUs arm64: Expose FRINT capabilities to userspace arm64: Expose ARMv8.5 CondM capability to userspace arm64: defconfig: enable CONFIG_RANDOMIZE_BASE arm64: ARM64_MODULES_PLTS must depend on MODULES arm64: bpf: do not allocate executable memory arm64/kprobes: set VM_FLUSH_RESET_PERMS on kprobe instruction pages arm64/mm: wire up CONFIG_ARCH_HAS_SET_DIRECT_MAP arm64: module: create module allocations without exec permissions arm64: Allow user selection of ARM64_MODULE_PLTS acpi/arm64: ignore 5.1 FADTs that are reported as 5.0 arm64: Allow selecting Pseudo-NMI again ... commit 20893d9da7af01f9202fa78782a178004eab420d Merge: f10ff380fd7d b6142608e806 Author: Jason Gunthorpe Date: Mon Jul 8 13:48:55 2019 -0300 Merge branch 'vhca-tunnel' into rdma.git for-next Max Gurtovoy says: ==================== Those two patches introduce VHCA tunnel mechanism to DEVX interface needed for Bluefield SOC. See extensive commit messages for more information. ==================== Based on the mlx5-next branch from git://git.kernel.org/pub/scm/linux/kernel/git/mellanox/linux for dependencies * branch 'vcha-tunnel': IB/mlx5: Implement VHCA tunnel mechanism in DEVX net/mlx5: Introduce VHCA tunnel device capability commit 686cbe9e5d88ad639bbe26d963e7d5dafa1c1c28 Author: Arnaldo Carvalho de Melo Date: Mon Jul 8 13:47:14 2019 -0300 tools arch x86: Sync asm/cpufeatures.h with the with the kernel To pick up the changes in: 6dbbf5ec9e1e ("x86/cpufeatures: Enumerate user wait instructions") b302e4b176d0 ("x86/cpufeatures: Enumerate the new AVX512 BFLOAT16 instructions") acec0ce081de ("x86/cpufeatures: Combine word 11 and 12 into a new scattered features word") cbb99c0f5887 ("x86/cpufeatures: Add FDP_EXCPTN_ONLY and ZERO_FCS_FDS") That don't affect anything in tools/. This silences this perf build warning: Warning: Kernel ABI header at 'tools/arch/x86/include/asm/cpufeatures.h' differs from latest version at 'arch/x86/include/asm/cpufeatures.h' diff -u tools/arch/x86/include/asm/cpufeatures.h arch/x86/include/asm/cpufeatures.h Cc: Aaron Lewis Cc: Adrian Hunter Cc: Borislav Petkov Cc: Fenghua Yu Cc: Jiri Olsa Cc: Namhyung Kim Cc: Thomas Gleixner Link: https://lkml.kernel.org/n/tip-y60wnyg2fuxi0hx7icruo9po@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit b6142608e8069dda26398e65b0a14eda6ca4282d Author: Max Gurtovoy Date: Mon Jul 1 21:14:02 2019 +0300 IB/mlx5: Implement VHCA tunnel mechanism in DEVX This mechanism will allow function-A to perform operations "on behalf" of function-B via tunnel object. Function-A will have privileges for creating and using this tunnel object. For example, in the device emulation feature presented in Bluefield-1 SoC, using device emulation capability, one can present NVMe function to the host OS. Since the NVMe function doesn't have a normal command interface to the HCA HW, here is a need to create a channel that will be able to issue commands "on behalf" of this function. This channel is the VHCA_TUNNEL general object. The emulation software will create this tunnel for every managed function and issue commands via devx general cmd interface using the appropriate tunnel ID. When devX context will receive a command with non-zero vhca_tunnel_id, it will pass the command as-is down to the HCA. All the validation, security and resource tracking of the commands and the created tunneled objects is in the responsibility of the HCA FW. When a VHCA_TUNNEL object destroyed, the device will issue an internal FLR (function level reset) to the emulated function associated with this tunnel. This will destroy all the created resources using the tunnel mechanism. Signed-off-by: Max Gurtovoy Reviewed-by: Yishai Hadas Signed-off-by: Leon Romanovsky Signed-off-by: Jason Gunthorpe commit e3b22a65348ab54261a98b6bc90ecf8977ff8ebf Merge: 05c78468a60f 552a031ba12a Author: Arnaldo Carvalho de Melo Date: Mon Jul 8 13:06:57 2019 -0300 Merge remote-tracking branch 'tip/perf/core' into perf/urgent To pick up fixes. Signed-off-by: Arnaldo Carvalho de Melo commit 552a031ba12a4236be107a5b082a399237758a5d Merge: f584dd32edc5 0ecfebd2b524 Author: Ingo Molnar Date: Mon Jul 8 18:04:41 2019 +0200 Merge tag 'v5.2' into perf/core, to pick up fixes Signed-off-by: Ingo Molnar commit f10ff380fd7dfba4a36d40f8dd00fe17da8a1a10 Author: Jason Gunthorpe Date: Mon Jul 8 12:17:48 2019 -0300 RDMA/rvt: Do not use a kernel header in the ABI rvt was using ib_sge as part of it's ABI, which is not allowed. Introduce a new struct with the same layout and use it instead. Fixes: dabac6e460ce ("IB/hfi1: Move receive work queue struct into uapi directory") Reported-by: Stephen Rothwell Signed-off-by: Jason Gunthorpe commit 1e0cf16cdad1ba53e9eeee8746fe57de42f20c97 Author: Marc Zyngier Date: Fri Jul 5 23:35:56 2019 +0100 KVM: arm/arm64: Initialise host's MPIDRs by reading the actual register As part of setting up the host context, we populate its MPIDR by using cpu_logical_map(). It turns out that contrary to arm64, cpu_logical_map() on 32bit ARM doesn't return the *full* MPIDR, but a truncated version. This leaves the host MPIDR slightly corrupted after the first run of a VM, since we won't correctly restore the MPIDR on exit. Oops. Since we cannot trust cpu_logical_map(), let's adopt a different strategy. We move the initialization of the host CPU context as part of the per-CPU initialization (which, in retrospect, makes a lot of sense), and directly read the MPIDR from the HW. This is guaranteed to work on both arm and arm64. Reported-by: Andre Przywara Tested-by: Andre Przywara Fixes: 32f139551954 ("arm/arm64: KVM: Statically configure the host's view of MPIDR") Signed-off-by: Marc Zyngier commit 8fc9f8bedf1bdaea48382ae2e3dd558e2b939cee Author: Quentin Monnet Date: Mon Jul 8 14:05:46 2019 +0100 tools: bpftool: add completion for bpftool prog "loadall" Bash completion for proposing the "loadall" subcommand is missing. Let's add it to the completion script. Add a specific case to propose "load" and "loadall" for completing: $ bpftool prog load ^ cursor is here Otherwise, completion considers that $command is in load|loadall and starts making related completions (file or directory names, as the number of words on the command line is below 6), when the only suggested keywords should be "load" and "loadall" until one has been picked and a space entered after that to move to the next word. Signed-off-by: Quentin Monnet Reviewed-by: Jakub Kicinski Signed-off-by: Daniel Borkmann commit bef8e2639242e7f7214f1ab3b37ace1415a4f750 Author: Arnd Bergmann Date: Mon Jul 8 14:57:21 2019 +0200 bpf: avoid unused variable warning in tcp_bpf_rtt() When CONFIG_BPF is disabled, we get a warning for an unused variable: In file included from drivers/target/target_core_device.c:26: include/net/tcp.h:2226:19: error: unused variable 'tp' [-Werror,-Wunused-variable] struct tcp_sock *tp = tcp_sk(sk); The variable is only used in one place, so it can be replaced with its value there to avoid the warning. Fixes: 23729ff23186 ("bpf: add BPF_CGROUP_SOCK_OPS callback that is executed on every RTT") Signed-off-by: Arnd Bergmann Acked-by: Soheil Hassas Yeganeh Signed-off-by: Daniel Borkmann commit 6705fea0c799a4efb9a9ce2968a2f7a570e33dc2 Author: YueHaibing Date: Wed Jul 3 16:26:30 2019 +0800 bpf: cgroup: Fix build error without CONFIG_NET If CONFIG_NET is not set and CONFIG_CGROUP_BPF=y, gcc building fails: kernel/bpf/cgroup.o: In function `cg_sockopt_func_proto': cgroup.c:(.text+0x237e): undefined reference to `bpf_sk_storage_get_proto' cgroup.c:(.text+0x2394): undefined reference to `bpf_sk_storage_delete_proto' kernel/bpf/cgroup.o: In function `__cgroup_bpf_run_filter_getsockopt': (.text+0x2a1f): undefined reference to `lock_sock_nested' (.text+0x2ca2): undefined reference to `release_sock' kernel/bpf/cgroup.o: In function `__cgroup_bpf_run_filter_setsockopt': (.text+0x3006): undefined reference to `lock_sock_nested' (.text+0x32bb): undefined reference to `release_sock' Reported-by: Hulk Robot Suggested-by: Stanislav Fomichev Fixes: 0d01da6afc54 ("bpf: implement getsockopt and setsockopt hooks") Signed-off-by: YueHaibing Acked-by: Yonghong Song Signed-off-by: Daniel Borkmann commit 4c7d6dcd364843e408a60952ba914bb72bafc6cc Author: Jason Gunthorpe Date: Mon Jul 8 11:36:32 2019 -0300 RDMA/siw: Fix DEFINE_PER_CPU compilation when ARCH_NEEDS_WEAK_PER_CPU The initializer for the variable cannot be inside the macro (and zero initialization isn't needed anyhow). include/linux/percpu-defs.h:92:33: warning: '__pcpu_unique_use_cnt' initialized and declared 'extern' extern __PCPU_DUMMY_ATTRS char __pcpu_unique_##name; \ ^~~~~~~~~~~~~~ include/linux/percpu-defs.h:115:2: note: in expansion of macro 'DEFINE_PER_CPU_SECTION' DEFINE_PER_CPU_SECTION(type, name, "") ^~~~~~~~~~~~~~~~~~~~~~ drivers/infiniband/sw/siw/siw_main.c:129:8: note: in expansion of macro 'DEFINE_PER_CPU' static DEFINE_PER_CPU(atomic_t, use_cnt = ATOMIC_INIT(0)); ^~~~~~~~~~~~~~ Also the rules for PER_CPU require the variable names to be globally unique, so prefix them with siw_ Fixes: b9be6f18cf9e ("rdma/siw: transmit path") Fixes: bdcf26bf9b3a ("rdma/siw: network and RDMA core interface") Reported-by: Stephen Rothwell Signed-off-by: Jason Gunthorpe commit 06ec0e2c490afd2f870d89c59200540fd9acde95 Author: Andrii Nakryiko Date: Fri Jul 5 21:44:20 2019 -0700 selftests/bpf: fix test_attach_probe map definition ef99b02b23ef ("libbpf: capture value in BTF type info for BTF-defined map defs") changed BTF-defined maps syntax, while independently merged 1e8611bbdfc9 ("selftests/bpf: add kprobe/uprobe selftests") added new test using outdated syntax of maps. This patch fixes this test after corresponding patch sets were merged. Fixes: ef99b02b23ef ("libbpf: capture value in BTF type info for BTF-defined map defs") Fixes: 1e8611bbdfc9 ("selftests/bpf: add kprobe/uprobe selftests") Signed-off-by: Andrii Nakryiko Acked-by: Yonghong Song Signed-off-by: Daniel Borkmann commit 8bfec4f325e12eec79b4477909ee48db83ae6b7e Merge: d2850ce0bdd7 76d950773cd2 Author: Daniel Borkmann Date: Mon Jul 8 16:22:56 2019 +0200 Merge branch 'bpf-sockaddr-wide-store' Stanislav Fomichev says: ==================== Clang can generate 8-byte stores for user_ip6 & msg_src_ip6, let's support that on the verifier side. v3: * fix comments spelling an -> and (Andrii Nakryiko) v2: * Add simple cover letter (Yonghong Song) * Update comments (Yonghong Song) * Remove [4] selftests (Yonghong Song) ==================== Signed-off-by: Daniel Borkmann commit 76d950773cd2a365f492ce973429ae629d58131c Author: Stanislav Fomichev Date: Mon Jul 1 10:38:41 2019 -0700 selftests/bpf: add verifier tests for wide stores Make sure that wide stores are allowed at proper (aligned) addresses. Note that user_ip6 is naturally aligned on 8-byte boundary, so correct addresses are user_ip6[0] and user_ip6[2]. msg_src_ip6 is, however, aligned on a 4-byte bondary, so only msg_src_ip6[1] can be wide-stored. Cc: Andrii Nakryiko Cc: Yonghong Song Acked-by: Andrii Nakryiko Signed-off-by: Stanislav Fomichev Acked-by: Yonghong Song Signed-off-by: Daniel Borkmann commit 4cfacbe6df972db4081dd76feb7871fce996118d Author: Stanislav Fomichev Date: Mon Jul 1 10:38:40 2019 -0700 bpf: sync bpf.h to tools/ Sync user_ip6 & msg_src_ip6 comments. Signed-off-by: Stanislav Fomichev Signed-off-by: Daniel Borkmann commit 600c70bad6594cb124c641ed05355ca134650ea4 Author: Stanislav Fomichev Date: Mon Jul 1 10:38:39 2019 -0700 bpf: allow wide (u64) aligned stores for some fields of bpf_sock_addr Since commit cd17d7770578 ("bpf/tools: sync bpf.h") clang decided that it can do a single u64 store into user_ip6[2] instead of two separate u32 ones: # 17: (18) r2 = 0x100000000000000 # ; ctx->user_ip6[2] = bpf_htonl(DST_REWRITE_IP6_2); # 19: (7b) *(u64 *)(r1 +16) = r2 # invalid bpf_context access off=16 size=8 >From the compiler point of view it does look like a correct thing to do, so let's support it on the kernel side. Credit to Andrii Nakryiko for a proper implementation of bpf_ctx_wide_store_ok. Cc: Andrii Nakryiko Cc: Yonghong Song Fixes: cd17d7770578 ("bpf/tools: sync bpf.h") Reported-by: kernel test robot Acked-by: Yonghong Song Acked-by: Andrii Nakryiko Signed-off-by: Stanislav Fomichev Signed-off-by: Daniel Borkmann commit d6fc9fcbaa655cff2d2be05e16867d1918f78b85 Author: Masahiro Yamada Date: Mon Jul 1 09:58:40 2019 +0900 kbuild: compile-test exported headers to ensure they are self-contained Multiple people have suggested compile-testing UAPI headers to ensure they can be really included from user-space. "make headers_check" is obviously not enough to catch bugs, and we often leak unresolved references to user-space. Use the new header-test-y syntax to implement it. Please note exported headers are compile-tested with a completely different set of compiler flags. The header search path is set to $(objtree)/usr/include since exported headers should not include unexported ones. We use -std=gnu89 for the kernel space since the kernel code highly depends on GNU extensions. On the other hand, UAPI headers should be written in more standardized C, so they are compiled with -std=c90. This will emit errors if C++ style comments, the keyword 'inline', etc. are used. Please use C style comments (/* ... */), '__inline__', etc. in UAPI headers. There is additional compiler requirement to enable this test because many of UAPI headers include , , , etc. directly or indirectly. You cannot use kernel.org pre-built toolchains [1] since they lack . I reused CONFIG_CC_CAN_LINK to check the system header availability. The intention is slightly different, but a compiler that can link userspace programs provide system headers. For now, a lot of headers need to be excluded because they cannot be compiled standalone, but this is a good start point. [1] https://mirrors.edge.kernel.org/pub/tools/crosstool/index.html Signed-off-by: Masahiro Yamada Reviewed-by: Sam Ravnborg commit b7fbd3e55c0f842551445d6dbe3dd92ab155b2e8 Author: Hoan Nguyen An Date: Thu May 23 18:29:38 2019 +0900 watchdog: renesas_wdt: Use 'dev' instead of dereferencing it repeatedly Add helper variable dev = &pdev->dev Signed-off-by: Hoan Nguyen An Reviewed-by: Geert Uytterhoeven Reviewed-by: Simon Horman Reviewed-by: Guenter Roeck Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit dfc01e2c83776f4bcadf4ec0a5cd8407904cd9b3 Author: Clément Péron Date: Thu May 23 17:10:47 2019 +0200 dt-bindings: watchdog: add Allwinner H6 watchdog Allwinner H6 has a similar watchdog as the A64 which is already a compatible of the A31. This commit add the H6 compatible. Signed-off-by: Clément Péron Reviewed-by: Rob Herring Reviewed-by: Guenter Roeck Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 9b3461188e86f19113f57a71c8873fab6ca95f36 Author: Paul Cercueil Date: Fri Jun 7 18:24:27 2019 +0200 watchdog: jz4740: Avoid starting watchdog in set_timeout Previously the jz4740_wdt_set_timeout() function was starting the timer unconditionally, even if it was stopped when that function was entered. Now, the timer will be restarted only if it was already running before this function is called. Signed-off-by: Paul Cercueil Reviewed-by: Guenter Roeck Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit df04cce3b8f9124fbb201edde84b591fd38d2169 Author: Paul Cercueil Date: Fri Jun 7 18:24:26 2019 +0200 watchdog: jz4740: Use register names from Use the macros from instead of declaring our own. Signed-off-by: Paul Cercueil Reviewed-by: Guenter Roeck Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit f1bb45b93345ac7e1eb237e54093520c42aa237d Author: Jerry Hoemann Date: Fri May 17 14:59:43 2019 -0600 watchdog/hpwdt: Reflect changes Bump driver number to reflect recent changes. Signed-off-by: Jerry Hoemann Reviewed-by: Guenter Roeck Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit f213fcf078c19d2b1b0876eb935cab20e311743e Author: Jerry Hoemann Date: Fri May 17 14:59:42 2019 -0600 watchdog/hpwdt: Update documentation Update documentation to explain new module parameter kdumptimeout. Signed-off-by: Jerry Hoemann Reviewed-by: Guenter Roeck Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit be3d7f7cb3ac2dd0b4dcb686d5a69519c35ef3a5 Author: Jerry Hoemann Date: Fri May 17 14:59:41 2019 -0600 watchdog/hpwdt: Add module parameter kdumptimeout. Instead of unconditionally stopping the watchdog timer after receipt of a pretimeout NMI, reprogram the timeout based upon module parameter kdumptimeout. The provides a more flexible override than the depricated allow_kdump. Signed-off-by: Jerry Hoemann Reviewed-by: Guenter Roeck Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit bb721d6b9eed631eed5d22bb8dfbb0c0717a67aa Author: Jerry Hoemann Date: Fri May 17 14:59:40 2019 -0600 watchdog/hpwdt: Have core ping watchdog. Instead of stopping the hw timer during probe, have the core update the timer if the timer is already running. Signed-off-by: Jerry Hoemann Reviewed-by: Guenter Roeck Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit c22d8e38e475c3a9fcc5923f98ac8cfdee8b1ad7 Author: Jerry Hoemann Date: Fri May 17 14:59:39 2019 -0600 watchdog/hpwdt: Advertize max_hw_heartbeat_ms Set max_hw_heartbeat_ms instead of max_timeout so that user client can set timeout range in excess of what the underlying hardware supports. Signed-off-by: Jerry Hoemann Reviewed-by: Guenter Roeck Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 48b32199f97ad2ac23ef4a5b64f2d1bc0aec444f Author: Jerry Hoemann Date: Fri May 17 14:59:38 2019 -0600 watchdog/hpwdt: Stop hpwdt on unregister. Have the WD core stop the watchdog on unregister instead of explicitly calling hpwdt_stop() in hpwdt_exit(). Signed-off-by: Jerry Hoemann Reviewed-by: Guenter Roeck Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 215e06f0d18d5d653d6ea269e4dfc684854d48bf Author: Stefan Wahren Date: Wed May 15 19:14:18 2019 +0200 watchdog: bcm2835_wdt: Fix module autoload The commit 5e6acc3e678e ("bcm2835-pm: Move bcm2835-watchdog's DT probe to an MFD.") broke module autoloading on Raspberry Pi. So add a module alias this fix this. Signed-off-by: Stefan Wahren Reviewed-by: Guenter Roeck Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 8632944841d41a36d77dd1fa88d4201b5291100f Author: Eugen Hristev Date: Wed May 8 14:15:03 2019 +0000 watchdog: sama5d4: fix WDD value to be always set to max WDD value must be always set to max (0xFFF) otherwise the hardware block will reset the board on the first ping of the watchdog. Signed-off-by: Eugen Hristev Reviewed-by: Guenter Roeck Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 93f1d3e4b59cf2e7ef31eaf1131480897b040e97 Author: Arnd Bergmann Date: Mon Jul 8 14:42:51 2019 +0200 remoteproc: stm32: fix building without ARM SMCC When compile testing this driver without SMCC support enabled, we get a link error: drivers/remoteproc/stm32_rproc.o: In function `stm32_rproc_start': stm32_rproc.c:(.text+0x776): undefined reference to `__arm_smccc_smc' drivers/remoteproc/stm32_rproc.o: In function `stm32_rproc_stop': stm32_rproc.c:(.text+0x92c): undefined reference to `__arm_smccc_smc' Make the actual call to arm_smccc_smc conditional on the Kconfig symbol controlling its implementation. Fixes: 13140de09cc2 ("remoteproc: stm32: add an ST stm32_rproc driver") Signed-off-by: Arnd Bergmann Signed-off-by: Bjorn Andersson commit 990dee3aa45690217e8d83e7704cf07b2f3d9821 Author: james qian wang (Arm Technology China) Date: Mon Jul 8 08:00:22 2019 +0100 drm/komeda: Computing image enhancer internally Enable image enhancer when the input data flow is 2x+ upscaling. Signed-off-by: james qian wang (Arm Technology China) Signed-off-by: Liviu Dudau Link: https://patchwork.freedesktop.org/patch/msgid/20190708070000.4945-1-james.qian.wang@arm.com commit 1930c11204b1d83549a6f5f32500b35a4b909dbb Author: james qian wang (Arm Technology China) Date: Mon Jul 8 07:59:45 2019 +0100 drm/komeda: Computing layer_split internally For layer_split no need user to enable/disable it, but compute it in komeda internally, komeda will enable it if the scaling exceed the acceptable range of scaler. Signed-off-by: james qian wang (Arm Technology China) Signed-off-by: Liviu Dudau Link: https://patchwork.freedesktop.org/patch/msgid/20190708065923.4887-1-james.qian.wang@arm.com commit b02f6a2ef0a14af5c19780521370673f55c1476d Author: Rajat Jain Date: Thu Jun 27 20:34:13 2019 -0700 platform/x86: intel_pmc_core: Attach using APCI HID "INT33A1" Most modern platforms already have the ACPI device "INT33A1" that could be used to attach to the driver. Switch the driver to using that and thus make the intel_pmc_core.c a pure platform_driver. Some of the legacy platforms though, may still not have this ACPI device in their ACPI tables. Thus for such platforms, move the code to manually instantiate a platform_device into a new file of its own. This would instantiate the intel_pmc_core platform device and thus attach to the driver, if the ACPI device for the same ("INT33A1") is not present in a system where it should be. This was discussed here: https://www.mail-archive.com/linux-kernel@vger.kernel.org/msg1966991.html Signed-off-by: Rajat Jain [andy: renamed to intel_pmc_core_pltdrv.c to be in align with other drivers] Signed-off-by: Andy Shevchenko commit 75c5bf97ed2fec43f64c91b9e33a6cbd20c23cf9 Author: Daniel Vetter Date: Fri Jul 5 14:10:06 2019 +0200 MAINTAINERS: maintain drm/arm drivers in drm-misc for now From discussions with Liviu it sounded like the komeda team would benefit a bit from more cross-review with other drivers. To make sure komeda is aligned with how similar problems are solved in other drivers (in the end everyone ends up with similar ideas on how to solve various display engine design issues). An option would be to use drm-misc as an incubator for a few kernel releases, at least until the big design items have been tackled: Aside from the four kms properties already landed that we need to take out again there's also a pile of new ones proposed already for komeda. drm-misc seems to work fairly well at encouraging these kind of cross-driver reviews and working on cross-driver infrastructure in drm core. Later on we can move all the drivers out to a dedicated arm tree again (if that's desired). Of coures that would mean Lowry and James need drm-misc commit rights (all other arm contributors have it already I think). Cc: Lowry Li (Arm Technology China) Cc: James Qian Wang (Arm Technology China) Cc: Liviu Dudau Cc: Mali DP Maintainers Cc: Brian Starkey Cc: Dave Airlie Cc: Maarten Lankhorst Cc: Maxime Ripard Cc: Sean Paul Signed-off-by: Daniel Vetter Signed-off-by: Daniel Vetter Acked-by: Maxime Ripard Acked-by: James Qian Wang (Arm Technology China) Signed-off-by: Liviu Dudau Link: https://patchwork.freedesktop.org/patch/msgid/20190705121006.26085-5-daniel.vetter@ffwll.ch commit c945623c05c34814c655a0c87155dca81d7e7146 Author: Daniel Vetter Date: Fri Jul 5 14:10:05 2019 +0200 drm/komeda: Remove layer_split property Properties are uapi like anything else, with all the usual rules regarding review, testcases, open source userspace ... Furthermore driver-private kms properties are highly discouraged, over the past few years we've realized we need to make a serious effort at better standardizing this stuff. Again this probably needs multiple pieces to solve this properly: - Instead of expecting userspace to compute this (and duplicating modeset code), the kernel driver should compute when it's necessary to enable layer_split mode to make a configuration possible. I.e. in komeda_plane_atomic_check() first try komeda_build_layer_data_flow() and if that fails, try komeda_build_layer_split_data_flow(), and set dflow.en_split accordingly. Assuming I understand somewhat correctly what this does. - If this is needed for validation then you want a debugfs file to force this one way or the other, or alternatively use ->atomic_print_state to dump such hidden driver-private state. Depends upon how you do your validation ofc. Fixes: a407a6509393 ("drm/komeda: Add layer split support") Cc: Lowry Li (Arm Technology China) Cc: James Qian Wang (Arm Technology China) Cc: Liviu Dudau Cc: Mali DP Maintainers Cc: Brian Starkey Signed-off-by: Daniel Vetter Signed-off-by: Daniel Vetter Signed-off-by: Liviu Dudau Link: https://patchwork.freedesktop.org/patch/msgid/20190705121006.26085-4-daniel.vetter@ffwll.ch commit a76f612c1de8f82b1712e78e73d223f677f8254e Author: Daniel Vetter Date: Fri Jul 5 14:10:04 2019 +0200 drm/komeda: remove img_enhancement property Properties are uapi like anything else, with all the usual rules regarding review, testcases, open source userspace ... Furthermore driver-private kms properties are highly discouraged, over the past few years we've realized we need to make a serious effort at better standardizing this stuff. Again this probably needs multiple pieces to solve this properly: - Instead of expecting userspace to compute this (and duplicating modeset code), the kernel driver should compute when it's possible to enable this better up/downscale mode (assuming I understood Liviu correctly on what this does) automatically. - If this is needed for validation then you want a debugfs file to force this one way or the other, or alternatively use ->atomic_print_state to dump such hidden driver-private state. Depends upon how you do your validation ofc. Fixes: 42b6f118f6d1 ("drm/komeda: Add image enhancement support") Cc: Lowry Li (Arm Technology China) Cc: James Qian Wang (Arm Technology China) Cc: Liviu Dudau Cc: Mali DP Maintainers Cc: Brian Starkey Signed-off-by: Daniel Vetter Signed-off-by: Daniel Vetter Signed-off-by: Liviu Dudau Link: https://patchwork.freedesktop.org/patch/msgid/20190705121006.26085-3-daniel.vetter@ffwll.ch commit 8aa0625f48559861b17606cf73fb24bd9f479303 Author: Daniel Vetter Date: Fri Jul 5 14:10:03 2019 +0200 drm/komeda: remove slave_planes property Properties are uapi like anything else, with all the usual rules regarding review, testcases, open source userspace ... Furthermore driver-private kms properties are highly discouraged, over the past few years we've realized we need to make a serious effort at better standardizing this stuff. Again this probably needs multiple pieces to solve this properly: - To make plane configuration less surprising to userspace you propably need to virtualize planes, and reorder which logical plane you map to which physical one dynamically. Instead of exposing a komeda-specific limitation to userspace and expecting them to dtrt. I think msm and rcar-du do that already (and others), if you need people to chat with or example code. - If this is needed for validation, again ->atomic_print_state and the infrastructure around that is your friend. Fixes: 3b9dfa4ef28c ("drm/komeda: Add slave pipeline support") Cc: Lowry Li (Arm Technology China) Cc: James Qian Wang (Arm Technology China) Cc: Liviu Dudau Cc: Mali DP Maintainers Cc: Brian Starkey Signed-off-by: Daniel Vetter Signed-off-by: Daniel Vetter Signed-off-by: Liviu Dudau Link: https://patchwork.freedesktop.org/patch/msgid/20190705121006.26085-2-daniel.vetter@ffwll.ch commit 505f6cff880e33a9725bc8337bcb2941c6dd43a6 Author: Daniel Vetter Date: Fri Jul 5 14:10:02 2019 +0200 drm/komeda: Remove clock ratio property Properties are uapi like anything else, with all the usual rules regarding review, testcases, open source userspace ... Furthermore driver-private kms properties are highly discouraged, over the past few years we've realized we need to make a serious effort at better standardizing this stuff. From the discussion with Liviu the solution for these here needs multiple pieces: - For being able to reliably read the memory clock we need a DT property, plus maybe DT override snippets to fix it if it's wrong. - For exposing plane limitations to userspace there's TEST_ONLY. There is a bit a gap in telling userspace better that scaling doesn't work due to limits (atm a good strategy is to retry again without scaling when adding a plane didn't work the first time around). But that needs a more generic solution, not exposing something extremely komeda specific. - If this is needed by validation tools, you can still expose it in debugfs. We have an entire nice infrastructure for debug printing of kms objects already, see the various atomic_print_state callbacks and infrastructure around them. Fixes: 1f7f9ab7900e ("drm/komeda: Add engine clock requirement check for the downscaling") Cc: Lowry Li (Arm Technology China) Cc: James Qian Wang (Arm Technology China) Cc: Liviu Dudau Cc: Mali DP Maintainers Cc: Brian Starkey Signed-off-by: Daniel Vetter Signed-off-by: Daniel Vetter Signed-off-by: Liviu Dudau Link: https://patchwork.freedesktop.org/patch/msgid/20190705121006.26085-1-daniel.vetter@ffwll.ch commit d2850ce0bdd772a85043b1f07af99205b96e6e2a Merge: c3ec002e633e cd07a95f9b4d Author: Daniel Borkmann Date: Mon Jul 8 15:35:44 2019 +0200 Merge branch 'bpf-libbpf-perf-rb-api' Andrii Nakryiko says: ==================== This patchset adds a high-level API for setting up and polling perf buffers associated with BPF_MAP_TYPE_PERF_EVENT_ARRAY map. Details of APIs are described in corresponding commit. Patch #1 adds a set of APIs to set up and work with perf buffer. Patch #2 enhances libbpf to support auto-setting PERF_EVENT_ARRAY map size. Patch #3 adds test. Patch #4 converts bpftool map event_pipe to new API. Patch #5 updates README to mention perf_buffer_ prefix. v6->v7: - __x64_ syscall prefix (Yonghong); v5->v6: - fix C99 for loop variable initialization usage (Yonghong); v4->v5: - initialize perf_buffer_raw_opts in bpftool map event_pipe (Jakub); - add perf_buffer_ to README; v3->v4: - fixed bpftool event_pipe cmd error handling (Jakub); v2->v3: - added perf_buffer__new_raw for more low-level control; - converted bpftool map event_pipe to new API (Daniel); - fixed bug with error handling in create_maps (Song); v1->v2: - add auto-sizing of PERF_EVENT_ARRAY maps; ==================== Signed-off-by: Daniel Borkmann commit cd07a95f9b4df63ac130b4ee0cf87beca12412ca Author: Andrii Nakryiko Date: Sat Jul 6 11:06:28 2019 -0700 libbpf: add perf_buffer_ prefix to README perf_buffer "object" is part of libbpf API now, add it to the list of libbpf function prefixes. Suggested-by: Daniel Borkman Signed-off-by: Andrii Nakryiko Acked-by: Yonghong Song Signed-off-by: Daniel Borkmann commit 9b190f185d2f6d65b4c16074db0c4eafa32c7ae1 Author: Andrii Nakryiko Date: Sat Jul 6 11:06:27 2019 -0700 tools/bpftool: switch map event_pipe to libbpf's perf_buffer Switch event_pipe implementation to rely on new libbpf perf buffer API (it's raw low-level variant). Signed-off-by: Andrii Nakryiko Acked-by: Jakub Kicinski Acked-by: Yonghong Song Signed-off-by: Daniel Borkmann commit ee5cf82ce04a60d71b0dc219804f6cf1e6ba6d14 Author: Andrii Nakryiko Date: Sat Jul 6 11:06:26 2019 -0700 selftests/bpf: test perf buffer API Add test verifying perf buffer API functionality. Signed-off-by: Andrii Nakryiko Acked-by: Song Liu Acked-by: Yonghong Song Signed-off-by: Daniel Borkmann commit d7ff34d5fb5a2f6722786863c4afa79c51f8edf2 Author: Andrii Nakryiko Date: Sat Jul 6 11:06:25 2019 -0700 libbpf: auto-set PERF_EVENT_ARRAY size to number of CPUs For BPF_MAP_TYPE_PERF_EVENT_ARRAY typically correct size is number of possible CPUs. This is impossible to specify at compilation time. This change adds automatic setting of PERF_EVENT_ARRAY size to number of system CPUs, unless non-zero size is specified explicitly. This allows to adjust size for advanced specific cases, while providing convenient and logical defaults. Signed-off-by: Andrii Nakryiko Acked-by: Song Liu Acked-by: Yonghong Song Signed-off-by: Daniel Borkmann commit fb84b8224655309e7d38f989e426b82a4543f115 Author: Andrii Nakryiko Date: Sat Jul 6 11:06:24 2019 -0700 libbpf: add perf buffer API BPF_MAP_TYPE_PERF_EVENT_ARRAY map is often used to send data from BPF program to user space for additional processing. libbpf already has very low-level API to read single CPU perf buffer, bpf_perf_event_read_simple(), but it's hard to use and requires a lot of code to set everything up. This patch adds perf_buffer abstraction on top of it, abstracting setting up and polling per-CPU logic into simple and convenient API, similar to what BCC provides. perf_buffer__new() sets up per-CPU ring buffers and updates corresponding BPF map entries. It accepts two user-provided callbacks: one for handling raw samples and one for get notifications of lost samples due to buffer overflow. perf_buffer__new_raw() is similar, but provides more control over how perf events are set up (by accepting user-provided perf_event_attr), how they are handled (perf_event_header pointer is passed directly to user-provided callback), and on which CPUs ring buffers are created (it's possible to provide a list of CPUs and corresponding map keys to update). This API allows advanced users fuller control. perf_buffer__poll() is used to fetch ring buffer data across all CPUs, utilizing epoll instance. perf_buffer__free() does corresponding clean up and unsets FDs from BPF map. All APIs are not thread-safe. User should ensure proper locking/coordination if used in multi-threaded set up. Signed-off-by: Andrii Nakryiko Acked-by: Yonghong Song Signed-off-by: Daniel Borkmann commit e14651352a8e9158b58e9ac0c16f8db106b52158 Author: Wolfram Sang Date: Sat May 18 23:28:01 2019 +0200 watchdog: xen_wdt: drop warning after registering device The core will print out details now. Signed-off-by: Wolfram Sang Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit f848a15347d9707b38430976e801dd442480b42a Author: Wolfram Sang Date: Sat May 18 23:28:00 2019 +0200 watchdog: wm831x_wdt: drop warning after registering device The core will print out details now. Signed-off-by: Wolfram Sang Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit c8c844f28b68d1b09be3993007b599b01886e6eb Author: Wolfram Sang Date: Sat May 18 23:27:59 2019 +0200 watchdog: ts4800_wdt: drop warning after registering device The core will print out details now. Signed-off-by: Wolfram Sang Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit e290eb8c233923b099aa9e6ea717bf0b30871a78 Author: Wolfram Sang Date: Sat May 18 23:27:58 2019 +0200 watchdog: tegra_wdt: drop warning after registering device The core will print out details now. Signed-off-by: Wolfram Sang Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 913b187d12962fe8d9fa93c959f2f71ac16597ec Author: Wolfram Sang Date: Sat May 18 23:27:57 2019 +0200 watchdog: stmp3xxx_rtc_wdt: drop warning after registering device The core will print out details now. Signed-off-by: Wolfram Sang Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 71777442df8f63954d6f2029998afb565d307bc2 Author: Wolfram Sang Date: Sat May 18 23:27:56 2019 +0200 watchdog: stm32_iwdg: drop warning after registering device The core will print out details now. Signed-off-by: Wolfram Sang Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 7283b217aebda61d4ecfad799e2353fa5ce91e2e Author: Wolfram Sang Date: Sat May 18 23:27:55 2019 +0200 watchdog: st_lpc_wdt: drop warning after registering device The core will print out details now. Signed-off-by: Wolfram Sang Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit d311048eb0d211627dd8aab682e8412a1c0b7a02 Author: Wolfram Sang Date: Sat May 18 23:27:54 2019 +0200 watchdog: sprd_wdt: drop warning after registering device The core will print out details now. Signed-off-by: Wolfram Sang Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 199801cd7a50b14b15c5b87528fd5e86dc81404f Author: Wolfram Sang Date: Sat May 18 23:27:53 2019 +0200 watchdog: sp805_wdt: drop warning after registering device The core will print out details now. Signed-off-by: Wolfram Sang Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit d41e3f4ee5849c2d4f2467863d08e276b7a8e70b Author: Wolfram Sang Date: Sat May 18 23:27:52 2019 +0200 watchdog: sp5100_tco: drop warning after registering device The core will print out details now. Signed-off-by: Wolfram Sang Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 24b8eb74082de101852b1d570145fa2206ff74a1 Author: Wolfram Sang Date: Sat May 18 23:27:51 2019 +0200 watchdog: sama5d4_wdt: drop warning after registering device The core will print out details now. Signed-off-by: Wolfram Sang Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 386f465ae6dfd82aade41670461c151bb0a7131c Author: Wolfram Sang Date: Sat May 18 23:27:50 2019 +0200 watchdog: s3c2410_wdt: drop warning after registering device The core will print out details now. Signed-off-by: Wolfram Sang Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 2df87cfd8ea10f1c2d22b85ea9c39c355516ed76 Author: Wolfram Sang Date: Sat May 18 23:27:49 2019 +0200 watchdog: rave-sp-wdt: drop warning after registering device The core will print out details now. Signed-off-by: Wolfram Sang Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit ccbf872a3ee7071a09c3a3c22a4cb4a2ee162611 Author: Wolfram Sang Date: Sat May 18 23:27:48 2019 +0200 watchdog: qcom-wdt: drop warning after registering device The core will print out details now. Signed-off-by: Wolfram Sang Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 375611e561b13f3be01e9b7be79f54de4bfd7711 Author: Wolfram Sang Date: Sat May 18 23:27:47 2019 +0200 watchdog: pnx4008_wdt: drop warning after registering device The core will print out details now. Signed-off-by: Wolfram Sang Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 90984aa137a1f1eb5c52eb8aaa63c0203ff12572 Author: Wolfram Sang Date: Sat May 18 23:27:46 2019 +0200 watchdog: pic32-wdt: drop warning after registering device The core will print out details now. Signed-off-by: Wolfram Sang Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 888ca35d74cef6e66cd3c651eba3fca6d66147e5 Author: Wolfram Sang Date: Sat May 18 23:27:45 2019 +0200 watchdog: pic32-dmt: drop warning after registering device The core will print out details now. Signed-off-by: Wolfram Sang Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 0fa6cf71cdec0eaebd69cf25de3f14a9152106e5 Author: Wolfram Sang Date: Sat May 18 23:27:44 2019 +0200 watchdog: of_xilinx_wdt: drop warning after registering device The core will print out details now. Signed-off-by: Wolfram Sang Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit ab9113d0460f06bff8c22271b77a05a5f6cadbac Author: Wolfram Sang Date: Sat May 18 23:27:43 2019 +0200 watchdog: npcm_wdt: drop warning after registering device The core will print out details now. Signed-off-by: Wolfram Sang Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 0a33dce48fbd418aeb3a4259b5f71e3f6bb9d7b9 Author: Wolfram Sang Date: Sat May 18 23:27:42 2019 +0200 watchdog: nic7018_wdt: drop warning after registering device The core will print out details now. Signed-off-by: Wolfram Sang Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 9076eb5dff9351c2178f76bb2ce63c2c0c98472a Author: Wolfram Sang Date: Sat May 18 23:27:41 2019 +0200 watchdog: ni903x_wdt: drop warning after registering device The core will print out details now. Signed-off-by: Wolfram Sang Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit a239027325d0ea6722d9ce04b920b894d93b5fed Author: Wolfram Sang Date: Sat May 18 23:27:40 2019 +0200 watchdog: mpc8xxx_wdt: drop warning after registering device The core will print out details now. Signed-off-by: Wolfram Sang Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 86fc18657899c76a998da288056b128d9da5c244 Author: Wolfram Sang Date: Sat May 18 23:27:39 2019 +0200 watchdog: menf21bmc_wdt: drop warning after registering device The core will print out details now. Signed-off-by: Wolfram Sang Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit eddeb07bd6445139b99ec88b5a23877f57620802 Author: Wolfram Sang Date: Sat May 18 23:27:38 2019 +0200 watchdog: mena21_wdt: drop warning after registering device The core will print out details now. Signed-off-by: Wolfram Sang Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 2b7ebd34895964174c6384ce1dade78fd82ca313 Author: Wolfram Sang Date: Sat May 18 23:27:37 2019 +0200 watchdog: mei_wdt: drop warning after registering device The core will print out details now. Signed-off-by: Wolfram Sang Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 9daa2e1436f307309663b176abd5d1d443c5e080 Author: Wolfram Sang Date: Sat May 18 23:27:36 2019 +0200 watchdog: max77620_wdt: drop warning after registering device The core will print out details now. Signed-off-by: Wolfram Sang Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 7da547350f5067c94d935f9b1fbef8dbc2c202ab Author: Wolfram Sang Date: Sat May 18 23:27:35 2019 +0200 watchdog: loongson1_wdt: drop warning after registering device The core will print out details now. Signed-off-by: Wolfram Sang Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 9ee644c9326cd5ad5080408820075465b51c9c16 Author: Wolfram Sang Date: Sat May 18 23:27:34 2019 +0200 watchdog: jz4740_wdt: drop warning after registering device The core will print out details now. Signed-off-by: Wolfram Sang Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit ca2d4490705f2f6d48292b171510a4230f56c7da Author: Wolfram Sang Date: Sat May 18 23:27:33 2019 +0200 watchdog: intel-mid_wdt: drop warning after registering device The core will print out details now. Signed-off-by: Wolfram Sang Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 31f4a2cf8fc1e9d52f00e824480ef807904edbca Author: Wolfram Sang Date: Sat May 18 23:27:32 2019 +0200 watchdog: imx_sc_wdt: drop warning after registering device The core will print out details now. Signed-off-by: Wolfram Sang Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 63c1cd53451527d1bfda6ae7e4a8d84661919ce3 Author: Wolfram Sang Date: Sat May 18 23:27:31 2019 +0200 watchdog: imx2_wdt: drop warning after registering device The core will print out details now. Signed-off-by: Wolfram Sang Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 8f952c015f456d0acc0a5e31415f657ccf85824c Author: Wolfram Sang Date: Sat May 18 23:27:30 2019 +0200 watchdog: ie6xx_wdt: drop warning after registering device The core will print out details now. Signed-off-by: Wolfram Sang Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 34b8580fe34d53226b83b2fd099317d7f4f9fd6f Author: Wolfram Sang Date: Sat May 18 23:27:29 2019 +0200 watchdog: i6300esb: drop warning after registering device The core will print out details now. Signed-off-by: Wolfram Sang Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit f51540b83faa1a575772b4a38d00aa9b2f263023 Author: Wolfram Sang Date: Sat May 18 23:27:28 2019 +0200 watchdog: hpwdt: drop warning after registering device The core will print out details now. Signed-off-by: Wolfram Sang Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 2d065d2e9b15c3bb2f00b7fa466c75425d8b9983 Author: Wolfram Sang Date: Sat May 18 23:27:27 2019 +0200 watchdog: ftwdt010_wdt: drop warning after registering device The core will print out details now. Signed-off-by: Wolfram Sang Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit cdad26977e3fc0621a9378ef286e243b5ec4b7c0 Author: Wolfram Sang Date: Sat May 18 23:27:26 2019 +0200 watchdog: digicolor_wdt: drop warning after registering device The core will print out details now. Signed-off-by: Wolfram Sang Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 6ab6d33ee002e68d607d77bab0612705995ffbe6 Author: Wolfram Sang Date: Sat May 18 23:27:25 2019 +0200 watchdog: davinci_wdt: drop warning after registering device The core will print out details now. Signed-off-by: Wolfram Sang Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 04892d893b1901503820897cc46839660bf1a6b0 Author: Wolfram Sang Date: Sat May 18 23:27:24 2019 +0200 watchdog: da9062_wdt: drop warning after registering device The core will print out details now. Signed-off-by: Wolfram Sang Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 60415f701fce001746f4cf37beb4d6c713cb44f7 Author: Wolfram Sang Date: Sat May 18 23:27:23 2019 +0200 watchdog: da9052_wdt: drop warning after registering device The core will print out details now. Signed-off-by: Wolfram Sang Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 76ed828b811e9c4f282179ec04ea8e65b591c844 Author: Wolfram Sang Date: Sat May 18 23:27:22 2019 +0200 watchdog: cadence_wdt: drop warning after registering device The core will print out details now. Signed-off-by: Wolfram Sang Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit ae07bdbe7f318ea6d543a68d8dc2457f81cd7ed0 Author: Wolfram Sang Date: Sat May 18 23:27:21 2019 +0200 watchdog: bcm_kona_wdt: drop warning after registering device The core will print out details now. Signed-off-by: Wolfram Sang Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit f54298950eab8d4b931eb4871bd37bc274f85d98 Author: Wolfram Sang Date: Sat May 18 23:27:20 2019 +0200 watchdog: bcm7038_wdt: drop warning after registering device The core will print out details now. Signed-off-by: Wolfram Sang Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit d5f3e24f22231991615421610d72d037423bba27 Author: Wolfram Sang Date: Sat May 18 23:27:19 2019 +0200 watchdog: bcm2835_wdt: drop warning after registering device The core will print out details now. Signed-off-by: Wolfram Sang Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 4ab054336109b743d851fe57fe51b8d61f1ff3e9 Author: Wolfram Sang Date: Sat May 18 23:27:18 2019 +0200 watchdog: aspeed_wdt: drop warning after registering device The core will print out details now. Signed-off-by: Wolfram Sang Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit b608075e4bd6ad21968e8bfddd396c43b625e2b1 Author: Wolfram Sang Date: Sat May 18 23:27:17 2019 +0200 watchdog: let core print error message when registering device fails So we can remove boilerplate code from drivers. Signed-off-by: Wolfram Sang Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 80030425e0207172cd68a8952c5054db85ffa85f Author: Wolfram Sang Date: Sat May 18 23:27:16 2019 +0200 watchdog: make watchdog_deferred_registration_add() void It cannot fail, so no return value needed. Signed-off-by: Wolfram Sang Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 0dcb4efb1095d0a1f5f681c2b94e98b009cc5d77 Author: Takashi Sakamoto Date: Sun Jul 7 21:07:59 2019 +0900 ALSA: firewire-lib: code refactoring for local variables It's better to use int type for loop index. For consistency, the name of local variable for the number of data block should be plural. Signed-off-by: Takashi Sakamoto Signed-off-by: Takashi Iwai commit 02394af3e00df73c3674de0783d3a31c8162c840 Author: Takashi Sakamoto Date: Sun Jul 7 21:07:58 2019 +0900 ALSA: firewire-lib: code refactoring for post operation to data block counter As a result of former commits, post operation to data block count for cases without CIP_DBC_IS_END_EVENT can be done just with data_block_counter member of amdtp_stream structure. This commit adds code refactoring to obsolete local variable for data block counter. Signed-off-by: Takashi Sakamoto Signed-off-by: Takashi Iwai commit b8b0e24c226e4434821f437070935218fdd39741 Author: Takashi Sakamoto Date: Sun Jul 7 21:07:57 2019 +0900 ALSA: firewire-lib: code refactoring for error path of parser for CIP header When a parser for CIP header returns -EAGAIN, no extra care is needed to probe tracepoints event. This commit adds code refactoring for the error path. Signed-off-by: Takashi Sakamoto Signed-off-by: Takashi Iwai commit 213fa98981588887c1a2ed817e6a48e2428e97a1 Author: Takashi Sakamoto Date: Sun Jul 7 21:07:56 2019 +0900 ALSA: firewire-lib: fix different data block counter between probed event and transferred isochronous packet For IT context, tracepoints event is probed after calculating next data block counter. This brings difference of data block counter between the probed event and actual isochronous packet. This commit fixes it. Signed-off-by: Takashi Sakamoto Signed-off-by: Takashi Iwai commit 4ece7f6fd830d71bbb185434bf081b1f47701a67 Author: Takashi Sakamoto Date: Sun Jul 7 21:07:55 2019 +0900 ALSA: firewire-lib: fix initial value of data block count for IR context without CIP_DBC_IS_END_EVENT For IR context, ALSA IEC 61883-1/6 engine uses initial value of data block counter as UINT_MAX, to detect first isochronous packet in the middle of packet streaming. At present, when CIP_DBC_IS_END_EVENT is not used (i.e. for drivers except for ALSA fireworks driver), the initial value is used as is for tracepoints event. However, the engine can detect the value of dbc field in the payload of first isochronous packet and the value should be assigned to the event. This commit fixes the bug. Fixes: 76864868dbab ("ALSA: firewire-lib: cache next data_block_counter after probing tracepoints event for IR context") Signed-off-by: Takashi Sakamoto Signed-off-by: Takashi Iwai commit 7fbf909668d69d7ab4428f6f55cb53fe4451b9b1 Author: Takashi Sakamoto Date: Sun Jul 7 21:07:54 2019 +0900 ALSA: firewire-lib/fireface: fix initial value of data block counter for IR context with CIP_NO_HEADER For IR context, ALSA IEC 61883-1/6 engine uses initial value of data block counter as UINT_MAX, to detect first isochronous packet in the middle of packet streaming. At present, when CIP_NO_HEADER is used (i.e. for ALSA fireface driver), the initial value is used for tracepoints event. 0x00 should be for the event when the initial value is UINT_MAX because isochronous packets with CIP_NO_HEADER option has no field for data block count. This commit fixes the bug. Fixes: 76864868dbab ("ALSA: firewire-lib: cache next data_block_counter after probing tracepoints event for IR context") Signed-off-by: Takashi Sakamoto Signed-off-by: Takashi Iwai commit 0ebf3ceb83648f9d149220bf0c6986ddce11361a Author: Takashi Sakamoto Date: Sun Jul 7 21:07:53 2019 +0900 ALSA: firewire-lib: fix invalid length of rx packet payload for tracepoint events Although CIP header is handled as context header, the length of isochronous packet includes two quadlets for its payload. In tracepoints event the value of payload_quadlets should includes the two quadlets. But at present it doesn't. This commit fixes the bug. Fixes: b18f0cfaf16b ("ALSA: firewire-lib: use 8 byte packet header for IT context to separate CIP header from CIP payload") Signed-off-by: Takashi Sakamoto Signed-off-by: Takashi Iwai commit 3c53c6255d598db7084c5c3d7553d7200e857818 Merge: b89b889a326a a98429acadef Author: Takashi Iwai Date: Mon Jul 8 14:45:20 2019 +0200 Merge tag 'asoc-v5.3' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus ASoC: Updates for v5.3 This is a very big update, mainly thanks to Morimoto-san's refactoring work and some fairly large new drivers. - Lots more work on moving towards a component based framework from Morimoto-san. - Support for force disconnecting muxes from Jerome Brunet. - New drivers for Cirrus Logic CS47L35, CS47L85 and CS47L90, Conexant CX2072X, Realtek RT1011 and RT1308. Signed-off-by: Takashi Iwai commit d31d07b97a5e76f41e00eb81dcca740e84aa7782 Author: Luis Henriques Date: Mon Jul 1 18:16:34 2019 +0100 ceph: fix end offset in truncate_inode_pages_range call Commit e450f4d1a5d6 ("ceph: pass inclusive lend parameter to filemap_write_and_wait_range()") fixed the end offset parameter used to call filemap_write_and_wait_range and invalidate_inode_pages2_range. Unfortunately it missed truncate_inode_pages_range, introducing a regression that is easily detected by xfstest generic/130. The problem is that when doing direct IO it is possible that an extra page is truncated from the page cache when the end offset is page aligned. This can cause data loss if that page hasn't been sync'ed to the OSDs. While there, change code to use PAGE_ALIGN macro instead. Cc: stable@vger.kernel.org Fixes: e450f4d1a5d6 ("ceph: pass inclusive lend parameter to filemap_write_and_wait_range()") Signed-off-by: Luis Henriques Reviewed-by: Jeff Layton Signed-off-by: Ilya Dryomov commit 52dd0f1b3f94e600901ad785226e597743401245 Author: Luis Henriques Date: Fri Jul 5 17:14:56 2019 +0100 ceph: use generic_delete_inode() for ->drop_inode ceph_drop_inode() implementation is not any different from the generic function, thus there's no point in keeping it around. Signed-off-by: Luis Henriques Reviewed-by: Jeff Layton Signed-off-by: Ilya Dryomov commit 87bc5b895d94a0f40fe170d4cf5771c8e8f85d15 Author: Yan, Zheng Date: Sun Jun 2 09:45:38 2019 +0800 ceph: use ceph_evict_inode to cleanup inode's resource remove_session_caps() relies on __wait_on_freeing_inode(), to wait for freeing inode to remove its caps. But VFS wakes freeing inode waiters before calling destroy_inode(). Cc: stable@vger.kernel.org Link: https://tracker.ceph.com/issues/40102 Signed-off-by: "Yan, Zheng" Reviewed-by: Jeff Layton Signed-off-by: Ilya Dryomov commit 0f7cf80ae96c2a585a00b2cd8b6d24699db47f35 Author: Luis Henriques Date: Thu Jun 27 14:51:22 2019 +0100 ceph: initialize superblock s_time_gran to 1 Having granularity set to 1us results in having inode timestamps with a accurancy different from the fuse client (i.e. atime, ctime and mtime will always end with '000'). This patch normalizes this behaviour and sets the granularity to 1. Signed-off-by: Luis Henriques Reviewed-by: Jeff Layton Reviewed-by: Sage Weil Signed-off-by: Ilya Dryomov commit 1edd1fecae5e7ab23c64c02aa52c4690d6a0b32f Author: Jeff Layton Date: Wed Jun 26 06:56:17 2019 -0400 MAINTAINERS: take over for Zheng as CephFS kernel client maintainer Zheng wants to be able to spend more time working on the MDS, so I've volunteered to take over for him as the CephFS kernel client maintainer. Signed-off-by: Jeff Layton Acked-by: "Yan, Zheng" Signed-off-by: Ilya Dryomov commit 8b5bec5c83e8e319d5ecb4efcbf04bdef85409e6 Author: Ilya Dryomov Date: Wed Jun 19 15:45:27 2019 +0200 rbd: setallochint only if object doesn't exist setallochint is really only useful on object creation. Continue hinting unconditionally if object map cannot be used. Signed-off-by: Ilya Dryomov Reviewed-by: Dongsheng Yang commit 22e8bd51bb0469d1a524130a057f894ff632376a Author: Ilya Dryomov Date: Wed Jun 5 19:25:11 2019 +0200 rbd: support for object-map and fast-diff Speed up reads, discards and zeroouts through RBD_OBJ_FLAG_MAY_EXIST and RBD_OBJ_FLAG_NOOP_FOR_NONEXISTENT based on object map. Invalid object maps are not trusted, but still updated. Note that we never iterate, resize or invalidate object maps. If object-map feature is enabled but object map fails to load, we just fail the requester (either "rbd map" or I/O, by way of post-acquire action). Signed-off-by: Ilya Dryomov commit da5ef6be3467eb2d293790dea69b5b562490715a Author: Ilya Dryomov Date: Mon Jun 17 15:29:49 2019 +0200 rbd: call rbd_dev_mapping_set() from rbd_dev_image_probe() Snapshot object map will be loaded in rbd_dev_image_probe(), so we need to know snapshot's size (as opposed to HEAD's size) sooner. Signed-off-by: Ilya Dryomov Reviewed-by: Dongsheng Yang commit 4cf3e6dff7ea517544e1da7810a0b3ebba380d2c Author: Ilya Dryomov Date: Fri Jun 14 18:00:19 2019 +0200 libceph: export osd_req_op_data() macro We already have one exported wrapper around it for extent.osd_data and rbd_object_map_update_finish() needs another one for cls.request_data. Signed-off-by: Ilya Dryomov Reviewed-by: Dongsheng Yang Reviewed-by: Jeff Layton commit 68ada915eea10f36760ffe414810390a104df093 Author: Ilya Dryomov Date: Fri Jun 14 18:16:51 2019 +0200 libceph: change ceph_osdc_call() to take page vector for response This will be used for loading object map. rbd_obj_read_sync() isn't suitable because object map must be accessed through class methods. Signed-off-by: Ilya Dryomov Reviewed-by: Dongsheng Yang Reviewed-by: Jeff Layton commit ef83171b49c66d851a1a0dc6da5b4a4d8ee6ce9a Author: Ilya Dryomov Date: Mon Apr 8 14:16:05 2019 +0200 libceph: bump CEPH_MSG_MAX_DATA_LEN (again) This time for rbd object map. Object maps are limited in size to 256000000 objects, two bits per object. Signed-off-by: Ilya Dryomov Reviewed-by: Dongsheng Yang commit 637cd060537d0c40bcf4f164b8a2c6e9b747e1ad Author: Ilya Dryomov Date: Thu Jun 6 17:14:49 2019 +0200 rbd: new exclusive lock wait/wake code rbd_wait_state_locked() is built around rbd_dev->lock_waitq and blocks rbd worker threads while waiting for the lock, potentially impacting other rbd devices. There is no good way to pass an error code into image request state machines when acquisition fails, hence the use of RBD_DEV_FLAG_BLACKLISTED for everything and various other issues. Introduce rbd_dev->acquiring_list and move acquisition into image request state machine. Use rbd_img_schedule() for kicking and passing error codes. No blocking occurs while waiting for the lock, but rbd_dev->lock_rwsem is still held across lock, unlock and set_cookie calls. Always acquire the lock on "rbd map" to avoid associating the latency of acquiring the lock with the first I/O request. A slight regression is that lock_timeout is now respected only if lock acquisition is triggered by "rbd map" and not by I/O. This is somewhat compensated by the fact that we no longer block if the peer refuses to release lock -- I/O is failed with EROFS right away. Signed-off-by: Ilya Dryomov Reviewed-by: Dongsheng Yang commit e1fddc8fdd22ed5a55fc7e7a81437c4663c7ba8c Author: Ilya Dryomov Date: Thu May 30 16:07:48 2019 +0200 rbd: quiescing lock should wait for image requests Syncing OSD requests doesn't really work. A single image request may be comprised of multiple object requests, each of which can go through a series of OSD requests (original, copyups, etc). On top of that, the OSD cliest may be shared with other rbd devices. What we want is to ensure that all in-flight image requests complete. Introduce rbd_dev->running_list and block in RBD_LOCK_STATE_RELEASING until that happens. New OSD requests may be started during this time. Note that __rbd_img_handle_request() acquires rbd_dev->lock_rwsem only if need_exclusive_lock() returns true. This avoids a deadlock similar to the one outlined in the previous commit between unlock and I/O that doesn't require lock, such as a read with object-map feature disabled. Signed-off-by: Ilya Dryomov Reviewed-by: Dongsheng Yang commit a2b1da09793d003410b57f96eaf7e83e43b7a50a Author: Ilya Dryomov Date: Thu May 30 11:15:23 2019 +0200 rbd: lock should be quiesced on reacquire Quiesce exclusive lock at the top of rbd_reacquire_lock() instead of only when ceph_cls_set_cookie() fails. This avoids a deadlock on rbd_dev->lock_rwsem. If rbd_dev->lock_rwsem is needed for I/O completion, set_cookie can hang ceph-msgr worker thread if set_cookie reply ends up behind an I/O reply, because, like lock and unlock requests, set_cookie is sent and waited upon with rbd_dev->lock_rwsem held for write. Signed-off-by: Ilya Dryomov Reviewed-by: Dongsheng Yang commit 793333a303c90174c317e3fa12e898bbc02daee4 Author: Ilya Dryomov Date: Thu Jun 13 17:44:08 2019 +0200 rbd: introduce copyup state machine Both write and copyup paths will get more complex with object map. Factor copyup code out into a separate state machine. While at it, take advantage of obj_req->osd_reqs list and issue empty and current snapc OSD requests together, one after another. Signed-off-by: Ilya Dryomov Reviewed-by: Dongsheng Yang commit ea9b743c97dc52c74b97d968bccbb51f6e5c92b6 Author: Ilya Dryomov Date: Fri May 31 15:11:26 2019 +0200 rbd: rename rbd_obj_setup_*() to rbd_obj_init_*() These functions don't allocate and set up OSD requests anymore. Signed-off-by: Ilya Dryomov Reviewed-by: Dongsheng Yang commit a086a1b8bdbd14a59b8a4cd979d5c7894e3af59e Author: Ilya Dryomov Date: Wed Jun 12 18:33:31 2019 +0200 rbd: move OSD request allocation into object request state machines Following submission, move initial OSD request allocation into object request state machines. Everything that has to do with OSD requests is now handled inside the state machine, all __rbd_img_fill_request() has left is initialization. Signed-off-by: Ilya Dryomov Reviewed-by: Dongsheng Yang commit 27bbd911624891ccb17980ff784d68e6f470b92b Author: Ilya Dryomov Date: Wed May 29 17:31:37 2019 +0200 rbd: factor out __rbd_osd_setup_discard_ops() With obj_req->xferred removed, obj_req->ex.oe_off and obj_req->ex.oe_len can be updated if required for alignment. Previously the new offset and length weren't stored anywhere beyond rbd_obj_setup_discard(). Signed-off-by: Ilya Dryomov Reviewed-by: Dongsheng Yang commit b5ae8cbc6e3746c05a5ffe59cb4c03fee1730764 Author: Ilya Dryomov Date: Wed May 29 16:53:14 2019 +0200 rbd: factor out rbd_osd_setup_copyup() Signed-off-by: Ilya Dryomov Reviewed-by: Dongsheng Yang commit bcbab1db6c95a9abe7793c186f87fd41f1b8d4ea Author: Ilya Dryomov Date: Mon May 27 11:41:36 2019 +0200 rbd: introduce obj_req->osd_reqs list Since the dawn of time it had been assumed that a single object request spawns a single OSD request. This is already impacting copyup: instead of sending empty and current snapc copyups together, we wait for empty snapc OSD request to complete in order to reassign obj_req->osd_req with current snapc OSD request. Looking further, updating potentially hundreds of snapshot object maps serially is a non-starter. Replace obj_req->osd_req pointer with obj_req->osd_reqs list. Use osd_req->r_private_item for linkage. Signed-off-by: Ilya Dryomov Reviewed-by: Dongsheng Yang commit 94e85771881027e62afdddadd31e3eec73025990 Author: Ilya Dryomov Date: Mon Jul 8 12:50:09 2019 +0200 libceph: rename r_unsafe_item to r_private_item This list item remained from when we had safe and unsafe replies (commit vs ack). It has since become a private list item for use by clients. Signed-off-by: Ilya Dryomov commit 0192ce2ee68b54394ba62e5668067bf01f7bc609 Author: Ilya Dryomov Date: Thu May 16 15:06:56 2019 +0200 rbd: introduce image request state machine Make it possible to schedule image requests on a workqueue. This fixes parent chain recursion added in the previous commit and lays the ground for exclusive lock wait/wake improvements. The "wait for pending subrequests and report first nonzero result" code is generalized to be used by object request state machine. Signed-off-by: Ilya Dryomov Reviewed-by: Dongsheng Yang commit 85b5e6d11898fddfcb2832024f73454d448f76e0 Author: Ilya Dryomov Date: Tue May 14 21:06:07 2019 +0200 rbd: move OSD request submission into object request state machines Start eliminating asymmetry where the initial OSD request is allocated and submitted from outside the state machine, making error handling and restarts harder than they could be. This commit deals with submission, a commit that deals with allocation will follow. Note that this commit adds parent chain recursion on the submission side: rbd_img_request_submit rbd_obj_handle_request __rbd_obj_handle_request rbd_obj_handle_read rbd_obj_handle_write_guard rbd_obj_read_from_parent rbd_img_request_submit This will be fixed in the next commit. Signed-off-by: Ilya Dryomov Reviewed-by: Dongsheng Yang commit 0ad5d953548fe336134026b039ad4fd9e6594f16 Author: Ilya Dryomov Date: Tue May 14 20:45:38 2019 +0200 rbd: get rid of RBD_OBJ_WRITE_{FLAT,GUARD} In preparation for moving OSD request allocation and submission into object request state machines, get rid of RBD_OBJ_WRITE_{FLAT,GUARD}. We would need to start in a new state, whether the request is guarded or not. Unify them into RBD_OBJ_WRITE_OBJECT and pass guard info through obj_req->flags. While at it, make our ENOENT handling a little more precise: only hide ENOENT when it is actually expected, that is on delete. Signed-off-by: Ilya Dryomov Reviewed-by: Dongsheng Yang commit a9b67e69949d20dcb38ea6aaed5500318c7c91f6 Author: Ilya Dryomov Date: Wed May 8 13:35:57 2019 +0200 rbd: replace obj_req->tried_parent with obj_req->read_state Make rbd_obj_handle_read() look like a state machine and get rid of the necessity to patch result in rbd_obj_handle_request(), completing the removal of obj_req->xferred and img_req->xferred. Signed-off-by: Ilya Dryomov Reviewed-by: Dongsheng Yang commit 54ab3b24c536bc9b45ab444830974c6bea57778e Author: Ilya Dryomov Date: Sat May 11 16:21:49 2019 +0200 rbd: get rid of obj_req->xferred, obj_req->result and img_req->xferred obj_req->xferred and img_req->xferred don't bring any value. The former is used for short reads and has to be set to obj_req->ex.oe_len after that and elsewhere. The latter is just an aggregate. Use result for short reads (>=0 - number of bytes read, <0 - error) and pass it around explicitly. No need to store it in obj_req. Signed-off-by: Ilya Dryomov Reviewed-by: Dongsheng Yang commit 26350535c2cef4bcf5de597c301b0560650cec19 Author: Jeff Layton Date: Mon Jun 24 07:32:21 2019 -0400 ceph: don't NULL terminate virtual xattrs The convention with xattrs is to not store the termination with string data, given that it returns the length. This is how setfattr/getfattr operate. Most of ceph's virtual xattr routines use snprintf to plop the string directly into the destination buffer, but snprintf always NULL terminates the string. This means that if we send the kernel a buffer that is the exact length needed to hold the string, it'll end up truncated. Add a ceph_fmt_xattr helper function to format the string into an on-stack buffer that should always be large enough to hold the whole thing and then memcpy the result into the destination buffer. If it does turn out that the formatted string won't fit in the on-stack buffer, then return -E2BIG and do a WARN_ONCE(). Change over most of the virtual xattr routines to use the new helper. A couple of the xattrs are sourced from strings however, and it's difficult to know how long they'll be. Just have those memcpy the result in place after verifying the length. Signed-off-by: Jeff Layton Reviewed-by: "Yan, Zheng" Acked-by: Ilya Dryomov Signed-off-by: Ilya Dryomov commit 3b421018f48c482bdc9650f894aa1747cf90e51d Author: Jeff Layton Date: Thu Jun 13 15:17:00 2019 -0400 ceph: return -ERANGE if virtual xattr value didn't fit in buffer The getxattr manpage states that we should return ERANGE if the destination buffer size is too small to hold the value. ceph_vxattrcb_layout does this internally, but we should be doing this for all vxattrs. Fix the only caller of getxattr_cb to check the returned size against the buffer length and return -ERANGE if it doesn't fit. Drop the same check in ceph_vxattrcb_layout and just rely on the caller to handle it. Signed-off-by: Jeff Layton Reviewed-by: "Yan, Zheng" Acked-by: Ilya Dryomov Signed-off-by: Ilya Dryomov commit f1d1b51deabbd1e7b8c24883145fbf784784d250 Author: Jeff Layton Date: Mon Jun 24 07:39:18 2019 -0400 ceph: make getxattr_cb return ssize_t The getxattr_cb functions return size_t, which is unsigned and then cast that value to int and then ssize_t before returning it. While all of this works, it relies on implicit casting rules for signed/unsigned conversions. Change getxattr_cb to return ssize_t to better conform with what the caller actually wants. Also, remove some suspicious casts. Signed-off-by: Jeff Layton Reviewed-by: "Yan, Zheng" Acked-by: Ilya Dryomov Signed-off-by: Ilya Dryomov commit 49ada6e8dc9f64ad1e8dd6f7b453c9e584e9f897 Author: Yan, Zheng Date: Thu Jun 20 12:09:08 2019 +0800 ceph: more precise CEPH_CLIENT_CAPS_PENDING_CAPSNAP Client uses this flag to tell mds if there is more cap snap need to flush. It's mainly for the case that client needs to re-send cap/snap flushes after mds failover, but CEPH_CAP_ANY_FILE_WR on corresponding inodes are all released before mds failover. Signed-off-by: "Yan, Zheng" Reviewed-by: Jeff Layton Signed-off-by: Ilya Dryomov commit d6cee9dbd8c841795cd672b98069866789916648 Author: Yan, Zheng Date: Thu Jun 20 16:09:37 2019 +0800 ceph: kick flushing and flush snaps before sending normal cap message Otherwise client may send cap flush messages in wrong order. Signed-off-by: "Yan, Zheng" Reviewed-by: Jeff Layton Signed-off-by: Ilya Dryomov commit 054f8d41affbaeddca15ac39366a1f2f4b4f4488 Author: Yan, Zheng Date: Thu Jun 20 16:00:31 2019 +0800 ceph: clear CEPH_I_KICK_FLUSH flag inside __kick_flushing_caps() Signed-off-by: "Yan, Zheng" Reviewed-by: Jeff Layton Signed-off-by: Ilya Dryomov commit 5c30835690f12e14f88dd2e90c8cbb0ea8eb975f Author: Jeff Layton Date: Thu Jun 6 08:57:27 2019 -0400 ceph: increment change_attribute on local changes We don't set SB_I_VERSION on ceph since we need to manage it ourselves, so we must increment it whenever we update the file times. Signed-off-by: Jeff Layton Reviewed-by: "Yan, Zheng" Signed-off-by: Ilya Dryomov commit 176c77c9c9b1f843332496a28f4545eb96d5dab9 Author: Jeff Layton Date: Thu Jun 6 08:06:40 2019 -0400 ceph: handle change_attr in cap messages Signed-off-by: Jeff Layton Reviewed-by: "Yan, Zheng" Signed-off-by: Ilya Dryomov commit a35ead314e0b9252a92a5e179a00b242d1af7bff Author: Jeff Layton Date: Thu Jun 6 07:29:23 2019 -0400 ceph: add change_attr field to ceph_inode_info Signed-off-by: Jeff Layton Reviewed-by: "Yan, Zheng" Signed-off-by: Ilya Dryomov commit 441d367644e2f60b37f36bfc656deee551acba5b Author: Jeff Layton Date: Wed Jun 5 17:24:22 2019 -0400 iversion: add a routine to update a raw value with a larger one Under ceph, clients can be independently updating iversion themselves, while working under comprehensive sets of caps on an inode. In that situation we always want to prefer the largest value of a change attribute. Add a new function that will update a raw value with a larger one, but otherwise leave it alone. Signed-off-by: Jeff Layton Reviewed-by: "Yan, Zheng" Signed-off-by: Ilya Dryomov commit 58981784a6926e14964bb0e41dca38d75976b946 Author: Jeff Layton Date: Wed Jun 5 12:08:32 2019 -0400 ceph: allow querying of STATX_BTIME in ceph_getattr Signed-off-by: Jeff Layton Reviewed-by: "Yan, Zheng" Signed-off-by: Ilya Dryomov commit 6adaaafdd81d5c01875fe233ab73deb81b34caa1 Author: Jeff Layton Date: Fri May 31 12:24:22 2019 -0400 libceph: turn on CEPH_FEATURE_MSG_ADDR2 Now that the client can handle either address formatting, advertise to the peer that we can support it. Signed-off-by: Jeff Layton Reviewed-by: "Yan, Zheng" Signed-off-by: Ilya Dryomov commit ec62b894df1ae69eb8e66d69317dfff517f6d1f3 Author: Jeff Layton Date: Wed May 29 12:23:14 2019 -0400 ceph: handle btime in cap messages Signed-off-by: Jeff Layton Reviewed-by: "Yan, Zheng" Signed-off-by: Ilya Dryomov commit 245ce991cca55eb16cfc43d1655574121b8ed85f Author: Jeff Layton Date: Wed May 29 11:19:42 2019 -0400 ceph: add btime field to ceph_inode_info Signed-off-by: Jeff Layton Reviewed-by: "Yan, Zheng" Signed-off-by: Ilya Dryomov commit 2c66de560fa2dda0a600e908897116914db8f500 Author: Jeff Layton Date: Mon Jun 17 09:24:31 2019 -0400 libceph: rename ceph_encode_addr to ceph_encode_banner_addr ...ditto for the decode function. We only use these functions to fix up banner addresses now, so let's name them more appropriately. Signed-off-by: Jeff Layton Reviewed-by: "Yan, Zheng" Signed-off-by: Ilya Dryomov commit d3c3c0a841d5dafc5395be363996d619255a732f Author: Jeff Layton Date: Mon Jun 17 06:57:25 2019 -0400 libceph: use TYPE_LEGACY for entity addrs instead of TYPE_NONE Going forward, we'll have different address types so let's use the addr2 TYPE_LEGACY for internal tracking rather than TYPE_NONE. Also, make ceph_pr_addr print the address type value as well. Signed-off-by: Jeff Layton Reviewed-by: "Yan, Zheng" Signed-off-by: Ilya Dryomov commit 2f9800c899dc1f4ad0ca32105069bfa83e80a05b Author: Jeff Layton Date: Tue Jun 4 15:17:32 2019 -0400 ceph: fix decode_locker to use ceph_decode_entity_addr Signed-off-by: Jeff Layton Reviewed-by: "Yan, Zheng" Signed-off-by: Ilya Dryomov commit f3848af1bf545575d7a98084f82f67e96ffdf4d5 Author: Jeff Layton Date: Tue Jun 4 11:26:36 2019 -0400 ceph: have MDS map decoding use entity_addr_t decoder Signed-off-by: Jeff Layton Reviewed-by: "Yan, Zheng" Signed-off-by: Ilya Dryomov commit 8cb5f2b4fcf4b8a4043e26c232b435e83e2abe87 Author: Jeff Layton Date: Tue Jun 4 15:10:44 2019 -0400 libceph: correctly decode ADDR2 addresses in incremental OSD maps Given the new format, we have to decode the addresses twice. Once to skip past the new_up_client field, and a second time to collect the addresses. Signed-off-by: Jeff Layton Reviewed-by: "Yan, Zheng" Signed-off-by: Ilya Dryomov commit 51fc7ab44519adc6684ac6575826f8b1a16ee4b3 Author: Jeff Layton Date: Tue Jun 4 14:35:18 2019 -0400 libceph: fix watch_item_t decoding to use ceph_decode_entity_addr While we're in there, let's also fix up the decoder to do proper bounds checking. Signed-off-by: Jeff Layton Reviewed-by: "Yan, Zheng" Signed-off-by: Ilya Dryomov commit dcbc919a5dc8c2629684a113a90c0b6fe10c3462 Author: Jeff Layton Date: Mon Jun 3 15:08:13 2019 -0400 libceph: switch osdmap decoding to use ceph_decode_entity_addr Signed-off-by: Jeff Layton Reviewed-by: "Yan, Zheng" Signed-off-by: Ilya Dryomov commit 0bfb0f288992adbf8d1f0d5f22f0fd398b146316 Author: Jeff Layton Date: Fri May 31 15:32:28 2019 -0400 libceph: ADDR2 support for monmap Switch the MonMap decoder to use the new decoding routine for entity_addr_t's. Signed-off-by: Jeff Layton Reviewed-by: "Yan, Zheng" Signed-off-by: Ilya Dryomov commit 6c37f0e64173571914a443f74d36e5a22dabfc05 Author: Jeff Layton Date: Mon Jun 3 14:45:16 2019 -0400 libceph: add ceph_decode_entity_addr Add a function for decoding an entity_addr_t. Once CEPH_FEATURE_MSG_ADDR2 is enabled, the server daemons will start encoding entity_addr_t differently. Add a new helper function that can handle either format. Signed-off-by: Jeff Layton Reviewed-by: "Yan, Zheng" Signed-off-by: Ilya Dryomov commit bc07532cc51f4c33cb6136405c9807c5961e468b Author: Jeff Layton Date: Tue Jun 4 13:13:48 2019 -0400 libceph: fix sa_family just after reading address It doesn't make sense to leave it undecoded until later. Signed-off-by: Jeff Layton Reviewed-by: "Yan, Zheng" Signed-off-by: Ilya Dryomov commit 428138c9892fac19a682973bbb6d8c2a904b6639 Author: Yan, Zheng Date: Fri Jun 14 10:55:05 2019 +0800 ceph: remove request from waiting list before unregister Link: https://tracker.ceph.com/issues/40339 Signed-off-by: "Yan, Zheng" Reviewed-by: Jeff Layton Signed-off-by: Ilya Dryomov commit 6f0f597b5debc7c2356fa6a17e2f179066e340d0 Author: Yan, Zheng Date: Mon Jun 10 15:45:09 2019 +0800 ceph: don't blindly unregister session that is in opening state handle_cap_export() may add placeholder caps to session that is in opening state. These caps' session pointer become wild after session get unregistered. The fix is not to unregister session in opening state during mds failovers, just let client to reconnect later when mds is recovered. Link: https://tracker.ceph.com/issues/40190 Signed-off-by: "Yan, Zheng" Signed-off-by: Ilya Dryomov commit 2ef5df1abe6777b463cdfec20211d9846b116d24 Author: Yan, Zheng Date: Fri May 31 20:19:18 2019 +0800 ceph: fix infinite loop in get_quota_realm() get_quota_realm() enters infinite loop if quota inode has no caps. This can happen after client gets evicted. Signed-off-by: "Yan, Zheng" Reviewed-by: Luis Henriques Signed-off-by: Ilya Dryomov commit ac6713ccb5a6d13b59a2e3fda4fb049a2c4e0af2 Author: Yan, Zheng Date: Sun May 26 16:27:56 2019 +0800 ceph: add selinux support When creating new file/directory, use security_dentry_init_security() to prepare selinux context for the new inode, then send openc/mkdir request to MDS, together with selinux xattr. security_dentry_init_security() only supports single security module and only selinux has dentry_init_security hook. So only selinux is supported for now. We can add support for other security modules once kernel has a generic version of dentry_init_security() Signed-off-by: "Yan, Zheng" Reviewed-by: Jeff Layton Signed-off-by: Ilya Dryomov commit 5c31e92dffb94c955fff2867a56aac68e63c286d Author: Yan, Zheng Date: Sun May 26 15:35:39 2019 +0800 ceph: rename struct ceph_acls_info to ceph_acl_sec_ctx Also rename ceph_release_acls_info() to ceph_release_acl_sec_ctx(). And move their definitions to different files. This is preparation for security label support. Signed-off-by: "Yan, Zheng" Reviewed-by: Jeff Layton Signed-off-by: Ilya Dryomov commit 057297812d1aa0163665532a3e80bf718d6a69d0 Author: Yan, Zheng Date: Mon May 27 16:15:41 2019 +0800 ceph: fix debug print format in __set_xattr() name is not '\0' terminated. Signed-off-by: "Yan, Zheng" Signed-off-by: Ilya Dryomov commit 03af439ad9408c28e53b880daa56590dda1c8472 Author: Hariprasad Kelam Date: Sat May 25 14:45:59 2019 +0530 ceph: fix warning PTR_ERR_OR_ZERO can be used change1: fix below warning reported by coccicheck /fs/ceph/export.c:371:33-39: WARNING: PTR_ERR_OR_ZERO can be used change2: typecasted PTR_ERR_OR_ZERO to long as dout expecting long Signed-off-by: Hariprasad Kelam Reviewed-by: "Yan, Zheng" Signed-off-by: Ilya Dryomov commit d6e47819721ae2d9d090058ad5570a66f3c42e39 Author: Yan, Zheng Date: Thu May 23 11:01:37 2019 +0800 ceph: hold i_ceph_lock when removing caps for freeing inode ceph_d_revalidate(, LOOKUP_RCU) may call __ceph_caps_issued_mask() on a freeing inode. Signed-off-by: "Yan, Zheng" Reviewed-by: Jeff Layton Signed-off-by: Ilya Dryomov commit 8f2a98ef3c1adf815ce38d5cc2f4e2a8759e98c5 Author: Yan, Zheng Date: Thu May 23 10:45:24 2019 +0800 ceph: ensure d_name/d_parent stability in ceph_mdsc_lease_send_msg() Signed-off-by: "Yan, Zheng" Reviewed-by: Jeff Layton Signed-off-by: Ilya Dryomov commit 41883ba8ee91af979f4a02b5b0c78647ae82a80b Author: Yan, Zheng Date: Thu May 23 10:22:55 2019 +0800 ceph: use READ_ONCE to access d_parent in RCU critical section Signed-off-by: "Yan, Zheng" Reviewed-by: Jeff Layton Signed-off-by: Ilya Dryomov commit feab6ac25dbfe3ab96299cb741925dc8d2da0caf Author: Yan, Zheng Date: Wed May 22 17:26:27 2019 +0800 ceph: fix dir_lease_is_valid() It should call __ceph_dentry_dir_lease_touch() under dentry->d_lock. Besides, ceph_dentry(dentry) can be NULL when called by LOOKUP_RCU d_revalidate() Signed-off-by: "Yan, Zheng" Reviewed-by: Jeff Layton Signed-off-by: Ilya Dryomov commit 543212b3a4a4abe0cbc610c704cc3cb85315c367 Author: Yan, Zheng Date: Wed May 22 21:49:44 2019 +0800 ceph: close race between d_name_cmp() and update_dentry_lease() d_name_cmp() and update_dentry_lease() lock and unlock dentry->d_lock respectively. Dentry may get renamed between them. The fix is moving the dentry name compare into update_dentry_lease(). This patch introduce two version of update_dentry_lease(). One version is for the case that parent inode is locked. It does not need to check parent/target inode and dentry name. Another version is for the case that parent inode is not locked. It checks parent/target inode and dentry name after locking dentry->d_lock. Signed-off-by: "Yan, Zheng" Reviewed-by: Jeff Layton Signed-off-by: Ilya Dryomov commit 749607731e26dfb2558118038c40e9c0c80d23b5 Author: Andrea Parri Date: Mon May 20 19:23:58 2019 +0200 ceph: fix improper use of smp_mb__before_atomic() This barrier only applies to the read-modify-write operations; in particular, it does not apply to the atomic64_set() primitive. Replace the barrier with an smp_mb(). Fixes: fdd4e15838e59 ("ceph: rework dcache readdir") Reported-by: "Paul E. McKenney" Reported-by: Peter Zijlstra Signed-off-by: Andrea Parri Reviewed-by: "Yan, Zheng" Signed-off-by: Ilya Dryomov commit 718807289d4130be1fe13f24f018733116958070 Author: David Disseldorp Date: Wed May 15 16:56:39 2019 +0200 ceph: fix "ceph.dir.rctime" vxattr value The vxattr value incorrectly places a "09" prefix to the nanoseconds field, instead of providing it as a zero-pad width specifier after '%'. Fixes: 3489b42a72a4 ("ceph: fix three bugs, two in ceph_vxattrcb_file_layout()") Link: https://tracker.ceph.com/issues/39943 Signed-off-by: David Disseldorp Reviewed-by: Ilya Dryomov Signed-off-by: Ilya Dryomov commit d0f191d20c1ce22ccfd7c8e2327f19fbba7f7521 Author: David Disseldorp Date: Thu Apr 18 14:15:49 2019 +0200 ceph: remove unused vxattr length helpers ceph_listxattr() now calculates the length of vxattrs dynamically, so these helpers, which incorrectly ignore vxattr.exists_cb(), can be removed. Signed-off-by: David Disseldorp Reviewed-by: "Yan, Zheng" Signed-off-by: Ilya Dryomov commit 2b2abcac8c251d1c77a4cc9d9f248daefae0fb4e Author: David Disseldorp Date: Thu Apr 18 14:15:48 2019 +0200 ceph: fix listxattr vxattr buffer length calculation ceph_listxattr() incorrectly returns a length based on the static ceph_vxattrs_name_size() value, which only takes into account whether vxattrs are hidden, ignoring vxattr.exists_cb(). When filling the xattr buffer ceph_listxattr() checks VXATTR_FLAG_HIDDEN and vxattr.exists_cb(). If both are false, we return an incorrect (oversize) length. Fix this behaviour by always calculating the vxattrs length at runtime, taking both vxattr.hidden and vxattr.exists_cb() into account. This bug is only exposed with the new "ceph.snap.btime" vxattr, as all other vxattrs with a non-null exists_cb also carry VXATTR_FLAG_HIDDEN. Signed-off-by: David Disseldorp Reviewed-by: "Yan, Zheng" Signed-off-by: Ilya Dryomov commit 100cc610a550affcbef13d74855f736b92caa947 Author: David Disseldorp Date: Thu Apr 18 14:15:47 2019 +0200 ceph: add ceph.snap.btime vxattr The ceph.snap.btime virtual xattr provides the snapshot creation (birth) time in $secs.$nsecs format. Link: https://tracker.ceph.com/issues/38838 Signed-off-by: David Disseldorp Reviewed-by: "Yan, Zheng" Signed-off-by: Ilya Dryomov commit 193e7b37628e97c6e66ec26a2c062dace68b4acd Author: David Disseldorp Date: Thu Apr 18 14:15:46 2019 +0200 ceph: carry snapshot creation time with inodes MDS InodeStat v3 wire structures include a trailing snapshot creation time member. Unmarshall this and retain it for a future vxattr. Signed-off-by: David Disseldorp Reviewed-by: "Yan, Zheng" Signed-off-by: Ilya Dryomov commit e1b814391440b65df0836cef8c7b641fb83f4bf6 Author: David Disseldorp Date: Thu Apr 18 14:15:45 2019 +0200 ceph: clean up ceph.dir.pin vxattr name sizeof() .name_size should use the same string as .name. Signed-off-by: David Disseldorp Reviewed-by: "Yan, Zheng" Signed-off-by: Ilya Dryomov commit 13c41737b912a6f6354369c9b20a02c3868ab304 Author: Dan Carpenter Date: Thu May 9 13:11:25 2019 +0300 ceph: silence a checker warning in mdsc_show() The problem is that if ceph_mdsc_build_path() fails then we set "path" to NULL and the "pathlen" variable is uninitialized. Then we call ceph_mdsc_free_path(path, pathlen) to clean up. Since "path" is NULL, the function is a no-op but Smatch and UBSan still complain that "pathlen" is uninitialized. This patch doesn't change run time, it just silence the warnings. Signed-off-by: Dan Carpenter Reviewed-by: Ilya Dryomov Signed-off-by: Ilya Dryomov commit 97a385e558292ba0851906783642239865670a5f Author: Christoph Hellwig Date: Wed May 1 16:40:32 2019 -0400 libceph: remove ceph_get_direct_page_vector() This function is entirely unused. Signed-off-by: Christoph Hellwig Reviewed-by: Ilya Dryomov Signed-off-by: Ilya Dryomov commit 8a4f9fea2697ae11a0f542f158636f00d10b800f Author: Hou Zhiqiang Date: Fri Jul 5 17:56:56 2019 +0800 PCI: mobiveil: Fix INTx interrupt clearing in mobiveil_pcie_isr() The current INTx handling function clears all interrupts after handling the first pending; this can potentially cause missing INTx detection. Fix the code to clear only the handled INTx IRQ. Fixes: 9af6bcb11e12 ("PCI: mobiveil: Add Mobiveil PCIe Host Bridge IP driver") Signed-off-by: Hou Zhiqiang Signed-off-by: Lorenzo Pieralisi Reviewed-by: Minghuan Lian Reviewed-by: Subrahmanya Lingappa Acked-by: Karthikeyan Mitran Tested-by: Karthikeyan Mitran commit 526c101dde6453e45ff5b25fbda8c3ff736f9788 Author: Hou Zhiqiang Date: Fri Jul 5 17:56:55 2019 +0800 PCI: mobiveil: Fix infinite-loop in the INTx handling function In the loop handling INTx interrupts in mobiveil_pcie_isr(), there is no code to update the loop control variable, which is causing an infinite loop. Fix the code by reading the interrupt status registers inside the loop. Fixes: 9af6bcb11e12 ("PCI: mobiveil: Add Mobiveil PCIe Host Bridge IP driver") Signed-off-by: Hou Zhiqiang Signed-off-by: Lorenzo Pieralisi Reviewed-by: Minghuan Lian Reviewed-by: Subrahmanya Lingappa Acked-by: Karthikeyan Mitran Tested-by: Karthikeyan Mitran commit fe83fa7e7eac505c40b269eeb892240d83c6b279 Author: Hou Zhiqiang Date: Fri Jul 5 17:56:54 2019 +0800 PCI: mobiveil: Move PCIe PIO enablement out of inbound window routine Move the PCIe PIO master enablement to function mobiveil_host_init(). Signed-off-by: Hou Zhiqiang Signed-off-by: Lorenzo Pieralisi Reviewed-by: Minghuan Lian Reviewed-by: Subrahmanya Lingappa commit 4e00aca3ba0b54d496c224888b468207c601463c Author: Hou Zhiqiang Date: Fri Jul 5 17:56:52 2019 +0800 PCI: mobiveil: Add upper 32-bit PCI base address setup in inbound window Current code erroneously sets-up the lower 32-bit PCI base address in the inbound window, which results in inbound transactions not working in 64-bit platforms. Fixes: 9af6bcb11e12 ("PCI: mobiveil: Add Mobiveil PCIe Host Bridge IP driver") Signed-off-by: Hou Zhiqiang Signed-off-by: Lorenzo Pieralisi Reviewed-by: Minghuan Lian Reviewed-by: Subrahmanya Lingappa commit 6f7374b871d5e55e772b532fe1c571da0fcc7164 Author: Hou Zhiqiang Date: Fri Jul 5 17:56:51 2019 +0800 PCI: mobiveil: Add upper 32-bit CPU base address setup in outbound window Current code erroneously sets-up only the lower 32-bit CPU base address in the outbound window, which results in outbound transactions not working in 64-bit platforms. Fix it. Fixes: 9af6bcb11e12 ("PCI: mobiveil: Add Mobiveil PCIe Host Bridge IP driver") Signed-off-by: Hou Zhiqiang Signed-off-by: Lorenzo Pieralisi Reviewed-by: Minghuan Lian Reviewed-by: Subrahmanya Lingappa commit 7717c7d7da31befa025c4402ac1179356b00012a Author: Hou Zhiqiang Date: Fri Jul 5 17:56:50 2019 +0800 PCI: mobiveil: Mask out hardcoded bits in inbound/outbound windows setup The lower 10 bits of window size field are hardcoded to zero in HW so they can't really be changed but the lower 10-bit of PAB_AXI_AMAP_CTRL register are used for control fields, so while programming inbound and outbout windows decoding we should mask out the lower 10-bit of window size to prevent overriding the control bits. Signed-off-by: Hou Zhiqiang Signed-off-by: Lorenzo Pieralisi Reviewed-by: Minghuan Lian Reviewed-by: Subrahmanya Lingappa commit cf22c591f93dbc92f9a1ec69343a17c74aac9743 Author: Hou Zhiqiang Date: Fri Jul 5 17:56:49 2019 +0800 PCI: mobiveil: Clear the control fields before updating it While programming the inbound and outbound windows in program_{ib/ob}_windows() we shoud clear the control fields in the registers before programming it with a new value to prevent stale bits from older configuration. Signed-off-by: Hou Zhiqiang Signed-off-by: Lorenzo Pieralisi Reviewed-by: Minghuan Lian Reviewed-by: Subrahmanya Lingappa commit 4b7e2e59f0e50f13d6498190da41e758e01e6489 Author: Hou Zhiqiang Date: Fri Jul 5 17:56:48 2019 +0800 PCI: mobiveil: Add configured inbound windows counter Current code only keeps track of the number of outbound windows configured but it does not for inbound windows. Add a counter to keep track of initialized inbound windows. Signed-off-by: Hou Zhiqiang Signed-off-by: Lorenzo Pieralisi Reviewed-by: Minghuan Lian Reviewed-by: Subrahmanya Lingappa commit ccd34dac2ed596b1f26079912bdf638e002a3979 Author: Hou Zhiqiang Date: Fri Jul 5 17:56:47 2019 +0800 PCI: mobiveil: Fix the valid check for inbound and outbound windows In program_ib/ob_windows() check the window index from the function parameter instead of the total number of initialized windows to determine if the specified window is valid. Fixes: 9af6bcb11e12 ("PCI: mobiveil: Add Mobiveil PCIe Host Bridge IP driver") Signed-off-by: Hou Zhiqiang Signed-off-by: Lorenzo Pieralisi Reviewed-by: Minghuan Lian Reviewed-by: Subrahmanya Lingappa commit ea0f1c959fb71dca26d30bbb9e3dccfb9da07a41 Author: Hou Zhiqiang Date: Fri Jul 5 17:56:46 2019 +0800 PCI: mobiveil: Clean-up program_{ib/ob}_windows() In function program_ob_windows(), remove the redundant read operations to registers PAB_AXI_AMAP_AXI_WIN and PAB_AXI_AMAP_PEX_WIN_H, and remove the useless definition of 'value'. Rename the parameter 'config_io_bit' to 'type' and then remove the definition of 'type'. In function program_ib_windows(), remove the definitions of 'pio_ctrl_val' and 'amap_ctrl_dw' and reduce to only one variable 'value' to keep the temporary value read from registers. Signed-off-by: Hou Zhiqiang Signed-off-by: Lorenzo Pieralisi Reviewed-by: Minghuan Lian Reviewed-by: Subrahmanya Lingappa commit afd899d3c8549cc82c8b329c0145e213c0755e60 Author: Hou Zhiqiang Date: Fri Jul 5 17:56:45 2019 +0800 PCI: mobiveil: Remove an unnecessary return value check The memory for the host controller private structure (struct mobiveil_pcie) is allocated together with the pci_host_bridge structure in function devm_pci_alloc_host_bridge(), so it is unnecessary to check the return value when get the private structure pointer. Remove the useless check. Signed-off-by: Hou Zhiqiang Signed-off-by: Lorenzo Pieralisi Reviewed-by: Minghuan Lian Reviewed-by: Subrahmanya Lingappa commit e0a7e56368a4a58488c80693f0b630a0a05f6c8d Author: Hou Zhiqiang Date: Fri Jul 5 17:56:44 2019 +0800 PCI: mobiveil: Fix error return values Some error return values in the host controller driver are either unconventional or plain wrong. Update them all with the expected return values. Signed-off-by: Hou Zhiqiang Signed-off-by: Lorenzo Pieralisi Reviewed-by: Minghuan Lian Reviewed-by: Subrahmanya Lingappa commit f97441f4c398b4ae29a4eb8439f9a09fcf26225a Author: Hou Zhiqiang Date: Fri Jul 5 17:56:43 2019 +0800 PCI: mobiveil: Refactor the MEM/IO outbound window initialization Move the resource type check into an if/else block and only set-up the outbound window for MEM and IO resource. No functional change intended. Signed-off-by: Hou Zhiqiang Signed-off-by: Lorenzo Pieralisi Reviewed-by: Minghuan Lian commit 91347af1c5c32e1fe9a8294a526e1cfdfa7b6ac2 Author: Hou Zhiqiang Date: Fri Jul 5 17:56:42 2019 +0800 PCI: mobiveil: Make some register updates more readable To make some register updates more readable use a temporary value to hold the register value and carry out the update. Change the register update sequence to: - Read out the original value from the target register - Update the value - Program the updated value back to the register Signed-off-by: Hou Zhiqiang Signed-off-by: Lorenzo Pieralisi Reviewed-by: Minghuan Lian commit e369faf6255df555644b33a22931dddff5e24755 Author: Hou Zhiqiang Date: Fri Jul 5 17:56:41 2019 +0800 PCI: mobiveil: Reformat the code for readability Reformat the code to make it more readable. No functional change intended. Signed-off-by: Hou Zhiqiang Signed-off-by: Lorenzo Pieralisi Reviewed-by: Minghuan Lian commit 93bad0f5d15f3acd6d2ab0aee4a81ce1fcc6300d Author: Hou Zhiqiang Date: Fri Jul 5 17:56:40 2019 +0800 dt-bindings: PCI: mobiveil: Change gpio_slave and apb_csr to optional Change the "gpio_slave" and "apb_csr" to optional, the "gpio_slave" is not used in current code, and "apb_csr" is not used by some platforms. Signed-off-by: Hou Zhiqiang Signed-off-by: Lorenzo Pieralisi Acked-by: Subrahmanya Lingappa Acked-by: Rob Herring Reviewed-by: Minghuan Lian Reviewed-by: Subrahmanya Lingappa commit cbd50b3ca3964c79dac65fda277637577e029e8c Author: Hou Zhiqiang Date: Fri Jul 5 17:56:39 2019 +0800 PCI: mobiveil: Fix devfn check in mobiveil_pcie_valid_device() Current check for devfn number in mobiveil_pci_valid_device() is wrong in that it flags as invalid functions present in PCI device 0 in the root bus while it is perfectly valid to access all functions in PCI device 0 in the root bus. Update the check in mobiveil_pci_valid_device() to fix the issue. Fixes: 9af6bcb11e12 ("PCI: mobiveil: Add Mobiveil PCIe Host Bridge IP driver") Signed-off-by: Hou Zhiqiang Signed-off-by: Lorenzo Pieralisi Reviewed-by: Minghuan Lian commit 6f3ab451aa5c2cbff33197d82fe8489cbd55ad91 Author: Hou Zhiqiang Date: Fri Jul 5 17:56:38 2019 +0800 PCI: mobiveil: Initialize Primary/Secondary/Subordinate bus numbers The reset value of Primary, Secondary and Subordinate bus numbers is zero which is a broken setup. Program a sensible default value for Primary/Secondary/Subordinate bus numbers. Signed-off-by: Hou Zhiqiang Signed-off-by: Lorenzo Pieralisi Reviewed-by: Minghuan Lian Reviewed-by: Subrahmanya Lingappa commit 284441a9662cd3352396cf7d74edd9270f641916 Author: Hou Zhiqiang Date: Fri Jul 5 17:56:37 2019 +0800 PCI: mobiveil: Move IRQ chained handler setup out of DT parse The irq_set_chained_handler_and_data() call is not dependent on device tree firmware so it should be moved out of the DT parsing function for clarity. Signed-off-by: Hou Zhiqiang [lorenzo.pieralisi@arm.com: rewritten commit log] Signed-off-by: Lorenzo Pieralisi Reviewed-by: Minghuan Lian Reviewed-by: Subrahmanya Lingappa commit 40af900c5f12ea3e4eda2688050a22dc1fee42d1 Author: Hou Zhiqiang Date: Fri Jul 5 17:56:36 2019 +0800 PCI: mobiveil: Move the link up waiting out of mobiveil_host_init() The host initializing sequence does not depend on the PCIe link being up, so move the link up check right before the code scanning the root bus for enumeration. Signed-off-by: Hou Zhiqiang Signed-off-by: Lorenzo Pieralisi Reviewed-by: Minghuan Lian Reviewed-by: Subrahmanya Lingappa commit 0122af0a08243f344a438f924e5c2486486555b3 Author: Hou Zhiqiang Date: Fri Jul 5 17:56:35 2019 +0800 PCI: mobiveil: Fix the Class Code field Fix up the Class Code field in PCI configuration space and set it to PCI_CLASS_BRIDGE_PCI. Move the Class Code fixup to function mobiveil_host_init() where it belongs. Fixes: 9af6bcb11e12 ("PCI: mobiveil: Add Mobiveil PCIe Host Bridge IP driver") Signed-off-by: Hou Zhiqiang Signed-off-by: Lorenzo Pieralisi Reviewed-by: Minghuan Lian Reviewed-by: Subrahmanya Lingappa commit 5ccd3bd992cf668b5a6fa1713da7b443a35e2930 Merge: c5d0e49e8d8f f785b42f4cb5 Author: Russell King Date: Wed Jul 3 10:30:58 2019 +0100 Merge branches 'fixes' and 'misc' Fix up the conflict between "VDSO: Drop implicit common-page-size linker flag" and "vdso: pass --be8 to linker if necessary" Signed-off-by: Russell King commit f7fee1b42fe4f8171a4b1cad05c61907c33c53f6 Author: Hou Zhiqiang Date: Fri Jul 5 17:56:34 2019 +0800 PCI: mobiveil: Use the 1st inbound window for MEM inbound transactions The inbound and outbound windows have completely separate control registers sets in the host controller MMIO space. Windows control register are accessed through an MMIO base address and an offset that depends on the window index. Since inbound and outbound windows control registers are completely separate there is no real need to use different window indexes in the inbound/outbound windows initialization routines to prevent clashing. To fix this inconsistency, change the MEM inbound window index to 0, mirroring the outbound window set-up. Signed-off-by: Hou Zhiqiang [lorenzo.pieralisi@arm.com: update commit log] Signed-off-by: Lorenzo Pieralisi Reviewed-by: Minghuan Lian Reviewed-by: Subrahmanya Lingappa commit f39ed3d09b34f733bb12178712019050bd8bd38d Author: Hou Zhiqiang Date: Fri Jul 5 17:56:33 2019 +0800 PCI: mobiveil: Use WIN_NUM_0 explicitly for CFG outbound window As the .map_bus() use the WIN_NUM_0 for CFG transactions, it is appropriate to pass WIN_NUM_0 explicitly when initializing the CFG outbound window rather than implicitly relying on the ob_wins_configure counter. Signed-off-by: Hou Zhiqiang Signed-off-by: Lorenzo Pieralisi Reviewed-by: Minghuan Lian Reviewed-by: Subrahmanya Lingappa commit 9815d3288ed0540efc5f261ea1736f4327c4c9b5 Author: Hou Zhiqiang Date: Fri Jul 5 17:56:32 2019 +0800 PCI: mobiveil: Update the resource list traversal function Code that executes the resource list traversal does not need to delete any node therefore using the *_safe() API version is useless. Replace function resource_list_for_each_entry_safe() with the resource_list_for_each_entry() counterpart. Signed-off-by: Hou Zhiqiang Signed-off-by: Lorenzo Pieralisi Reviewed-by: Minghuan Lian Reviewed-by: Subrahmanya Lingappa commit f99536e9d2f55996038158a6559d4254a7cc1693 Author: Hou Zhiqiang Date: Fri Jul 5 17:56:31 2019 +0800 PCI: mobiveil: Fix PCI base address in MEM/IO outbound windows The outbound memory windows PCI base addresses should be taken from the 'ranges' property of DT node to setup MEM/IO outbound windows decoding correctly instead of being hardcoded to zero. Update the code to retrieve the PCI base address for each range and use it to program the outbound windows address decoders Fixes: 9af6bcb11e12 ("PCI: mobiveil: Add Mobiveil PCIe Host Bridge IP driver") Signed-off-by: Hou Zhiqiang Signed-off-by: Lorenzo Pieralisi Reviewed-by: Minghuan Lian Reviewed-by: Subrahmanya Lingappa commit a131fb6364c1be0924dcb969ecf6b988c556a5d5 Author: Hou Zhiqiang Date: Fri Jul 5 17:56:30 2019 +0800 PCI: mobiveil: Remove the flag MSI_FLAG_MULTI_PCI_MSI The Mobiveil internal MSI controller requires separate target addresses, one per MSI vector; this is clearly incompatible with the Multiple MSI feature, which requires the same target address for all vectors requested by an endpoint (ie the Message Address field in the MSI Capability structure), so the multi MSI feature is clearly not supported by the host controller driver. Remove the flag MSI_FLAG_MULTI_PCI_MSI and with it multi MSI support, fixing the misconfiguration. Fixes: 1e913e58335f ("PCI: mobiveil: Add MSI support") Signed-off-by: Hou Zhiqiang [lorenzo.pieralisi@arm.com: commit log] Signed-off-by: Lorenzo Pieralisi Reviewed-by: Minghuan Lian commit bcbe0d9a8d931597202859d13506611dd9736da9 Author: Hou Zhiqiang Date: Fri Jul 5 17:56:29 2019 +0800 PCI: mobiveil: Unify register accessors It is confusing to have two sets of functions to read/write registers, some with csr_readl()/csr_writel(), while others with read_paged_register()/write_paged_register(). In the register space the lower 3KB of 4KB PCIe configure space can be accessed directly and higher 1KB through a simple paging mechanism. Unify the register accessors in csr_readl() and csr_writel() by comparing the register offset with page access boundary 3KB in the accessor internal so that the paging mechanism is hidden behind the csr_read()/write() common function calls. Signed-off-by: Hou Zhiqiang Signed-off-by: Lorenzo Pieralisi Reviewed-by: Minghuan Lian Reviewed-by: Subrahmanya Lingappa commit 64372c0b7dcbc9ad08b1bad877ae8d8cddb62e45 Merge: 62fd33d3f519 371b86897d01 5d8cbf7176a4 b244883ca89c Author: Rafael J. Wysocki Date: Mon Jul 8 11:04:14 2019 +0200 Merge branches 'acpi-apei', 'acpi-doc' and 'acpi-soc' * acpi-apei: ACPI / APEI: Remove needless __ghes_check_estatus() calls * acpi-doc: docs: extcon: convert it to ReST and move to ACPI dir * acpi-soc: ACPI: APD: remove redundant assignment to pointer clk commit 62fd33d3f519ef84e17fde4d7b4f1e3b62e7156d Merge: 8ca572ec3c9c 02a93f35f57f Author: Rafael J. Wysocki Date: Mon Jul 8 11:04:00 2019 +0200 Merge branch 'acpica' * acpica: ACPICA: Update version to 20190703 ACPICA: Update table load object initialization ACPICA: Update for object initialization sequence ACPICA: remove legacy module-level code due to deprecation ACPICA: Namespace: simplify creation of the initial/default namespace ACPICA: Clear status of GPEs on first direct enable commit 8ca572ec3c9c0ad372550d3fd2535ad7b943f474 Merge: 417a564c6588 d06c47e3dd07 9fe51603d953 fb683f47a9fb b1954bbf1272 Author: Rafael J. Wysocki Date: Mon Jul 8 11:02:22 2019 +0200 Merge branches 'acpi-tables', 'acpi-osl', 'acpi-misc' and 'acpi-tools' * acpi-tables: ACPI: configfs: Resolve objects on host-directed table loads ACPI: tables: Allow BGRT to be overridden * acpi-osl: ACPI: OSL: Make a W=1 kernel-doc warning go away * acpi-misc: ACPI: Make AC and battery drivers available on !X86 * acpi-tools: ACPI: tools: Exclude tools/* from .gitignore patterns commit 586a07dca8c51b966960d1f0d8be9c27d7e0a95c Merge: 13b06b78c772 70a59fde6e69 Author: Rafael J. Wysocki Date: Mon Jul 8 11:00:02 2019 +0200 Merge branch 'pm-cpufreq' * pm-cpufreq: cpufreq: Avoid calling cpufreq_verify_current_freq() from handle_update() cpufreq: Consolidate cpufreq_update_current_freq() and __cpufreq_get() cpufreq: Don't skip frequency validation for has_target() drivers cpufreq: Use has_target() instead of !setpolicy cpufreq: Remove redundant !setpolicy check cpufreq: Move the IS_ENABLED(CPU_THERMAL) macro into a stub cpufreq: s5pv210: Don't flood kernel log after cpufreq change cpufreq: pcc-cpufreq: Fail initialization if driver cannot be registered cpufreq: add driver for Raspberry Pi cpufreq: Switch imx7d to imx-cpufreq-dt for speed grading cpufreq: imx-cpufreq-dt: Remove global platform match list cpufreq: brcmstb-avs-cpufreq: Fix types for voltage/frequency cpufreq: brcmstb-avs-cpufreq: Fix initial command check cpufreq: armada-37xx: Remove set but not used variable 'freq' cpufreq: imx-cpufreq-dt: Fix no OPPs available on unfused parts dt-bindings: imx-cpufreq-dt: Document opp-supported-hw usage cpufreq: Add imx-cpufreq-dt driver commit 13b06b78c772d64e2207e4a5a5329856fe2bf241 Merge: 3dbeb448543e 41de256b6fd4 338c993f9aa2 8eb835e4789a d382084f77b0 Author: Rafael J. Wysocki Date: Mon Jul 8 10:59:38 2019 +0200 Merge branches 'pm-opp', 'pm-misc', 'pm-avs' and 'pm-tools' * pm-opp: opp: Don't use IS_ERR on invalid supplies opp: Make dev_pm_opp_set_rate() handle freq = 0 to drop performance votes opp: Don't overwrite rounded clk rate opp: Allocate genpd_virt_devs from dev_pm_opp_attach_genpd() opp: Attach genpds to devices from within OPP core * pm-misc: PM / clk: Remove error message on out-of-memory condition drivers: base: power: clock_ops: Use of_clk_get_parent_count() * pm-avs: power: avs: smartreflex: no need to check return value of debugfs_create functions * pm-tools: cpupower : frequency-set -r option misses the last cpu in related cpu list cpupower: correct spelling of interval Add README and update pm-graph and sleepgraph docs Update to pm-graph 5.4 Update to pm-graph 5.3 commit 3dbeb448543efc01f04cadd6d358b9f33dd20d31 Merge: 50e163d43ab1 02bd45a28bf3 Author: Rafael J. Wysocki Date: Mon Jul 8 10:51:25 2019 +0200 Merge branch 'pm-sleep' * pm-sleep: PM: sleep: Drop dev_pm_skip_next_resume_phases() ACPI: PM: Drop unused function and function header ACPI: PM: Introduce "poweroff" callbacks for ACPI PM domain and LPSS ACPI: PM: Simplify and fix PM domain hibernation callbacks PCI: PM: Simplify bus-level hibernation callbacks PM: ACPI/PCI: Resume all devices during hibernation kernel: power: swap: use kzalloc() instead of kmalloc() followed by memset() PM: sleep: Update struct wakeup_source documentation drivers: base: power: remove wakeup_sources_stats_dentry variable PM: suspend: Rename pm_suspend_via_s2idle() PM: sleep: Show how long dpm_suspend_start() and dpm_suspend_end() take PM: hibernate: powerpc: Expose pfn_is_nosave() prototype commit 50e163d43ab123193a7f381528a7485881f730e9 Merge: 5004efbb3611 ad5a449b707b 9ed411c06dd1 Author: Rafael J. Wysocki Date: Mon Jul 8 10:49:36 2019 +0200 Merge branches 'acpi-pm' and 'pm-pci' * acpi-pm: ACPI: PM: Make acpi_sleep_state_supported() non-static ACPI: PM: Allow transitions to D0 to occur in special cases ACPI: PM: Avoid evaluating _PS3 on transitions from D3hot to D3cold ACPI / sleep: Switch to use acpi_dev_get_first_match_dev() ACPI / LPIT: Correct LPIT end address for lpit_process() * pm-pci: ACPI: PM: Unexport acpi_device_get_power() PCI: PM/ACPI: Refresh all stale power state data in pci_pm_complete() PCI / ACPI: Add _PR0 dependent devices ACPI / PM: Introduce concept of a _PR0 dependent device PCI / ACPI: Use cached ACPI device state to get PCI device power state PCI: Do not poll for PME if the device is in D3cold PCI: Add missing link delays required by the PCIe spec PCI: PM: Replace pci_dev_keep_suspended() with two functions PCI: PM: Avoid resuming devices in D3hot during system suspend commit c33d442328f556460b79aba6058adb37bb555389 Author: Greg Kroah-Hartman Date: Sat Jul 6 17:42:56 2019 +0200 debugfs: make error message a bit more verbose When a file/directory is already present in debugfs, and it is attempted to be created again, be more specific about what file/directory is being created and where it is trying to be created to give a bit more help to developers to figure out the problem. Cc: Stephen Rothwell Cc: Rafael J. Wysocki Cc: Mark Brown Cc: Takashi Iwai Reviewed-by: Mark Brown Link: https://lore.kernel.org/r/20190706154256.GA2683@kroah.com Signed-off-by: Greg Kroah-Hartman commit 24a20b0a443fd485852d51d08e98bbd9d212e0ec Author: Eugeniy Paltsev Date: Fri Jul 5 19:24:09 2019 +0300 ARC: [plat-hsdk]: Enable AXI DW DMAC in defconfig For some reasons my previous patch "Enable AXI DW DMAC support" was applied only partially (only device tree part). So enable AXI DW DMAC in HSDK defconfig to be able to use it in verification flow. Signed-off-by: Eugeniy Paltsev Signed-off-by: Vineet Gupta commit aab128d006e709954f2a67b5e27a4c587a0584bd Author: Eugeniy Paltsev Date: Fri Jun 7 17:48:00 2019 +0300 ARC: [plat-hsdk]: enable DW SPI controller HSDK SoC has DW SPI controller. Enable it in preparation of enabling on-board SPI peripherals. Acked-by: Alexey Brodkin Signed-off-by: Eugeniy Paltsev Signed-off-by: Vineet Gupta commit fd5de2721ea7d16e2b16c4049ac49f229551b290 Author: Arnd Bergmann Date: Wed Jul 3 15:39:25 2019 +0200 ARC: hide unused function unw_hdr_alloc As kernelci.org reports, this function is not used in vdk_hs38_defconfig: arch/arc/kernel/unwind.c:188:14: warning: 'unw_hdr_alloc' defined but not used [-Wunused-function] Fixes: bc79c9a72165 ("ARC: dw2 unwind: Reinstante unwinding out of modules") Link: https://kernelci.org/build/id/5d1cae3f59b514300340c132/logs/ Cc: stable@vger.kernel.org Signed-off-by: Arnd Bergmann Signed-off-by: Vineet Gupta commit 94b8beb972c524f42078281c9950ed3a946455fa Author: Alexey Brodkin Date: Tue Jul 2 19:40:33 2019 +0300 ARC: [haps] Add Virtio support As a preparation for QEMU usage for ARC let's add basic Virtio-MMIO peripherals support for the platform we're going to use. For now we add 5 Virtio slots in .dts and enable block and network devices via Virtio-MMIO. Note even though typically Virtio register set fits in 0x200 bytes we "allocate" here 0x2000 so that it matches ARC's default 8KiB page size and so remapping of that area is done clearly. We also enable DEVTMPFS automount for more convenient use of external root file-stystem. Before that we used to use built-in Initramfs which didn't automount DEVTMPFS anyways so we didn't need that option, while now it starts making sense. Signed-off-by: Alexey Brodkin Cc: Rob Herring Signed-off-by: Vineet Gupta commit 75370ad44075e832966a6dd1f6a649b8aee2325b Author: Vineet Gupta Date: Wed May 22 08:47:13 2019 -0700 ARCv2: entry: simplify return to Delay Slot via interrupt Commit 4255b07f2c9c43540 ("ARCv2: STAR 9000793984: Handle return from intr to Delay Slot") involved a complex 2 staged trampoline. Apparently this can be greatly simplified by returning from pure kernel mode (iso interrupt) so drop to pure kernel mdoe and execute the normal exception return path. Testing this was a bit of challenge as return from interrupt is rarely executed now after commit 4de0e52867d83105767 ("ARCv2: STAR 9000814690: Really Re-enable interrupts to avoid deadlocks"). That fix is necessary evil and pct interrupts etc do exercise intr return path. Anyhow after a revert of above in my local test setup I was able to hit this case and verify the patch works. Signed-off-by: Vineet Gupta commit 68e5c6f073bcf70da5f8eef88eb2d98f7c560bb6 Author: Vineet Gupta Date: Wed May 15 16:08:10 2019 -0700 ARC: entry: EV_Trap expects r10 (vs. r9) to have exception cause avoids 1 MOV instruction in light of double load/store code Signed-off-by: Vineet Gupta commit 36c4357c63f382becfe1d9775ea0872135c8a8ab Author: Gary Lin Date: Fri Jul 5 03:54:58 2019 +0000 net: bpfilter: print umh messages to /dev/kmsg bpfilter_umh currently printed all messages to /dev/console and this might interfere the user activity(*). This commit changes the output device to /dev/kmsg so that the messages from bpfilter_umh won't show on the console directly. (*) https://bugzilla.suse.com/show_bug.cgi?id=1140221 Signed-off-by: Gary Lin Signed-off-by: David S. Miller commit 61a582be1a668a0c1407a46f779965bfeff88784 Author: Xue Chaojing Date: Fri Jul 5 02:40:28 2019 +0000 hinic: add fw version query This patch adds firmware version query in ethtool -i. Signed-off-by: Xue Chaojing Reviewed-by: Jakub Kicinski Signed-off-by: David S. Miller commit 5c274ca4cfb22a455e880f61536b1894fa29fd17 Author: Vinod Koul Date: Mon Jul 8 09:42:55 2019 +0530 dmaengine: Revert "dmaengine: fsl-edma: add i.mx7ulp edma2 version support" This reverts commit 7144afd025b2 ("dmaengine: fsl-edma: add i.mx7ulp edma2 version support") as this fails to build with module option due to usage of of_irq_count() which is not an exported symbol as kernel drivers are *not* expected to use it (rightly so). Signed-off-by: Vinod Koul commit f5f111c231f56e56e186c9a61a9d22fb8bf05faa Author: Ronnie Sahlberg Date: Sun Jul 7 07:45:42 2019 +1000 cifs: refactor and clean up arguments in the reparse point parsing Will be helpful as we improve handling of special file types. Signed-off-by: Ronnie Sahlberg Signed-off-by: Steve French commit ff2a09e9196e2f9d5edc60d1a68bc3d3649d035b Author: Steve French Date: Sat Jul 6 14:41:38 2019 -0500 SMB3: query inode number on open via create context We can cut the number of roundtrips on open (may also help some rename cases as well) by returning the inode number in the SMB2 open request itself instead of querying it afterwards via a query FILE_INTERNAL_INFO. This should significantly improve the performance of posix open. Add SMB2_CREATE_QUERY_ON_DISK_ID create context request on open calls so that when server supports this we can save a roundtrip for QUERY_INFO on every open. Follow on patch will add the response processing for SMB2_CREATE_QUERY_ON_DISK_ID context and optimize smb2_open_file to avoid the extra network roundtrip on every posix open. This patch adds the context on SMB2/SMB3 open requests. Signed-off-by: Steve French commit 96d3cca1241d6e56910b74435301e095705e1ebc Author: Steve French Date: Tue Jun 25 04:39:51 2019 -0500 smb3: Send netname context during negotiate protocol See MS-SMB2 2.2.3.1.4 Allows hostname to be used by load balancers Signed-off-by: Steve French commit 9fe5ff1c5d6a2a6c4ed4ba051a858571fdb7834c Author: Steve French Date: Mon Jun 24 20:39:04 2019 -0500 smb3: do not send compression info by default Since in theory a server could respond with compressed read responses even if not requested on read request (assuming that a compression negcontext is sent in negotiate protocol) - do not send compression information during negotiate protocol unless the user asks for compression explicitly (compression is experimental), and add a mount warning that compression is experimental. Signed-off-by: Steve French Reviewed-by: Ronnie Sahlberg commit 412094a8fb0711e9f332bed6723aa59706a4ff7e Author: Steve French Date: Mon Jun 24 02:01:42 2019 -0500 smb3: add new mount option to retrieve mode from special ACE There is a special ACE used by some servers to allow the mode bits to be stored. This can be especially helpful in scenarios in which the client is trusted, and access checking on the client vs the POSIX mode bits is sufficient. Add mount option to allow enabling this behavior. Follow on patch will add support for chmod and queryinfo (stat) by retrieving the POSIX mode bits from the special ACE, SID: S-1-5-88-3 See e.g. https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/hh509017(v=ws.10) Signed-off-by: Steve French Reviewed-by: Ronnie Sahlberg commit d5ecebc4900df7f6e8dff0717574668885110553 Author: Steve French Date: Fri Jun 28 02:04:18 2019 -0500 smb3: Allow query of symlinks stored as reparse points The 'NFS' style symlinks (see MS-FSCC 2.1.2.4) were not being queried properly in query_symlink. Fix this. Signed-off-by: Steve French Reviewed-by: Ronnie Sahlberg commit f2caf901c1b7ce65f9e6aef4217e3241039db768 Author: Ronnie Sahlberg Date: Sat Jul 6 06:52:46 2019 +1000 cifs: Fix a race condition with cifs_echo_request There is a race condition with how we send (or supress and don't send) smb echos that will cause the client to incorrectly think the server is unresponsive and thus needs to be reconnected. Summary of the race condition: 1) Daisy chaining scheduling creates a gap. 2) If traffic comes unfortunate shortly after the last echo, the planned echo is suppressed. 3) Due to the gap, the next echo transmission is delayed until after the timeout, which is set hard to twice the echo interval. This is fixed by changing the timeouts from 2 to three times the echo interval. Detailed description of the bug: https://lutz.donnerhacke.de/eng/Blog/Groundhog-Day-with-SMB-remount Signed-off-by: Ronnie Sahlberg Reviewed-by: Pavel Shilovsky Signed-off-by: Steve French commit 3e2725796cbdfe4efc7eb7b27cacaeac2ddad1a5 Author: Ronnie Sahlberg Date: Sat Jul 6 06:43:08 2019 +1000 cifs: always add credits back for unsolicited PDUs not just if CONFIG_CIFS_DEBUG2 is enabled. Signed-off-by: Ronnie Sahlberg Reviewed-by: Pavel Shilovsky CC: Stable Signed-off-by: Steve French commit 0aa3a24be011676b7231fde9a5b39ae6cd3092b4 Author: Hariprasad Kelam Date: Tue Jul 2 23:50:02 2019 +0530 fs: cifs: cifsssmb: Change return type of convert_ace_to_cifs_ace Change return from int to void of convert_ace_to_cifs_ace as it never fails. fixes below issue reported by coccicheck fs/cifs/cifssmb.c:3606:7-9: Unneeded variable: "rc". Return "0" on line 3620 Signed-off-by: Hariprasad Kelam Signed-off-by: Steve French commit e7348e35a34dc61d161f44b0e42e6a041337595c Author: Steve French Date: Fri Jun 28 02:35:10 2019 -0500 add some missing definitions query on disk id structure definition was missing Signed-off-by: Steve French commit 63d614a608fcfcd891b0713d818530c93ef1b69b Author: Colin Ian King Date: Mon Jun 24 17:39:43 2019 +0100 cifs: fix typo in debug message with struct field ia_valid Field ia_valid is being debugged with the field name iavalid, fix this. Signed-off-by: Colin Ian King Signed-off-by: Steve French commit 3190b59a050ecdbdc86602af506b35f40fd2332e Author: Aurelien Aptel Date: Mon Jun 24 13:00:12 2019 -0500 smb3: minor cleanup of compound_send_recv Trivial cleanup. Will make future multichannel code smaller as well. Signed-off-by: Aurelien Aptel Reviewed-by: Ronnie Sahlberg Signed-off-by: Steve French commit e7a1a2df4dfdae0cb9bfff6edaa6a159cbe33932 Author: Steve French Date: Sun Jun 30 18:00:41 2019 -0500 CIFS: Fix module dependency KEYS is required not that CONFIG_CIFS_ACL is always on and the ifdef for it removed. Signed-off-by: Steve French commit 73cf8085dc09442f17f32972d3cdec7232f1be55 Author: Steve French Date: Mon Jun 24 01:44:11 2019 -0500 cifs: simplify code by removing CONFIG_CIFS_ACL ifdef SMB3 ACL support is needed for many use cases now and should not be ifdeffed out, even for SMB1 (CIFS). Remove the CONFIG_CIFS_ACL ifdef so ACL support is always built into cifs.ko Signed-off-by: Steve French commit 6552d6a0264de505d3bb1445aecf757b1ec3873a Author: Steve French Date: Mon Jun 24 01:19:52 2019 -0500 cifs: Fix check for matching with existing mount If we mount the same share twice, we check the flags to see if the second mount matches the earlier mount, but we left some flags out. Signed-off-by: Steve French commit 29fbeb7a908a60a5ae8c50fbe171cb8fdcef1980 Author: Paulo Alcantara (SUSE) Date: Tue Jun 18 16:16:02 2019 -0300 cifs: Properly handle auto disabling of serverino option Fix mount options comparison when serverino option is turned off later in cifs_autodisable_serverino() and thus avoiding mismatch of new cifs mounts. Cc: stable@vger.kernel.org Signed-off-by: Paulo Alcantara (SUSE) Signed-off-by: Steve French Reviewed-by: Pavel Shilovsky commit dc179268cde43e0fb17e03507f09a3485625e52f Author: Steve French Date: Mon Jun 17 17:34:57 2019 -0500 smb3: if max_credits is specified then display it in /proc/mounts If "max_credits" is overridden from its default by specifying it on the smb3 mount then display it in /proc/mounts Signed-off-by: Steve French commit 43cdae88de2e8ec101961708ef7e51ba96776035 Author: Steve French Date: Thu Jun 13 14:26:49 2019 -0500 Fix match_server check to allow for auto dialect negotiate When using multidialect negotiate (default or specifying vers=3.0 which allows any smb3 dialect), fix how we check for an existing server session. Before this fix if you mounted a second time to the same server (e.g. a different share on the same server) we would only reuse the existing smb session if a single dialect were requested (e.g. specifying vers=2.1 or vers=3.0 or vers=3.1.1 on the mount command). If a default mount (e.g. not specifying vers=) is done then would always create a new socket connection and SMB3 (or SMB3.1.1) session each time we connect to a different share on the same server rather than reusing the existing one. Signed-off-by: Steve French Reviewed-by: Pavel Shilovsky commit 5fc3681fa5ed5cbbe70592967dcfa8f0848f75c0 Author: Aurelien Aptel Date: Fri Jun 14 21:46:35 2019 +0200 cifs: add missing GCM module dependency Signed-off-by: Aurelien Aptel Signed-off-by: Steve French commit 2b2f7548076200b69ee377b4bb4f426696502b04 Author: Steve French Date: Fri Jun 7 15:16:10 2019 -0500 SMB3.1.1: Add GCM crypto to the encrypt and decrypt functions SMB3.1.1 GCM performs much better than the older CCM default: more than twice as fast in the write patch (copy to the Samba server on localhost for example) and 80% faster on the read patch (copy from the server). Signed-off-by: Steve French Reviewed-by: Ronnie Sahlberg Reviewed-by: Pavel Shilovsky commit 9ac63ec7760957658700890038d804ec6c26ed34 Author: Steve French Date: Fri Jun 7 08:59:40 2019 -0500 SMB3: Add SMB3.1.1 GCM to negotiated crypto algorigthms GCM is faster. Request it during negotiate protocol. Followon patch will add callouts to GCM crypto Signed-off-by: Steve French Reviewed-by: Ronnie Sahlberg Reviewed-by: Pavel Shilovsky commit 06f2fca7ff51d87c82fc911759373be5e1d0f7b6 Author: Kefeng Wang Date: Wed Jun 5 22:24:25 2019 +0800 fs: cifs: Drop unlikely before IS_ERR(_OR_NULL) IS_ERR(_OR_NULL) already contain an 'unlikely' compiler flag, so no need to do that again from its callers. Drop it. Cc: linux-cifs@vger.kernel.org Signed-off-by: Kefeng Wang Signed-off-by: Steve French Reviewed-by: Paulo Alcantara commit d81f09748dd705c4480c804146e5ee48a13f0c74 Author: YueHaibing Date: Sat Jun 1 03:31:10 2019 +0000 cifs: Use kmemdup in SMB2_ioctl_init() Use kmemdup rather than duplicating its implementation This was reported by coccinelle. Signed-off-by: YueHaibing Signed-off-by: Steve French commit 877cb240f6a000078aabcd57f8ef7765d9fdf134 Author: Wei Yongjun Date: Fri Jul 5 01:16:42 2019 +0000 gve: Fix error return code in gve_alloc_qpls() Fix to return a negative error code from the error handling case instead of 0, as done elsewhere in this function. Fixes: f5cedc84a30d ("gve: Add transmit and receive support") Signed-off-by: Wei Yongjun Signed-off-by: David S. Miller commit 6b4ddf9950c38969f666dea1509955bd99120c4f Author: Joe Perches Date: Thu Jul 4 16:57:46 2019 -0700 net: nixge: Fix misuse of strlcpy Probable cut&paste typo - use the correct field size. Signed-off-by: Joe Perches Signed-off-by: David S. Miller commit 7391324ba485f1579afe1e1baa0a44309612b894 Author: Joe Perches Date: Thu Jul 4 16:57:45 2019 -0700 net: ethernet: sun4i-emac: Fix misuse of strlcpy Probable cut&paste typo - use the correct field size. Signed-off-by: Joe Perches Signed-off-by: David S. Miller commit 07996783491f94d55ef3bfffaadf6cb8412d5f2a Merge: ccd1479e4839 e30155fd23c9 Author: David S. Miller Date: Sun Jul 7 18:42:48 2019 -0700 Merge branch 'gtp-fix-several-bugs' Taehee Yoo says: ==================== gtp: fix several bugs This patch series fixes several bugs in the gtp module. First patch fixes suspicious RCU usage. The problem is to use rcu_dereference_sk_user_data() outside of RCU read critical section. Second patch fixes use-after-free. gtp_encap_destroy() is called twice. gtp_encap_destroy() use both gtp->sk0 and gtp->sk1u. these pointers can be freed in gtp_encap_destroy(). So, gtp_encap_destroy() should avoid using freed sk pointer. Third patch removes duplicate code in gtp_dellink(). gtp_dellink() calls gtp_encap_disable() twice. So, remove one of them. Fourth patch fixes usage of GFP_KERNEL. GFP_KERNEL can not be used in RCU read critical section. This patch make ipv4_pdp_add() to use GFP_ATOMIC instead of GFP_KERNEL. Fifth patch fixes use-after-free in gtp_newlink(). gtp_newlink() uses gtp_net which would be destroyed by the __exit_net routine. So, gtp_newlink should not be called after the __exit_net routine. Sixth patch adds missing error handling routine in gtp_encap_enable(). gtp_encap_enable() will fail, if invalid role value is sent from user-space. if so, gtp_encap_enable() should execute error handling routine. ==================== Signed-off-by: David S. Miller commit e30155fd23c9c141cbe7d99b786e10a83a328837 Author: Taehee Yoo Date: Wed Jul 3 00:24:04 2019 +0900 gtp: add missing gtp_encap_disable_sock() in gtp_encap_enable() If an invalid role is sent from user space, gtp_encap_enable() will fail. Then, it should call gtp_encap_disable_sock() but current code doesn't. It makes memory leak. Fixes: 91ed81f9abc7 ("gtp: support SGSN-side tunnels") Signed-off-by: Taehee Yoo Signed-off-by: David S. Miller commit a2bed90704c68d3763bf24decb1b781a45395de8 Author: Taehee Yoo Date: Wed Jul 3 00:23:42 2019 +0900 gtp: fix use-after-free in gtp_newlink() Current gtp_newlink() could be called after unregister_pernet_subsys(). gtp_newlink() uses gtp_net but it can be destroyed by unregister_pernet_subsys(). So unregister_pernet_subsys() should be called after rtnl_link_unregister(). Test commands: #SHELL 1 while : do for i in {1..5} do ./gtp-link add gtp$i & done killall gtp-link done #SHELL 2 while : do modprobe -rv gtp done Splat looks like: [ 753.176631] BUG: KASAN: use-after-free in gtp_newlink+0x9b4/0xa5c [gtp] [ 753.177722] Read of size 8 at addr ffff8880d48f2458 by task gtp-link/7126 [ 753.179082] CPU: 0 PID: 7126 Comm: gtp-link Tainted: G W 5.2.0-rc6+ #50 [ 753.185801] Call Trace: [ 753.186264] dump_stack+0x7c/0xbb [ 753.186863] ? gtp_newlink+0x9b4/0xa5c [gtp] [ 753.187583] print_address_description+0xc7/0x240 [ 753.188382] ? gtp_newlink+0x9b4/0xa5c [gtp] [ 753.189097] ? gtp_newlink+0x9b4/0xa5c [gtp] [ 753.189846] __kasan_report+0x12a/0x16f [ 753.190542] ? gtp_newlink+0x9b4/0xa5c [gtp] [ 753.191298] kasan_report+0xe/0x20 [ 753.191893] gtp_newlink+0x9b4/0xa5c [gtp] [ 753.192580] ? __netlink_ns_capable+0xc3/0xf0 [ 753.193370] __rtnl_newlink+0xb9f/0x11b0 [ ... ] [ 753.241201] Allocated by task 7186: [ 753.241844] save_stack+0x19/0x80 [ 753.242399] __kasan_kmalloc.constprop.3+0xa0/0xd0 [ 753.243192] __kmalloc+0x13e/0x300 [ 753.243764] ops_init+0xd6/0x350 [ 753.244314] register_pernet_operations+0x249/0x6f0 [ ... ] [ 753.251770] Freed by task 7178: [ 753.252288] save_stack+0x19/0x80 [ 753.252833] __kasan_slab_free+0x111/0x150 [ 753.253962] kfree+0xc7/0x280 [ 753.254509] ops_free_list.part.11+0x1c4/0x2d0 [ 753.255241] unregister_pernet_operations+0x262/0x390 [ ... ] [ 753.285883] list_add corruption. next->prev should be prev (ffff8880d48f2458), but was ffff8880d497d878. (next. [ 753.287241] ------------[ cut here ]------------ [ 753.287794] kernel BUG at lib/list_debug.c:25! [ 753.288364] invalid opcode: 0000 [#1] SMP DEBUG_PAGEALLOC KASAN PTI [ 753.289099] CPU: 0 PID: 7126 Comm: gtp-link Tainted: G B W 5.2.0-rc6+ #50 [ 753.291036] RIP: 0010:__list_add_valid+0x74/0xd0 [ 753.291589] Code: 48 39 da 75 27 48 39 f5 74 36 48 39 dd 74 31 48 83 c4 08 b8 01 00 00 00 5b 5d c3 48 89 d9 48b [ 753.293779] RSP: 0018:ffff8880cae8f398 EFLAGS: 00010286 [ 753.294401] RAX: 0000000000000075 RBX: ffff8880d497d878 RCX: 0000000000000000 [ 753.296260] RDX: 0000000000000075 RSI: 0000000000000008 RDI: ffffed10195d1e69 [ 753.297070] RBP: ffff8880cd250ae0 R08: ffffed101b4bff21 R09: ffffed101b4bff21 [ 753.297899] R10: 0000000000000001 R11: ffffed101b4bff20 R12: ffff8880d497d878 [ 753.298703] R13: 0000000000000000 R14: ffff8880cd250ae0 R15: ffff8880d48f2458 [ 753.299564] FS: 00007f5f79805740(0000) GS:ffff8880da400000(0000) knlGS:0000000000000000 [ 753.300533] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 753.301231] CR2: 00007fe8c7ef4f10 CR3: 00000000b71a6006 CR4: 00000000000606f0 [ 753.302183] Call Trace: [ 753.302530] gtp_newlink+0x5f6/0xa5c [gtp] [ 753.303037] ? __netlink_ns_capable+0xc3/0xf0 [ 753.303576] __rtnl_newlink+0xb9f/0x11b0 [ 753.304092] ? rtnl_link_unregister+0x230/0x230 Fixes: 459aa660eb1d ("gtp: add initial driver for datapath of GPRS Tunneling Protocol (GTP-U)") Signed-off-by: Taehee Yoo Signed-off-by: David S. Miller commit 3f167e1921865b379a9becf03828e7202c7b4917 Author: Taehee Yoo Date: Wed Jul 3 00:23:13 2019 +0900 gtp: fix Illegal context switch in RCU read-side critical section. ipv4_pdp_add() is called in RCU read-side critical section. So GFP_KERNEL should not be used in the function. This patch make ipv4_pdp_add() to use GFP_ATOMIC instead of GFP_KERNEL. Test commands: gtp-link add gtp1 & gtp-tunnel add gtp1 v1 100 200 1.1.1.1 2.2.2.2 Splat looks like: [ 130.618881] ============================= [ 130.626382] WARNING: suspicious RCU usage [ 130.626994] 5.2.0-rc6+ #50 Not tainted [ 130.627622] ----------------------------- [ 130.628223] ./include/linux/rcupdate.h:266 Illegal context switch in RCU read-side critical section! [ 130.629684] [ 130.629684] other info that might help us debug this: [ 130.629684] [ 130.631022] [ 130.631022] rcu_scheduler_active = 2, debug_locks = 1 [ 130.632136] 4 locks held by gtp-tunnel/1025: [ 130.632925] #0: 000000002b93c8b7 (cb_lock){++++}, at: genl_rcv+0x15/0x40 [ 130.634159] #1: 00000000f17bc999 (genl_mutex){+.+.}, at: genl_rcv_msg+0xfb/0x130 [ 130.635487] #2: 00000000c644ed8e (rtnl_mutex){+.+.}, at: gtp_genl_new_pdp+0x18c/0x1150 [gtp] [ 130.636936] #3: 0000000007a1cde7 (rcu_read_lock){....}, at: gtp_genl_new_pdp+0x187/0x1150 [gtp] [ 130.638348] [ 130.638348] stack backtrace: [ 130.639062] CPU: 1 PID: 1025 Comm: gtp-tunnel Not tainted 5.2.0-rc6+ #50 [ 130.641318] Call Trace: [ 130.641707] dump_stack+0x7c/0xbb [ 130.642252] ___might_sleep+0x2c0/0x3b0 [ 130.642862] kmem_cache_alloc_trace+0x1cd/0x2b0 [ 130.643591] gtp_genl_new_pdp+0x6c5/0x1150 [gtp] [ 130.644371] genl_family_rcv_msg+0x63a/0x1030 [ 130.645074] ? mutex_lock_io_nested+0x1090/0x1090 [ 130.645845] ? genl_unregister_family+0x630/0x630 [ 130.646592] ? debug_show_all_locks+0x2d0/0x2d0 [ 130.647293] ? check_flags.part.40+0x440/0x440 [ 130.648099] genl_rcv_msg+0xa3/0x130 [ ... ] Fixes: 459aa660eb1d ("gtp: add initial driver for datapath of GPRS Tunneling Protocol (GTP-U)") Signed-off-by: Taehee Yoo Signed-off-by: David S. Miller commit a635037ac1106202118a6cccc83c877caa6e1c9a Author: Taehee Yoo Date: Wed Jul 3 00:22:56 2019 +0900 gtp: remove duplicate code in gtp_dellink() gtp_encap_disable() in gtp_dellink() is unnecessary because it will be called by unregister_netdevice(). unregister_netdevice() internally calls gtp_dev_uninit() by ->ndo_uninit(). And gtp_dev_uninit() calls gtp_encap_disable(). Signed-off-by: Taehee Yoo Signed-off-by: David S. Miller commit 1788b8569f5de27da09087fa3f6580d2aa04cc75 Author: Taehee Yoo Date: Wed Jul 3 00:22:25 2019 +0900 gtp: fix use-after-free in gtp_encap_destroy() gtp_encap_destroy() is called twice. 1. When interface is deleted. 2. When udp socket is destroyed. either gtp->sk0 or gtp->sk1u could be freed by sock_put() in gtp_encap_destroy(). so, when gtp_encap_destroy() is called again, it would uses freed sk pointer. patch makes gtp_encap_destroy() to set either gtp->sk0 or gtp->sk1u to null. in addition, both gtp->sk0 and gtp->sk1u pointer are protected by rtnl_lock. so, rtnl_lock() is added. Test command: gtp-link add gtp1 & killall gtp-link ip link del gtp1 Splat looks like: [ 83.182767] BUG: KASAN: use-after-free in __lock_acquire+0x3a20/0x46a0 [ 83.184128] Read of size 8 at addr ffff8880cc7d5360 by task ip/1008 [ 83.185567] CPU: 1 PID: 1008 Comm: ip Not tainted 5.2.0-rc6+ #50 [ 83.188469] Call Trace: [ ... ] [ 83.200126] lock_acquire+0x141/0x380 [ 83.200575] ? lock_sock_nested+0x3a/0xf0 [ 83.201069] _raw_spin_lock_bh+0x38/0x70 [ 83.201551] ? lock_sock_nested+0x3a/0xf0 [ 83.202044] lock_sock_nested+0x3a/0xf0 [ 83.202520] gtp_encap_destroy+0x18/0xe0 [gtp] [ 83.203065] gtp_encap_disable.isra.14+0x13/0x50 [gtp] [ 83.203687] gtp_dellink+0x56/0x170 [gtp] [ 83.204190] rtnl_delete_link+0xb4/0x100 [ ... ] [ 83.236513] Allocated by task 976: [ 83.236925] save_stack+0x19/0x80 [ 83.237332] __kasan_kmalloc.constprop.3+0xa0/0xd0 [ 83.237894] kmem_cache_alloc+0xd8/0x280 [ 83.238360] sk_prot_alloc.isra.42+0x50/0x200 [ 83.238874] sk_alloc+0x32/0x940 [ 83.239264] inet_create+0x283/0xc20 [ 83.239684] __sock_create+0x2dd/0x540 [ 83.240136] __sys_socket+0xca/0x1a0 [ 83.240550] __x64_sys_socket+0x6f/0xb0 [ 83.240998] do_syscall_64+0x9c/0x450 [ 83.241466] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 83.242061] [ 83.242249] Freed by task 0: [ 83.242616] save_stack+0x19/0x80 [ 83.243013] __kasan_slab_free+0x111/0x150 [ 83.243498] kmem_cache_free+0x89/0x250 [ 83.244444] __sk_destruct+0x38f/0x5a0 [ 83.245366] rcu_core+0x7e9/0x1c20 [ 83.245766] __do_softirq+0x213/0x8fa Fixes: 1e3a3abd8b28 ("gtp: make GTP sockets in gtp_newlink optional") Signed-off-by: Taehee Yoo Signed-off-by: David S. Miller commit e198987e7dd7d3645a53875151cd6f8fc425b706 Author: Taehee Yoo Date: Wed Jul 3 00:20:51 2019 +0900 gtp: fix suspicious RCU usage gtp_encap_enable_socket() and gtp_encap_destroy() are not protected by rcu_read_lock(). and it's not safe to write sk->sk_user_data. This patch make these functions to use lock_sock() instead of rcu_dereference_sk_user_data(). Test commands: gtp-link add gtp1 Splat looks like: [ 83.238315] ============================= [ 83.239127] WARNING: suspicious RCU usage [ 83.239702] 5.2.0-rc6+ #49 Not tainted [ 83.240268] ----------------------------- [ 83.241205] drivers/net/gtp.c:799 suspicious rcu_dereference_check() usage! [ 83.243828] [ 83.243828] other info that might help us debug this: [ 83.243828] [ 83.246325] [ 83.246325] rcu_scheduler_active = 2, debug_locks = 1 [ 83.247314] 1 lock held by gtp-link/1008: [ 83.248523] #0: 0000000017772c7f (rtnl_mutex){+.+.}, at: __rtnl_newlink+0x5f5/0x11b0 [ 83.251503] [ 83.251503] stack backtrace: [ 83.252173] CPU: 0 PID: 1008 Comm: gtp-link Not tainted 5.2.0-rc6+ #49 [ 83.253271] Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006 [ 83.254562] Call Trace: [ 83.254995] dump_stack+0x7c/0xbb [ 83.255567] gtp_encap_enable_socket+0x2df/0x360 [gtp] [ 83.256415] ? gtp_find_dev+0x1a0/0x1a0 [gtp] [ 83.257161] ? memset+0x1f/0x40 [ 83.257843] gtp_newlink+0x90/0xa21 [gtp] [ 83.258497] ? __netlink_ns_capable+0xc3/0xf0 [ 83.259260] __rtnl_newlink+0xb9f/0x11b0 [ 83.260022] ? rtnl_link_unregister+0x230/0x230 [ ... ] Fixes: 1e3a3abd8b28 ("gtp: make GTP sockets in gtp_newlink optional") Signed-off-by: Taehee Yoo Signed-off-by: David S. Miller commit ad7b134f65385627ebe9b3162a652267c8d991ee Merge: 30a4616c1bfd 1da39ff09e56 Author: David S. Miller Date: Sun Jul 7 14:16:32 2019 -0700 Merge branch 'net-dsa-Add-Vitesse-VSC73xx-parallel-mode' Pawel Dembicki says: ==================== net: dsa: Add Vitesse VSC73xx parallel mode Main goal of this patch series is to add support for CPU attached parallel bus in Vitesse VSC73xx switches. Existing driver supports only SPI mode. Second change is needed for devices in unmanaged state. V3: - fix commit messages and descriptions about memory-mapped I/O mode V2: - drop changes in compatible strings - make changes less invasive - drop mutex in platform part and move mutex from core to spi part - fix indentation - fix devm_ioremap_resource result check - add cover letter ==================== Signed-off-by: David S. Miller commit 1da39ff09e561df9062342563ce8db9b9181a3de Author: Pawel Dembicki Date: Fri Jul 5 00:29:07 2019 +0200 net: dsa: vsc73xx: Assert reset if iCPU is enabled Driver allow to use devices with disabled iCPU only. Some devices have pre-initialised iCPU by bootloader. That state make switch unmanaged. This patch force reset if device is in unmanaged state. In the result chip lost internal firmware from RAM and it can be managed. Signed-off-by: Pawel Dembicki Reviewed-by: Linus Walleij Reviewed-by: Florian Fainelli Signed-off-by: David S. Miller commit 631e83bf7c0e801f0ab960a97a3228b2dbf9ebeb Author: Pawel Dembicki Date: Fri Jul 5 00:29:06 2019 +0200 net: dsa: vsc73xx: add support for parallel mode This patch add platform part of vsc73xx driver. It allows to use chip connected to a parallel memory bus and work in memory-mapped I/O mode. (aka PI bus in chip manual) By default device is working in big endian mode. Signed-off-by: Pawel Dembicki Reviewed-by: Linus Walleij Reviewed-by: Florian Fainelli Signed-off-by: David S. Miller commit 95711cd5f0b4b0394f2e0c30fdd99b853317ed49 Author: Pawel Dembicki Date: Fri Jul 5 00:29:05 2019 +0200 net: dsa: vsc73xx: Split vsc73xx driver This driver (currently) only takes control of the switch chip over SPI and configures it to route packages around when connected to a CPU port. But Vitesse chip support also parallel interface. This patch split driver into two parts: core and spi. It is required for add support to another managing interface. Tested-by: Linus Walleij Signed-off-by: Pawel Dembicki Reviewed-by: Linus Walleij Reviewed-by: Florian Fainelli Signed-off-by: David S. Miller commit 86116f4d649bec311bbf3ee50a1eb582e3fcfd9c Author: Pawel Dembicki Date: Fri Jul 5 00:29:04 2019 +0200 net: dsa: Change DT bindings for Vitesse VSC73xx switches This commit introduce how to use vsc73xx platform driver. Signed-off-by: Pawel Dembicki Reviewed-by: Linus Walleij Reviewed-by: Florian Fainelli Signed-off-by: David S. Miller commit ccd1479e48391674ff76002a92b75defc3c78257 Merge: 537de0c8ca2b 81a89ef6be5b Author: David S. Miller Date: Sun Jul 7 14:11:45 2019 -0700 Merge branch 'net-tls-fix-poll-wake-up' Jakub Kicinski says: ==================== net/tls: fix poll() wake up This small fix + selftest series is very similar to the previous commit 04b25a5411f9 ("net/tls: fix no wakeup on partial reads"). This time instead of recvmsg we're fixing poll wake up. ==================== Signed-off-by: David S. Miller commit 81a89ef6be5befcc5a168af1aca377670bbf4997 Author: Jakub Kicinski Date: Thu Jul 4 14:50:37 2019 -0700 selftests/tls: add test for poll() with data in TLS ULP Add a test which checks if leftover record data in TLS layer correctly wakes up poll(). Signed-off-by: Jakub Kicinski Reviewed-by: Dirk van der Merwe Signed-off-by: David S. Miller commit 13aecb17acabc2a92187d08f7ca93bb8aad62c6f Author: Jakub Kicinski Date: Thu Jul 4 14:50:36 2019 -0700 net/tls: fix poll ignoring partially copied records David reports that RPC applications which use epoll() occasionally get stuck, and that TLS ULP causes the kernel to not wake applications, even though read() will return data. This is indeed true. The ctx->rx_list which holds partially copied records is not consulted when deciding whether socket is readable. Note that SO_RCVLOWAT with epoll() is and has always been broken for kernel TLS. We'd need to parse all records from the TCP layer, instead of just the first one. Fixes: 692d7b5d1f91 ("tls: Fix recvmsg() to be able to peek across multiple records") Reported-by: David Beckett Signed-off-by: Jakub Kicinski Reviewed-by: Dirk van der Merwe Signed-off-by: David S. Miller commit 46ce10df799fb0647a9c0e3f793e66463a8d6773 Merge: 3bb4bba79254 8d1336c241bd Author: Miquel Raynal Date: Sun Jul 7 22:53:15 2019 +0200 Merge tag 'spi-nor/for-5.3-v2' of gitolite.kernel.org:pub/scm/linux/kernel/git/mtd/linux into mtd/next SPI-NOR core changes: - add support for the mt25ql02g and w25q16jv flashes - print error in case of jedec read id fails - is25lp256: add post BFPT fix to correct the addr_width SPI NOR controller drivers changes: - intel-spi: Add support for Intel Elkhart Lake SPI serial flash - smt32: remove the driver as the driver was replaced by spi-stm32-qspi.c - cadence-quadspi: add reset control commit 05c78468a60f2fd961cd0a0c01c27f288bf81204 Author: Arnaldo Carvalho de Melo Date: Thu Jun 13 12:04:19 2019 -0300 tools build: Check if gettid() is available before providing helper Laura reported that the perf build failed in fedora when we got a glibc that provides gettid(), which I reproduced using fedora rawhide with the glibc-devel-2.29.9000-26.fc31.x86_64 package. Add a feature check to avoid providing a gettid() helper in such systems. On a fedora rawhide system with this patch applied we now get: [root@7a5f55352234 perf]# grep gettid /tmp/build/perf/FEATURE-DUMP feature-gettid=1 [root@7a5f55352234 perf]# cat /tmp/build/perf/feature/test-gettid.make.output [root@7a5f55352234 perf]# ldd /tmp/build/perf/feature/test-gettid.bin linux-vdso.so.1 (0x00007ffc6b1f6000) libc.so.6 => /lib64/libc.so.6 (0x00007f04e0a74000) /lib64/ld-linux-x86-64.so.2 (0x00007f04e0c47000) [root@7a5f55352234 perf]# nm /tmp/build/perf/feature/test-gettid.bin | grep -w gettid U gettid@@GLIBC_2.30 [root@7a5f55352234 perf]# While on a fedora:29 system: [acme@quaco perf]$ grep gettid /tmp/build/perf/FEATURE-DUMP feature-gettid=0 [acme@quaco perf]$ cat /tmp/build/perf/feature/test-gettid.make.output test-gettid.c: In function ‘main’: test-gettid.c:8:9: error: implicit declaration of function ‘gettid’; did you mean ‘getgid’? [-Werror=implicit-function-declaration] return gettid(); ^~~~~~ getgid cc1: all warnings being treated as errors [acme@quaco perf]$ Reported-by: Laura Abbott Tested-by: Laura Abbott Acked-by: Jiri Olsa Cc: Adrian Hunter Cc: Florian Weimer Cc: Namhyung Kim Cc: Stephane Eranian Link: https://lkml.kernel.org/n/tip-yfy3ch53agmklwu9o7rlgf9c@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 35051f84344bcbd40ba76e943183f0e9a1be9fa5 Merge: 4471e44f972f 841ed60264b3 Author: Olof Johansson Date: Sun Jul 7 13:33:01 2019 -0700 Merge tag 'samsung-dt-5.3-3' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux into arm/dt Samsung DTS ARM changes for v5.3, third round 1. Fix imprecise abort on Exynos4210 caused by newly added Mali nodes, 2. Reorganize Mali nodes under /soc, 3. Adjust buck regulators voltages on Arndale Octa and Odroid XU3/XU4 family to sane values. * tag 'samsung-dt-5.3-3' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux: ARM: dts: exynos: Adjust buck[78] regulators to supported values on Arndale Octa ARM: dts: exynos: Adjust buck[78] regulators to supported values on Odroid XU3 family ARM: dts: exynos: Move Mali400 GPU node to "/soc" ARM: dts: exynos: Fix imprecise abort on Mali GPU probe on Exynos4210 Link: https://lore.kernel.org/r/20190707180115.5562-1-krzk@kernel.org Signed-off-by: Olof Johansson commit 30a4616c1bfd121ecd7e4325aebd6621e0af719f Author: Xin Long Date: Tue Jul 2 00:54:55 2019 +0800 tipc: use rcu dereference functions properly For these places are protected by rcu_read_lock, we change from rcu_dereference_rtnl to rcu_dereference, as there is no need to check if rtnl lock is held. For these places are protected by rtnl_lock, we change from rcu_dereference_rtnl to rtnl_dereference/rcu_dereference_protected, as no extra memory barriers are needed under rtnl_lock() which also protects tn->bearer_list[] and dev->tipc_ptr/b->media_ptr updating. rcu_dereference_rtnl will be only used in the places where it could be under rcu_read_lock or rtnl_lock. Signed-off-by: Xin Long Signed-off-by: David S. Miller commit 9e0773c3873e8b4d2ae77f6bf19de11e08a9f1ef Author: Heiner Kallweit Date: Sun Jul 7 13:59:54 2019 +0200 r8169: sync few chip names with vendor driver This patch syncs the name of few chip versions with the latest vendor driver version. Signed-off-by: Heiner Kallweit Signed-off-by: David S. Miller commit f7623d340794620ac8d933477cc265be77c78fe5 Merge: 437fde6cda74 9ce67c3235be Author: David S. Miller Date: Sun Jul 7 12:54:36 2019 -0700 Merge branch 'for-upstream' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth-next Johan Hedberg says: ==================== pull request: bluetooth-next 2019-07-07 Here's the main bluetooth-next pull request for 5.3: - Added support for new devices from Qualcomm, Realtek and Broadcom and MediaTek - Various fixes to 6LoWPAN - Fix L2CAP PSM namespace separation for LE & BR/EDR - Fix behavior with Microsoft Surface Precision Mouse - Added support for LE Ping feature - Fix L2CAP Disconnect response handling if received in wrong state Please let me know if there are any issues pulling. Thanks. ==================== Signed-off-by: David S. Miller commit 3bb4bba79254be87c86ef416d6b7f69882e6a02c Author: Chris Packham Date: Thu May 23 11:19:48 2019 +1200 mtd: concat: implement _is_locked mtd operation Add an implementation of the _is_locked operation for concatenated mtd devices. This doesn't handle getting the lock status of a range that spans chips, which is consistent with cfi_ppb_is_locked and cfi_intelext_is_locked which only look at the first block in the range. Signed-off-by: Chris Packham Signed-off-by: Richard Weinberger commit 6a08a2f12781ca788759ff73acf1f36f6ae3f9b7 Author: Chris Packham Date: Thu May 23 11:19:47 2019 +1200 mtd: concat: refactor concat_lock/concat_unlock concat_lock() and concat_unlock() only differed in terms of the mtd_xx operation they called. Refactor them to use a common helper function and pass a boolean flag to indicate whether lock or unlock is needed. Signed-off-by: Chris Packham Signed-off-by: Richard Weinberger commit df616d7a442b90798d63fbf4447154bbbb9040b1 Author: Masahiro Yamada Date: Thu Jun 27 16:07:45 2019 +0900 mtd: abi: do not use C++ style comments in uapi header Linux kernel tolerates C++ style comments these days. Actually, the SPDX License tags for .c files start with //. On the other hand, uapi headers are written in more strict C, where the C++ comment style is forbidden. Signed-off-by: Masahiro Yamada Acked-by: Richard Weinberger Signed-off-by: Richard Weinberger commit 63898ab5159f6349f58b23cbf9cd06a824d88527 Author: Ding Xiang Date: Wed May 29 15:18:22 2019 +0800 mtd: afs: remove unneeded NULL check NULL check before kfree is unneeded, so remove it. Signed-off-by: Ding Xiang Signed-off-by: Richard Weinberger commit 1a927fd347ebb3c02046150ee489d4fe4e6b9e81 Author: Masahiro Yamada Date: Mon Jul 1 09:58:39 2019 +0900 init/Kconfig: add CONFIG_CC_CAN_LINK Currently, scripts/cc-can-link.sh is run just for BPFILTER_UMH, but defining CC_CAN_LINK will be useful in other places. Signed-off-by: Masahiro Yamada commit 33177f01ca3fe550146bb9001bec2fd806b2f40c Author: Vasily Gorbik Date: Fri Jun 28 19:22:47 2019 +0200 kallsyms: exclude kasan local symbols on s390 gcc asan instrumentation emits the following sequence to store frame pc when the kernel is built with CONFIG_RELOCATABLE: debug/vsprintf.s: .section .data.rel.ro.local,"aw" .align 8 .LC3: .quad .LASANPC4826@GOTOFF .text .align 8 .type number, @function number: .LASANPC4826: and in case reloc is issued for LASANPC label it also gets into .symtab with the same address as actual function symbol: $ nm -n vmlinux | grep 0000000001397150 0000000001397150 t .LASANPC4826 0000000001397150 t number In the end kernel backtraces are almost unreadable: [ 143.748476] Call Trace: [ 143.748484] ([<000000002da3e62c>] .LASANPC2671+0x114/0x190) [ 143.748492] [<000000002eca1a58>] .LASANPC2612+0x110/0x160 [ 143.748502] [<000000002de9d830>] print_address_description+0x80/0x3b0 [ 143.748511] [<000000002de9dd64>] __kasan_report+0x15c/0x1c8 [ 143.748521] [<000000002ecb56d4>] strrchr+0x34/0x60 [ 143.748534] [<000003ff800a9a40>] kasan_strings+0xb0/0x148 [test_kasan] [ 143.748547] [<000003ff800a9bba>] kmalloc_tests_init+0xe2/0x528 [test_kasan] [ 143.748555] [<000000002da2117c>] .LASANPC4069+0x354/0x748 [ 143.748563] [<000000002dbfbb16>] do_init_module+0x136/0x3b0 [ 143.748571] [<000000002dbff3f4>] .LASANPC3191+0x2164/0x25d0 [ 143.748580] [<000000002dbffc4c>] .LASANPC3196+0x184/0x1b8 [ 143.748587] [<000000002ecdf2ec>] system_call+0xd8/0x2d8 Since LASANPC labels are not even unique and get into .symtab only due to relocs filter them out in kallsyms. Signed-off-by: Vasily Gorbik Signed-off-by: Masahiro Yamada commit 4e8fc3f55a38996a56106d6adfac72885ddd97ef Author: Masahiro Yamada Date: Tue Jun 25 17:51:27 2019 +0900 kbuild: add more hints about SUBDIRS replacement Commit 0126be38d988 ("kbuild: announce removal of SUBDIRS if used") added a hint about the 'SUBDIRS' replacement, but it was not clear enough. Multiple people sent me similar questions, patches. For instance, https://lkml.org/lkml/2019/1/17/456 I did not mean to use M= for building a subdirectory in the kernel tree. From commit 669efc76b317 ("net: hns3: fix compile error"), people already (ab)use M=... to do that because it seems to work to some extent. Documentation/kbuild/kbuild.txt says M= and KBUILD_EXTMOD are used for building external modules. In fact, Kbuild supports the single target '%/' for this purpose, but this may not be noticed much. Kindly add more hints. Makefile:213: ================= WARNING ================ Makefile:214: 'SUBDIRS' will be removed after Linux 5.3 Makefile:215: Makefile:216: If you are building an individual subdirectory Makefile:217: in the kernel tree, you can do like this: Makefile:218: $ make path/to/dir/you/want/to/build/ Makefile:219: (Do not forget the trailing slash) Makefile:220: Makefile:221: If you are building an external module, Makefile:222: Please use 'M=' or 'KBUILD_EXTMOD' instead Makefile:223: ========================================== Suggested-by: Christoph Hellwig Signed-off-by: Masahiro Yamada Acked-by: Sam Ravnborg commit 0c4ab18fc33bba70299f51fac83e32397cf9a04b Author: Kirill Smelkov Date: Sun Jun 23 07:28:53 2019 +0000 coccinelle: api/stream_open: treat all wait_.*() calls as blocking Previously steam_open.cocci was treating only wait_event_.* - e.g. wait_event_interruptible - as a blocking operation. However e.g. wait_for_completion_interruptible is also blocking, and so from this point of view it would be more logical to treat all wait_.* as a blocking point. The logic of this change actually came up for real when drivers/pci/switch/switchtec.c changed from using wait_event_interruptible to wait_for_completion_interruptible: https://lore.kernel.org/linux-pci/20190413170056.GA11293@deco.navytux.spb.ru/ https://lore.kernel.org/linux-pci/20190415145456.GA15280@deco.navytux.spb.ru/ https://lore.kernel.org/linux-pci/20190415154102.GB17661@deco.navytux.spb.ru/ For a driver that uses nonseekable_open with read/write having stream semantic and read also calling e.g. wait_for_completion_interruptible, running stream_open.cocci before this patch would produce: WARNING: _fops: .read() and .write() have stream semantic; safe to change nonseekable_open -> stream_open. while after this patch it will report: ERROR: _fops: .read() can deadlock .write(); change nonseekable_open -> stream_open to fix. Signed-off-by: Kirill Smelkov Acked-by: Julia Lawall Signed-off-by: Masahiro Yamada commit f58c17c202e7aec9623754a7ec0b0669e043b838 Author: Markus Elfring Date: Wed May 8 13:50:49 2019 +0200 coccinelle: put_device: Add a cast to an expression for an assignment Extend a when constraint in a SmPL rule so that an additional cast is optionally excluded from source code searches for an expression in assignments. Signed-off-by: Markus Elfring Suggested-by: Julia Lawall Link: https://lore.kernel.org/lkml/alpine.DEB.2.21.1902160934400.3212@hadrien/ Link: https://systeme.lip6.fr/pipermail/cocci/2019-February/005592.html Acked-by: Julia Lawall Signed-off-by: Masahiro Yamada commit 30a70e806d938ed9fd9bfd2074c4458e63efc3ed Author: Markus Elfring Date: Tue May 7 11:20:48 2019 +0200 coccinelle: put_device: Adjust a message construction The Linux coding style tolerates long string literals so that the provided information can be easier found also by search tools like grep. Thus simplify a message construction in a SmPL rule by concatenating text with two plus operators less. Signed-off-by: Markus Elfring Signed-off-by: Masahiro Yamada commit a3b0b6f953ecd51c98bc84efd043a4aad786801b Author: Rikard Falkeborn Date: Mon Apr 8 21:14:32 2019 +0200 coccinelle: kstrdup: Fix typo in warning messages Replace 'kstrdep' with 'kstrdup' in warning messages. Signed-off-by: Rikard Falkeborn Acked-by: Julia Lawall Signed-off-by: Masahiro Yamada commit b7f5b656ffe19e3c65f04e3adeae21ac17227126 Author: Raag Jadav Date: Sat Jun 29 13:50:48 2019 +0530 dmaengine: at_xdmac: check for non-empty xfers_list before invoking callback tx descriptor retrieved from an empty xfers_list may not have valid pointers to the callback functions. Avoid calling dmaengine_desc_get_callback_invoke if xfers_list is empty. Signed-off-by: Raag Jadav Acked-by: Ludovic Desroches Signed-off-by: Vinod Koul commit dab0f4ebb22ee6d16051011d624cff79a99baa8a Author: Jiri Olsa Date: Fri May 31 15:13:21 2019 +0200 perf jvmti: Address gcc string overflow warning for strncpy() We are getting false positive gcc warning when we compile with gcc9 (9.1.1): CC jvmti/libjvmti.o In file included from /usr/include/string.h:494, from jvmti/libjvmti.c:5: In function ‘strncpy’, inlined from ‘copy_class_filename.constprop’ at jvmti/libjvmti.c:166:3: /usr/include/bits/string_fortified.h:106:10: error: ‘__builtin_strncpy’ specified bound depends on the length of the source argument [-Werror=stringop-overflow=] 106 | return __builtin___strncpy_chk (__dest, __src, __len, __bos (__dest)); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ jvmti/libjvmti.c: In function ‘copy_class_filename.constprop’: jvmti/libjvmti.c:165:26: note: length computed here 165 | size_t file_name_len = strlen(file_name); | ^~~~~~~~~~~~~~~~~ cc1: all warnings being treated as errors As per Arnaldo's suggestion use strlcpy(), which does the same thing and keeps gcc silent. Suggested-by: Arnaldo Carvalho de Melo Signed-off-by: Jiri Olsa Cc: Alexander Shishkin Cc: Ben Gainey Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Stephane Eranian Link: http://lkml.kernel.org/r/20190531131321.GB1281@krava Signed-off-by: Arnaldo Carvalho de Melo commit c18ae6327a13a6d707f6139c31597057103aa85b Author: Arnaldo Carvalho de Melo Date: Tue May 28 17:36:46 2019 -0300 perf python: Remove -fstack-protector-strong if clang doesn't have it Some distros put -fstack-protector-strong in the compiler flags to be used to build python extensions, but then, the clang version in that distro doesn't know about that, only gcc does. Check if that is the case and remove it from the set of options used to build the python binding with clang. Case at hand: oraclelinux:7 $ head -2 /etc/os-release NAME="Oracle Linux Server" VERSION="7.6" $ grep stack-protector /usr/lib64/python2.7/_sysconfigdata.py | head -1 | cut -c-120 'CFLAGS': '-fno-strict-aliasing -O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --para $ gcc version 4.8.5 20150623 (Red Hat 4.8.5-36.0.1) (GCC) clang version 3.4.2 (tags/RELEASE_34/dot2-final) clang: error: unknown argument: '-fstack-protector-strong' clang: error: unknown argument: '-fstack-protector-strong' error: command 'clang' failed with exit status 1 cp: cannot stat '/tmp/build/perf/python_ext_build/lib/perf*.so': No such file or directory make[2]: *** [/tmp/build/perf/python/perf.so] Error 1 Cc: Adrian Hunter Cc: Jiri Olsa Cc: Namhyung Kim Link: https://lkml.kernel.org/n/tip-brmp2415zxpbhz45etkgjoma@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit d3e5397169175628696e92191dfc0e86d8e48db9 Author: Maksym Planeta Date: Tue Jul 2 15:49:28 2019 +0200 ibverbs/rxe: Remove variable self-initialization In some cases (not in this particular one) variable self-initialization can lead to undefined behavior. In this case, it is just obscure code. Signed-off-by: Maksym Planeta Signed-off-by: Jason Gunthorpe commit 617cf24f9f9efcd5e2f0258e7da10b8a2447662b Author: Lang Cheng Date: Mon Jun 24 19:47:52 2019 +0800 RDMA/hns: Clean up unnecessary variable initialization Here Clean up unnecessary initial value for some variable. Signed-off-by: Lang Cheng Signed-off-by: Jason Gunthorpe commit ec5bc2cc69b4fc494e04d10fc5226f6f9cf67c56 Author: Xi Wang Date: Mon Jun 24 19:47:51 2019 +0800 RDMA/hns: Fixs hw access invalid dma memory error When smmu is enable, if execute the perftest command and then use 'kill -9' to exit, follow this operation repeatedly, the kernel will have a high probability to print the following smmu event: arm-smmu-v3 arm-smmu-v3.1.auto: event 0x10 received: arm-smmu-v3 arm-smmu-v3.1.auto: 0x00007d0000000010 arm-smmu-v3 arm-smmu-v3.1.auto: 0x0000020900000080 arm-smmu-v3 arm-smmu-v3.1.auto: 0x00000000f47cf000 arm-smmu-v3 arm-smmu-v3.1.auto: 0x00000000f47cf000 This is because the hw will periodically refresh the qpc cache until the next reset. This patch fixed it by removing the action that release qpc memory in the 'hns_roce_qp_free' function. Fixes: 9a4435375cd1 ("IB/hns: Add driver files for hns RoCE driver") Signed-off-by: Xi Wang Signed-off-by: Jason Gunthorpe commit fd7dd8bc8784bc96213781f1bfb454ae1c13e79f Author: Lang Cheng Date: Mon Jun 24 19:47:50 2019 +0800 RDMA/hns: Use %pK format pointer print The format specifier \"%p\" can leak kernel addresses. Use \"%pK\" instead. Signed-off-by: Lang Cheng Signed-off-by: Jason Gunthorpe commit e0222d18d628ce96f0def790ea26b6b7b3c18f78 Author: Lijun Ou Date: Mon Jun 24 19:47:49 2019 +0800 RDMA/hns: Bugfix for calculating qp buffer size The buffer size of qp which used to allocate qp buffer space for storing sqwqe and rqwqe will be the length of buffer space. The kernel driver will use the buffer address and the same size to get the user memory. The same size named buff_size of qp. According the algorithm of calculating, The size of the two is not equal when users set the max sge of sq. Fixes: b28ca7cceff8 ("RDMA/hns: Limit extend sq sge num") Signed-off-by: Lijun Ou Signed-off-by: Jason Gunthorpe commit 9176ab1b848059a0cd9caf39f0cebaa1b7ec5ec2 Author: zhengbin Date: Sun Jul 7 08:51:41 2019 +0800 time: Validate user input in compat_settimeofday() The user value is validated after converting the timeval to a timespec, but for a wide range of negative tv_usec values the multiplication overflow turns them in positive numbers. So the 'validated later' is not catching the invalid input. Signed-off-by: zhengbin Signed-off-by: Thomas Gleixner Link: https://lkml.kernel.org/r/1562460701-113301-1-git-send-email-zhengbin13@huawei.com commit 7891bc0ab739a31538b5f879a523232b8b07a0d3 Author: Sebastian Andrzej Siewior Date: Thu Jul 4 08:07:43 2019 +0200 x86/fpu: Inline fpu__xstate_clear_all_cpu_caps() All fpu__xstate_clear_all_cpu_caps() does is to invoke one simple function since commit 73e3a7d2a7c3b ("x86/fpu: Remove the explicit clearing of XSAVE dependent features") so invoke that function directly and remove the wrapper. Signed-off-by: Sebastian Andrzej Siewior Signed-off-by: Thomas Gleixner Link: https://lkml.kernel.org/r/20190704060743.rvew4yrjd6n33uzx@linutronix.de commit 9838e3bff0f92f23fcd50fe1ff1d4b3e91b8a448 Author: Sebastian Andrzej Siewior Date: Wed Jul 3 10:32:47 2019 +0200 x86/fpu: Make 'no387' and 'nofxsr' command line options useful The command line option `no387' is designed to disable the FPU entirely. This only 'works' with CONFIG_MATH_EMULATION enabled. But on 64bit this cannot work because user space expects SSE to work which required basic FPU support. MATH_EMULATION does not help because SSE is not emulated. The command line option `nofxsr' should also be limited to 32bit because FXSR is part of the required flags on 64bit so turning it off is not possible. Clearing X86_FEATURE_FPU without emulation enabled will not work anyway and hang in fpu__init_system_early_generic() before the console is enabled. Setting additioal dependencies, ensures that the CPU still boots on a modern CPU. Otherwise, dropping FPU will leave FXSR enabled causing the kernel to crash early in fpu__init_system_mxcsr(). With XSAVE support it will crash in fpu__init_cpu_xstate(). The problem is that xsetbv() with XMM set and SSE cleared is not allowed. That means XSAVE has to be disabled. The XSAVE support is disabled in fpu__init_system_xstate_size_legacy() but it is too late. It can be removed, it has been added in commit 1f999ab5a1360 ("x86, xsave: Disable xsave in i387 emulation mode") to use `no387' on a CPU with XSAVE support. All this happens before console output. After hat, the next possible crash is in RAID6 detect code because MMX remained enabled. With a 3DNOW enabled config it will explode in memcpy() for instance due to kernel_fpu_begin() but this is unconditionally enabled. This is enough to boot a Debian Wheezy on a 32bit qemu "host" CPU which supports everything up to XSAVES, AVX2 without 3DNOW. Later, Debian increased the minimum requirements to i686 which means it does not boot userland atleast due to CMOV. After masking the additional features it still keeps SSE4A and 3DNOW* enabled (if present on the host) but those are unused in the kernel. Restrict `no387' and `nofxsr' otions to 32bit only. Add dependencies for FPU, FXSR to additionaly mask CMOV, MMX, XSAVE if FXSR or FPU is cleared. Reported-by: Vegard Nossum Signed-off-by: Sebastian Andrzej Siewior Signed-off-by: Thomas Gleixner Link: https://lkml.kernel.org/r/20190703083247.57kjrmlxkai3vpw3@linutronix.de commit 28ef2db8866495150e4260773fead8313f1a5625 Author: Peter Xu Date: Fri Jun 28 18:59:42 2019 +0800 timer: Document TIMER_PINNED The flag hints the user that the pinned timers will always be run on a static CPU (because that should be what "pinned" means...) but that's not the truth, at least with the current implementation. For example, currently if a pinned timer is set up but later mod_timer() upon the pinned timer is invoked, mod_timer() will still try to queue the timer on the current processor and migrate the timer if necessary. Document it a bit with the definition of TIMER_PINNED so that all future users will use it correctly. Signed-off-by: Peter Xu Signed-off-by: Thomas Gleixner Cc: Marcelo Tosatti Cc: Luiz Capitulino Link: https://lkml.kernel.org/r/20190628105942.14131-1-peterx@redhat.com commit b89b889a326a7abf1c9ceef7ddbe06dbaf8c2520 Merge: d4bd30532688 774a075ab514 Author: Takashi Iwai Date: Sun Jul 7 11:29:03 2019 +0200 Merge branch 'topic/hda-refresh-cleanup' into for-next Merge a cleanup for HD-audio widget refresh code Signed-off-by: Takashi Iwai commit d4bd30532688558a7de70f0c8edd2a7a25c3963f Author: Nicola Lunghi Date: Sun Jul 7 09:27:34 2019 +0100 ALSA: usb-audio: fix Line6 Helix audio format rates Line6 Helix and HX stomp devices don't support retrieving the number of clock sample rate. Add a quirk to set it to 48Khz by default. [ fixed wrong variable initialization changes by tiwai ] Signed-off-by: Nicola Lunghi Signed-off-by: Takashi Iwai commit ba18ca2b8e18146228ff36b50f0c9a3f5c5bd1b5 Author: Takashi Sakamoto Date: Sun Jul 7 14:20:11 2019 +0900 firewire-motu: fix wrong reference count for stream functionality at error path of rawmidi interface In IEC 61883-6, several types of sampling data can be multiplexed into payload of common isochronous packet (CIP). For typical audio and music units, PCM samples and MIDI messages are multiplexed into one packet streaming. ALSA firewire-motu driver allows applications of rawmidi interface to start packet streaming for transmission of MIDI messages. However at error path, the reference count of stream functionality is not operated correctly. This can brings a bug that packet streaming is not stopped when all referrers release the count. This commit fixes the bug. Fixes: 8edc56ec8f14 ("ALSA: firewire-motu: reserve/release isochronous resources in pcm.hw_params/hw_free callbacks") Signed-off-by: Takashi Sakamoto Signed-off-by: Takashi Iwai commit 64582c56a9156ce88297a89a3b8ba03754e7149a Author: Takashi Sakamoto Date: Sun Jul 7 14:20:10 2019 +0900 ALSA: firewire-digi00x: fix wrong reference count for stream functionality at error path of rawmidi interface In IEC 61883-6, several types of sampling data can be multiplexed into payload of common isochronous packet (CIP). For typical audio and music units, PCM samples and MIDI messages are multiplexed into one packet streaming. ALSA firewire-digi00x driver allows applications of rawmidi interface to start packet streaming for transmission of MIDI messages. However at error path, the reference count of stream functionality is not operated correctly. This can brings a bug that packet streaming is not stopped when all referrers release the count. This commit fixes the bug. Fixes: ae8ffbb26512 ("ALSA: firewire-digi00x: reserve/release isochronous resources in pcm.hw_params/hw_free callbacks") Signed-off-by: Takashi Sakamoto Signed-off-by: Takashi Iwai commit e79c3f0c006ec26d0de5ba9747f65b81c16f83f1 Author: Takashi Sakamoto Date: Sun Jul 7 14:20:09 2019 +0900 ALSA: dice: fix wrong reference count for stream functionality at error path of rawmidi interface In IEC 61883-6, several types of sampling data can be multiplexed into payload of common isochronous packet (CIP). For typical audio and music units, PCM samples and MIDI messages are multiplexed into one packet streaming. ALSA dice driver allows applications of rawmidi interface to start packet streaming for transmission of MIDI messages. However at error path, the reference count of stream functionality is not operated correctly. This can brings a bug that packet streaming is not stopped when all referrers release the count. This commit fixes the bug. Fixes: 3cd2c2d780a2 ("ALSA: dice: reserve/release isochronous resources in pcm.hw_params/hw_free callbacks") Signed-off-by: Takashi Sakamoto Signed-off-by: Takashi Iwai commit 03a954aef70e10003b3f1cf7066ab7c955eb27f1 Author: Takashi Sakamoto Date: Sun Jul 7 14:20:08 2019 +0900 ALSA: oxfw: fix wrong reference count for stream functionality at error path of rawmidi interface In IEC 61883-6, several types of sampling data can be multiplexed into payload of common isochronous packet (CIP). For typical audio and music units, PCM samples and MIDI messages are multiplexed into one packet streaming. ALSA oxfw driver allows applications of rawmidi interface to start packet streaming for transmission of MIDI messages. However at error path, the reference count of stream functionality is not operated correctly. This can brings a bug that packet streaming is not stopped when all referrers release the count. This commit fixes the bug. Fixes: 4f380d007052 ("ALSA: oxfw: configure packet format in pcm.hw_params callback") Signed-off-by: Takashi Sakamoto Signed-off-by: Takashi Iwai commit 2e9f17e34eb7b728d4cd9ec474c3c5a9a6685298 Author: Takashi Sakamoto Date: Sun Jul 7 14:20:07 2019 +0900 ALSA: fireworks: fix wrong reference count for stream functionality at error path of rawmidi interface In IEC 61883-6, several types of sampling data can be multiplexed into payload of common isochronous packet (CIP). For typical audio and music units, PCM samples and MIDI messages are multiplexed into one packet streaming. ALSA fireworks driver allows applications of rawmidi interface to start packet streaming for transmission of MIDI messages. However at error path, the reference count of stream functionality is not operated correctly. This can brings a bug that packet streaming is not stopped when all referrers release the count. This commit fixes the bug. Fixes: 3d7250667ea9 ("ALSA: fireworks: configure sampling transfer frequency in pcm.hw_params callback") Signed-off-by: Takashi Sakamoto Signed-off-by: Takashi Iwai commit 097f8ba3873dcbd2f55c627ed2fe0b13845e53cd Author: Takashi Sakamoto Date: Sun Jul 7 14:20:06 2019 +0900 ALSA: bebob: fix wrong reference count for stream functionality at error path of rawmidi interface In IEC 61883-6, several types of sampling data can be multiplexed into payload of common isochronous packet (CIP). For typical audio and music units, PCM samples and MIDI messages are multiplexed into one packet streaming. ALSA bebob driver allows applications of rawmidi interface to start packet streaming for transmission of MIDI messages. However at error path, the reference count of stream functionality is not operated correctly. This can brings a bug that packet streaming is not stopped when all referrers release the count. This commit fixes the bug. Fixes: ac2888b958f2 ("ALSA: bebob: configure sampling transfer frequency in pcm.hw_params callback") Signed-off-by: Takashi Sakamoto Signed-off-by: Takashi Iwai commit 1dd7382b1bb608e7ccae3672621eaceca355ae8b Author: Max Gurtovoy Date: Mon Jul 1 21:14:01 2019 +0300 net/mlx5: Introduce VHCA tunnel device capability When using the device emulation feature (introduced in Bluefield-1 SOC), a privileged function (the device emulation manager) will be able to create a channel to execute commands on behalf of the emulated function. This channel will be a general object of type VHCA_TUNNEL that will have a unique ID for each emulated function. This ID will be passed in each cmd that will be issued by the emulation SW in a well known offset in the command header. This channel is needed since the emulated function doesn't have a normal command interface to the HCA HW, but some basic configuration for that function is needed (e.g. initialize and enable the HCA). For that matter, a specific command-set was defined and only those commands will be issued by the HCA. Signed-off-by: Max Gurtovoy Reviewed-by: Yishai Hadas Signed-off-by: Leon Romanovsky commit 593fdd4fb44ef2cbf4ec53ec2c6eb60eb079bb4c Author: Enrico Weigelt, metux IT consult Date: Sat Jul 6 22:55:46 2019 -0700 Input: gpio_keys_polled - allow specifying name of input device Instead of hardcoding the input name to the driver name ('gpio-keys-polled'), allow specifying the name of the device via "label" property. If the property is not present (nor name is set in board-supplied platform data), we'll default to the old name. Signed-off-by: Enrico Weigelt, metux IT consult Signed-off-by: Dmitry Torokhov commit 211bbf3c38ed90f43a3ec905e246014f96bceed7 Author: Darrick J. Wong Date: Sat Jul 6 09:29:01 2019 -0700 xfs: don't update lastino for FSBULKSTAT_SINGLE The kernel test robot found a regression of xfs/054 in the conversion of bulkstat to use the new iwalk infrastructure -- if a caller set *lastip = 128 and invoked FSBULKSTAT_SINGLE, the bstat info would be for inode 128, but *lastip would be increased by the kernel to 129. FSBULKSTAT_SINGLE never incremented lastip before, so it's incorrect to make such an update to the internal lastino value now. Fixes: 2810bd6840e463 ("xfs: convert bulkstat to new iwalk infrastructure") Reported-by: kernel test robot Signed-off-by: Darrick J. Wong Reviewed-by: Allison Collins Reviewed-by: Brian Foster commit c5eaab1d131d0a6272df7d55a971a67400d63f56 Author: Carmeli Tamir Date: Sat Jul 6 11:07:38 2019 -0400 security/commoncap: Use xattr security prefix len Using the existing defined XATTR_SECURITY_PREFIX_LEN instead of sizeof(XATTR_SECURITY_PREFIX) - 1. Pretty simple cleanup. Signed-off-by: Carmeli Tamir Signed-off-by: James Morris commit 437fde6cda74bb31705a9f37f14d481cdd431ad8 Merge: 23f30c41c732 5adcdab6ae1b Author: David S. Miller Date: Sat Jul 6 15:19:01 2019 -0700 Merge tag 'wireless-drivers-next-for-davem-2019-07-06' of git://git.kernel.org/pub/scm/linux/kernel/git/kvalo/wireless-drivers-next Kalle Valo says: ==================== wireless-drivers-next patches for 5.3 Second, and last, set of patches for 5.3. Major changes: mt76 * use NAPI polling for tx cleanup on mt7603/mt7615 * add support for toggling edcca on mt7603 * fix rate control / tx status reporting issues on mt76x02/mt7603 * add support for eeprom calibration data from mtd on mt7615 * support configuring tx power on mt7615 * per-chain signal reporting on mt7615 iwlwifi * Update the FW API for Channel State Information (CSI) * Special Specific Absorption Rate (SAR) implementation for South Korea ath10k * fixes for SDIO support * add support for firmware logging via WMI ==================== Signed-off-by: David S. Miller commit 1d2af80d581d1bae81594e497cd57e345235b940 Merge: b07079f1642c bce9437a0a48 Author: Richard Weinberger Date: Sat Jul 6 22:51:56 2019 +0200 Merge tag 'nand/for-5.3' of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux into mtd/next NAND core changes: - use longest matching pattern in ->exec_op() default parser - export NAND operation tracer - add flag to indicate panic_write in MTD - use kzalloc() instead of kmalloc() and memset() Raw NAND controller drivers changes: - brcmnand: * fix BCH ECC layout for large page NAND parts * fallback to detected ecc-strength, ecc-step-size * when oops in progress use pio and interrupt polling * code refactor code to introduce helper functions * add support for v7.3 controller - FSMC: * use nand_op_trace for operation tracing - GPMI: * move all driver code into single file * various cleanups (including dmaengine changes) * use runtime PM to manage clocks * implement exec_op - MTK: * correct low level time calculation of r/w cycle * improve data sampling timing for read cycle * add validity check for CE# pin setting * fix wrongly assigned OOB buffer pointer issue * re-license MTK NAND driver as Dual MIT/GPL - STM32: * manage the get_irq error case * increase DMA completion timeouts Raw NAND chips drivers changes: - Macronix: add read-retry support Onenand driver changes: - add support for 8Gb datasize chips - avoid fall-through warnings SPI-NAND changes: - define macros for page-read ops with three-byte addresses - add support for two-byte device IDs and then for GigaDevice GD5F1GQ4UFxxG - add initial support for Paragon PN26G0xA - handle the case where the last page read has bitflips commit d5b2179d6a675ee8cdbd3250d42f1e32d5a45fb1 Author: Arnaldo Carvalho de Melo Date: Tue May 28 16:02:56 2019 -0300 perf annotate TUI browser: Do not use member from variable within its own initialization Some compilers will complain when using a member of a struct to initialize another member, in the same struct initialization. For instance: debian:8 Debian clang version 3.5.0-10 (tags/RELEASE_350/final) (based on LLVM 3.5.0) oraclelinux:7 clang version 3.4.2 (tags/RELEASE_34/dot2-final) Produce: ui/browsers/annotate.c:104:12: error: variable 'ops' is uninitialized when used within its own initialization [-Werror,-Wuninitialized] (!ops.current_entry || ^~~ 1 error generated. So use an extra variable, initialized just before that struct, to have the value used in the expressions used to init two of the struct members. Cc: Adrian Hunter Cc: Jiri Olsa Cc: Namhyung Kim Fixes: c298304bd747 ("perf annotate: Use a ops table for annotation_line__write()") Link: https://lkml.kernel.org/n/tip-f9nexro58q62l3o9hez8hr0i@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 9ce67c3235be71e8cf922a9b3d0b7359ed3f4ce5 Author: Sean Wang Date: Sun Jun 2 08:02:49 2019 +0800 Bluetooth: btusb: Add protocol support for MediaTek MT7663U USB devices This adds the support of enabling MT7663U Bluetooth function running on the top of btusb driver. The information in /sys/kernel/debug/usb/devices about the Bluetooth device is listed as the below. T: Bus=04 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 5 Spd=5000 MxCh= 0 D: Ver= 3.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS= 9 #Cfgs= 1 P: Vendor=0e8d ProdID=7663 Rev= 1.00 S: Manufacturer=MediaTek Inc. S: Product=Wireless_Device S: SerialNumber=000000000 C:* #Ifs= 3 Cfg#= 1 Atr=a0 MxPwr=160mA A: FirstIf#= 0 IfCount= 2 Cls=e0(wlcon) Sub=01 Prot=01 I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=125us E: Ad=82(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=02(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms I: If#= 1 Alt= 6 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 63 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 63 Ivl=1ms Signed-off-by: Sean Wang Signed-off-by: Marcel Holtmann commit a1c49c434e15050b5dafe3b6f5cc732d4f02d657 Author: Sean Wang Date: Sun Jun 2 08:02:48 2019 +0800 Bluetooth: btusb: Add protocol support for MediaTek MT7668U USB devices This adds the support of enabling MT7668U Bluetooth function running on the top of btusb driver. The information in /sys/kernel/debug/usb/devices about the Bluetooth device is listed as the below. T: Bus=02 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 2 Spd=5000 MxCh= 0 D: Ver= 3.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS= 9 #Cfgs= 1 P: Vendor=0e8d ProdID=7668 Rev= 1.00 S: Manufacturer=MediaTek Inc. S: Product=Wireless_Device S: SerialNumber=000000000 C:* #Ifs= 3 Cfg#= 1 Atr=a0 MxPwr=160mA A: FirstIf#= 0 IfCount= 2 Cls=e0(wlcon) Sub=01 Prot=01 I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=125us E: Ad=82(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=02(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms I: If#= 1 Alt= 6 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 63 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 63 Ivl=1ms Signed-off-by: Sean Wang Signed-off-by: Marcel Holtmann commit 688d94fd0d10d9ebe611a445d85811894f8cf6c4 Author: Josua Mayer Date: Sat Jul 6 17:54:48 2019 +0200 Bluetooth: 6lowpan: always check destination address BLE based 6LoWPAN networks are highly constrained in bandwidth. Do not take a short-cut, always check if the destination address is known to belong to a peer. As a side-effect this also removes any behavioral differences between one, and two or more connected peers. Acked-by: Jukka Rissanen Tested-by: Michael Scott Signed-off-by: Josua Mayer Signed-off-by: Marcel Holtmann commit 5636376c26502c39260853e529e9467f79f95931 Author: Josua Mayer Date: Sat Jul 6 17:54:47 2019 +0200 Bluetooth: 6lowpan: check neighbour table for SLAAC Like any IPv6 capable device, 6LNs can have multiple addresses assigned using SLAAC and made known through neighbour advertisements. After checking the destination address against all peers link-local addresses, consult the neighbour cache for additional known addresses. RFC7668 defines the scope of Neighbor Advertisements in Section 3.2.3: 1. "A Bluetooth LE 6LN MUST NOT register its link-local address" 2. "A Bluetooth LE 6LN MUST register its non-link-local addresses with the 6LBR by sending Neighbor Solicitation (NS) messages ..." Due to these constranits both the link-local addresses tracked in the list of 6lowpan peers, and the neighbour cache have to be used when identifying the 6lowpan peer for a destination address. Acked-by: Jukka Rissanen Tested-by: Michael Scott Signed-off-by: Josua Mayer Signed-off-by: Marcel Holtmann commit b188b03270b7f8568fc714101ce82fbf5e811c5a Author: Josua Mayer Date: Sat Jul 6 17:54:46 2019 +0200 Bluetooth: 6lowpan: search for destination address in all peers Handle overlooked case where the target address is assigned to a peer and neither route nor gateway exist. For one peer, no checks are performed to see if it is meant to receive packets for a given address. As soon as there is a second peer however, checks are performed to deal with routes and gateways for handling complex setups with multiple hops to a target address. This logic assumed that no route and no gateway imply that the destination address can not be reached, which is false in case of a direct peer. Acked-by: Jukka Rissanen Tested-by: Michael Scott Signed-off-by: Josua Mayer Signed-off-by: Marcel Holtmann commit 80d3c45fd765fbf4f10981b60ff6b1384bdbc706 Author: Dave Wysochanski Date: Wed Jun 26 16:30:24 2019 -0400 SUNRPC: Fix possible autodisconnect during connect due to old last_used Ensure last_used is updated before calling mod_timer inside xprt_schedule_autodisconnect. This avoids a possible xprt_autoclose firing immediately after a successful connect when xprt_unlock_connect calls xprt_schedule_autodisconnect with an old value of last_used. Signed-off-by: Dave Wysochanski Signed-off-by: Trond Myklebust commit 4368d77a4d985758303a4257c07991c079db7a75 Author: Anna Schumaker Date: Wed Jun 19 17:24:10 2019 -0400 SUNRPC: Drop redundant CONFIG_ from CONFIG_SUNRPC_DISABLE_INSECURE_ENCTYPES The "CONFIG_" portion is added automatically, so this was being expanded into "CONFIG_CONFIG_SUNRPC_DISABLE_INSECURE_ENCTYPES" Signed-off-by: Anna Schumaker Signed-off-by: Trond Myklebust commit 9f7761cf0409465075dadb875d5d4b8ef2f890c8 Author: Benjamin Coddington Date: Tue Jun 11 12:57:52 2019 -0400 NFS: Cleanup if nfs_match_client is interrupted Don't bail out before cleaning up a new allocation if the wait for searching for a matching nfs client is interrupted. Memory leaks. Reported-by: syzbot+7fe11b49c1cc30e3fce2@syzkaller.appspotmail.com Fixes: 950a578c6128 ("NFS: make nfs_match_client killable") Signed-off-by: Benjamin Coddington Signed-off-by: Trond Myklebust commit 9026b3a973b0b0b73c15ba40aff87cd0959fd0f3 Author: Darrick J. Wong Date: Fri May 31 14:06:05 2019 -0700 nfs: disable client side deduplication The NFS protocol doesn't support deduplication, so turn it off again. Fixes: ce96e888fe48e ("Fix nfs4.2 return -EINVAL when do dedupe operation") Signed-off-by: Darrick J. Wong Signed-off-by: Trond Myklebust commit 1a7441b282cef3bb94acaba9f474ebc6d22277ba Author: Dave Wysochanski Date: Fri May 17 17:06:41 2019 -0400 NFSv4: Add lease_time and lease_expired to 'nfs4:' line of mountstats On the NFS client there is no low-impact way to determine the nfs4 lease time or whether the lease is expired, so add these to mountstats with times displayed in seconds. If the lease is not expired, display lease_expired=0. Otherwise, display lease_expired=seconds_since_expired, similar to 'age:' line in mountstats. Signed-off-by: Dave Wysochanski Signed-off-by: Trond Myklebust commit 2b17d725f9be59a1bfa0583af690c463fca1f385 Author: Trond Myklebust Date: Tue Jun 11 16:49:52 2019 -0400 NFS: Clean up writeback code Now that the VM promises never to recurse back into the filesystem layer on writeback, remove all the GFP_NOFS references etc from the generic writeback code. Signed-off-by: Trond Myklebust commit c98ebe2937404d8e6e028ac9cadcf870a6faccc2 Merge: 28ade856c0f7 b6580ab39b09 Author: Trond Myklebust Date: Tue Jun 11 16:53:33 2019 -0400 Merge branch 'multipath_tcp' commit 28ade856c0f724b1d74d7d683ec2dc0e98de60ae Merge: 02a2779f223e bf11fbdb20b3 Author: Trond Myklebust Date: Fri Jun 28 11:10:39 2019 -0400 Merge branch 'containers' commit 02a2779f223e9f77c114b0c64ca246b01c1dc563 Merge: 41adafa02eeb 1c341b777501 Author: Trond Myklebust Date: Tue Jun 11 14:29:47 2019 -0400 Merge branch 'cache_consistency' commit b6580ab39b092aac40871fed11faa410c44b1da0 Author: Trond Myklebust Date: Thu May 30 11:24:26 2019 -0400 SUNRPC: Remove warning in debugfs.c when compiling with W=1 Remove the following warning: net/sunrpc/debugfs.c:13: warning: cannot understand function prototype: 'struct dentry *topdir; Signed-off-by: Trond Myklebust commit 41adafa02eeb622ffc1f085c9a862a6554ed667e Merge: a332518fda47 c049f8ea9a0d Author: Trond Myklebust Date: Tue Jun 11 14:19:07 2019 -0400 Merge branch 'bh-remove' commit 2f34b8bfae19a244993e2b6cd0a8514f3ffd3fa8 Author: NeilBrown Date: Thu May 30 10:41:28 2019 +1000 SUNRPC: add links for all client xprts to debugfs Now that a client can have multiple xprts, we need to add them all to debugs. The first one is still "xprt" Subsequent xprts are "xprt1", "xprt2", etc. Signed-off-by: NeilBrown Signed-off-by: Trond Myklebust commit a332518fda4731c07394164b3edcbb6efaf4c4d7 Author: Dave Wysochanski Date: Thu May 23 16:13:50 2019 -0400 SUNRPC: Count ops completing with tk_status < 0 We often see various error conditions with NFS4.x that show up with a very high operation count all completing with tk_status < 0 in a short period of time. Add a count to rpc_iostats to record on a per-op basis the ops that complete in this manner, which will enable lower overhead diagnostics. Signed-off-by: Dave Wysochanski Signed-off-by: Trond Myklebust commit 10db56917bcb80e70bbcd443d78bbfcb0b1e0652 Author: NeilBrown Date: Thu May 30 10:41:28 2019 +1000 SUNRPC: enhance rpc_clnt_show_stats() to report on all xprts. Now that a client can have multiple xprts, we need to report the statistics for all of them. Reported-by: Chuck Lever Signed-off-by: NeilBrown Signed-off-by: Trond Myklebust commit 93ba048e1b9f95ac7e1584fa33ed4d985bf1133d Author: Dave Wysochanski Date: Thu May 23 16:13:49 2019 -0400 SUNRPC: Use proper printk specifiers for unsigned long long Update the printk specifiers inside _print_rpc_iostats to avoid a checkpatch warning. Signed-off-by: Dave Wysochanski Signed-off-by: Trond Myklebust commit 9dfe52a95a60096fc12234383a19b0f436304418 Author: Dave Wysochanski Date: Thu May 23 16:13:48 2019 -0400 SUNRPC: Move call to rpc_count_iostats before rpc_call_done For diagnostic purposes, it would be useful to have an rpc_iostats metric of RPCs completing with tk_status < 0. Unfortunately, tk_status is reset inside the rpc_call_done functions for each operation, and the call to tally the per-op metrics comes after rpc_call_done. Refactor the call to rpc_count_iostat earlier in rpc_exit_task so we can count these RPCs completing in error. Signed-off-by: Dave Wysochanski Signed-off-by: Trond Myklebust commit 5a0c257f8e0f4c4b3c33dff545317c21a921303e Author: NeilBrown Date: Thu May 30 10:41:28 2019 +1000 NFS: send state management on a single connection. With NFSv4.1, different network connections need to be explicitly bound to a session. During session startup, this is not possible so only a single connection must be used for session startup. So add a task flag to disable the default round-robin choice of connections (when nconnect > 1) and force the use of a single connection. Then use that flag on all requests for session management - for consistence, include NFSv4.0 management (SETCLIENTID) and session destruction Reported-by: Chuck Lever Signed-off-by: NeilBrown Signed-off-by: Trond Myklebust commit 53c326307156249253be36b33cd6c32f4a24f9b2 Author: Trond Myklebust Date: Mon Sep 17 13:32:02 2018 -0400 NFS: Allow multiple connections to a NFSv2 or NFSv3 server Signed-off-by: Trond Myklebust commit fd87c8b73a0c7689cf3112b35c8c173e8326a5fb Author: Trond Myklebust Date: Thu Apr 27 11:40:04 2017 -0400 NFS: Display the "nconnect" mount option if it is set. Signed-off-by: Trond Myklebust commit bb71e4a5d7eb151aa8d4e98c628b744f78af7c57 Author: Trond Myklebust Date: Thu Apr 27 11:22:07 2017 -0400 pNFS: Allow multiple connections to the DS If the user specifies -onconnect= mount option, and the transport protocol is TCP, then set up connections to the pNFS data server as well. The connections will all go to the same IP address. Signed-off-by: Trond Myklebust commit 6619079d05404cb32be29af329b87ac3b0ad4f96 Author: Trond Myklebust Date: Thu Apr 27 11:13:40 2017 -0400 NFSv4: Allow multiple connections to NFSv4.x (x>0) servers If the user specifies the -onconn= mount option, and the transport protocol is TCP, then set up connections to the server. The connections will all go to the same IP address. Signed-off-by: Trond Myklebust commit 28cc5cd8c68f1cd2146d88c7a54cc3234ed4dabe Author: Trond Myklebust Date: Wed Apr 26 23:30:48 2017 -0400 NFS: Add a mount option to specify number of TCP connections to use Allow the user to specify that the client should use multiple connections to the server. For the moment, this functionality will be limited to TCP and to NFSv4.x (x>0). Signed-off-by: Trond Myklebust commit 612b41f808a98a124b23d72229693c3181733291 Author: Trond Myklebust Date: Thu Apr 27 08:50:51 2017 -0400 SUNRPC: Allow creation of RPC clients with multiple connections Add an argument to struct rpc_create_args that allows the specification of how many transport connections you want to set up to the server. Signed-off-by: Trond Myklebust commit bf11fbdb20b385157b046ea7781f04d0c62554a3 Author: Trond Myklebust Date: Tue Jan 29 21:40:10 2019 -0500 NFS: Add sysfs support for per-container identifier In order to identify containers to the NFS client, we add a per-net sysfs attribute that udev can fill with the appropriate identifier. The identifier could be a unique hostname, but in most cases it will probably be a persisted uuid. Signed-off-by: Trond Myklebust commit 1c341b777501613aad83f9c233a3fe5701cff083 Author: Trond Myklebust Date: Wed May 22 08:38:57 2019 -0400 NFS: Add deferred cache invalidation for close-to-open consistency violations If the client detects that close-to-open cache consistency has been violated, and that the file or directory has been changed on the server, then do a cache invalidation when we're done working with the file. The reason we don't do an immediate cache invalidation is that we want to avoid performance problems due to false positives. Also, note that we cannot guarantee cache consistency in this situation even if we do invalidate the cache. Signed-off-by: Trond Myklebust commit c049f8ea9a0db11d87bc8cb4c106be65fe06b70b Author: Trond Myklebust Date: Thu May 2 11:23:12 2019 -0400 SUNRPC: Remove the bh-safe lock requirement on the rpc_wait_queue->lock Signed-off-by: Trond Myklebust commit 21f0ffaff510b0530bfdf77da7133c0b99dee2fe Author: Trond Myklebust Date: Fri Apr 28 10:52:42 2017 -0400 SUNRPC: Add basic load balancing to the transport switch For now, just count the queue length. It is less accurate than counting number of bytes queued, but easier to implement. Signed-off-by: Trond Myklebust commit 10b7a70cbb81a62353f763c3343ac0c48410696f Author: Trond Myklebust Date: Wed Feb 6 09:32:50 2019 -0500 NFS: Cleanup - add nfs_clients_exit to mirror nfs_clients_init Add a helper to clean up the struct nfs_net when it is being destroyed. Signed-off-by: Trond Myklebust commit 996bc4f405d37ffd88c9b830202ee47fc7a6c449 Author: Trond Myklebust Date: Thu Jan 24 16:10:46 2019 -0500 NFS: Create a root NFS directory in /sys/fs/nfs Signed-off-by: Trond Myklebust commit b5e924191f87239e555f3ef3b8d8e697bb95e7dc Author: Trond Myklebust Date: Thu May 2 11:21:08 2019 -0400 SUNRPC: Remove the bh-safe lock requirement on xprt->transport_lock Signed-off-by: Trond Myklebust commit 4f8943f8088348ec01456b075d44ad19dce3d698 Author: Trond Myklebust Date: Wed May 1 16:28:29 2019 -0400 SUNRPC: Replace direct task wakeups from softirq context Replace the direct task wakeups from inside a softirq context with wakeups from a process context. Signed-off-by: Trond Myklebust commit 7e0a0e38fcfea47e74b0ff6da6266f00bcd2af43 Author: Trond Myklebust Date: Wed May 1 10:49:27 2019 -0400 SUNRPC: Replace the queue timer with a delayed work function The queue timer function, which walks the RPC queue in order to locate candidates for waking up is one of the current constraints against removing the bh-safe queue spin locks. Replace it with a delayed work queue, so that we can do the actual rpc task wake ups from an ordinary process context. Signed-off-by: Trond Myklebust commit 44942b4e457beda00981f616402a1a791e8c616e Author: Trond Myklebust Date: Thu Jun 27 06:41:45 2019 -0400 NFSv4: Handle the special Linux file open access mode According to the open() manpage, Linux reserves the access mode 3 to mean "check for read and write permission on the file and return a file descriptor that can't be used for reading or writing." Currently, the NFSv4 code will ask the server to open the file, and will use an incorrect share access mode of 0. Since it has an incorrect share access mode, the client later forgets to send a corresponding close, meaning it can leak stateids on the server. Fixes: ce4ef7c0a8a05 ("NFS: Split out NFS v4 file operations") Cc: stable@vger.kernel.org # 3.6+ Signed-off-by: Trond Myklebust commit 1bf85d8c98756421e29b9990469ee63bb0bc87cc Author: Trond Myklebust Date: Thu Jun 27 06:30:48 2019 -0400 NFSv4: Handle open for execute correctly When mapping the NFSv4 context to an open mode and access mode, we need to treat the FMODE_EXEC flag differently. For the open mode, FMODE_EXEC means we need read share access. For the access mode checking, we need to verify that the user actually has execute access. Signed-off-by: Trond Myklebust commit 9b3b623804a67d2274ee372c1587926ab0275833 Author: Linus Walleij Date: Sat Jul 6 20:15:54 2019 +0200 Revert "gpio: tegra: Clean-up debugfs initialisation" This reverts commit a4de43049a1d0e2ed2a1d95e18e74b82cd9ca058. The commit creates build errors. Signed-off-by: Linus Walleij commit f0b40863bee4e5f689f6c839b4d0b512b8f0fdbe Author: Sebastian Andrzej Siewior Date: Thu Jul 4 17:38:03 2019 +0200 gpiolib: Use spinlock_t instead of struct spinlock For spinlocks the type spinlock_t should be used instead of "struct spinlock". Use spinlock_t for spinlock's definition. Cc: linux-gpio@vger.kernel.org Signed-off-by: Sebastian Andrzej Siewior Link: https://lore.kernel.org/r/20190704153803.12739-8-bigeasy@linutronix.de Reviewed-by: Bartosz Golaszewski Signed-off-by: Linus Walleij commit bff5a556c149804de29347a88a884d25e4e4e3a2 Author: Seeteena Thoufeek Date: Thu Jun 27 15:46:54 2019 +0530 perf tests: Fix record+probe_libc_inet_pton.sh for powerpc64 'probe libc's inet_pton & backtrace it with ping' testcase sometimes fails on powerpc because distro ping binary does not have symbol information and thus it prints "[unknown]" function name in the backtrace. Accept "[unknown]" as valid function name for powerpc as well. # perf test -v "probe libc's inet_pton & backtrace it with ping" Before: 59: probe libc's inet_pton & backtrace it with ping : --- start --- test child forked, pid 79695 ping 79718 [077] 96483.787025: probe_libc:inet_pton: (7fff83a754c8) 7fff83a754c8 __GI___inet_pton+0x8 (/usr/lib64/power9/libc-2.28.so) 7fff83a2b7a0 gaih_inet.constprop.7+0x1020 (/usr/lib64/power9/libc-2.28.so) 7fff83a2c170 getaddrinfo+0x160 (/usr/lib64/power9/libc-2.28.so) 1171830f4 [unknown] (/usr/bin/ping) FAIL: expected backtrace entry ".*\+0x[[:xdigit:]]+[[:space:]]\(.*/bin/ping.*\)$" got "1171830f4 [unknown] (/usr/bin/ping)" test child finished with -1 ---- end ---- probe libc's inet_pton & backtrace it with ping: FAILED! After: 59: probe libc's inet_pton & backtrace it with ping : --- start --- test child forked, pid 79085 ping 79108 [045] 96400.214177: probe_libc:inet_pton: (7fffbb9654c8) 7fffbb9654c8 __GI___inet_pton+0x8 (/usr/lib64/power9/libc-2.28.so) 7fffbb91b7a0 gaih_inet.constprop.7+0x1020 (/usr/lib64/power9/libc-2.28.so) 7fffbb91c170 getaddrinfo+0x160 (/usr/lib64/power9/libc-2.28.so) 132e830f4 [unknown] (/usr/bin/ping) test child finished with 0 ---- end ---- probe libc's inet_pton & backtrace it with ping: Ok Signed-off-by: Seeteena Thoufeek Reviewed-by: Kim Phillips Cc: Alexander Shishkin Cc: Hendrik Brueckner Cc: Jiri Olsa Cc: Michael Petlan Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Sandipan Das Fixes: 1632936480a5 ("perf tests: Fix record+probe_libc_inet_pton.sh without ping's debuginfo") Link: http://lkml.kernel.org/r/1561630614-3216-1-git-send-email-s1seetee@linux.vnet.ibm.com Signed-off-by: Arnaldo Carvalho de Melo commit cd136189370cc8a5aec0ea4b4ec517e5ee38d8a0 Author: Jiri Olsa Date: Wed Jul 3 10:09:49 2019 +0200 perf evsel: Do not rely on errno values for precise_ip fallback Konstantin reported problem with default perf record command, which fails on some AMD servers, because of the default maximum precise config. The current fallback mechanism counts on getting ENOTSUP errno for precise_ip fails, but that's not the case on some AMD servers. We can fix this by removing the errno check completely, because the precise_ip fallback is separated. We can just try (if requested by evsel->precise_max) all possible precise_ip, and if one succeeds we win, if not, we continue with standard fallback. Reported-by: Konstantin Kharlamov Signed-off-by: Jiri Olsa Cc: Alexander Shishkin Cc: Andi Kleen Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Quentin Monnet Cc: Kim Phillips Link: http://lkml.kernel.org/r/20190703080949.10356-1-jolsa@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 4c00af0e94cd01b8c5a5e6b3323d34677b04e192 Author: Arnaldo Carvalho de Melo Date: Fri Jul 5 12:11:35 2019 -0300 perf thread: Allow references to thread objects after machine__exit() Threads are created when we either synthesize PERF_RECORD_FORK events for pre-existing threads or when we receive PERF_RECORD_FORK events from the kernel as new threads get created. We then keep them in machine->threads[].entries rb trees till when we receive a PERF_RECORD_EXIT, i.e. that thread terminated. The thread object has a reference count that is grabbed when, for instance, we keep that thread referenced in struct hist_entry, in 'perf report' and 'perf top'. When we receive a PERF_RECORD_EXIT we remove the thread object from the rb tree and move it to the corresponding machine->threads[].dead list, then we do a thread__put(), dropping the reference we had for keeping it in the rb tree. In thread__put() we were assuming that when the reference count hit zero we should remove it from the dead list by simply doing a list_del_init(&thread->node). That works well when all the thread lifetime is during the machine that has the list heads lifetime, since we know that we can do the list_del_init() and it will update the 'dead' list_head. But in 'perf sched lat' we were doing: machine__new() (via perf_session__new) process events, grabbing refcounts to keep those thread objects in 'perf sched' local data structures. machine__exit() (via perf_session__delete) which would delete the 'dead' list heads. And then doing the final thread__put() for the refcounts 'perf sched' rightfully obtained for keeping those thread object references. b00m, since thread__put() would do the list_del_init() touching a dead dead list head. Fix it by removing all the dead threads from machine->threads[].dead at machine__exit(), since whatever is there should have refcounts taken by things like 'perf sched lat', and make thread__put() check if the thread is in a linked list before removing it from that list. Reported-by: Wei Li Link: https://lkml.kernel.org/r/20190508143648.8153-1-liwei391@huawei.com Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Jiri Olsa Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Zhipeng Xie Link: https://lkml.kernel.org/r/20190704194355.GI10740@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit c952b35f4b15dd1b83e952718dec3307256383ef Author: Song Liu Date: Wed Jun 19 18:04:53 2019 -0700 perf header: Assign proper ff->ph in perf_event__synthesize_features() bpf/btf write_* functions need ff->ph->env. With this missing, pipe-mode (perf record -o -) would crash like: Program terminated with signal SIGSEGV, Segmentation fault. This patch assign proper ph value to ff. Committer testing: (gdb) run record -o - Starting program: /root/bin/perf record -o - PERFILE2 Thread 1 "perf" received signal SIGSEGV, Segmentation fault. __do_write_buf (size=4, buf=0x160, ff=0x7fffffff8f80) at util/header.c:126 126 memcpy(ff->buf + ff->offset, buf, size); (gdb) bt #0 __do_write_buf (size=4, buf=0x160, ff=0x7fffffff8f80) at util/header.c:126 #1 do_write (ff=ff@entry=0x7fffffff8f80, buf=buf@entry=0x160, size=4) at util/header.c:137 #2 0x00000000004eddba in write_bpf_prog_info (ff=0x7fffffff8f80, evlist=) at util/header.c:912 #3 0x00000000004f69d7 in perf_event__synthesize_features (tool=tool@entry=0x97cc00 , session=session@entry=0x7fffe9c6d010, evlist=0x7fffe9cae010, process=process@entry=0x4435d0 ) at util/header.c:3695 #4 0x0000000000443c79 in record__synthesize (tail=tail@entry=false, rec=0x97cc00 ) at builtin-record.c:1214 #5 0x0000000000444ec9 in __cmd_record (rec=0x97cc00 , argv=, argc=0) at builtin-record.c:1435 #6 cmd_record (argc=0, argv=) at builtin-record.c:2450 #7 0x00000000004ae3e9 in run_builtin (p=p@entry=0x98e058 , argc=argc@entry=3, argv=0x7fffffffd670) at perf.c:304 #8 0x000000000042eded in handle_internal_command (argv=, argc=) at perf.c:356 #9 run_argv (argcp=, argv=) at perf.c:400 #10 main (argc=3, argv=) at perf.c:522 (gdb) After the patch the SEGSEGV is gone. Reported-by: David Carrillo Cisneros Signed-off-by: Song Liu Tested-by: Arnaldo Carvalho de Melo Cc: Jiri Olsa Cc: Namhyung Kim Cc: kernel-team@fb.com Cc: stable@vger.kernel.org # v5.1+ Fixes: 606f972b1361 ("perf bpf: Save bpf_prog_info information as headers to perf.data") Link: http://lkml.kernel.org/r/20190620010453.4118689-1-songliubraving@fb.com Signed-off-by: Arnaldo Carvalho de Melo commit c499d1f483a99e86a5f712277de7c8fa33a9ec0a Author: Arnaldo Carvalho de Melo Date: Sat Jul 6 14:26:40 2019 -0300 tools arch kvm: Sync kvm headers with the kernel sources To pick up the changes from: 41040cf7c5f0 ("arm64/sve: Fix missing SVE/FPSIMD endianness conversions") 6ca00dfafda7 ("KVM: x86: Modify struct kvm_nested_state to have explicit fields for data") None entail changes in tooling. This silences these tools/perf build warnings: Warning: Kernel ABI header at 'tools/arch/x86/include/uapi/asm/kvm.h' differs from latest version at 'arch/x86/include/uapi/asm/kvm.h' diff -u tools/arch/x86/include/uapi/asm/kvm.h arch/x86/include/uapi/asm/kvm.h Warning: Kernel ABI header at 'tools/arch/arm64/include/uapi/asm/kvm.h' differs from latest version at 'arch/arm64/include/uapi/asm/kvm.h' diff -u tools/arch/arm64/include/uapi/asm/kvm.h arch/arm64/include/uapi/asm/kvm.h Cc: Adrian Hunter Cc: Dave Martin Cc: Jiri Olsa Cc: Liran Alon Cc: Namhyung Kim Cc: Paolo Bonzini Cc: Will Deacon Link: https://lkml.kernel.org/n/tip-1cdbq5ulr4d6cx3iv2ye5wdv@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit cc6b9dfb2c5769afeb3335048173c730bdf8dbe1 Author: YueHaibing Date: Sat Jun 29 02:44:21 2019 +0000 i2c: mt7621: Fix platform_no_drv_owner.cocci warnings Remove .owner field if calls are used which set it automatically Generated by: scripts/coccinelle/api/platform_no_drv_owner.cocci Signed-off-by: YueHaibing Reviewed-by: Stefan Roese Signed-off-by: Wolfram Sang commit 1d87b88ba26eabd4745e158ecfd87c93a9b51dc2 Author: Szymon Janc Date: Wed Jun 19 00:47:47 2019 +0200 Bluetooth: Add SMP workaround Microsoft Surface Precision Mouse bug Microsoft Surface Precision Mouse provides bogus identity address when pairing. It connects with Static Random address but provides Public Address in SMP Identity Address Information PDU. Address has same value but type is different. Workaround this by dropping IRK if ID address discrepancy is detected. > HCI Event: LE Meta Event (0x3e) plen 19 LE Connection Complete (0x01) Status: Success (0x00) Handle: 75 Role: Master (0x00) Peer address type: Random (0x01) Peer address: E0:52:33:93:3B:21 (Static) Connection interval: 50.00 msec (0x0028) Connection latency: 0 (0x0000) Supervision timeout: 420 msec (0x002a) Master clock accuracy: 0x00 .... > ACL Data RX: Handle 75 flags 0x02 dlen 12 SMP: Identity Address Information (0x09) len 7 Address type: Public (0x00) Address: E0:52:33:93:3B:21 Signed-off-by: Szymon Janc Tested-by: Maarten Fonville Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=199461 Cc: stable@vger.kernel.org Signed-off-by: Marcel Holtmann commit 00f62726dd8bb4554e219e38c51104c49bd31bef Author: Luiz Augusto von Dentz Date: Mon Jun 3 13:48:43 2019 +0300 Bluetooth: L2CAP: Check bearer type on __l2cap_global_chan_by_addr The spec defines PSM and LE_PSM as different domains so a listen on the same PSM is valid if the address type points to a different bearer. Signed-off-by: Luiz Augusto von Dentz Signed-off-by: Marcel Holtmann commit 1d0fac2c38edb25067e8f69195e2f76b67a2717d Author: Luiz Augusto von Dentz Date: Mon Jun 3 13:48:42 2019 +0300 Bluetooth: Use controller sets when available This makes use of controller sets when using Extended Advertising feature thus offloading the scheduling to the controller. Signed-off-by: Luiz Augusto von Dentz Signed-off-by: Marcel Holtmann commit c49a8682fc5d298d44e8d911f4fa14690ea9485e Author: csonsino Date: Wed Jun 12 15:00:52 2019 -0600 Bluetooth: validate BLE connection interval updates Problem: The Linux Bluetooth stack yields complete control over the BLE connection interval to the remote device. The Linux Bluetooth stack provides access to the BLE connection interval min and max values through /sys/kernel/debug/bluetooth/hci0/ conn_min_interval and /sys/kernel/debug/bluetooth/hci0/conn_max_interval. These values are used for initial BLE connections, but the remote device has the ability to request a connection parameter update. In the event that the remote side requests to change the connection interval, the Linux kernel currently only validates that the desired value is within the acceptable range in the Bluetooth specification (6 - 3200, corresponding to 7.5ms - 4000ms). There is currently no validation that the desired value requested by the remote device is within the min/max limits specified in the conn_min_interval/conn_max_interval configurations. This essentially leads to Linux yielding complete control over the connection interval to the remote device. The proposed patch adds a verification step to the connection parameter update mechanism, ensuring that the desired value is within the min/max bounds of the current connection. If the desired value is outside of the current connection min/max values, then the connection parameter update request is rejected and the negative response is returned to the remote device. Recall that the initial connection is established using the local conn_min_interval/conn_max_interval values, so this allows the Linux administrator to retain control over the BLE connection interval. The one downside that I see is that the current default Linux values for conn_min_interval and conn_max_interval typically correspond to 30ms and 50ms respectively. If this change were accepted, then it is feasible that some devices would no longer be able to negotiate to their desired connection interval values. This might be remedied by setting the default Linux conn_min_interval and conn_max_interval values to the widest supported range (6 - 3200 / 7.5ms - 4000ms). This could lead to the same behavior as the current implementation, where the remote device could request to change the connection interval value to any value that is permitted by the Bluetooth specification, and Linux would accept the desired value. Signed-off-by: Carey Sonsino Signed-off-by: Marcel Holtmann commit 302975cba1a4244d84e645773c82edbcfae1875f Author: Spoorthi Ravishankar Koppad Date: Fri Jun 21 14:51:56 2019 +0530 Bluetooth: Add support for LE ping feature Changes made to add HCI Write Authenticated Payload timeout command for LE Ping feature. As per the Core Specification 5.0 Volume 2 Part E Section 7.3.94, the following code changes implements HCI Write Authenticated Payload timeout command for LE Ping feature. Signed-off-by: Spoorthi Ravishankar Koppad Signed-off-by: Marcel Holtmann commit 28261da8a26f4915aa257d12d506c6ba179d961f Author: Matias Karhumaa Date: Tue May 21 13:07:22 2019 +0300 Bluetooth: Check state in l2cap_disconnect_rsp Because of both sides doing L2CAP disconnection at the same time, it was possible to receive L2CAP Disconnection Response with CID that was already freed. That caused problems if CID was already reused and L2CAP Connection Request with same CID was sent out. Before this patch kernel deleted channel context regardless of the state of the channel. Example where leftover Disconnection Response (frame #402) causes local device to delete L2CAP channel which was not yet connected. This in turn confuses remote device's stack because same CID is re-used without properly disconnecting. Btmon capture before patch: ** snip ** > ACL Data RX: Handle 43 flags 0x02 dlen 8 #394 [hci1] 10.748949 Channel: 65 len 4 [PSM 3 mode 0] {chan 2} RFCOMM: Disconnect (DISC) (0x43) Address: 0x03 cr 1 dlci 0x00 Control: 0x53 poll/final 1 Length: 0 FCS: 0xfd < ACL Data TX: Handle 43 flags 0x00 dlen 8 #395 [hci1] 10.749062 Channel: 65 len 4 [PSM 3 mode 0] {chan 2} RFCOMM: Unnumbered Ack (UA) (0x63) Address: 0x03 cr 1 dlci 0x00 Control: 0x73 poll/final 1 Length: 0 FCS: 0xd7 < ACL Data TX: Handle 43 flags 0x00 dlen 12 #396 [hci1] 10.749073 L2CAP: Disconnection Request (0x06) ident 17 len 4 Destination CID: 65 Source CID: 65 > HCI Event: Number of Completed Packets (0x13) plen 5 #397 [hci1] 10.752391 Num handles: 1 Handle: 43 Count: 1 > HCI Event: Number of Completed Packets (0x13) plen 5 #398 [hci1] 10.753394 Num handles: 1 Handle: 43 Count: 1 > ACL Data RX: Handle 43 flags 0x02 dlen 12 #399 [hci1] 10.756499 L2CAP: Disconnection Request (0x06) ident 26 len 4 Destination CID: 65 Source CID: 65 < ACL Data TX: Handle 43 flags 0x00 dlen 12 #400 [hci1] 10.756548 L2CAP: Disconnection Response (0x07) ident 26 len 4 Destination CID: 65 Source CID: 65 < ACL Data TX: Handle 43 flags 0x00 dlen 12 #401 [hci1] 10.757459 L2CAP: Connection Request (0x02) ident 18 len 4 PSM: 1 (0x0001) Source CID: 65 > ACL Data RX: Handle 43 flags 0x02 dlen 12 #402 [hci1] 10.759148 L2CAP: Disconnection Response (0x07) ident 17 len 4 Destination CID: 65 Source CID: 65 = bluetoothd: 00:1E:AB:4C:56:54: error updating services: Input/o.. 10.759447 > HCI Event: Number of Completed Packets (0x13) plen 5 #403 [hci1] 10.759386 Num handles: 1 Handle: 43 Count: 1 > ACL Data RX: Handle 43 flags 0x02 dlen 12 #404 [hci1] 10.760397 L2CAP: Connection Request (0x02) ident 27 len 4 PSM: 3 (0x0003) Source CID: 65 < ACL Data TX: Handle 43 flags 0x00 dlen 16 #405 [hci1] 10.760441 L2CAP: Connection Response (0x03) ident 27 len 8 Destination CID: 65 Source CID: 65 Result: Connection successful (0x0000) Status: No further information available (0x0000) < ACL Data TX: Handle 43 flags 0x00 dlen 27 #406 [hci1] 10.760449 L2CAP: Configure Request (0x04) ident 19 len 19 Destination CID: 65 Flags: 0x0000 Option: Maximum Transmission Unit (0x01) [mandatory] MTU: 1013 Option: Retransmission and Flow Control (0x04) [mandatory] Mode: Basic (0x00) TX window size: 0 Max transmit: 0 Retransmission timeout: 0 Monitor timeout: 0 Maximum PDU size: 0 > HCI Event: Number of Completed Packets (0x13) plen 5 #407 [hci1] 10.761399 Num handles: 1 Handle: 43 Count: 1 > ACL Data RX: Handle 43 flags 0x02 dlen 16 #408 [hci1] 10.762942 L2CAP: Connection Response (0x03) ident 18 len 8 Destination CID: 66 Source CID: 65 Result: Connection successful (0x0000) Status: No further information available (0x0000) *snip* Similar case after the patch: *snip* > ACL Data RX: Handle 43 flags 0x02 dlen 8 #22702 [hci0] 1664.411056 Channel: 65 len 4 [PSM 3 mode 0] {chan 3} RFCOMM: Disconnect (DISC) (0x43) Address: 0x03 cr 1 dlci 0x00 Control: 0x53 poll/final 1 Length: 0 FCS: 0xfd < ACL Data TX: Handle 43 flags 0x00 dlen 8 #22703 [hci0] 1664.411136 Channel: 65 len 4 [PSM 3 mode 0] {chan 3} RFCOMM: Unnumbered Ack (UA) (0x63) Address: 0x03 cr 1 dlci 0x00 Control: 0x73 poll/final 1 Length: 0 FCS: 0xd7 < ACL Data TX: Handle 43 flags 0x00 dlen 12 #22704 [hci0] 1664.411143 L2CAP: Disconnection Request (0x06) ident 11 len 4 Destination CID: 65 Source CID: 65 > HCI Event: Number of Completed Pac.. (0x13) plen 5 #22705 [hci0] 1664.414009 Num handles: 1 Handle: 43 Count: 1 > HCI Event: Number of Completed Pac.. (0x13) plen 5 #22706 [hci0] 1664.415007 Num handles: 1 Handle: 43 Count: 1 > ACL Data RX: Handle 43 flags 0x02 dlen 12 #22707 [hci0] 1664.418674 L2CAP: Disconnection Request (0x06) ident 17 len 4 Destination CID: 65 Source CID: 65 < ACL Data TX: Handle 43 flags 0x00 dlen 12 #22708 [hci0] 1664.418762 L2CAP: Disconnection Response (0x07) ident 17 len 4 Destination CID: 65 Source CID: 65 < ACL Data TX: Handle 43 flags 0x00 dlen 12 #22709 [hci0] 1664.421073 L2CAP: Connection Request (0x02) ident 12 len 4 PSM: 1 (0x0001) Source CID: 65 > ACL Data RX: Handle 43 flags 0x02 dlen 12 #22710 [hci0] 1664.421371 L2CAP: Disconnection Response (0x07) ident 11 len 4 Destination CID: 65 Source CID: 65 > HCI Event: Number of Completed Pac.. (0x13) plen 5 #22711 [hci0] 1664.424082 Num handles: 1 Handle: 43 Count: 1 > HCI Event: Number of Completed Pac.. (0x13) plen 5 #22712 [hci0] 1664.425040 Num handles: 1 Handle: 43 Count: 1 > ACL Data RX: Handle 43 flags 0x02 dlen 12 #22713 [hci0] 1664.426103 L2CAP: Connection Request (0x02) ident 18 len 4 PSM: 3 (0x0003) Source CID: 65 < ACL Data TX: Handle 43 flags 0x00 dlen 16 #22714 [hci0] 1664.426186 L2CAP: Connection Response (0x03) ident 18 len 8 Destination CID: 66 Source CID: 65 Result: Connection successful (0x0000) Status: No further information available (0x0000) < ACL Data TX: Handle 43 flags 0x00 dlen 27 #22715 [hci0] 1664.426196 L2CAP: Configure Request (0x04) ident 13 len 19 Destination CID: 65 Flags: 0x0000 Option: Maximum Transmission Unit (0x01) [mandatory] MTU: 1013 Option: Retransmission and Flow Control (0x04) [mandatory] Mode: Basic (0x00) TX window size: 0 Max transmit: 0 Retransmission timeout: 0 Monitor timeout: 0 Maximum PDU size: 0 > ACL Data RX: Handle 43 flags 0x02 dlen 16 #22716 [hci0] 1664.428804 L2CAP: Connection Response (0x03) ident 12 len 8 Destination CID: 66 Source CID: 65 Result: Connection successful (0x0000) Status: No further information available (0x0000) *snip* Fix is to check that channel is in state BT_DISCONN before deleting the channel. This bug was found while fuzzing Bluez's OBEX implementation using Synopsys Defensics. Reported-by: Matti Kamunen Reported-by: Ari Timonen Signed-off-by: Matias Karhumaa Signed-off-by: Marcel Holtmann commit baa23ec860920ebf3e897c4bbb3420a88ea80ec1 Author: Marco Ammon Date: Thu Jul 4 12:50:41 2019 +0200 kconfig: Fix spelling of sym_is_changable There is a spelling mistake in "changable", it is corrected to "changeable" and all call sites are updated accordingly. Signed-off-by: Marco Ammon Signed-off-by: Masahiro Yamada commit a98429acadefc2b36611220f51659ecb3c1f35d2 Merge: 043b35f281f5 abdcfc25641c Author: Mark Brown Date: Sat Jul 6 12:25:28 2019 +0100 Merge remote-tracking branch 'asoc/topic/meson' into asoc-next commit 043b35f281f5f141e7a928d27492133ef33b8119 Merge: 0dceaf7c798d 87a6fe80d56b Author: Mark Brown Date: Sat Jul 6 12:25:26 2019 +0100 Merge branch 'asoc-5.3' into asoc-next commit 0dceaf7c798de953c74073cc77be40b7be49abbc Merge: 6fbc7275c7a9 1bcc1fd64e4d Author: Mark Brown Date: Sat Jul 6 12:25:24 2019 +0100 Merge branch 'asoc-5.2' into asoc-linus commit 87a6fe80d56be85bda093c4dd8a3e6535bda7e4a Author: Kai Vehmanen Date: Tue Jul 2 16:24:28 2019 +0300 ASoC: SOF: Intel: implement runtime idle for CNL/APL Implement runtime idle for CNL/APL devices using similar runtime PM idle logic as the Intel AZX HDA driver. If any HDA codecs are powered when runtime suspend request comes, return -EBUSY. By doing this, strict ordering is enforced between HDA codec and the HDA controller. Signed-off-by: Kai Vehmanen Reviewed-by: Pierre-Louis Bossart Reviewed-by: Takashi Iwai Link: https://lore.kernel.org/r/20190702132428.13129-4-kai.vehmanen@linux.intel.com Signed-off-by: Mark Brown commit 62fde9772dd8400bc407de8822ede56b5f2f67f1 Author: Kai Vehmanen Date: Tue Jul 2 16:24:27 2019 +0300 ASoC: SOF: add runtime idle callback Add ability to implement a SOF device level runtime idle callback. Signed-off-by: Kai Vehmanen Reviewed-by: Pierre-Louis Bossart Reviewed-by: Takashi Iwai Link: https://lore.kernel.org/r/20190702132428.13129-3-kai.vehmanen@linux.intel.com Signed-off-by: Mark Brown commit e62bccf8a5ec47768ae2600dc880b148cce19f1b Author: Kai Vehmanen Date: Tue Jul 2 16:24:26 2019 +0300 ASoC: hdac_hdmi: report codec link up/down status to bus Report codec power status to the HDA codec bus from runtime pm suspend and resume callbacks. This is required to implement runtime idle logic that relies on 'codec_powered' field of hdac_bus to be maintained for all codecs. Signed-off-by: Kai Vehmanen Reviewed-by: Pierre-Louis Bossart Reviewed-by: Takashi Iwai Link: https://lore.kernel.org/r/20190702132428.13129-2-kai.vehmanen@linux.intel.com Signed-off-by: Mark Brown commit dcae9052ebb0c5b2614de620323d615fcbfda7f8 Author: Dan Carpenter Date: Thu May 16 21:24:00 2019 +0300 Bluetooth: hidp: NUL terminate a string in the compat ioctl This change is similar to commit a1616a5ac99e ("Bluetooth: hidp: fix buffer overflow") but for the compat ioctl. We take a string from the user and forgot to ensure that it's NUL terminated. I have also changed the strncpy() in to strscpy() in hidp_setup_hid(). The difference is the strncpy() doesn't necessarily NUL terminate the destination string. Either change would fix the problem but it's nice to take a belt and suspenders approach and do both. Signed-off-by: Dan Carpenter Signed-off-by: Marcel Holtmann commit 44d34af2e4cfd0c5357182f8b43f3e0a1fe30a2e Author: João Paulo Rechi Vita Date: Thu May 23 13:32:01 2019 -0700 Bluetooth: Add new 13d3:3491 QCA_ROME device Without the QCA ROME setup routine this adapter fails to establish a SCO connection. T: Bus=01 Lev=01 Prnt=01 Port=08 Cnt=01 Dev#= 2 Spd=12 MxCh= 0 D: Ver= 1.10 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=13d3 ProdID=3491 Rev=00.01 C: #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=100mA I: If#=0x0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb I: If#=0x1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb Signed-off-by: João Paulo Rechi Vita Signed-off-by: Marcel Holtmann commit 881cec4f6b4da78e54b73c046a60f39315964c7d Author: João Paulo Rechi Vita Date: Thu May 23 13:32:02 2019 -0700 Bluetooth: Add new 13d3:3501 QCA_ROME device Without the QCA ROME setup routine this adapter fails to establish a SCO connection. T: Bus=01 Lev=01 Prnt=01 Port=04 Cnt=01 Dev#= 2 Spd=12 MxCh= 0 D: Ver= 1.10 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=13d3 ProdID=3501 Rev=00.01 C: #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=100mA I: If#=0x0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb I: If#=0x1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb Signed-off-by: João Paulo Rechi Vita Signed-off-by: Marcel Holtmann commit 4ce9146e0370fcd573f0372d9b4e5a211112567c Author: Tomas Bortoli Date: Tue May 28 15:42:58 2019 +0200 Bluetooth: hci_bcsp: Fix memory leak in rx_skb Syzkaller found that it is possible to provoke a memory leak by never freeing rx_skb in struct bcsp_struct. Fix by freeing in bcsp_close() Signed-off-by: Tomas Bortoli Reported-by: syzbot+98162c885993b72f19c4@syzkaller.appspotmail.com Signed-off-by: Marcel Holtmann commit 6c595ea8b7b9d4048760c28cbccd8956acbc0762 Author: Larry Finger Date: Wed May 29 13:12:34 2019 -0500 Bluetooth:: btrtl: Add support for RTL8723DU This device is functionally equivalent to the BT part of the RTL8723DE, uses the same firmware, but the LMP subversion and HCI revision are unique. Signed-off-by: Larry Finger Signed-off-by: Marcel Holtmann commit 055825614c6b4da8c931fe1dea2f2920553f7a67 Author: Sean Wang Date: Sun Jun 2 09:04:17 2019 +0800 Bluetooth: btmtkuart: add an implementation for clock osc property Some board requires explicitily control external osscilator via GPIO. So, add an implementation of a clock property for an external oscillator to the device. Signed-off-by: Sean Wang Signed-off-by: Marcel Holtmann commit a3cb6d602a7a948f0b4ff77b6a087f9c25038d52 Author: Sean Wang Date: Sun Jun 2 09:04:16 2019 +0800 Bluetooth: btmtkuart: add an implementation for boot-gpios property Not every platform has the pinctrl device integrates the GPIO the function such as MT7621 whose pinctrl and GPIO are separate hardware so the driver adds additional boot-gpios to let the MT766[3,8]U can enter the proper boot mode by gpiod for such platform. Signed-off-by: Sean Wang Signed-off-by: Marcel Holtmann commit 14e3ed84d77e78fbf386006d3e5a0c20150681f5 Author: Sean Wang Date: Sun Jun 2 09:04:15 2019 +0800 dt-bindings: net: bluetooth: add clock property to UART-based device Some board requires explicitily control external osscilator via GPIO. So, add a clock property for an external oscillator for the device. Signed-off-by: Sean Wang Signed-off-by: Marcel Holtmann commit 1c576f385a440cd8790516d6227235b4161c6668 Author: Sean Wang Date: Sun Jun 2 09:04:14 2019 +0800 dt-bindings: net: bluetooth: add boot-gpios property to UART-based device Not every platform has the pinctrl device integrates the GPIO the function such as MT7621 whose pinctrl and GPIO are separate hardware so adding an additional boot-gpios property for such platform allows them to bring up the device. Signed-off-by: Sean Wang Signed-off-by: Marcel Holtmann commit f4d297eec673097ad5c1a971db7ea8f9b6e5fa2e Author: Neil Armstrong Date: Mon May 20 15:41:04 2019 +0200 Bluetooth: btbcm: Add entry for BCM4359C0 UART bluetooth The BCM4359C0 BT/Wi-Fi compo chip needs an entry to be discovered by the btbcm driver. Tested using an AP6398S module from Ampak. Signed-off-by: Neil Armstrong Signed-off-by: Marcel Holtmann commit 956f664635ecca59d027d57c6eb5a5cf4b711c9b Author: Rocky Liao Date: Thu Jun 6 17:40:55 2019 +0800 dt-bindings: net: bluetooth: Add device property firmware-name for QCA6174 This patch adds an optional device property "firmware-name" to allow the driver to load customized nvm firmware file based on this property. Signed-off-by: Rocky Liao Reviewed-by: Rob Herring Signed-off-by: Marcel Holtmann commit 99c905c6a165a590780a961988892bfec41566dd Author: Rocky Liao Date: Thu Jun 6 17:40:30 2019 +0800 Bluetooth: hci_qca: Load customized NVM based on the device property QCA BTSOC NVM is a customized firmware file and different vendors may want to have different BTSOC configuration (e.g. Configure SCO over PCM or I2S, Setting Tx power, etc.) via this file. This patch will allow vendors to download different NVM firmware file by reading a device property "firmware-name". Signed-off-by: Rocky Liao Tested-by: Harish Bandi Signed-off-by: Marcel Holtmann commit be70e5e774a616ad43e63c0b42c2f6e2709dbf3b Author: Sascha Hauer Date: Fri Jun 14 09:23:51 2019 +0200 Bluetooth: hci_mrvl: Add serdev support This adds serdev support to the Marvell hci uart driver. Only basic serdev support, none of the fancier features like regulator or enable GPIO support is added for now. Signed-off-by: Sascha Hauer Signed-off-by: Marcel Holtmann commit a55b896455f558075197d89e026c91fcea263627 Author: Sascha Hauer Date: Fri Jun 14 09:23:50 2019 +0200 Bluetooth: hci_mrvl: Wait for final ack before switching baudrate For the Marvell HCI UART we have to upload two firmware files. The first one is only for switching the baudrate of the device to a higher baudrate. After the baudrate switching firmware has been uploaded the device waits for a final ack (0x5a) before actually switching the baudrate. To send this final ack with the old baudrate give the hci ldisc workqueue a chance to run before switching the baudrate. Without this the final ack will never be received by the device and firmware upload fails. Signed-off-by: Sascha Hauer Signed-off-by: Marcel Holtmann commit 40fbb915fd0f4b088f5c9b07061b7d665287d26f Author: Sascha Hauer Date: Fri Jun 14 09:23:49 2019 +0200 Bluetooth: hci_ldisc: Add function to wait for characters to be sent The hci UART line discipline sends its characters in a workqueue. Some devices like the Marvell Bluetooth chips need to make sure that all queued characters are sent before switching the baudrate. This adds a function to synchronize with the workqueue. Signed-off-by: Sascha Hauer Signed-off-by: Marcel Holtmann commit db50450d096a452ae36dc265575cbff50f0f9f01 Author: Greg Kroah-Hartman Date: Fri Jun 14 09:14:23 2019 +0200 6lowpan: no need to check return value of debugfs_create functions When calling debugfs functions, there is no need to ever check the return value. The function can work or not, but the code logic should never do something different based on this. Because we don't care if debugfs works or not, this trickles back a bit so we can clean things up by making some functions return void instead of an error value that is never going to fail. Signed-off-by: Greg Kroah-Hartman Acked-by: Jukka Rissanen Signed-off-by: Marcel Holtmann commit 2faa3f15fa2fc13ad1e12a61fc3dbb14b326ba7a Author: Matthias Kaehlcke Date: Tue May 21 12:53:07 2019 -0700 Bluetooth: hci_qca: wcn3990: Drop baudrate change vendor event Firmware download to the WCN3990 often fails with a 'TLV response size mismatch' error: [ 133.064659] Bluetooth: hci0: setting up wcn3990 [ 133.489150] Bluetooth: hci0: QCA controller version 0x02140201 [ 133.495245] Bluetooth: hci0: QCA Downloading qca/crbtfw21.tlv [ 133.507214] Bluetooth: hci0: QCA TLV response size mismatch [ 133.513265] Bluetooth: hci0: QCA Failed to download patch (-84) This is caused by a vendor event that corresponds to an earlier command to change the baudrate. The event is not processed in the context of the baudrate change and is later interpreted as response to the firmware download command (which is also a vendor command), but the driver detects that the event doesn't have the expected amount of associated data. More details: For the WCN3990 the vendor command for a baudrate change isn't sent as synchronous HCI command, because the controller sends the corresponding vendor event with the new baudrate. The event is received and decoded after the baudrate change of the host port. Identify the 'unused' event when it is received and don't add it to the queue of RX frames. Signed-off-by: Matthias Kaehlcke Signed-off-by: Marcel Holtmann commit 32646db8cc2862a14788de1bb4c365d0a27fb532 Author: Balakrishna Godavarthi Date: Tue May 28 14:43:22 2019 -0700 Bluetooth: btqca: inject command complete event during fw download Latest qualcomm chips are not sending an command complete event for every firmware packet sent to chip. They only respond with a vendor specific event for the last firmware packet. This optimization will decrease the BT ON time. Due to this we are seeing a timeout error message logs on the console during firmware download. Now we are injecting a command complete event once we receive an vendor specific event for the last RAM firmware packet. Signed-off-by: Balakrishna Godavarthi Tested-by: Matthias Kaehlcke Reviewed-by: Matthias Kaehlcke Signed-off-by: Matthias Kaehlcke Signed-off-by: Marcel Holtmann commit 82b7d856649988b5ddaad5f17abb787f6909107f Author: Fabian Schindlatz Date: Sun Jun 23 23:15:48 2019 +0200 Bluetooth: Cleanup formatting and coding style Fix some warnings and one error reported by checkpatch.pl: - lines longer than 80 characters are wrapped - empty lines inserted to separate variable declarations from the actual code - line break inserted after if (...) Co-developed-by: Thomas Röthenbacher Signed-off-by: Thomas Röthenbacher Signed-off-by: Fabian Schindlatz Cc: linux-kernel@i4.cs.fau.de Signed-off-by: Marcel Holtmann commit 7af3f558aca74f2ee47b173f1c27f6bb9a5b5561 Author: Jian-Hong Pan Date: Tue Jun 25 16:30:51 2019 +0800 Bluetooth: btrtl: HCI reset on close for Realtek BT chip Realtek RTL8822BE BT chip on ASUS X420FA cannot be turned on correctly after on-off several times. Bluetooth daemon sets BT mode failed when this issue happens. Scanning must be active while turning off for this bug to be hit. bluetoothd[1576]: Failed to set mode: Failed (0x03) If BT is turned off, then turned on again, it works correctly again. According to the vendor driver, the HCI_QUIRK_RESET_ON_CLOSE flag is set during probing. So, this patch makes Realtek's BT reset on close to fix this issue. Link: https://bugzilla.kernel.org/show_bug.cgi?id=203429 Signed-off-by: Jian-Hong Pan Reviewed-by: Daniel Drake Signed-off-by: Marcel Holtmann commit 6322f377bc4a0e3dac040c1c6d01761514f42187 Author: Fabian Schindlatz Date: Mon Jul 1 22:57:13 2019 +0200 Bluetooth: hci_ll: Refactor download_firmware Extract the new function send_command_from_firmware from download_firmware, which helps with the readability of the switch statement. This way the code is less deeply nested and also no longer exceeds the 80 character limit. Co-developed-by: Thomas Röthenbacher Signed-off-by: Thomas Röthenbacher Signed-off-by: Fabian Schindlatz Signed-off-by: Marcel Holtmann commit a2e02f38eff84f199c8e32359eb213f81f270047 Author: Philipp Puschmann Date: Tue Jul 2 16:13:37 2019 +0200 Bluetooth: hci_ll: set operational frequency earlier Uploading the firmware needs quite a few seconds if done at 115200 kbps. So set the operational frequency, usually 3 MHz, before uploading the firmware. I have successfully tested this with a wl1837mod. Signed-off-by: Philipp Puschmann Signed-off-by: Marcel Holtmann commit 98d9856a759f5cc8032efeb5c87badc1c652d430 Author: Peter Robinson Date: Sun Jun 30 23:14:08 2019 +0100 Bluetooth: btsdio: Do not bind to non-removable BCM4356 BCM4356 devices soldered onto the PCB (non-removable) use an UART connection for bluetooth, such as the Rock960, but it also advertise btsdio support as a sdio function. Signed-off-by: Peter Robinson CC: Manivannan Sadhasivam Signed-off-by: Marcel Holtmann commit 3a1d24ca9573fbc74a3d32c972c333b161e0e9dc Author: Zenghui Yu Date: Sat Jul 6 04:41:12 2019 +0000 irq/irqdomain: Fix comment typo Fix typo in the comment on top of __irq_domain_add(). Signed-off-by: Zenghui Yu Signed-off-by: Thomas Gleixner Link: https://lkml.kernel.org/r/1562388072-23492-1-git-send-email-yuzenghui@huawei.com commit c09cb1293523dd786ae54a12fd88001542cba2f6 Author: Shijith Thotton Date: Fri Jul 5 07:56:20 2019 +0000 genirq: Update irq stats from NMI handlers The NMI handlers handle_percpu_devid_fasteoi_nmi() and handle_fasteoi_nmi() do not update the interrupt counts. Due to that the NMI interrupt count does not show up correctly in /proc/interrupts. Add the statistics and treat the NMI handlers in the same way as per cpu interrupts and prevent them from updating irq_desc::tot_count as this might be corrupted due to concurrency. [ tglx: Massaged changelog ] Fixes: 2dcf1fbcad35 ("genirq: Provide NMI handlers") Signed-off-by: Shijith Thotton Signed-off-by: Thomas Gleixner Link: https://lkml.kernel.org/r/1562313336-11888-1-git-send-email-sthotton@marvell.com commit ad5a449b707b909a91ed59109f421a1b965c6004 Author: Dexuan Cui Date: Thu Jul 4 02:43:32 2019 +0000 ACPI: PM: Make acpi_sleep_state_supported() non-static With some upcoming patches to save/restore the Hyper-V drivers related states, a Linux VM running on Hyper-V will be able to hibernate. When a Linux VM hibernates, unluckily we must disable the memory hot-add/remove and balloon up/down capabilities in the hv_balloon driver (drivers/hv/hv_balloon.c), because these can not really work according to the design of the related back-end driver on the host. By default, Hyper-V does not enable the virtual ACPI S4 state for a VM; on recent Hyper-V hosts, the administrator is able to enable the virtual ACPI S4 state for a VM, so we hope to use the presence of the virtual ACPI S4 state as a hint for hv_balloon to disable the aforementioned capabilities. In this way, hibernation will work more reliably, from the user's perspective. By marking acpi_sleep_state_supported() non-static, we'll be able to implement a hv_is_hibernation_supported() API in the always-built-in module arch/x86/hyperv/hv_init.c, and the API will be called by hv_balloon. Signed-off-by: Dexuan Cui Signed-off-by: Rafael J. Wysocki commit 0ef1efd1354d732d040f29b2005420f83fcdd8f4 Author: Pablo Neira Ayuso Date: Fri Jul 5 23:38:54 2019 +0200 netfilter: nf_tables: force module load in case select_ops() returns -EAGAIN nft_meta needs to pull in the nft_meta_bridge module in case that this is a bridge family rule from the select_ops() path. Signed-off-by: Pablo Neira Ayuso commit 23f30c41c732fe9800f4a2d545b37c9515d35ad6 Merge: 61c2491db779 d2ead1f360e8 Author: David S. Miller Date: Fri Jul 5 16:29:20 2019 -0700 Merge branch 'mlx5-TLS-TX-HW-offload-support' Tariq Toukan says: ==================== mlx5 TLS TX HW offload support This series from Eran and me, adds TLS TX HW offload support to the mlx5 driver. This offloads the kTLS encryption process from kernel to the Mellanox NIC, saving CPU cycles and improving utilization. Upon a new TLS connection request, driver is responsible to create a dedicated HW context and configure it according to the crypto info, so HW can do the encryption itself. When the HW context gets out-of-sync (i.e. due to packets retransmission), driver is responsible for the re-sync process. This is done by posting special resync descriptors to the HW. Feature is supported on Mellanox Connect-X 6DX, and newer. Series was tested on SimX simulator. Series generated against net-next commit [1], with Saeed's request pulled [2]: [1] c4cde5804d51 Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next [2] git://git.kernel.org/pub/scm/linux/kernel/git/saeed/linux.git tags/mlx5-updates-2019-07-04-v2 Changes from last pull request: Fixed comments from Jakub: Patch 4: - Replace zero memset with a call to memzero_explicit(). Patch 11: - Fix stats counters names. - Drop TLS SKB with non-matching netdev. ==================== Acked-by: Jakub Kicinski Signed-off-by: David S. Miller commit d2ead1f360e8abd9817dea4f7290ffaf00078ac1 Author: Tariq Toukan Date: Fri Jul 5 18:30:22 2019 +0300 net/mlx5e: Add kTLS TX HW offload support Add support for transmit side kernel-TLS acceleration. Offload the crypto encryption to HW. Per TLS connection: - Use a separate TIS to maintain the HW context. - Use a separate encryption key. - Maintain static and progress HW contexts by posting the proper WQEs at creation time, or upon resync. - Use a special DUMP opcode to replay the previous frags and sync the HW context. To make sure the SQ is able to serve an xmit request, increase SQ stop room to cover: - static params WQE, - progress params WQE, and - resync DUMP per frag. Currently supporting TLS 1.2, and key size 128bit. Tested over SimX simulator. Signed-off-by: Tariq Toukan Signed-off-by: Eran Ben Elisha Signed-off-by: Saeed Mahameed Signed-off-by: David S. Miller commit 37badd159c52768e31aab2c978b9f837e4dd66bc Author: Tariq Toukan Date: Fri Jul 5 18:30:21 2019 +0300 net/mlx5e: Introduce a fenced NOP WQE posting function Similar to the existing mlx5e_post_nop(), but marks a fence in the WQE control segment. Added as a separate new function to not hurt the performance of the common case. To be used in a downstream patch of the series. Signed-off-by: Tariq Toukan Reviewed-by: Boris Pismenny Signed-off-by: Saeed Mahameed Signed-off-by: David S. Miller commit 2b257a6e736f5af17c796087b628cb320cdec062 Author: Tariq Toukan Date: Fri Jul 5 18:30:20 2019 +0300 net/mlx5e: Re-work TIS creation functions Let the EN TIS creation function (mlx5e_create_tis) be responsible for applying common mdev related fields. Other specific fields must be set by the caller and passed within the inbox. Signed-off-by: Tariq Toukan Reviewed-by: Boris Pismenny Signed-off-by: Saeed Mahameed Signed-off-by: David S. Miller commit 01614d4f603ed651098b7741f4742e7caf6d0155 Author: Tariq Toukan Date: Fri Jul 5 18:30:19 2019 +0300 net/mlx5e: Tx, Unconstify SQ stop room Use an SQ field for stop_room, and use the larger value only if TLS is supported. Signed-off-by: Tariq Toukan Signed-off-by: Saeed Mahameed Signed-off-by: David S. Miller commit 9ab0233728cab92575eee90a86cda639ef34ba57 Author: Eran Ben Elisha Date: Fri Jul 5 18:30:18 2019 +0300 net/mlx5e: Tx, Don't implicitly assume SKB-less wqe has one WQEBB When polling a CQE of an SKB-less WQE, don't assume it consumed only one WQEBB. Use wi->num_wqebbs directly instead. In the downstream patch, SKB-less WQEs might have more the one WQEBB, thus this change is needed. Signed-off-by: Eran Ben Elisha Signed-off-by: Tariq Toukan Signed-off-by: Saeed Mahameed Signed-off-by: David S. Miller commit fd1b225963189f2f16d44649496a8246c5cfdbc2 Author: Tariq Toukan Date: Fri Jul 5 18:30:17 2019 +0300 net/mlx5e: Tx, Make SQ WQE fetch function type generic Change mlx5e_sq_fetch_wqe to be agnostic to the Work Queue Element (WQE) type. Before this patch, it was specific for struct mlx5e_tx_wqe. In order to allow the change, the function now returns the generic void pointer, and gets the WQE size to do the zero memset. Signed-off-by: Tariq Toukan Signed-off-by: Eran Ben Elisha Signed-off-by: Saeed Mahameed Signed-off-by: David S. Miller commit 740114a87e43a4ceb9ff5ff3a4a704bcef1f60be Author: Tariq Toukan Date: Fri Jul 5 18:30:16 2019 +0300 net/mlx5e: Tx, Enforce L4 inline copy when needed When ctrl->tisn field exists, this indicates an operation (HW offload) on the TCP payload. For such WQEs, inline the headers up to L4. This is in preparation for kTLS HW offload support, added in a downstream patch. Signed-off-by: Tariq Toukan Signed-off-by: Saeed Mahameed Signed-off-by: David S. Miller commit 542578c6793698a98cd0b7c77a96b8c6bfdfcb88 Author: Tariq Toukan Date: Fri Jul 5 18:30:15 2019 +0300 net/mlx5e: Move helper functions to a new txrx datapath header Take datapath helper functions to a new header file en/txrx.h. Signed-off-by: Tariq Toukan Signed-off-by: Eran Ben Elisha Signed-off-by: Saeed Mahameed Signed-off-by: David S. Miller commit fc707e59c9dda2b3675b137757907e41d658da7e Author: Tariq Toukan Date: Fri Jul 5 18:30:14 2019 +0300 net/mlx5: Accel, Add core TLS support for the Connect-X family Add support for the new TLS implementation of the Connect-X family. Introduce a new compilation flag MLX5_TLS for it. Signed-off-by: Tariq Toukan Signed-off-by: Eran Ben Elisha Signed-off-by: Saeed Mahameed Signed-off-by: David S. Miller commit 45d3b55dc665670f87373744e30fa0e8eaced495 Author: Tariq Toukan Date: Fri Jul 5 18:30:13 2019 +0300 net/mlx5: Add crypto library to support create/destroy encryption key Encryption key create / destroy is done via CREATE_GENERAL_OBJECT / DESTROY_GENERAL_OBJECT commands. To be used in downstream patches by TLS API wrappers, to configure the TIS context with the encryption key. Signed-off-by: Tariq Toukan Signed-off-by: Eran Ben Elisha Signed-off-by: Saeed Mahameed Signed-off-by: David S. Miller commit e2869fb2068be603b46cd62bc980b4765948c6ed Author: Tariq Toukan Date: Fri Jul 5 18:30:12 2019 +0300 net/mlx5: Kconfig, Better organize compilation flags Always contain all acceleration functions declarations in 'accel' files, independent to the flags setting. For this, introduce new flags CONFIG_FPGA_{IPSEC/TLS} and use stubs where needed. This obsoletes the need for stubs in 'fpga' files. Remove them. Also use the new flags in Makefile, to decide whether to compile TLS-specific or IPSEC-specific objects, or not. Signed-off-by: Tariq Toukan Signed-off-by: Saeed Mahameed Signed-off-by: David S. Miller commit c778dd31ac22f9027b7c8dfd62f421e245b49639 Author: Tariq Toukan Date: Fri Jul 5 18:30:11 2019 +0300 net/mlx5: Accel, Expose accel wrapper for IPsec FPGA function Do not directly call fpga version of IPsec function from main.c. Wrap it by an accel version, and call the wrapper. This will allow deprecating the FPGA IPsec stubs in downstream patch. Signed-off-by: Tariq Toukan Reviewed-by: Boris Pismenny Signed-off-by: Saeed Mahameed Signed-off-by: David S. Miller commit 61c2491db779c94d29446cea38b95d0c72bc1a9e Merge: f654e676702e 8338d9378895 Author: David S. Miller Date: Fri Jul 5 16:24:27 2019 -0700 Merge tag 'mlx5-updates-2019-07-04-v2' of git://git.kernel.org/pub/scm/linux/kernel/git/saeed/linux Saeed Mahameed says: ==================== mlx5-update-2019-07-04 This series adds mlx5 support for devlink fw versions query. 1) Implement the required low level firmware commands 2) Implement the devlink knobs and callbacks for fw versions query. ==================== Signed-off-by: David S. Miller commit 537de0c8ca2b2fd49046e06194425f56e6246148 Author: Ido Schimmel Date: Thu Jul 4 19:26:38 2019 +0300 ipv4: Fix NULL pointer dereference in ipv4_neigh_lookup() Both ip_neigh_gw4() and ip_neigh_gw6() can return either a valid pointer or an error pointer, but the code currently checks that the pointer is not NULL. Fix this by checking that the pointer is not an error pointer, as this can result in a NULL pointer dereference [1]. Specifically, I believe that what happened is that ip_neigh_gw4() returned '-EINVAL' (0xffffffffffffffea) to which the offset of 'refcnt' (0x70) was added, which resulted in the address 0x000000000000005a. [1] BUG: KASAN: null-ptr-deref in refcount_inc_not_zero_checked+0x6e/0x180 Read of size 4 at addr 000000000000005a by task swapper/2/0 CPU: 2 PID: 0 Comm: swapper/2 Not tainted 5.2.0-rc6-custom-reg-179657-gaa32d89 #396 Hardware name: Mellanox Technologies Ltd. MSN2010/SA002610, BIOS 5.6.5 08/24/2017 Call Trace: dump_stack+0x73/0xbb __kasan_report+0x188/0x1ea kasan_report+0xe/0x20 refcount_inc_not_zero_checked+0x6e/0x180 ipv4_neigh_lookup+0x365/0x12c0 __neigh_update+0x1467/0x22f0 arp_process.constprop.6+0x82e/0x1f00 __netif_receive_skb_one_core+0xee/0x170 process_backlog+0xe3/0x640 net_rx_action+0x755/0xd90 __do_softirq+0x29b/0xae7 irq_exit+0x177/0x1c0 smp_apic_timer_interrupt+0x164/0x5e0 apic_timer_interrupt+0xf/0x20 Fixes: 5c9f7c1dfc2e ("ipv4: Add helpers for neigh lookup for nexthop") Signed-off-by: Ido Schimmel Reported-by: Shalom Toledo Reviewed-by: Jiri Pirko Reviewed-by: David Ahern Signed-off-by: David S. Miller commit f654e676702e88650e78ed8ea1b118662f80b28a Author: Sebastian Andrzej Siewior Date: Thu Jul 4 17:38:02 2019 +0200 nfp: Use spinlock_t instead of struct spinlock For spinlocks the type spinlock_t should be used instead of "struct spinlock". Use spinlock_t for spinlock's definition. Cc: Jakub Kicinski Cc: "David S. Miller" Cc: oss-drivers@netronome.com Cc: netdev@vger.kernel.org Signed-off-by: Sebastian Andrzej Siewior Acked-by: Jakub Kicinski Signed-off-by: David S. Miller commit cd1973a9215ade41d99c3a7c34c127cf0d21774b Author: Ilias Apalodimas Date: Thu Jul 4 17:11:09 2019 +0300 net: netsec: Sync dma for device on buffer allocation Quoting Arnd, We have to do a sync_single_for_device /somewhere/ before the buffer is given to the device. On a non-cache-coherent machine with a write-back cache, there may be dirty cache lines that get written back after the device DMA's data into it (e.g. from a previous memset from before the buffer got freed), so you absolutely need to flush any dirty cache lines on it first. Since the coherency is configurable in this device make sure we cover all configurations by explicitly syncing the allocated buffer for the device before refilling it's descriptors Signed-off-by: Ilias Apalodimas Signed-off-by: David S. Miller commit 2bf8001e5387537f2d9acfecf3d724e0d6044b23 Merge: e4aa33ad5959 892951524647 Author: David S. Miller Date: Fri Jul 5 15:39:39 2019 -0700 Merge branch 'hns3-next' Huazhong Tan says: ==================== net: hns3: some cleanups & bugfixes This patch-set includes cleanups and bugfixes for the HNS3 ethernet controller driver. [patch 1/9] fixes VF's broadcast promisc mode not enabled after initializing. [patch 2/9] adds hints for fibre port not support flow control. [patch 3/9] fixes a port capbility updating issue. [patch 4/9 - 9/9] adds some cleanups for HNS3 driver. ==================== Signed-off-by: David S. Miller commit 892951524647d593d9f5e540a56fef4e52b95c03 Author: Peng Li Date: Thu Jul 4 22:04:28 2019 +0800 net: hns3: set maximum length to resp_data_len for exceptional case If HCLGE_MBX_MAX_RESP_DATA_SIZE > HCLGE_MBX_MAX_RESP_DATA_SIZE, the memcpy will cause out of memory. So this patch just set resp_data_len to the maximum length for this case. Signed-off-by: Peng Li Signed-off-by: Huazhong Tan Signed-off-by: David S. Miller commit b9a8f88373c586e357c8c203b657407437040e40 Author: Yonglong Liu Date: Thu Jul 4 22:04:27 2019 +0800 net: hns3: bitwise operator should use unsigned type There are some bitwise operator used signed type, this patch fixes them with unsigned type. Signed-off-by: Yonglong Liu Signed-off-by: Peng Li Signed-off-by: Huazhong Tan Signed-off-by: David S. Miller commit 354d0fab649d47045517cf7cae03d653a4dcb3b8 Author: Peng Li Date: Thu Jul 4 22:04:26 2019 +0800 net: hns3: add default value for tc_size and tc_offset This patch adds default value for tc_size and tc_offset, or it may get random value and used later. Signed-off-by: Peng Li Signed-off-by: Huazhong Tan Signed-off-by: David S. Miller commit 0bae5cf25d66156ae3eb9ca20a1ad9bc4aa35a6d Author: Weihang Li Date: Thu Jul 4 22:04:25 2019 +0800 net: hns3: check msg_data before memcpy in hclgevf_send_mbx_msg The value of msg_data may be NULL in some cases, which will cause errors reported by some compiler. So this patch adds a check to fix it. Signed-off-by: Weihang Li Signed-off-by: Peng Li Signed-off-by: Huazhong Tan Signed-off-by: David S. Miller commit c09ba484563c17f90ec91b46322c31d3440acc42 Author: Peng Li Date: Thu Jul 4 22:04:24 2019 +0800 net: hns3: set default value for param "type" in hclgevf_bind_ring_to_vector The value of param type is always not changed in hclgevf_bind_ring_to_vector, move the assignment to front of "for {}" can reduce the redundant assignment. Signed-off-by: Peng Li Signed-off-by: Huazhong Tan Signed-off-by: David S. Miller commit 9e1511fb8091e3f5b23bb21f32e9394bedc6c34e Author: Peng Li Date: Thu Jul 4 22:04:23 2019 +0800 net: hns3: add all IMP return code Currently, the HNS3 driver just defines part of IMP return code, This patch supplements all the remaining IMP return code, and adds a function to convert this code to the error number. Signed-off-by: Peng Li Signed-off-by: Huazhong Tan Signed-off-by: David S. Miller commit 49b1255603de5183c5e377200be3b3afe0dcdb86 Author: Jian Shen Date: Thu Jul 4 22:04:22 2019 +0800 net: hns3: fix port capbility updating issue Currently, the driver queries the media port information, and updates the port capability periodically. But it sets an error mac->speed_type value, which stops update port capability. Fixes: 88d10bd6f730 ("net: hns3: add support for multiple media type") Signed-off-by: Jian Shen Signed-off-by: Peng Li Signed-off-by: Huazhong Tan Signed-off-by: David S. Miller commit fb89629f2ecfa0feb07f9981c1bd66a4b4407f44 Author: Jian Shen Date: Thu Jul 4 22:04:21 2019 +0800 net: hns3: fix flow control configure issue for fibre port Flow control autoneg is unsupported for fibre port. It takes no effect for flow control when restart autoneg. This patch fixes it, return -EOPNOTSUPP when user tries to enable flow control autoneg. Signed-off-by: Jian Shen Signed-off-by: Peng Li Signed-off-by: Huazhong Tan Signed-off-by: David S. Miller commit 2d5066fc175ea77a733d84df9ef414b34f311641 Author: Jian Shen Date: Thu Jul 4 22:04:20 2019 +0800 net: hns3: enable broadcast promisc mode when initializing VF For revision 0x20, the broadcast promisc is enabled by firmware, it's unnecessary to enable it when initializing VF. For revision 0x21, it's necessary to enable broadcast promisc mode when initializing or re-initializing VF, otherwise, it will be unable to send and receive promisc packets. Fixes: f01f5559cac8 ("net: hns3: don't allow vf to enable promisc mode") Signed-off-by: Jian Shen Signed-off-by: Peng Li Signed-off-by: Huazhong Tan Signed-off-by: David S. Miller commit ffa9fec30ca0ceb7d5156a1649b9576058756616 Author: Hayes Wang Date: Thu Jul 4 17:36:32 2019 +0800 r8152: set RTL8152_UNPLUG only for real disconnection Set the flag of RTL8152_UNPLUG if and only if the device is unplugged. Some error codes sometimes don't mean the real disconnection of usb device. For those situations, set the flag of RTL8152_UNPLUG causes the driver skips some flows of disabling the device, and it let the device stay at incorrect state. Signed-off-by: Hayes Wang Signed-off-by: David S. Miller commit e4aa33ad595936391f7356f25c0c839011f14ead Author: Li RongQing Date: Thu Jul 4 17:03:26 2019 +0800 net: remove unused parameter from skb_checksum_try_convert the check parameter is never used Signed-off-by: Li RongQing Signed-off-by: David S. Miller commit 60a6127c5e4888aa701744d9b9dbd8a94cec35c7 Merge: cfe261c24e55 72458e279488 Author: David S. Miller Date: Fri Jul 5 15:28:57 2019 -0700 Merge branch 'mlxsw-Enable-disable-PTP-shapers' Ido Schimmel says: ==================== mlxsw: Enable/disable PTP shapers Shalom says: In order to get more accurate hardware time stamping in Spectrum-1, the driver needs to apply a shaper on the port for speeds lower than 40Gbps. This shaper is called a PTP shaper and it is applied on hierarchy 0, which is the port hierarchy. This shaper may affect the shaper rates of all hierarchies. This patchset adds the ability to enable or disable the PTP shaper on the port in two scenarios: 1. When the user wants to enable/disable the hardware time stamping 2. When the port is brought up or down (including port speed change) Patch #1 adds the QEEC.ptps field that is used for enabling or disabling the PTP shaper on a port. Patch #2 adds a note about disabling the PTP shaper when calling to mlxsw_sp_port_ets_maxrate_set(). Patch #3 adds the QPSC register that is responsible for configuring the PTP shaper parameters per speed. Patch #4 sets the PTP shaper parameters during the ptp_init(). Patch #5 adds new operation for getting the port's speed. Patch #6 enables/disables the PTP shaper when turning on or off the hardware time stamping. Patch #7 enables/disables the PTP shaper when the port's status has changed (including port speed change). Patch #8 applies the PTP shaper enable/disable logic by filling the PTP shaper parameters array. ==================== Signed-off-by: David S. Miller commit 72458e2794884a75808b646fd6f085385046f681 Author: Shalom Toledo Date: Thu Jul 4 10:07:40 2019 +0300 mlxsw: spectrum_ptp: Apply the PTP shaper enable/disable logic Apply by filling the PTP shaper parameters array. Signed-off-by: Shalom Toledo Reviewed-by: Petr Machata Acked-by: Jiri Pirko Signed-off-by: Ido Schimmel Signed-off-by: David S. Miller commit 5fc1733897bff10b2a9d1fb1eae775c96cefa333 Author: Shalom Toledo Date: Thu Jul 4 10:07:39 2019 +0300 mlxsw: spectrum: Set up PTP shaper when port status has changed When getting port up down event (PUDE), change the PTP shaper configuration based on hardware time stamping on/off and the port's speed. Signed-off-by: Shalom Toledo Reviewed-by: Petr Machata Acked-by: Jiri Pirko Signed-off-by: Ido Schimmel Signed-off-by: David S. Miller commit eceed3b1453d4115b4256ea1d24fab7b6eb7ba1f Author: Shalom Toledo Date: Thu Jul 4 10:07:38 2019 +0300 mlxsw: spectrum_ptp: Enable/disable PTP shaper on a port when getting HWTSTAMP on/off In order to get more accurate hardware time stamping, the driver needs to enable PTP shaper on the port, for speeds lower than 40 Gbps. Enable the PTP shaper on the port when the user turns on the hardware time stamping, and disable it when the user turns off the hardware time stamping. Signed-off-by: Shalom Toledo Reviewed-by: Petr Machata Acked-by: Jiri Pirko Signed-off-by: Ido Schimmel Signed-off-by: David S. Miller commit 4ae5cc42d347ff349ab3dd7c1981c93803788956 Author: Shalom Toledo Date: Thu Jul 4 10:07:37 2019 +0300 mlxsw: spectrum: Add new operation for getting the port's speed New operation for getting the port's speed as part of port-type-speed operations. Signed-off-by: Shalom Toledo Acked-by: Jiri Pirko Reviewed-by: Petr Machata Signed-off-by: Ido Schimmel Signed-off-by: David S. Miller commit 399569cb0a2afaf6ad3a961f85513c8a4395f65b Author: Shalom Toledo Date: Thu Jul 4 10:07:36 2019 +0300 mlxsw: spectrum_ptp: Set the PTP shaper parameters Set the PTP shaper parameters during the ptp_init(). For different speeds, there are different parameters. When the port's speed changes and PTP shaper is enabled, the firmware changes the ETS shaper values according to the PTP shaper parameters for this new speed. The PTP shaper parameters array is left empty for now, will be filled in a follow-up patch. Signed-off-by: Shalom Toledo Reviewed-by: Petr Machata Acked-by: Jiri Pirko Signed-off-by: Ido Schimmel Signed-off-by: David S. Miller commit 71147506a95dd2ed5c0befcbc9caa03d7348df63 Author: Shalom Toledo Date: Thu Jul 4 10:07:35 2019 +0300 mlxsw: reg: Add QoS PTP Shaper Configuration Register The QPSC allows advanced configuration of the PTP shapers. Signed-off-by: Shalom Toledo Acked-by: Jiri Pirko Reviewed-by: Petr Machata Signed-off-by: Ido Schimmel Signed-off-by: David S. Miller commit ea7bb579fc3d1d6426c34e1af0158dd1826613b2 Author: Shalom Toledo Date: Thu Jul 4 10:07:34 2019 +0300 mlxsw: spectrum: Add note about the PTP shaper Add note about disabling the PTP shaper when calling to mlxsw_sp_port_ets_maxrate_set(). Signed-off-by: Shalom Toledo Acked-by: Jiri Pirko Reviewed-by: Petr Machata Signed-off-by: Ido Schimmel Signed-off-by: David S. Miller commit 12f0e2e9adee687e921332527769064903772498 Author: Shalom Toledo Date: Thu Jul 4 10:07:33 2019 +0300 mlxsw: reg: Add ptps field in QoS ETS Element Configuration Register The PTP Shaper field is used for enabling and disabling of port-rate based shaper which is slightly lower than port rate. Signed-off-by: Shalom Toledo Acked-by: Jiri Pirko Reviewed-by: Petr Machata Signed-off-by: Ido Schimmel Signed-off-by: David S. Miller commit cfe261c24e553d322ef3fc5ae96667767d80142a Author: YueHaibing Date: Thu Jul 4 03:37:45 2019 +0000 net: socionext: remove set but not used variable 'pkts' Fixes gcc '-Wunused-but-set-variable' warning: drivers/net/ethernet/socionext/netsec.c: In function 'netsec_clean_tx_dring': drivers/net/ethernet/socionext/netsec.c:637:15: warning: variable 'pkts' set but not used [-Wunused-but-set-variable] It is not used since commit ba2b232108d3 ("net: netsec: add XDP support") Signed-off-by: YueHaibing Acked-by: Ilias Apalodimas Signed-off-by: David S. Miller commit 04fc71435fdebff3f4fcde09a208316af502f5c6 Author: Hariprasad Kelam Date: Thu Jul 4 08:29:06 2019 +0530 net: ethernet: allwinner: Remove unneeded memset Remove unneeded memset as alloc_etherdev is using kvzalloc which uses __GFP_ZERO flag Signed-off-by: Hariprasad Kelam Signed-off-by: David S. Miller commit b82b21391092c87d257467762eacf496f43c6874 Author: Fuqian Huang Date: Thu Jul 4 10:36:40 2019 +0800 net/ethernet: using dev_get_drvdata directly Several drivers cast a struct device pointer to a struct platform_device pointer only to then call platform_get_drvdata(). To improve readability, these constructs can be simplified by using dev_get_drvdata() directly. Signed-off-by: Fuqian Huang Signed-off-by: David S. Miller commit 233cc605a2ef2ec051086b360e0e47c54bba7c32 Author: Fuqian Huang Date: Thu Jul 4 10:36:33 2019 +0800 net/can: using dev_get_drvdata directly Several drivers cast a struct device pointer to a struct platform_device pointer only to then call platform_get_drvdata(). To improve readability, these constructs can be simplified by using dev_get_drvdata() directly. Signed-off-by: Fuqian Huang Signed-off-by: David S. Miller commit fa8043017cf83427c7e3d7d8defe2c2133edffea Merge: 114b5b355ec0 edf070a0fb45 Author: David S. Miller Date: Fri Jul 5 15:22:28 2019 -0700 Merge branch 'hsr-bug-fixes' Cong Wang says: ==================== hsr: a few bug fixes This patchset contains 3 bug fixes for hsr triggered by a syzbot reproducer, please check each patch for details. ==================== Signed-off-by: Cong Wang commit edf070a0fb45ac845f534baf172fbadbeb5048c6 Author: Cong Wang Date: Wed Jul 3 17:21:14 2019 -0700 hsr: fix a NULL pointer deref in hsr_dev_xmit() hsr_port_get_hsr() could return NULL and kernel could crash: BUG: kernel NULL pointer dereference, address: 0000000000000010 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 8000000074b84067 P4D 8000000074b84067 PUD 7057d067 PMD 0 Oops: 0000 [#1] SMP PTI CPU: 0 PID: 754 Comm: a.out Not tainted 5.2.0-rc6+ #718 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-2.fc30 04/01/2014 RIP: 0010:hsr_dev_xmit+0x20/0x31 Code: 48 8b 1b eb e0 5b 5d 41 5c c3 66 66 66 66 90 55 48 89 fd 48 8d be 40 0b 00 00 be 04 00 00 00 e8 ee f2 ff ff 48 89 ef 48 89 c6 <48> 8b 40 10 48 89 45 10 e8 6c 1b 00 00 31 c0 5d c3 66 66 66 66 90 RSP: 0018:ffffb5b400003c48 EFLAGS: 00010246 RAX: 0000000000000000 RBX: ffff9821b4509a88 RCX: 0000000000000000 RDX: ffff9821b4509a88 RSI: 0000000000000000 RDI: ffff9821bc3fc7c0 RBP: ffff9821bc3fc7c0 R08: 0000000000000000 R09: 00000000000c2019 R10: 0000000000000000 R11: 0000000000000002 R12: ffff9821bc3fc7c0 R13: ffff9821b4509a88 R14: 0000000000000000 R15: 000000000000006e FS: 00007fee112a1800(0000) GS:ffff9821bd800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000010 CR3: 000000006e9ce000 CR4: 00000000000406f0 Call Trace: netdev_start_xmit+0x1b/0x38 dev_hard_start_xmit+0x121/0x21e ? validate_xmit_skb.isra.0+0x19/0x1e3 __dev_queue_xmit+0x74c/0x823 ? lockdep_hardirqs_on+0x12b/0x17d ip6_finish_output2+0x3d3/0x42c ? ip6_mtu+0x55/0x5c ? mld_sendpack+0x191/0x229 mld_sendpack+0x191/0x229 mld_ifc_timer_expire+0x1f7/0x230 ? mld_dad_timer_expire+0x58/0x58 call_timer_fn+0x12e/0x273 __run_timers.part.0+0x174/0x1b5 ? mld_dad_timer_expire+0x58/0x58 ? sched_clock_cpu+0x10/0xad ? mark_lock+0x26/0x1f2 ? __lock_is_held+0x40/0x71 run_timer_softirq+0x26/0x48 __do_softirq+0x1af/0x392 irq_exit+0x53/0xa2 smp_apic_timer_interrupt+0x1c4/0x1d9 apic_timer_interrupt+0xf/0x20 Cc: Arvid Brodin Signed-off-by: Cong Wang Signed-off-by: David S. Miller commit b9a1e627405d68d475a3c1f35e685ccfb5bbe668 Author: Cong Wang Date: Wed Jul 3 17:21:13 2019 -0700 hsr: implement dellink to clean up resources hsr_link_ops implements ->newlink() but not ->dellink(), which leads that resources not released after removing the device, particularly the entries in self_node_db and node_db. So add ->dellink() implementation to replace the priv_destructor. This also makes the code slightly easier to understand. Reported-by: syzbot+c6167ec3de7def23d1e8@syzkaller.appspotmail.com Cc: Arvid Brodin Signed-off-by: Cong Wang Signed-off-by: David S. Miller commit 619afef01f74f3572b5e9a266c1230dc83761eec Author: Cong Wang Date: Wed Jul 3 17:21:12 2019 -0700 hsr: fix a memory leak in hsr_del_port() hsr_del_port() should release all the resources allocated in hsr_add_port(). As a consequence of this change, hsr_for_each_port() is no longer safe to work with hsr_del_port(), switch to list_for_each_entry_safe() as we always hold RTNL lock. Cc: Arvid Brodin Signed-off-by: Cong Wang Signed-off-by: David S. Miller commit b21fec414095d966789581c1466fb2f55de33bfe Author: Pankaj Gupta Date: Fri Jul 5 19:33:28 2019 +0530 xfs: disable map_sync for async flush Dont support 'MAP_SYNC' with non-DAX files and DAX files with asynchronous dax_device. Virtio pmem provides asynchronous host page cache flush mechanism. We don't support 'MAP_SYNC' with virtio pmem and xfs. Signed-off-by: Pankaj Gupta Reviewed-by: Darrick J. Wong Signed-off-by: Dan Williams commit e46bfc3f03d7894c0eb47c7d754c38bafe39e197 Author: Pankaj Gupta Date: Fri Jul 5 19:33:27 2019 +0530 ext4: disable map_sync for async flush Dont support 'MAP_SYNC' with non-DAX files and DAX files with asynchronous dax_device. Virtio pmem provides asynchronous host page cache flush mechanism. We don't support 'MAP_SYNC' with virtio pmem and ext4. Signed-off-by: Pankaj Gupta Reviewed-by: Jan Kara Signed-off-by: Dan Williams commit 32de1484648a837db5dea0a7007fe7136804e392 Author: Pankaj Gupta Date: Fri Jul 5 19:33:26 2019 +0530 dax: check synchronous mapping is supported This patch introduces 'daxdev_mapping_supported' helper which checks if 'MAP_SYNC' is supported with filesystem mapping. It also checks if corresponding dax_device is synchronous. Virtio pmem device is asynchronous and does not not support VM_SYNC. Suggested-by: Jan Kara Signed-off-by: Pankaj Gupta Reviewed-by: Jan Kara Signed-off-by: Dan Williams commit 2e9ee0955d3c2d3db56aa02ba6f948ba35d5e9c1 Author: Pankaj Gupta Date: Fri Jul 5 19:33:25 2019 +0530 dm: enable synchronous dax This patch sets dax device 'DAXDEV_SYNC' flag if all the target devices of device mapper support synchrononous DAX. If device mapper consists of both synchronous and asynchronous dax devices, we don't set 'DAXDEV_SYNC' flag. 'dm_table_supports_dax' is refactored to pass 'iterate_devices_fn' as argument so that the callers can pass the appropriate functions. Suggested-by: Mike Snitzer Signed-off-by: Pankaj Gupta Reviewed-by: Mike Snitzer Signed-off-by: Dan Williams commit fefc1d97fa4b5e016bbe15447dc3edcd9e1bcb9f Author: Pankaj Gupta Date: Fri Jul 5 19:33:24 2019 +0530 libnvdimm: add dax_dev sync flag This patch adds 'DAXDEV_SYNC' flag which is set for nd_region doing synchronous flush. This later is used to disable MAP_SYNC functionality for ext4 & xfs filesystem for devices don't support synchronous flush. Signed-off-by: Pankaj Gupta Signed-off-by: Dan Williams commit 6e84200c0a2994b991259d19450eee561029bf70 Author: Pankaj Gupta Date: Fri Jul 5 19:33:23 2019 +0530 virtio-pmem: Add virtio pmem driver This patch adds virtio-pmem driver for KVM guest. Guest reads the persistent memory range information from Qemu over VIRTIO and registers it on nvdimm_bus. It also creates a nd_region object with the persistent memory range information so that existing 'nvdimm/pmem' driver can reserve this into system memory map. This way 'virtio-pmem' driver uses existing functionality of pmem driver to register persistent memory compatible for DAX capable filesystems. This also provides function to perform guest flush over VIRTIO from 'pmem' driver when userspace performs flush on DAX memory range. Signed-off-by: Pankaj Gupta Reviewed-by: Yuval Shaia Acked-by: Michael S. Tsirkin Acked-by: Jakub Staron Tested-by: Jakub Staron Reviewed-by: Cornelia Huck Signed-off-by: Dan Williams commit c5d4355d10d414a96ca870b731756b89d068d57a Author: Pankaj Gupta Date: Fri Jul 5 19:33:22 2019 +0530 libnvdimm: nd_region flush callback support This patch adds functionality to perform flush from guest to host over VIRTIO. We are registering a callback based on 'nd_region' type. virtio_pmem driver requires this special flush function. For rest of the region types we are registering existing flush function. Report error returned by host fsync failure to userspace. Signed-off-by: Pankaj Gupta Signed-off-by: Dan Williams commit db5d00c93edc0afba1027e51ff3b38dc0e5f7728 Author: Andy Shevchenko Date: Fri Jun 21 14:45:18 2019 +0300 libnvdimm, namespace: Drop uuid_t implementation detail There is no need for caller to know how uuid_t type is constructed. Thus, whenever we use it the implementation details are not needed. Drop it for good. Signed-off-by: Andy Shevchenko Signed-off-by: Dan Williams commit c3ec002e633e25f6e0ce6f97346dd6f38afcbd6a Author: Stanislav Fomichev Date: Wed Jul 3 13:09:52 2019 -0700 selftests/bpf: add test_tcp_rtt to .gitignore Forgot to add it in the original patch. Fixes: b55873984dab ("selftests/bpf: test BPF_SOCK_OPS_RTT_CB") Reported-by: Andrii Nakryiko Signed-off-by: Stanislav Fomichev Acked-by: Andrii Nakryiko Acked-by: Yonghong Song Signed-off-by: Daniel Borkmann commit d6dbce8fdd2b71a7aafc50b2dc5a67cc449428de Author: Stanislav Fomichev Date: Wed Jul 3 14:29:07 2019 -0700 selftests/bpf: fix test_align liveliness expectations Commit 2589726d12a1 ("bpf: introduce bounded loops") caused a change in the way some registers liveliness is reported in the test_align. Add missing "_w" to a couple of tests. Note, there are no offset changes! Fixes: 2589726d12a1 ("bpf: introduce bounded loops") Signed-off-by: Stanislav Fomichev Acked-by: Yonghong Song Signed-off-by: Daniel Borkmann commit e3b60ffbc16feeb007d07b2b7d1da4304e98c1a3 Merge: c4cde5804d51 c7b37c769d2a Author: David S. Miller Date: Fri Jul 5 15:01:15 2019 -0700 Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec-next Steffen Klassert says: ==================== pull request (net-next): ipsec-next 2019-07-05 1) A lot of work to remove indirections from the xfrm code. From Florian Westphal. 2) Fix a WARN_ON with ipv6 that triggered because of a forgotten break statement. From Florian Westphal. 3) Remove xfrmi_init_net, it is not needed. From Li RongQing. Please pull or let me know if there are problems. ==================== Signed-off-by: David S. Miller commit 114b5b355ec0b6e83a6628a5ab5d03e50fd40a31 Merge: 9d1bc24b52fb 56c5ee1a5823 Author: David S. Miller Date: Fri Jul 5 14:58:22 2019 -0700 Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec Steffen Klassert says: ==================== pull request (net): ipsec 2019-07-05 1) Fix xfrm selector prefix length validation for inter address family tunneling. From Anirudh Gupta. 2) Fix a memleak in pfkey. From Jeremy Sowden. 3) Fix SA selector validation to allow empty selectors again. From Nicolas Dichtel. 4) Select crypto ciphers for xfrm_algo, this fixes some randconfig builds. From Arnd Bergmann. 5) Remove a duplicated assignment in xfrm_bydst_resize. From Cong Wang. 6) Fix a hlist corruption on hash rebuild. From Florian Westphal. 7) Fix a memory leak when creating xfrm interfaces. From Nicolas Dichtel. Please pull or let me know if there are problems. ==================== Signed-off-by: David S. Miller commit 46dd3d7d287b4f1850a4fe02d74587b5375ec4ab Author: Luke Nelson Date: Thu Jul 4 17:18:02 2019 -0700 bpf, riscv: Enable zext optimization for more RV64G ALU ops Commit 66d0d5a854a6 ("riscv: bpf: eliminate zero extension code-gen") added the new zero-extension optimization for some BPF ALU operations. Since then, bugs in the JIT that have been fixed in the bpf tree require this optimization to be added to other operations: commit 1e692f09e091 ("bpf, riscv: clear high 32 bits for ALU32 add/sub/neg/lsh/rsh/arsh"), and commit fe121ee531d1 ("bpf, riscv: clear target register high 32-bits for and/or/xor on ALU32"). Now that these have been merged to bpf-next, the zext optimization can be enabled for the fixed operations. Signed-off-by: Luke Nelson Cc: Song Liu Cc: Jiong Wang Cc: Xi Wang Acked-by: Björn Töpel Acked-by: Jiong Wang Signed-off-by: Daniel Borkmann commit 9cff126f73a7025bcb0883189b2bed90010a57d4 Author: Pablo Neira Ayuso Date: Fri Jul 5 22:59:05 2019 +0200 netfilter: nf_tables: __nft_expr_type_get() selects specific family type In case that there are two types, prefer the family specify extension. Signed-off-by: Pablo Neira Ayuso commit aa52bcbe0e72fac36b1862db08b9c09c4caefae3 Author: Jiri Olsa Date: Fri Jul 5 14:10:31 2019 +0200 tools: bpftool: Fix json dump crash on powerpc Michael reported crash with by bpf program in json mode on powerpc: # bpftool prog -p dump jited id 14 [{ "name": "0xd00000000a9aa760", "insns": [{ "pc": "0x0", "operation": "nop", "operands": [null ] },{ "pc": "0x4", "operation": "nop", "operands": [null ] },{ "pc": "0x8", "operation": "mflr", Segmentation fault (core dumped) The code is assuming char pointers in format, which is not always true at least for powerpc. Fixing this by dumping the whole string into buffer based on its format. Please note that libopcodes code does not check return values from fprintf callback, but as per Jakub suggestion returning -1 on allocation failure so we do the best effort to propagate the error. Fixes: 107f041212c1 ("tools: bpftool: add JSON output for `bpftool prog dump jited *` command") Reported-by: Michael Petlan Signed-off-by: Jiri Olsa Reviewed-by: Quentin Monnet Reviewed-by: Jakub Kicinski Signed-off-by: Daniel Borkmann commit b9c04ae7907f09c5e873e7c9a8feea2ce41e15b3 Author: Pablo Neira Ayuso Date: Fri Jul 5 23:38:46 2019 +0200 netfilter: nf_tables: add nft_expr_type_request_module() This helper function makes sure the family specific extension is loaded. Signed-off-by: Pablo Neira Ayuso commit ba95c7452439756d4f6dceb5a188b7c31dbbe5b6 Author: Quentin Monnet Date: Fri Jul 5 18:54:33 2019 +0100 tools: bpftool: add "prog run" subcommand to test-run programs Add a new "bpftool prog run" subcommand to run a loaded program on input data (and possibly with input context) passed by the user. Print output data (and output context if relevant) into a file or into the console. Print return value and duration for the test run into the console. A "repeat" argument can be passed to run the program several times in a row. The command does not perform any kind of verification based on program type (Is this program type allowed to use an input context?) or on data consistency (Can I work with empty input data?), this is left to the kernel. Example invocation: # perl -e 'print "\x0" x 14' | ./bpftool prog run \ pinned /sys/fs/bpf/sample_ret0 \ data_in - data_out - repeat 5 0000000 0000 0000 0000 0000 0000 0000 0000 | ........ ...... Return value: 0, duration (average): 260ns When one of data_in or ctx_in is "-", bpftool reads from standard input, in binary format. Other formats (JSON, hexdump) might be supported (via an optional command line keyword like "data_fmt_in") in the future if relevant, but this would require doing more parsing in bpftool. v2: - Fix argument names for function check_single_stdin(). (Yonghong) Signed-off-by: Quentin Monnet Reviewed-by: Jakub Kicinski Acked-by: Yonghong Song Signed-off-by: Daniel Borkmann commit c9b3007feca018d3f7061f5d5a14cb00766ffe9b Author: Dennis Zhou Date: Fri Jul 5 17:09:09 2019 -0400 blk-iolatency: fix STS_AGAIN handling The iolatency controller is based on rq_qos. It increments on rq_qos_throttle() and decrements on either rq_qos_cleanup() or rq_qos_done_bio(). a3fb01ba5af0 fixes the double accounting issue where blk_mq_make_request() may call both rq_qos_cleanup() and rq_qos_done_bio() on REQ_NO_WAIT. So checking STS_AGAIN prevents the double decrement. The above works upstream as the only way we can get STS_AGAIN is from blk_mq_get_request() failing. The STS_AGAIN handling isn't a real problem as bio_endio() skipping only happens on reserved tag allocation failures which can only be caused by driver bugs and already triggers WARN. However, the fix creates a not so great dependency on how STS_AGAIN can be propagated. Internally, we (Facebook) carry a patch that kills read ahead if a cgroup is io congested or a fatal signal is pending. This combined with chained bios progagate their bi_status to the parent is not already set can can cause the parent bio to not clean up properly even though it was successful. This consequently leaks the inflight counter and can hang all IOs under that blkg. To nip the adverse interaction early, this removes the rq_qos_cleanup() callback in iolatency in favor of cleaning up always on the rq_qos_done_bio() path. Fixes: a3fb01ba5af0 ("blk-iolatency: only account submitted bios") Debugged-by: Tejun Heo Debugged-by: Josef Bacik Signed-off-by: Dennis Zhou Signed-off-by: Jens Axboe commit 3e2bb60ab2b1d9371008d4a3d0b01cd28f505cb7 Author: Kevin Wang Date: Fri Jul 5 12:51:45 2019 +0800 drm/amdgpu: add mode1 (psp) reset for navi asic add mode1 (by psp) reset for navi asic. Signed-off-by: Kevin Wang Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher commit f1c1314be4297183937fc2eab994be688425e328 Author: xinhui pan Date: Thu Jul 4 10:54:58 2019 +0800 drm/amdgpu: Disable ras features on all IPs before gpu reset Perform a ras_suspend to disable ras on all IPs to workaround some ROCm stability issue. Signed-off-by: xinhui pan Acked-by: Andrey Grodzovsky Signed-off-by: Alex Deucher commit 767acabdac81ded97e8f6930bc2dabff8db1638c Author: Kevin Wang Date: Fri Jul 5 15:58:46 2019 -0500 drm/amd/powerplay: add baco smu reset function for smu11 add baco reset support for smu11. it can help gpu do asic reset when gpu recovery. Signed-off-by: Kevin Wang Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher commit e3000669a7b4b26383fad06af8f736ad3b5d161e Author: Jack Xiao Date: Wed Jul 3 11:56:07 2019 +0800 drm/amd/powerplay: increase waiting time for smu response We observed some SMU commands take more time for execution, so increase waiting time for response. Signed-off-by: Jack Xiao Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher commit 69064bbe7ecbe6e6147069368efaa869cff4eace Author: Yrjan Skrimstad Date: Thu May 30 02:08:21 2019 +0200 drm/amd/powerplay/smu7_hwmgr: replace blocking delay with non-blocking This driver currently contains a repeated 500ms blocking delay call which causes frequent major buffer underruns in PulseAudio. This patch fixes this issue by replacing the blocking delay with a non-blocking sleep call. Signed-off-by: Yrjan Skrimstad Signed-off-by: Alex Deucher commit d12c202289b07037da285299b4122fa2072eca96 Author: Fuqian Huang Date: Thu Jul 4 00:27:18 2019 +0800 drm/amdgpu: Use kmemdup rather than duplicating its implementation kmemdup is introduced to duplicate a region of memory in a neat way. Rather than kmalloc/kzalloc + memcpy, which the programmer needs to write the size twice (sometimes lead to mistakes), kmemdup improves readability, leads to smaller code and also reduce the chances of mistakes. Suggestion to use kmemdup rather than using kmalloc/kzalloc + memcpy. Reviewed-by: Christian König Reviewed-by: Emil Velikov Signed-off-by: Fuqian Huang Signed-off-by: Alex Deucher commit e232cb6ff75bbfdae86e01ada24ead7528dbebe4 Merge: c5f48c927601 1639b17c72fa Author: Daniel Borkmann Date: Fri Jul 5 22:52:26 2019 +0200 Merge branch 'bpf-libbpf-int-btf-map' Andrii Nakryiko says: ==================== This patch set implements an update to how BTF-defined maps are specified. The change is in how integer attributes, e.g., type, max_entries, map_flags, are specified: now they are captured as part of map definition struct's BTF type information (using array dimension), eliminating the need for compile-time data initialization and keeping all the metadata in one place. All existing selftests that were using BTF-defined maps are updated, along with some other selftests, that were switched to new syntax. v4->v5: - revert sample_map_ret0.c, which is loaded with iproute2 (kernel test robot); v3->v4: - add acks; - fix int -> uint type in commit message; v2->v3: - rename __int into __uint (Yonghong); v1->v2: - split bpf_helpers.h change from libbpf change (Song). ==================== Signed-off-by: Daniel Borkmann commit 1639b17c72fa7ad977ccd0ad6c673e3f7048723b Author: Andrii Nakryiko Date: Fri Jul 5 08:50:12 2019 -0700 selftests/bpf: convert legacy BPF maps to BTF-defined ones Convert selftests that were originally left out and new ones added recently to consistently use BTF-defined maps. Reported-by: kernel test robot Signed-off-by: Andrii Nakryiko Acked-by: Song Liu Acked-by: Yonghong Song Signed-off-by: Daniel Borkmann commit bc7430cc8bfb51577e466a8ca02ad87375a70bde Author: Andrii Nakryiko Date: Fri Jul 5 08:50:11 2019 -0700 selftests/bpf: convert selftests using BTF-defined maps to new syntax Convert all the existing selftests that are already using BTF-defined maps to use new syntax (with no static data initialization). Signed-off-by: Andrii Nakryiko Acked-by: Song Liu Acked-by: Yonghong Song Signed-off-by: Daniel Borkmann commit 00acd00814527a1856c92beda17475205bddaba6 Author: Andrii Nakryiko Date: Fri Jul 5 08:50:10 2019 -0700 selftests/bpf: add __uint and __type macro for BTF-defined maps Add simple __uint and __type macro that hide details of how type and integer values are captured in BTF-defined maps. Signed-off-by: Andrii Nakryiko Acked-by: Song Liu Acked-by: Yonghong Song Signed-off-by: Daniel Borkmann commit ef99b02b23ef4308057573f76750e661b5aea3e1 Author: Andrii Nakryiko Date: Fri Jul 5 08:50:09 2019 -0700 libbpf: capture value in BTF type info for BTF-defined map defs Change BTF-defined map definitions to capture compile-time integer values as part of BTF type definition, to avoid split of key/value type information and actual type/size/flags initialization for maps. Signed-off-by: Andrii Nakryiko Acked-by: Song Liu Acked-by: Yonghong Song Signed-off-by: Daniel Borkmann commit c5f48c92760115282c80136839eabdbf3183f0b9 Merge: c4cde5804d51 1bdb34274acd Author: Daniel Borkmann Date: Fri Jul 5 22:37:31 2019 +0200 Merge branch 'bpf-libbpf-link-trace' Andrii Nakryiko says: ==================== This patchset adds the following APIs to allow attaching BPF programs to tracing entities: - bpf_program__attach_perf_event for attaching to any opened perf event FD, allowing users full control; - bpf_program__attach_kprobe for attaching to kernel probes (both entry and return probes); - bpf_program__attach_uprobe for attaching to user probes (both entry/return); - bpf_program__attach_tracepoint for attaching to kernel tracepoints; - bpf_program__attach_raw_tracepoint for attaching to raw kernel tracepoint (wrapper around bpf_raw_tracepoint_open); This set of APIs makes libbpf more useful for tracing applications. All attach APIs return abstract struct bpf_link that encapsulates logic of detaching BPF program. See patch #2 for details. bpf_assoc was considered as an alternative name for this opaque "handle", but bpf_link seems to be appropriate semantically and is nice and short. Pre-patch #1 makes internal libbpf_strerror_r helper function work w/ negative error codes, lifting the burder off callers to keep track of error sign. Patch #2 adds bpf_link abstraction. Patch #3 adds attach_perf_event, which is the base for all other APIs. Patch #4 adds kprobe/uprobe APIs. Patch #5 adds tracepoint API. Patch #6 adds raw_tracepoint API. Patch #7 converts one existing test to use attach_perf_event. Patch #8 adds new kprobe/uprobe tests. Patch #9 converts some selftests currently using tracepoint to new APIs. v4->v5: - typo and small nits (Yonghong); - validate pfd in attach_perf_event (Yonghong); - parse_uint_from_file fixes (Yonghong); - check for malloc failure in attach_raw_tracepoint (Yonghong); - attach_probes selftests clean up fixes (Yonghong); v3->v4: - proper errno handling (Stanislav); - bpf_fd -> prog_fd (Stanislav); - switch to fprintf (Song); v2->v3: - added bpf_link concept (Daniel); - didn't add generic bpf_link__attach_program for reasons described in [0]; - dropped Stanislav's Reviewed-by from patches #2-#6, in case he doesn't like the change; v1->v2: - preserve errno before close() call (Stanislav); - use libbpf_perf_event_disable_and_close in selftest (Stanislav); - remove unnecessary memset (Stanislav); [0] https://lore.kernel.org/bpf/CAEf4BzZ7EM5eP2eaZn7T2Yb5QgVRiwAs+epeLR1g01TTx-6m6Q@mail.gmail.com/ ==================== Acked-by: Yonghong Song Signed-off-by: Daniel Borkmann commit 1bdb34274acd4a772865289aeaa41696acb60110 Author: Andrii Nakryiko Date: Mon Jul 1 16:59:03 2019 -0700 selftests/bpf: convert existing tracepoint tests to new APIs Convert some existing tests that attach to tracepoints to use bpf_program__attach_tracepoint API instead. Signed-off-by: Andrii Nakryiko Reviewed-by: Stanislav Fomichev Acked-by: Song Liu Signed-off-by: Daniel Borkmann commit 1e8611bbdfc99faf8c9670dbbe582129a9a29973 Author: Andrii Nakryiko Date: Mon Jul 1 16:59:02 2019 -0700 selftests/bpf: add kprobe/uprobe selftests Add tests verifying kprobe/kretprobe/uprobe/uretprobe APIs work as expected. Signed-off-by: Andrii Nakryiko Reviewed-by: Stanislav Fomichev Acked-by: Song Liu Signed-off-by: Daniel Borkmann commit 8c51b314d2eeae687bf8c28491c9f5e4f05f30f5 Author: Andrii Nakryiko Date: Mon Jul 1 16:59:01 2019 -0700 selftests/bpf: switch test to new attach_perf_event API Use new bpf_program__attach_perf_event() in test previously relying on direct ioctl manipulations. Signed-off-by: Andrii Nakryiko Reviewed-by: Stanislav Fomichev Acked-by: Song Liu Signed-off-by: Daniel Borkmann commit 84bf5e1f4f174fc4f06bc747dafa1a7cfa4e9a67 Author: Andrii Nakryiko Date: Mon Jul 1 16:59:00 2019 -0700 libbpf: add raw tracepoint attach API Add a wrapper utilizing bpf_link "infrastructure" to allow attaching BPF programs to raw tracepoints. Signed-off-by: Andrii Nakryiko Acked-by: Song Liu Reviewed-by: Stanislav Fomichev Signed-off-by: Daniel Borkmann commit f6de59c17f111b3efc701c95b438e46245c4aeb1 Author: Andrii Nakryiko Date: Mon Jul 1 16:58:59 2019 -0700 libbpf: add tracepoint attach API Allow attaching BPF programs to kernel tracepoint BPF hooks specified by category and name. Signed-off-by: Andrii Nakryiko Acked-by: Song Liu Reviewed-by: Stanislav Fomichev Signed-off-by: Daniel Borkmann commit b26500274767bacbe571c75926fee2489f91ba28 Author: Andrii Nakryiko Date: Mon Jul 1 16:58:58 2019 -0700 libbpf: add kprobe/uprobe attach API Add ability to attach to kernel and user probes and retprobes. Implementation depends on perf event support for kprobes/uprobes. Signed-off-by: Andrii Nakryiko Reviewed-by: Stanislav Fomichev Signed-off-by: Daniel Borkmann commit 63f2f5ee856ba9db751123bc5519be099a3849a7 Author: Andrii Nakryiko Date: Mon Jul 1 16:58:57 2019 -0700 libbpf: add ability to attach/detach BPF program to perf event bpf_program__attach_perf_event allows to attach BPF program to existing perf event hook, providing most generic and most low-level way to attach BPF programs. It returns struct bpf_link, which should be passed to bpf_link__destroy to detach and free resources, associated with a link. Signed-off-by: Andrii Nakryiko Reviewed-by: Stanislav Fomichev Signed-off-by: Daniel Borkmann commit 1c2e9efc26f389effc86e9b4d41f85d101f17629 Author: Andrii Nakryiko Date: Mon Jul 1 16:58:56 2019 -0700 libbpf: introduce concept of bpf_link bpf_link is an abstraction of an association of a BPF program and one of many possible BPF attachment points (hooks). This allows to have uniform interface for detaching BPF programs regardless of the nature of link and how it was created. Details of creation and setting up of a specific bpf_link is handled by corresponding attachment methods (bpf_program__attach_xxx) added in subsequent commits. Once successfully created, bpf_link has to be eventually destroyed with bpf_link__destroy(), at which point BPF program is disassociated from a hook and all the relevant resources are freed. Signed-off-by: Andrii Nakryiko Acked-by: Song Liu Reviewed-by: Stanislav Fomichev Signed-off-by: Daniel Borkmann commit d66f43666a6811bcc3e529d5a088e1bdde94ca1b Author: Andrii Nakryiko Date: Mon Jul 1 16:58:55 2019 -0700 libbpf: make libbpf_strerror_r agnostic to sign of error It's often inconvenient to switch sign of error when passing it into libbpf_strerror_r. It's better for it to handle that automatically. Signed-off-by: Andrii Nakryiko Reviewed-by: Stanislav Fomichev Acked-by: Song Liu Signed-off-by: Daniel Borkmann commit 548f7fb22234c6fe13c64459059fbd42058953c4 Author: Wanpeng Li Date: Fri Jul 5 23:23:42 2019 +0800 KVM: LAPIC: Retry tune per-vCPU timer_advance_ns if adaptive tuning goes insane Retry tune per-vCPU timer_advance_ns if adaptive tuning goes insane which can happen sporadically in product environment. Cc: Paolo Bonzini Cc: Radim Krčmář Signed-off-by: Wanpeng Li Signed-off-by: Paolo Bonzini commit 2a3a93ef0ba5166e8b5766bb232f216fd412d40b Author: wenxu Date: Fri Jul 5 21:16:37 2019 +0800 netfilter: nft_meta_bridge: Add NFT_META_BRI_IIFVPROTO support This patch allows you to match on bridge vlan protocol, eg. nft add rule bridge firewall zones counter meta ibrvproto 0x8100 Signed-off-by: wenxu Reviewed-by: Nikolay Aleksandrov Signed-off-by: Pablo Neira Ayuso commit 31aed46fedbba65abece57e14d24f00b52389c4f Author: wenxu Date: Fri Jul 5 21:16:36 2019 +0800 bridge: add br_vlan_get_proto() This new function allows you to fetch the bridge port vlan protocol. Signed-off-by: wenxu Acked-by: Nikolay Aleksandrov Signed-off-by: Pablo Neira Ayuso commit c54c7c685494fc0f1662091d4d0c4fc26e810471 Author: wenxu Date: Fri Jul 5 21:16:35 2019 +0800 netfilter: nft_meta_bridge: add NFT_META_BRI_IIFPVID support This patch allows you to match on the bridge port pvid, eg. nft add rule bridge firewall zones counter meta ibrpvid 10 Signed-off-by: wenxu Reviewed-by: Nikolay Aleksandrov Signed-off-by: Pablo Neira Ayuso commit 7582f5b70f9a2335f3713edb9a2614a50f1f1a90 Author: Pablo Neira Ayuso Date: Fri Jul 5 21:16:34 2019 +0800 bridge: add br_vlan_get_pvid_rcu() This new function allows you to fetch bridge pvid from packet path. Signed-off-by: Pablo Neira Ayuso Acked-by: Nikolay Aleksandrov commit 9d6a1ecdc99717051a4831ea9b6554dc42830dee Author: wenxu Date: Fri Jul 5 21:16:33 2019 +0800 netfilter: nft_meta_bridge: Remove the br_private.h header nft_bridge_meta should not access the bridge internal API. Signed-off-by: wenxu Reviewed-by: Nikolay Aleksandrov Signed-off-by: Pablo Neira Ayuso commit 30e103fe24debce6f35f2e53cc763ed7be292df3 Author: wenxu Date: Fri Jul 5 21:16:32 2019 +0800 netfilter: nft_meta: move bridge meta keys into nft_meta_bridge Separate bridge meta key from nft_meta to meta_bridge to avoid a dependency between the bridge module and nft_meta when using the bridge API available through include/linux/if_bridge.h Signed-off-by: wenxu Reviewed-by: Nikolay Aleksandrov Signed-off-by: Pablo Neira Ayuso commit 6aedd14b25dbcf6cfdf2da8569153d45b3e5d9fd Author: Julian Anastasov Date: Wed Jul 3 21:38:09 2019 +0300 ipvs: strip gre tunnel headers from icmp errors Recognize GRE tunnels in received ICMP errors and properly strip the tunnel headers. Signed-off-by: Julian Anastasov Signed-off-by: Pablo Neira Ayuso commit ad49d86e07a497e834cb06f2b151dccd75f8e148 Author: Fernando Fernandez Mancera Date: Wed Jun 26 12:59:19 2019 +0200 netfilter: nf_tables: Add synproxy support Add synproxy support for nf_tables. This behaves like the iptables synproxy target but it is structured in a way that allows us to propose improvements in the future. Signed-off-by: Fernando Fernandez Mancera Signed-off-by: Pablo Neira Ayuso commit 831c4f3da83e260df943dfb982d77cef5cba2c49 Author: Markus Elfring Date: Fri Jul 5 18:33:58 2019 +0200 xtensa: One function call less in bootmem_init() Avoid an extra function call by using a ternary operator instead of a conditional statement for a setting selection. This issue was detected by using the Coccinelle software. Signed-off-by: Markus Elfring Message-Id: <495c9f2e-7880-ee9a-5c61-eee598bb24c2@web.de> Signed-off-by: Max Filippov commit 998bcae4d6267f9737d758dc648851318a29ddde Author: Vasyl Gomonovych Date: Sun Jun 23 23:13:53 2019 +0200 i2c: cpm: remove casting dma_alloc Generated by: alloc_cast.cocci Signed-off-by: Vasyl Gomonovych Acked-by: Jochen Friedrich Signed-off-by: Wolfram Sang commit 0038617132dea5c0516b6208a6d005ec9293ab94 Author: Maxime Ripard Date: Wed Jul 3 11:53:38 2019 +0200 dt-bindings: i2c: sun6i-p2wi: Fix the binding example Even though the binding claims that the frequency can go up to 6MHz, the common i2c binding sets a limit at 3MHz, which then triggers a warning. Since the only SoC that uses that bus uses a frequency of 100kHz, and that this bus hasn't been found in an SoC for something like 5 years, let's just fix the example to have a frequency within the acceptable range for i2c. Signed-off-by: Maxime Ripard Acked-by: Gregory CLEMENT Reviewed-by: Rob Herring Signed-off-by: Wolfram Sang commit 166f28c3eed269190d310ec611476b78101c309b Author: Maxime Ripard Date: Wed Jul 3 11:53:37 2019 +0200 dt-bindings: i2c: mv64xxx: Fix the example compatible One example has a compatible that isn't a valid combination according to the binding, and now that the examples are validated as well, this generates a warning. Let's fix this. Signed-off-by: Maxime Ripard Acked-by: Gregory CLEMENT Reviewed-by: Rob Herring Signed-off-by: Wolfram Sang commit ed6182a83924c2385679afd5a3b9cd3d41e2ef44 Author: Jean Delvare Date: Thu Jul 4 11:34:02 2019 +0200 i2c: i801: Documentation update The i2c-i801 driver documentation needs some dusting: * Mention disable_features flag 0x20. * The i2c_ec driver has been removed from the kernel long ago. Driver i2c-scmi serves the same purpose for more recent hardware. * Replace obsolete /proc paths with equivalent /sys paths. Signed-off-by: Jean Delvare Reviewed-by: Jarkko Nikula Signed-off-by: Wolfram Sang commit 051d769f0a36b4642897d909cef980f944ae20ab Author: Jarkko Nikula Date: Mon Jul 1 16:15:34 2019 +0300 i2c: i801: Add support for Intel Tiger Lake Add SMBUS PCI ID for Intel Tiger Lake -LP. Signed-off-by: Jarkko Nikula Reviewed-by: Jean Delvare Signed-off-by: Wolfram Sang commit 856078bf642b985cbe856886d7f396b81c169ec2 Author: Jarkko Nikula Date: Mon Jul 1 16:15:33 2019 +0300 i2c: i801: Fix PCI ID sorting I managed to break sorting in PCI ID defines in my last two patches: commit 5cd1c56c42be ("i2c: i801: Add support for Intel Comet Lake") commit 9be1485accd4 ("i2c: i801: Add support for Intel Elkhart Lake") Fix them up. Signed-off-by: Jarkko Nikula Reviewed-by: Jean Delvare Signed-off-by: Wolfram Sang commit 036f463fe15db26c2d90724203e4a7ea8f9b8580 Author: Darrick J. Wong Date: Fri Jul 5 10:29:56 2019 -0700 xfs: online scrub needn't bother zeroing its temporary buffer The xattr scrubber functions use the temporary memory buffer either for storing bitmaps or for testing if attribute value extraction works. The bitmap code always zeroes what it needs and the value extraction sets the buffer contents, so it's not necessary to waste CPU time zeroing on allocation. Note that while we never read the contents that the attr value extraction function sets, we do need to call it to check the remote attribute header and CRCs to check for corruption. A flame graph analysis showed that we were spending 7% of a xfs_scrub run (the whole program, not just the attr scrubber itself) allocating and zeroing 64k segments needlessly. Signed-off-by: Darrick J. Wong Reviewed-by: Brian Foster commit 6d6ccedd76823c28115bd6925342ceb73bab6cd4 Author: Darrick J. Wong Date: Fri Jul 5 10:29:56 2019 -0700 xfs: only allocate memory for scrubbing attributes when we need it In examining a flame graph of time spent running xfs_scrub on various filesystems, I noticed that we spent nearly 7% of the total runtime on allocating a zeroed 65k buffer for every SCRUB_TYPE_XATTR invocation. We do this even if none of the attribute values were anywhere near 64k in size, even if there were no attribute blocks to check space on, and even if it just turns out there are no attributes at all. Therefore, rearrange the xattr buffer setup code to support reallocating with a bigger buffer and redistribute the callers of that function so that we only allocate memory just prior to needing it, and only allocate as much as we need. If we can't get memory with the ILOCK held we'll bail out with EDEADLOCK which will allocate the maximum memory. Signed-off-by: Darrick J. Wong Reviewed-by: Brian Foster commit 00816759337cd28bc5290a24dcb527fd9d30680e Author: Darrick J. Wong Date: Fri Jul 5 10:29:55 2019 -0700 xfs: refactor attr scrub memory allocation function Move the code that allocates memory buffers for the extended attribute scrub code into a separate function so we can reduce memory allocations in the next patch. Signed-off-by: Darrick J. Wong Reviewed-by: Brian Foster commit 3addd248800c0d278900c064e54e611ae505c622 Author: Darrick J. Wong Date: Fri Jul 5 10:29:55 2019 -0700 xfs: refactor extended attribute buffer pointer functions Replace the open-coded attribute buffer pointer calculations with helper functions to make it more obvious what we're doing with our freeform memory allocation w.r.t. either storing xattr values or computing btree block free space. Signed-off-by: Darrick J. Wong Reviewed-by: Brian Foster commit 2c3b83d7ca6d73b9478afc86c89377c15a90b9ed Author: Darrick J. Wong Date: Fri Jul 5 10:29:54 2019 -0700 xfs: attribute scrub should use seen_enough to pass error values When we're iterating all the attributes using the built-in xattr iterator, we can use the seen_enough variable to pass error codes back to the main scrub function instead of flattening them into 0/1. This will be used in a more exciting fashion in upcoming patches. Signed-off-by: Darrick J. Wong Reviewed-by: Brian Foster commit 17b92927f8531d1ceb7e4f10b75fc4b066ac77fc Author: Dmitry Torokhov Date: Sat Jun 22 23:21:24 2019 -0700 Input: edt-ft5x06 - simplify event reporting code Now that input_mt_report_slot_state() returns true if slot is active we no longer need a temporary for the slot state. Tested-by: Benoit Parrot Signed-off-by: Dmitry Torokhov commit 904e782b07df1c685fdc8c4fc8d62e1d61f9ee32 Author: Bartosz Golaszewski Date: Thu Jul 4 16:12:54 2019 -0700 Input: max77650-onkey - add MODULE_ALIAS() Define a MODULE_ALIAS() in the input sub-driver for max77650 so that the appropriate module gets loaded together with the core mfd driver. Signed-off-by: Bartosz Golaszewski Signed-off-by: Dmitry Torokhov commit f0dd687815f9546860fc3ac4379d55da045942c9 Author: Ian Ray Date: Thu Jul 4 16:13:25 2019 -0700 Input: atmel_mxt_ts - fix leak in mxt_update_cfg() Fix leak (whose magnitude is the configuration file size) when the CRCs match in mxt_update_cfg(). Signed-off-by: Ian Ray Signed-off-by: Dmitry Torokhov commit b90bab3b1b1b6c56dd6f9d5c960932239f36f6d3 Author: Wei Yongjun Date: Fri Jul 5 08:16:37 2019 +0000 ASoC: SOF: debug: fix possible memory leak in sof_dfsentry_write() 'string' is malloced in sof_dfsentry_write() and should be freed before leaving from the error handling cases, otherwise it will cause memory leak. Fixes: 091c12e1f50c ("ASoC: SOF: debug: add new debugfs entries for IPC flood test") Signed-off-by: Wei Yongjun Reviewed-by: Ranjani Sridharan Link: https://lore.kernel.org/r/20190705081637.157169-1-weiyongjun1@huawei.com Signed-off-by: Mark Brown commit 1fe08602d1179e7bfb2e805b22e8f57f4916c51e Author: Luca Weiss Date: Wed Jul 3 20:48:11 2019 +0200 ASoC: sunxi: sun50i-codec-analog: Add earpiece This adds the necessary registers and audio routes to play audio using the Earpiece, that's supported on the A64. Signed-off-by: Luca Weiss Reviewed-by: Chen-Yu Tsai Link: https://lore.kernel.org/r/20190703184814.27191-1-luca@z3ntu.xyz Signed-off-by: Mark Brown commit 590eb2f4ef94cb3f3e73345c6db4de97c9cd539e Author: Colin Ian King Date: Fri Jul 5 08:53:03 2019 +0100 ASoC: rt5665: remove redundant assignment to variable idx The variable idx is being initialized with a value that is never read and it is being updated later with a new value. The initialization is redundant and can be removed. Addresses-Coverity: ("Unused value") Signed-off-by: Colin Ian King Link: https://lore.kernel.org/r/20190705075303.14692-1-colin.king@canonical.com Signed-off-by: Mark Brown commit c150266f592bc0baf1de515ca793ef839f645fc8 Author: Srinivas Kandagatla Date: Thu Jul 4 17:54:10 2019 +0100 ASoC: wcd9335: remove multiple defines. Found during review that there are multiple defines of same constants. This patch removes them! Signed-off-by: Srinivas Kandagatla Link: https://lore.kernel.org/r/20190704165410.7173-1-srinivas.kandagatla@linaro.org Signed-off-by: Mark Brown commit e02d48eaaed77f6c36916a7aa65c451e1f9d9aab Author: Colin Ian King Date: Fri Jul 5 08:26:24 2019 +0100 btrfs: fix memory leak of path on error return path Currently if the allocation of roots or tmp_ulist fails the error handling does not free up the allocation of path causing a memory leak. Fix this and other similar leaks by moving the call of btrfs_free_path from label out to label out_free_ulist. Kudos to David Sterba for spotting the issue in my original fix and suggesting the correct way to fix the leak and Anand Jain for spotting a double free issue. Addresses-Coverity: ("Resource leak") Fixes: 5911c8fe05c5 ("btrfs: fiemap: preallocate ulists for btrfs_check_shared") Reviewed-by: Nikolay Borisov Signed-off-by: Colin Ian King Reviewed-by: David Sterba Signed-off-by: David Sterba commit 120357ea176e420d313cf8cf2ff35fbe233d3bab Author: Uenal Mutlu Date: Mon May 13 16:24:10 2019 +0200 drivers: ata: ahci_sunxi: Increased SATA/AHCI DMA TX/RX FIFOs Increasing the SATA/AHCI DMA TX/RX FIFOs (P0DMACR.TXTS and .RXTS, ie. TX_TRANSACTION_SIZE and RX_TRANSACTION_SIZE) from default 0x0 each to 0x3 each, gives a write performance boost of 120 MiB/s to 132 MiB/s from lame 36 MiB/s to 45 MiB/s previously. Read performance is above 200 MiB/s. [tested on SSD using dd bs=4K/8K/12K/16K/20K/24K/32K: peak-perf at 12K] Tested on the SBCs Banana Pi R1 (aka Lamobo R1) and Banana Pi M1 which are based on the Allwinner A20 32bit-SoC (ARMv7-a / arm-linux-gnueabihf). These devices are RaspberryPi-like small devices. This problem of slow SATA write-speed with these small devices lasts for about 7 years now (beginning with the A10 SoC). Many commentators throughout the years wrongly assumed the slow write speed was a hardware limitation. This patch finally solves the problem, which in fact was just a hard-to-find software problem due to lack of SATA/AHCI documentation by the SoC-maker Allwinner Technology. Lists of the affected sunxi and other boards and SoCs with SATA using the ahci_sunxi driver: $ grep -i -e "^&ahci" arch/arm/boot/dts/sun*dts and http://linux-sunxi.org/SATA#Devices_with_SATA_ports See also http://linux-sunxi.org/Category:Devices_with_SATA_port Tested-by: Chen-Yu Tsai Acked-by: Maxime Ripard Reviewed-by: Hans de Goede Signed-off-by: Uenal Mutlu Signed-off-by: Jens Axboe commit 7e8ab1b268b1ab2d2956823f93c7f3c62b9c2b26 Author: Leonard Crestez Date: Mon Mar 11 18:59:28 2019 +0000 PCI: imx6: Simplify Kconfig depends on The imx6 driver can be used on imx6sx without enabling support for imx6q or imx7d but the "depends on" condition doesn't allow that. Instead of making the condition even longer just make it depend on "ARCH_MXC || COMPILE_TEST" instead. Signed-off-by: Leonard Crestez Signed-off-by: Lorenzo Pieralisi Acked-by: Lucas Stach commit 732146a3f1dc78ebb0d3c4b1f4dc6ea33cc2c58f Author: Wei Yongjun Date: Fri Jul 5 17:42:13 2019 +0200 video: fbdev: imxfb: fix a typo in imxfb_probe() Fix the return value check which testing the wrong variable in imxfb_probe(). b.zolnierkie: please note that ->screen_base and ->screen_buffer are equivalent (they are part of unnamed union in struct fb_info) Fixes: 739a6439c2bf ("video: fbdev: imxfb: fix sparse warnings about using incorrect types") Signed-off-by: Wei Yongjun Cc: Sascha Hauer Cc: Pengutronix Kernel Team Cc: Shawn Guo Cc: Fabio Estevam Cc: NXP Linux Team Signed-off-by: Bartlomiej Zolnierkiewicz commit 6eaa79ff688ceb0a5e3ca2e95e8a9a133066829b Author: Gustavo A. R. Silva Date: Fri Jul 5 17:42:13 2019 +0200 video: fbdev: s3c-fb: Mark expected switch fall-throughs In preparation to enabling -Wimplicit-fallthrough, mark switch cases where we are expecting to fall through. This patch fixes the following warnings: drivers/video/fbdev/s3c-fb.c: In function ‘s3c_fb_blank’: drivers/video/fbdev/s3c-fb.c:811:16: warning: this statement may fall through [-Wimplicit-fallthrough=] sfb->enabled &= ~(1 << index); ~~~~~~~~~~~~~^~~~~~~~~~~~~~~~ drivers/video/fbdev/s3c-fb.c:814:2: note: here case FB_BLANK_NORMAL: ^~~~ LD [M] drivers/staging/greybus/gb-light.o CC [M] drivers/gpu/drm/nouveau/nvkm/subdev/secboot/gp10b.o drivers/video/fbdev/s3c-fb.c: In function ‘s3c_fb_check_var’: drivers/video/fbdev/s3c-fb.c:286:22: warning: this statement may fall through [-Wimplicit-fallthrough=] var->transp.length = 1; ~~~~~~~~~~~~~~~~~~~^~~ drivers/video/fbdev/s3c-fb.c:288:2: note: here case 18: ^~~~ drivers/video/fbdev/s3c-fb.c:314:22: warning: this statement may fall through [-Wimplicit-fallthrough=] var->transp.offset = 24; ~~~~~~~~~~~~~~~~~~~^~~~ drivers/video/fbdev/s3c-fb.c:316:2: note: here case 24: ^~~~ Warning level 3 was used: -Wimplicit-fallthrough=3 Notice that, in this particular case, the code comments are modified in accordance with what GCC is expecting to find. This patch is part of the ongoing efforts to enable -Wimplicit-fallthrough. Signed-off-by: Gustavo A. R. Silva Cc: Jingoo Han Cc: Kees Cook Signed-off-by: Bartlomiej Zolnierkiewicz commit 726be12f5ca0a9b464e7d91add512071e4c224f6 Author: Lang Cheng Date: Mon Jun 24 19:47:48 2019 +0800 RDMA/hns: Set reset flag when hw resetting When hw resetting, there is no response from hw when driver sending cmdq. If driver still send cmdq to hw, the reset process may be blocked. So reset flag should be set to intercept the cmdq command when driver receiving "notify down" signal. Signed-off-by: Lang Cheng Signed-off-by: Jason Gunthorpe commit f5662b4ddc9db20033f310694edbd3fc7041f6f2 Author: Yangyang Li Date: Mon Jun 24 19:47:47 2019 +0800 RDMA/hns: Modify ba page size for cqe Currently, the depth of cq only supports 64K. According to the UM, the depth of cq is up to 4M, Therefore the ba page size of cqe was modified to support the maximum specification of cq depth. Signed-off-by: Yangyang Li Signed-off-by: Lijun Ou Signed-off-by: Jason Gunthorpe commit 21b97f538765996ac76b3a99adf371d0da5450f9 Author: chenglang Date: Mon Jun 24 19:47:46 2019 +0800 RDMA/hns: Fixup qp release bug Hip06 reserve 12 qps, Hip08 reserve 8 qps. When the QP is released, the chip model is not judged, and the Hip08 cannot release the qpn 8~12 Signed-off-by: Lang Cheng Signed-off-by: Lijun Ou Signed-off-by: Jason Gunthorpe commit 6fafe560ee4ddb79b1c9d6c168d4f2e7eef2a037 Author: Lijun Ou Date: Mon Jun 24 19:47:45 2019 +0800 RDMA/hns: Bugfix for cleaning mtr It uses hns_roce_mtr_init in hns_roce_create_qp_common function. As a result, it should use hns_roce_mtr_cleanup function for cleaning mtr when destroying qp. Fixes: 8d18ad83f19b ("RDMA/hns: Fix bug when wqe num is larger than 16K") Signed-off-by: Xi Wang Signed-off-by: Lijun Ou Signed-off-by: Jason Gunthorpe commit a2b6f26c264e510f1d76ce347e34a21fbda9d8b2 Author: Christophe Leroy Date: Fri May 3 06:40:17 2019 +0000 powerpc/module64: Use symbolic instructions names. To increase readability/maintainability, replace hard coded instructions values by symbolic names. Signed-off-by: Christophe Leroy [mpe: Fix R_PPC64_ENTRY case, the addi reads from r2 not r12] Signed-off-by: Michael Ellerman commit 4eb4516eada3ae469cd9d97c6dbe730ad3cdf2b6 Author: Christophe Leroy Date: Fri May 3 06:40:16 2019 +0000 powerpc/module32: Use symbolic instructions names. To increase readability/maintainability, replace hard coded instructions values by symbolic names. Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman commit 7f9c929a7ff203eae60b4225bb6824c3eb31796c Author: Christophe Leroy Date: Fri May 3 06:40:15 2019 +0000 powerpc: Move PPC_HA() PPC_HI() and PPC_LO() to ppc-opcode.h PPC_HA() PPC_HI() and PPC_LO() macros are nice macros. Move them from module64.c to ppc-opcode.h in order to use them in other places. Signed-off-by: Christophe Leroy [mpe: Clean up formatting in new code, drop duplicates in ftrace.c] Signed-off-by: Michael Ellerman commit 2fb0a2c989837c976b68233496bbaefb47cd3d6f Author: Michael Ellerman Date: Sat Jul 6 00:18:53 2019 +1000 powerpc/module64: Fix comment in R_PPC64_ENTRY handling The comment here is wrong, the addi reads from r2 not r12. The code is correct, 0x38420000 = addi r2,r2,0. Fixes: a61674bdfc7c ("powerpc/module: Handle R_PPC64_ENTRY relocations") Signed-off-by: Michael Ellerman commit 4df591b20b80cb77920953812d894db259d85bd7 Author: Dexuan Cui Date: Fri Jun 21 23:45:23 2019 +0000 PCI: hv: Fix a use-after-free bug in hv_eject_device_work() Fix a use-after-free in hv_eject_device_work(). Fixes: 05f151a73ec2 ("PCI: hv: Fix a memory leak in hv_eject_device_work()") Signed-off-by: Dexuan Cui Signed-off-by: Lorenzo Pieralisi Reviewed-by: Michael Kelley Cc: stable@vger.kernel.org commit 01402cf81051f796dac7c60ca11d6147153ca46a Author: Paolo Bonzini Date: Fri Jul 5 14:57:58 2019 +0200 kvm: LAPIC: write down valid APIC registers Replace a magic 64-bit mask with a list of valid registers, computing the same mask in the end. Suggested-by: Liran Alon Signed-off-by: Paolo Bonzini commit 6e7be47a53459ba3d288c3240ccd948fc699c377 Author: Mark Zhang Date: Tue Jul 2 13:02:46 2019 +0300 RDMA/nldev: Allow get default counter statistics through RDMA netlink This patch adds the ability to return the hwstats of per-port default counters (which can also be queried through sysfs nodes). Signed-off-by: Mark Zhang Signed-off-by: Leon Romanovsky Signed-off-by: Jason Gunthorpe commit 83c2c1fcbd08ec3eb69a7f381c4e453d1a45ade3 Author: Mark Zhang Date: Tue Jul 2 13:02:45 2019 +0300 RDMA/nldev: Allow get counter mode through RDMA netlink Provide an option to get current counter mode through RDMA netlink. Signed-off-by: Mark Zhang Reviewed-by: Majd Dibbiny Signed-off-by: Leon Romanovsky Signed-off-by: Jason Gunthorpe commit b389327df90530d47931d0f5616b5cd6abb96c96 Author: Mark Zhang Date: Tue Jul 2 13:02:44 2019 +0300 RDMA/nldev: Allow counter manual mode configration through RDMA netlink Provide an option to allow users to manually bind a qp with a counter through RDMA netlink. Limit it to users with ADMIN capability only. Signed-off-by: Mark Zhang Reviewed-by: Majd Dibbiny Signed-off-by: Leon Romanovsky Signed-off-by: Jason Gunthorpe commit 1bd8e0a9d0fd1be03d2833a0c15ac676bdf275d8 Author: Mark Zhang Date: Tue Jul 2 13:02:43 2019 +0300 RDMA/counter: Allow manual mode configuration support In manual mode a QP is bound to a counter manually. If counter is not specified then a new one will be allocated. Manual mode is enabled when user binds a QP, and disabled when the last manually bound QP is unbound. When auto-mode is turned off and there are counters left, manual mode is enabled so that the user is able to access these counters. Signed-off-by: Mark Zhang Reviewed-by: Majd Dibbiny Signed-off-by: Leon Romanovsky Signed-off-by: Jason Gunthorpe commit f34a55e497e81347ffbdc6e828f123520d33ce5d Author: Mark Zhang Date: Tue Jul 2 13:02:42 2019 +0300 RDMA/core: Get sum value of all counters when perform a sysfs stat read Since a QP can only be bound to one counter, then if it is bound to a separate counter, for backward compatibility purpose, the statistic value must be: * stat of default counter + stat of all running allocated counters + stat of all deallocated counters (history stats) Signed-off-by: Mark Zhang Reviewed-by: Majd Dibbiny Signed-off-by: Leon Romanovsky Signed-off-by: Jason Gunthorpe commit 18d422ce8ccf47c65b98c2ce9e1758d84c8434eb Author: Mark Zhang Date: Tue Jul 2 13:02:41 2019 +0300 IB/mlx5: Add counter_alloc_stats() and counter_update_stats() support Add support for ib callback counter_alloc_stats() and counter_update_stats(). Signed-off-by: Mark Zhang Reviewed-by: Majd Dibbiny Signed-off-by: Leon Romanovsky Signed-off-by: Jason Gunthorpe commit c4ffee7c9bdba7b189df3251e375c4c7e93a91ac Author: Mark Zhang Date: Tue Jul 2 13:02:40 2019 +0300 RDMA/netlink: Implement counter dumpit calback This patch adds the ability to return all available counters together with their properties and hwstats. Signed-off-by: Mark Zhang Reviewed-by: Majd Dibbiny Signed-off-by: Leon Romanovsky Signed-off-by: Jason Gunthorpe commit b47ae6f803b727952dfb37afd83e51c465147b85 Author: Mark Zhang Date: Tue Jul 2 13:02:39 2019 +0300 RDMA/nldev: Allow counter auto mode configration through RDMA netlink Provide an option to enable/disable per-port counter auto mode through RDMA netlink. Limit it to users with ADMIN capability only. Signed-off-by: Mark Zhang Reviewed-by: Majd Dibbiny Signed-off-by: Leon Romanovsky Signed-off-by: Jason Gunthorpe commit 45842fc627c7f0e55ad41613b64055266c710ac7 Author: Mark Zhang Date: Tue Jul 2 13:02:38 2019 +0300 IB/mlx5: Support statistic q counter configuration Add support for ib callbacks counter_bind_qp(), counter_unbind_qp() and counter_dealloc(). Signed-off-by: Mark Zhang Reviewed-by: Majd Dibbiny Signed-off-by: Leon Romanovsky Signed-off-by: Jason Gunthorpe commit 318d535cefecf2227ab20ec6e2961f9830c96e9b Author: Mark Zhang Date: Tue Jul 2 13:02:37 2019 +0300 IB/mlx5: Add counter set id as a parameter for mlx5_ib_query_q_counters() Add counter set id as a parameter so that this API can be used for querying any q counter. Signed-off-by: Mark Zhang Reviewed-by: Majd Dibbiny Signed-off-by: Leon Romanovsky Signed-off-by: Jason Gunthorpe commit d14133dd41614aaaac1fa0505c7dab01f4211d2c Author: Mark Zhang Date: Tue Jul 2 13:02:36 2019 +0300 IB/mlx5: Support set qp counter Support bind a qp with counter. If counter is null then bind the qp to the default counter. Different QP state has different operation: - RESET: Set the counter field so that it will take effective during RST2INIT change; - RTS: Issue an RTS2RTS change to update the QP counter; - Other: Set the counter field and mark the counter_pending flag, when QP is moved to RTS state and this flag is set, then issue an RTS2RTS modification to update the counter. Signed-off-by: Mark Zhang Reviewed-by: Majd Dibbiny Acked-by: Saeed Mahameed Signed-off-by: Leon Romanovsky Signed-off-by: Jason Gunthorpe commit 99fa331dc8629be55ac7a0cca0dc56492070ddac Author: Mark Zhang Date: Tue Jul 2 13:02:35 2019 +0300 RDMA/counter: Add "auto" configuration mode support In auto mode all QPs belong to one category are bind automatically to a single counter set. Currently only "qp type" is supported. In this mode the qp counter is set in RST2INIT modification, and when a qp is destroyed the counter is unbound. Signed-off-by: Mark Zhang Reviewed-by: Majd Dibbiny Signed-off-by: Leon Romanovsky Signed-off-by: Jason Gunthorpe commit 413d3347503bc39e17577eaf16451fd492a68558 Author: Mark Zhang Date: Tue Jul 2 13:02:34 2019 +0300 RDMA/counter: Add set/clear per-port auto mode support Add an API to support set/clear per-port auto mode. Signed-off-by: Mark Zhang Reviewed-by: Majd Dibbiny Signed-off-by: Leon Romanovsky Signed-off-by: Jason Gunthorpe commit 6a6c306a09b5227d51fcc1643c888e316935dfa8 Author: Mark Zhang Date: Tue Jul 2 13:02:33 2019 +0300 RDMA/restrack: Make is_visible_in_pid_ns() as an API Remove is_visible_in_pid_ns() from nldev.c and make it as a restrack API, so that it can be taken advantage by other parts like counter. Signed-off-by: Mark Zhang Reviewed-by: Majd Dibbiny Signed-off-by: Leon Romanovsky Signed-off-by: Jason Gunthorpe commit 699a9c540a04d05aa342cd84606bc8b1e8c05b7b Author: Mark Zhang Date: Tue Jul 2 13:02:32 2019 +0300 RDMA/restrack: Add an API to attach a task to a resource Add rdma_restrack_attach_task() which is able to attach a task other then "current" to a resource. Signed-off-by: Mark Zhang Reviewed-by: Majd Dibbiny Signed-off-by: Leon Romanovsky Signed-off-by: Jason Gunthorpe commit 7ade1ff96c7aa7e10445688a433d7ae39a13c6c9 Author: Mark Zhang Date: Tue Jul 2 13:02:31 2019 +0300 RDMA/restrack: Introduce statistic counter Introduce statistic counter as a new resource. It allows a user to monitor specific objects (e.g., QPs) by binding to a counter. In some cases a user counter resource is created with task other then "current", because its creation is done as part of rdmatool call. Signed-off-by: Mark Zhang Reviewed-by: Majd Dibbiny Signed-off-by: Leon Romanovsky Signed-off-by: Jason Gunthorpe commit 5600a410ea24cb8467abdd4b8530961ff4f14907 Merge: bcde9a83b13e f8efee08dd9d Author: Jason Gunthorpe Date: Fri Jul 5 10:16:19 2019 -0300 Merge mlx5-next into rdma for-next From git://git.kernel.org/pub/scm/linux/kernel/git/mellanox/linux Required for dependencies in the next patches. * mlx5-next: net/mlx5: Add rts2rts_qp_counters_set_id field in hca cap net/mlx5: Properly name the generic WQE control field net/mlx5: Introduce TLS TX offload hardware bits and structures net/mlx5: Refactor mlx5_esw_query_functions for modularity net/mlx5: E-Switch prepare functions change handler to be modular net/mlx5: Introduce and use mlx5_eswitch_get_total_vports() commit 7be142caabc4780b13a522c485abc806de5c4114 Author: Vidya Sagar Date: Thu Jul 4 20:34:28 2019 +0530 PCI: tegra: Enable Relaxed Ordering only for Tegra20 & Tegra30 The PCI Tegra controller conversion to a device tree configurable driver in commit d1523b52bff3 ("PCI: tegra: Move PCIe driver to drivers/pci/host") implied that code for the driver can be compiled in for a kernel supporting multiple platforms. Unfortunately, a blind move of the code did not check that some of the quirks that were applied in arch/arm (eg enabling Relaxed Ordering on all PCI devices - since the quirk hook erroneously matches PCI_ANY_ID for both Vendor-ID and Device-ID) are now applied in all kernels that compile the PCI Tegra controlled driver, DT and ACPI alike. This is completely wrong, in that enablement of Relaxed Ordering is only required by default in Tegra20 platforms as described in the Tegra20 Technical Reference Manual (available at https://developer.nvidia.com/embedded/downloads#?search=tegra%202 in Section 34.1, where it is mentioned that Relaxed Ordering bit needs to be enabled in its root ports to avoid deadlock in hardware) and in the Tegra30 platforms for the same reasons (unfortunately not documented in the TRM). There is no other strict requirement on PCI devices Relaxed Ordering enablement on any other Tegra platforms or PCI host bridge driver. Fix this quite upsetting situation by limiting the vendor and device IDs to which the Relaxed Ordering quirk applies to the root ports in question, reported above. Signed-off-by: Vidya Sagar [lorenzo.pieralisi@arm.com: completely rewrote the commit log/fixes tag] Signed-off-by: Lorenzo Pieralisi Acked-by: Thierry Reding commit 4b16a8227907118e011fb396022da671a52b2272 Author: Manikanta Maddireddy Date: Tue Jun 18 23:32:06 2019 +0530 PCI: tegra: Change link retry log level to debug Driver checks for link up three times before giving up, each retry attempt is printed as an error. Letting users know that PCIe link is down and in the process of being brought up again is for debug, not an error condition. Signed-off-by: Manikanta Maddireddy Signed-off-by: Lorenzo Pieralisi Acked-by: Thierry Reding commit dbdcc22c845be72d0b930a82ca20df8c92c677b9 Author: Manikanta Maddireddy Date: Tue Jun 18 23:32:05 2019 +0530 PCI: tegra: Add support for GPIO based PERST# Tegra PCIe has fixed per port SFIO line to signal PERST#, which can be controlled by AFI port register. However, if a platform routes a different GPIO to the PCIe slot, then port register cannot control it. Add support for GPIO based PERST# signal for such platforms. GPIO number comes from per port PCIe device tree node. PCIe driver probe doesn't fail if per port "reset-gpios" property is not populated, so platforms that require this workaround must make sure that the DT property is not missed in the corresponding device tree. Link: https://lore.kernel.org/linux-pci/20190705084850.30777-1-jonathanh@nvidia.com/ Signed-off-by: Manikanta Maddireddy [lorenzo.pieralisi@arm.com: squashed in fix in Link] Signed-off-by: Lorenzo Pieralisi Acked-by: Thierry Reding commit fdec2a9ef853172529baaa192673b4cdb9a44fac Author: Dave Martin Date: Sat Apr 6 11:29:40 2019 +0100 KVM: arm64: Migrate _elx sysreg accessors to msr_s/mrs_s Currently, the {read,write}_sysreg_el*() accessors for accessing particular ELs' sysregs in the presence of VHE rely on some local hacks and define their system register encodings in a way that is inconsistent with the core definitions in . As a result, it is necessary to add duplicate definitions for any system register that already needs a definition in sysreg.h for other reasons. This is a bit of a maintenance headache, and the reasons for the _el*() accessors working the way they do is a bit historical. This patch gets rid of the shadow sysreg definitions in , converts the _el*() accessors to use the core __msr_s/__mrs_s interface, and converts all call sites to use the standard sysreg #define names (i.e., upper case, with SYS_ prefix). This patch will conflict heavily anyway, so the opportunity to clean up some bad whitespace in the context of the changes is taken. The change exposes a few system registers that have no sysreg.h definition, due to msr_s/mrs_s being used in place of msr/mrs: additions are made in order to fill in the gaps. Signed-off-by: Dave Martin Cc: Catalin Marinas Cc: Christoffer Dall Cc: Mark Rutland Cc: Will Deacon Link: https://www.spinics.net/lists/kvm-arm/msg31717.html [Rebased to v4.21-rc1] Signed-off-by: Sudeep Holla [Rebased to v5.2-rc5, changelog updates] Signed-off-by: Marc Zyngier commit 49caebe9b3e2a83161f4374ac347eb14e11c3b54 Author: Andre Przywara Date: Fri May 3 15:27:50 2019 +0100 KVM: doc: Add API documentation on the KVM_REG_ARM_WORKAROUNDS register Add documentation for the newly defined firmware registers to save and restore any vulnerability mitigation status. Signed-off-by: Andre Przywara Reviewed-by: Steven Price Signed-off-by: Marc Zyngier commit 99adb567632b656a4a54a90adb2172cc725b6896 Author: Andre Przywara Date: Fri May 3 15:27:49 2019 +0100 KVM: arm/arm64: Add save/restore support for firmware workaround state KVM implements the firmware interface for mitigating cache speculation vulnerabilities. Guests may use this interface to ensure mitigation is active. If we want to migrate such a guest to a host with a different support level for those workarounds, migration might need to fail, to ensure that critical guests don't loose their protection. Introduce a way for userland to save and restore the workarounds state. On restoring we do checks that make sure we don't downgrade our mitigation level. Signed-off-by: Andre Przywara Reviewed-by: Eric Auger Reviewed-by: Steven Price Signed-off-by: Marc Zyngier commit c118bbb52743df70e6297671606c1c08edc659fe Author: Andre Przywara Date: Fri May 3 15:27:48 2019 +0100 arm64: KVM: Propagate full Spectre v2 workaround state to KVM guests Recent commits added the explicit notion of "workaround not required" to the state of the Spectre v2 (aka. BP_HARDENING) workaround, where we just had "needed" and "unknown" before. Export this knowledge to the rest of the kernel and enhance the existing kvm_arm_harden_branch_predictor() to report this new state as well. Export this new state to guests when they use KVM's firmware interface emulation. Signed-off-by: Andre Przywara Reviewed-by: Steven Price Signed-off-by: Marc Zyngier commit 80f393a23be68e2f8a0f74258d6155438c200bbd Author: Andrew Murray Date: Mon Jun 17 20:01:05 2019 +0100 KVM: arm/arm64: Support chained PMU counters ARMv8 provides support for chained PMU counters, where an event type of 0x001E is set for odd-numbered counters, the event counter will increment by one for each overflow of the preceding even-numbered counter. Let's emulate this in KVM by creating a 64 bit perf counter when a user chains two emulated counters together. For chained events we only support generating an overflow interrupt on the high counter. We use the attributes of the low counter to determine the attributes of the perf event. Suggested-by: Marc Zyngier Signed-off-by: Andrew Murray Reviewed-by: Julien Thierry Reviewed-by: Suzuki K Poulose Signed-off-by: Marc Zyngier commit 218907cbc2b82419c70180610163c987d4764b27 Author: Andrew Murray Date: Mon Jun 17 20:01:04 2019 +0100 KVM: arm/arm64: Remove pmc->bitmask We currently use pmc->bitmask to determine the width of the pmc - however it's superfluous as the pmc index already describes if the pmc is a cycle counter or event counter. The architecture clearly describes the widths of these counters. Let's remove the bitmask to simplify the code. Signed-off-by: Andrew Murray Signed-off-by: Marc Zyngier commit 30d97754b2d1bc4fd20f27c25fed92fc7ce39ce3 Author: Andrew Murray Date: Mon Jun 17 20:01:03 2019 +0100 KVM: arm/arm64: Re-create event when setting counter value The perf event sample_period is currently set based upon the current counter value, when PMXEVTYPER is written to and the perf event is created. However the user may choose to write the type before the counter value in which case sample_period will be set incorrectly. Let's instead decouple event creation from PMXEVTYPER and (re)create the event in either suitation. Signed-off-by: Andrew Murray Reviewed-by: Julien Thierry Reviewed-by: Suzuki K Poulose Signed-off-by: Marc Zyngier commit 6f4d2a0b0b1e9a1f7594e666eebad98372901818 Author: Andrew Murray Date: Mon Jun 17 20:01:02 2019 +0100 KVM: arm/arm64: Extract duplicated code to own function Let's reduce code duplication by extracting common code to its own function. Signed-off-by: Andrew Murray Reviewed-by: Suzuki K Poulose Signed-off-by: Marc Zyngier commit 418e5ca88cc18b7e9eaafa40eac26397ccd66a71 Author: Andrew Murray Date: Mon Jun 17 20:01:01 2019 +0100 KVM: arm/arm64: Rename kvm_pmu_{enable/disable}_counter functions The kvm_pmu_{enable/disable}_counter functions can enable/disable multiple counters at once as they operate on a bitmask. Let's make this clearer by renaming the function. Suggested-by: Suzuki K Poulose Signed-off-by: Andrew Murray Reviewed-by: Julien Thierry Reviewed-by: Suzuki K Poulose Signed-off-by: Marc Zyngier commit 101628ded5d990f7f364bd4d371ada9b2beaae64 Author: Paolo Bonzini Date: Fri Jul 5 14:14:15 2019 +0200 KVM: LAPIC: ARBPRI is a reserved register for x2APIC kvm-unit-tests were adjusted to match bare metal behavior, but KVM itself was not doing what bare metal does; fix that. Signed-off-by: Paolo Bonzini commit 11b41626bd5327332f5805ad8f8580365a363067 Author: James Morse Date: Tue Jun 18 16:18:09 2019 +0100 KVM: arm64: Skip more of the SError vaxorcism During __guest_exit() we need to consume any SError left pending by the guest so it doesn't contaminate the host. With v8.2 we use the ESB-instruction. For systems without v8.2, we use dsb+isb and unmask SError. We do this on every guest exit. Use the same dsb+isr_el1 trick, this lets us know if an SError is pending after the dsb, allowing us to skip the isb and self-synchronising PSTATE write if its not. This means SError remains masked during KVM's world-switch, so any SError that occurs during this time is reported by the host, instead of causing a hyp-panic. As we're benchmarking this code lets polish the layout. If you give gcc likely()/unlikely() hints in an if() condition, it shuffles the generated assembly so that the likely case is immediately after the branch. Lets do the same here. Signed-off-by: James Morse Changes since v2: * Added isb after the dsb to prevent an early read Signed-off-by: Marc Zyngier commit dad6321ffacadbd1235faaf84897b63050b81a5f Author: James Morse Date: Tue Jun 18 16:18:08 2019 +0100 KVM: arm64: Re-mask SError after the one instruction window KVM consumes any SError that were pending during guest exit with a dsb/isb and unmasking SError. It currently leaves SError unmasked for the rest of world-switch. This means any SError that occurs during this part of world-switch will cause a hyp-panic. We'd much prefer it to remain pending until we return to the host. Signed-off-by: James Morse Signed-off-by: Marc Zyngier commit 3276cc2489641f7f37e9558f5fe9d6ae17a25528 Author: James Morse Date: Tue Jun 18 16:17:38 2019 +0100 arm64: Update silicon-errata.txt for Neoverse-N1 #1349291 Neoverse-N1 affected by #1349291 may report an Uncontained RAS Error as Unrecoverable. The kernel's architecture code already considers Unrecoverable errors as fatal as without kernel-first support no further error-handling is possible. Now that KVM attributes SError to the host/guest more precisely the host's architecture code will always handle host errors that become pending during world-switch. Errors misclassified by this errata that affected the guest will be re-injected to the guest as an implementation-defined SError, which can be uncontained. Until kernel-first support is implemented, no workaround is needed for this issue. Signed-off-by: James Morse Signed-off-by: Marc Zyngier commit 5dcd0fdbb492d49dac6bf21c436dfcb5ded0a895 Author: James Morse Date: Tue Jun 18 16:17:37 2019 +0100 KVM: arm64: Defer guest entry when an asynchronous exception is pending SError that occur during world-switch's entry to the guest will be accounted to the guest, as the exception is masked until we enter the guest... but we want to attribute the SError as precisely as possible. Reading DISR_EL1 before guest entry requires free registers, and using ESB+DISR_EL1 to consume and read back the ESR would leave KVM holding a host SError... We would rather leave the SError pending and let the host take it once we exit world-switch. To do this, we need to defer guest-entry if an SError is pending. Read the ISR to see if SError (or an IRQ) is pending. If so fake an exit. Place this check between __guest_enter()'s save of the host registers, and restore of the guest's. SError that occur between here and the eret into the guest must have affected the guest's registers, which we can naturally attribute to the guest. The dsb is needed to ensure any previous writes have been done before we read ISR_EL1. On systems without the v8.2 RAS extensions this doesn't give us anything as we can't contain errors, and the ESR bits to describe the severity are all implementation-defined. Replace this with a nop for these systems. Signed-off-by: James Morse Signed-off-by: Marc Zyngier commit 0e5b9c085dcef61163f3f277964c1a1623043f67 Author: James Morse Date: Tue Jun 18 16:17:36 2019 +0100 KVM: arm64: Consume pending SError as early as possible On systems with v8.2 we switch the 'vaxorcism' of guest SError with an alternative sequence that uses the ESB-instruction, then reads DISR_EL1. This saves the unmasking and remasking of asynchronous exceptions. We do this after we've saved the guest registers and restored the host's. Any SError that becomes pending due to this will be accounted to the guest, when it actually occurred during host-execution. Move the ESB-instruction as early as possible. Any guest SError will become pending due to this ESB-instruction and then consumed to DISR_EL1 before the host touches anything. This lets us account for host/guest SError precisely on the guest exit exception boundary. Because the ESB-instruction now lands in the preamble section of the vectors, we need to add it to the unpatched indirect vectors too, and to any sequence that may be patched in over the top. The ESB-instruction always lives in the head of the vectors, to be before any memory write. Whereas the register-store always lives in the tail. Signed-off-by: James Morse Signed-off-by: Marc Zyngier commit 5d994374e872bef1bba25c80950af6a77ea470e1 Author: James Morse Date: Tue Jun 18 16:17:35 2019 +0100 KVM: arm64: Make indirect vectors preamble behaviour symmetric The KVM indirect vectors support is a little complicated. Different CPUs may use different exception vectors for KVM that are generated at boot. Adding new instructions involves checking all the possible combinations do the right thing. To make changes here easier to review lets state what we expect of the preamble: 1. The first vector run, must always run the preamble. 2. Patching the head or tail of the vector shouldn't remove preamble instructions. Today, this is easy as we only have one instruction in the preamble. Change the unpatched tail of the indirect vector so that it always runs this, regardless of patching. Signed-off-by: James Morse Signed-off-by: Marc Zyngier commit 3dbf100b0b10e91d65bd83b91cee3ef61f1b96c4 Author: James Morse Date: Tue Jun 18 16:17:34 2019 +0100 KVM: arm64: Abstract the size of the HYP vectors pre-amble The EL2 vector hardening feature causes KVM to generate vectors for each type of CPU present in the system. The generated sequences already do some of the early guest-exit work (i.e. saving registers). To avoid duplication the generated vectors branch to the original vector just after the preamble. This size is hard coded. Adding new instructions to the HYP vector causes strange side effects, which are difficult to debug as the affected code is patched in at runtime. Add KVM_VECTOR_PREAMBLE to tell kvm_patch_vector_branch() how big the preamble is. The valid_vect macro can then validate this at build time. Reviewed-by: Julien Thierry Signed-off-by: James Morse Signed-off-by: Marc Zyngier commit 2b68a2a963a157f024c67c0697b16f5f792c8a35 Author: James Morse Date: Tue Jun 18 16:17:33 2019 +0100 arm64: assembler: Switch ESB-instruction with a vanilla nop if !ARM64_HAS_RAS The ESB-instruction is a nop on CPUs that don't implement the RAS extensions. This lets us use it in places like the vectors without having to use alternatives. If someone disables CONFIG_ARM64_RAS_EXTN, this instruction still has its RAS extensions behaviour, but we no longer read DISR_EL1 as this register does depend on alternatives. This could go wrong if we want to synchronize an SError from a KVM guest. On a CPU that has the RAS extensions, but the KConfig option was disabled, we consume the pending SError with no chance of ever reading it. Hide the ESB-instruction behind the CONFIG_ARM64_RAS_EXTN option, outputting a regular nop if the feature has been disabled. Reported-by: Julien Thierry Signed-off-by: James Morse Signed-off-by: Marc Zyngier commit 1ef23e1f16088f5a91b25bb17585c2d532a097f7 Author: Krish Sadhukhan Date: Wed Jul 3 19:54:35 2019 -0400 KVM nVMX: Check Host Segment Registers and Descriptor Tables on vmentry of nested guests According to section "Checks on Host Segment and Descriptor-Table Registers" in Intel SDM vol 3C, the following checks are performed on vmentry of nested guests: - In the selector field for each of CS, SS, DS, ES, FS, GS and TR, the RPL (bits 1:0) and the TI flag (bit 2) must be 0. - The selector fields for CS and TR cannot be 0000H. - The selector field for SS cannot be 0000H if the "host address-space size" VM-exit control is 0. - On processors that support Intel 64 architecture, the base-address fields for FS, GS and TR must contain canonical addresses. Signed-off-by: Krish Sadhukhan Reviewed-by: Karl Heubaum Signed-off-by: Paolo Bonzini commit f087a02941feacf7d6f097522bc67c602fda18e6 Author: Sean Christopherson Date: Fri Jun 7 11:55:34 2019 -0700 KVM: nVMX: Stash L1's CR3 in vmcs01.GUEST_CR3 on nested entry w/o EPT KVM does not have 100% coverage of VMX consistency checks, i.e. some checks that cause VM-Fail may only be detected by hardware during a nested VM-Entry. In such a case, KVM must restore L1's state to the pre-VM-Enter state as L2's state has already been loaded into KVM's software model. L1's CR3 and PDPTRs in particular are loaded from vmcs01.GUEST_*. But when EPT is disabled, the associated fields hold KVM's shadow values, not L1's "real" values. Fortunately, when EPT is disabled the PDPTRs come from memory, i.e. are not cached in the VMCS. Which leaves CR3 as the sole anomaly. A previously applied workaround to handle CR3 was to force nested early checks if EPT is disabled: commit 2b27924bb1d48 ("KVM: nVMX: always use early vmcs check when EPT is disabled") Forcing nested early checks is undesirable as doing so adds hundreds of cycles to every nested VM-Entry. Rather than take this performance hit, handle CR3 by overwriting vmcs01.GUEST_CR3 with L1's CR3 during nested VM-Entry when EPT is disabled *and* nested early checks are disabled. By stuffing vmcs01.GUEST_CR3, nested_vmx_restore_host_state() will naturally restore the correct vcpu->arch.cr3 from vmcs01.GUEST_CR3. These shenanigans work because nested_vmx_restore_host_state() does a full kvm_mmu_reset_context(), i.e. unloads the current MMU, which guarantees vmcs01.GUEST_CR3 will be rewritten with a new shadow CR3 prior to re-entering L1. vcpu->arch.root_mmu.root_hpa is set to INVALID_PAGE via: nested_vmx_restore_host_state() -> kvm_mmu_reset_context() -> kvm_mmu_unload() -> kvm_mmu_free_roots() kvm_mmu_unload() has WARN_ON(root_hpa != INVALID_PAGE), i.e. we can bank on 'root_hpa == INVALID_PAGE' unless the implementation of kvm_mmu_reset_context() is changed. On the way into L1, VMCS.GUEST_CR3 is guaranteed to be written (on a successful entry) via: vcpu_enter_guest() -> kvm_mmu_reload() -> kvm_mmu_load() -> kvm_mmu_load_cr3() -> vmx_set_cr3() Stuff vmcs01.GUEST_CR3 if and only if nested early checks are disabled as a "late" VM-Fail should never happen win that case (KVM WARNs), and the conditional write avoids the need to restore the correct GUEST_CR3 when nested_vmx_check_vmentry_hw() fails. Signed-off-by: Sean Christopherson Message-Id: <20190607185534.24368-1-sean.j.christopherson@intel.com> Signed-off-by: Paolo Bonzini commit 335e192a3fa415e1202c8b9ecdaaecd643f823cc Author: Paolo Bonzini Date: Mon Jul 1 06:22:57 2019 -0400 KVM: x86: add tracepoints around __direct_map and FNAME(fetch) These are useful in debugging shadow paging. Signed-off-by: Paolo Bonzini commit e9f2a760b158551bfbef6db31d2cae45ab8072e5 Author: Paolo Bonzini Date: Sun Jun 30 08:36:21 2019 -0400 KVM: x86: change kvm_mmu_page_get_gfn BUG_ON to WARN_ON Note that in such a case it is quite likely that KVM will BUG_ON in __pte_list_remove when the VM is closed. However, there is no immediate risk of memory corruption in the host so a WARN_ON is enough and it lets you gather traces for debugging. Signed-off-by: Paolo Bonzini commit d679b32611c0102ce33b9e1a4e4b94854ed1812a Author: Paolo Bonzini Date: Sun Jun 23 19:15:49 2019 +0200 KVM: x86: remove now unneeded hugepage gfn adjustment After the previous patch, the low bits of the gfn are masked in both FNAME(fetch) and __direct_map, so we do not need to clear them in transparent_hugepage_adjust. Signed-off-by: Paolo Bonzini commit 3fcf2d1bdeb6a513523cb2c77012a6b047aa859c Author: Paolo Bonzini Date: Mon Jun 24 13:06:21 2019 +0200 KVM: x86: make FNAME(fetch) and __direct_map more similar These two functions are basically doing the same thing through kvm_mmu_get_page, link_shadow_page and mmu_set_spte; yet, for historical reasons, their code looks very different. This patch tries to take the best of each and make them very similar, so that it is easy to understand changes that apply to both of them. Signed-off-by: Paolo Bonzini commit 43fdcda96e2550c6d1c46fb8a78801aa2f7276ed Author: Junaid Shahid Date: Thu Jan 3 16:22:21 2019 -0800 kvm: x86: Do not release the page inside mmu_set_spte() Release the page at the call-site where it was originally acquired. This makes the exit code cleaner for most call sites, since they do not need to duplicate code between success and the failure label. Signed-off-by: Junaid Shahid Signed-off-by: Paolo Bonzini commit 60cec433c485564bd7caac38a9df5c1ed79ee560 Author: Paolo Bonzini Date: Mon Jun 24 10:32:57 2019 +0200 KVM: cpuid: remove has_leaf_count from struct kvm_cpuid_param The has_leaf_count member was originally added for KVM's paravirtualization CPUID leaves. However, since then the leaf count _has_ been added to those leaves as well, so we can drop that special case. Signed-off-by: Paolo Bonzini commit 50a9e1a4b1dece60fd79ecdee25db01274a7f291 Author: Paolo Bonzini Date: Mon Jun 24 10:29:25 2019 +0200 KVM: cpuid: rename do_cpuid_1_ent do_cpuid_1_ent does not do the entire processing for a CPUID entry, it only retrieves the host's values. Rename it to match reality. Signed-off-by: Paolo Bonzini commit d9aadaf689928ba896529cb684729923b21c2de5 Author: Paolo Bonzini Date: Thu Jul 4 12:20:48 2019 +0200 KVM: cpuid: set struct kvm_cpuid_entry2 flags in do_cpuid_1_ent do_cpuid_1_ent is typically called in two places by __do_cpuid_func for CPUID functions that have subleafs. Both places have to set the KVM_CPUID_FLAG_SIGNIFCANT_INDEX. Set that flag, and KVM_CPUID_FLAG_STATEFUL_FUNC as well, directly in do_cpuid_1_ent. Signed-off-by: Paolo Bonzini commit 54d360d41211006437bebf97513394693bd32623 Author: Paolo Bonzini Date: Thu Jul 4 12:18:13 2019 +0200 KVM: cpuid: extract do_cpuid_7_mask and support multiple subleafs CPUID function 7 has multiple subleafs. Instead of having nested switch statements, move the logic to filter supported features to a separate function, and call it for each subleaf. Signed-off-by: Paolo Bonzini commit ab8bcf64971180e1344ce2c7e70c49b0f24f6b0d Author: Paolo Bonzini Date: Mon Jun 24 10:23:33 2019 +0200 KVM: cpuid: do_cpuid_ent works on a whole CPUID function Rename it as well as __do_cpuid_ent and __do_cpuid_ent_emulated to have "func" in its name, and drop the index parameter which is always 0. Signed-off-by: Paolo Bonzini commit 499723d12063aab97dfe6b41c822e9c1c74eff3e Author: Steffen Maier Date: Wed Jul 3 12:19:49 2019 +0200 docs: s390: s390dbf: typos and formatting, update crash command Signed-off-by: Steffen Maier Acked-by: Christian Borntraeger Message-Id: <1562149189-1417-4-git-send-email-maier@linux.ibm.com> Signed-off-by: Vasily Gorbik commit 0328e519a726ff6e4abacba838eb00415171c34b Author: Steffen Maier Date: Wed Jul 3 12:19:48 2019 +0200 docs: s390: unify and update s390dbf kdocs at debug.c For non-static-inlines, debug.c already had non-compliant function header docs. So move the pure prototype kdocs of ("s390: include/asm/debug.h add kerneldoc markups") from debug.h to debug.c and merge them with the old function docs. Also, I had the impression that kdoc typically is at the implementation in the compile unit rather than at the prototype in the header file. While at it, update the short kdoc description to distinguish the different functions. And a few more consistency cleanups. Added a new kdoc for debug_set_critical() since debug.h comments it as part of the API. Signed-off-by: Steffen Maier Acked-by: Christian Borntraeger Message-Id: <1562149189-1417-3-git-send-email-maier@linux.ibm.com> Signed-off-by: Vasily Gorbik commit f11977be1af94c6d42350fe85fa073d24ba75fac Author: Steffen Maier Date: Wed Jul 3 12:19:47 2019 +0200 docs: s390: restore important non-kdoc parts of s390dbf.rst Complements previous ("s390: include/asm/debug.h add kerneldoc markups") which seemed to have dropped important non-kdoc parts such as user space interface (level, size, flush) as well as views and caution regarding strings in the sprintf view. Signed-off-by: Steffen Maier Acked-by: Christian Borntraeger Message-Id: <1562149189-1417-2-git-send-email-maier@linux.ibm.com> Signed-off-by: Vasily Gorbik commit 555827c28a3eaf7c4b020e076eb727b9f2a96b3c Merge: 6ae3483d4116 c382cbc6dbf5 Author: Vasily Gorbik Date: Fri Jul 5 13:39:22 2019 +0200 Merge tag 'vfio-ccw-20190705' of https://git.kernel.org/pub/scm/linux/kernel/git/kvms390/vfio-ccw into features Fix a bug introduced in the refactoring. * tag 'vfio-ccw-20190705' of https://git.kernel.org/pub/scm/linux/kernel/git/kvms390/vfio-ccw: vfio-ccw: Fix the conversion of Format-0 CCWs to Format-1 Signed-off-by: Vasily Gorbik commit 388b00f045180179fedff4b108d40a0192684cda Author: Colin Ian King Date: Fri Jul 5 10:57:04 2019 +0100 ALSA: cs4281: remove redundant assignment to variable val and remove a goto The variable val is being assigned with a value that is never read and it is being updated later with a new value. The assignment is redundant and can be removed. Also remove a goto statement and a label and replace with a break statement. Addresses-Coverity: ("Unused value") Signed-off-by: Colin Ian King Signed-off-by: Takashi Iwai commit 774a075ab5140bb4504e6026bf327021926c3e65 Author: Takashi Iwai Date: Wed Jul 3 14:35:12 2019 +0200 ALSA: hda: Simplify snd_hdac_refresh_widgets() Along with the recent fix for the races of snd_hdac_refresh_widgets() it turned out that the instantiation of widgets sysfs at snd_hdac_sysfs_reinit() could cause a race. The race itself was already covered later by extending the mutex protection range, the commit 98482377dc72 ("ALSA: hda: Fix widget_mutex incomplete protection"), but this also indicated that the call of *_reinit() is basically superfluous, as the widgets shall be created sooner or later from snd_hdac_device_register(). This patch removes the redundant call of snd_hdac_sysfs_reinit() at first. By this removal, the sysfs argument itself in snd_hdac_refresh_widgets() becomes superfluous, too, because the only case sysfs=false is always with codec->widgets=NULL. So, we drop this redundant argument as well. Signed-off-by: Takashi Iwai commit 9dcb98a29b6e81394fa33ca984f3aaad4d0d1393 Author: Hook, Gary Date: Mon Jun 24 18:35:01 2019 +0000 Documentation: dmaengine: clean up description of dmatest usage Fix the formatting of the multi-channel test usage example. Call out the note about parameter ordering and add detail on the settings of parameters for the new version of dmatest. Fixes: f80f9988a26d7 ("dmaengine: Documentation: Add documentation for multi chan testing") Signed-off-by: Gary R Hook Signed-off-by: Vinod Koul commit 3145d73e69ba0ab58cb302d3e6a80232bf373b7e Author: Sameer Pujar Date: Thu Jun 20 21:24:19 2019 +0530 dmaengine: tegra210-adma: remove PM_CLK dependency Tegra ADMA does not use pm-clk interface now and hence the dependency is removed from Kconfig. Signed-off-by: Sameer Pujar Acked-by: Jon Hunter Signed-off-by: Vinod Koul commit bb26e0c636d42f9eda81b1cd863e59e42669dce7 Author: Hariprasad Kelam Date: Fri Jul 5 08:27:33 2019 +0530 ALSA: asihpi: Remove unneeded variable change this patch fixes below issue reported by coccicheck sound/pci/asihpi/asihpi.c:1558:5-11: Unneeded variable: "change". Return "1" on line 1564 Signed-off-by: Hariprasad Kelam Signed-off-by: Takashi Iwai commit 2f4281f4dce12440727ab770683cfb83eab62a26 Merge: 996cdfaf538f 2aeac95d1a4c Author: Greg Kroah-Hartman Date: Fri Jul 5 08:15:08 2019 +0200 Merge tag 'soundwire-5.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/soundwire into char-misc-next Vinod writes: soundwire updates for v5.3-rc1 Updates for 5.3 include: - module_sdw_driver macro for drivers - Documentation updates for code-blocks - Improvement from Pierre on intel and cadence driver - Clarification of DisCo properties and updates * tag 'soundwire-5.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/soundwire: soundwire: add module_sdw_driver helper macro docs: soundwire: locking: fix tags for a code-block soundwire: intel_init: add checks on link numbers soundwire: fix typo in comments soundwire: Intel: add log for number of PCM and PDM PDIs soundwire: cadence_master: check the number of bidir PDIs soundwire: cadence_master: log Slave status mask on errors soundwire: cadence_master: use rate_limited dynamic debug soundwire: rename/clarify MIPI DisCo properties soundwire: clarify comment soundwire: mipi-disco: fix clock stop modes soundwire: rename 'freq' fields soundwire: mipi-disco: remove master_count property for masters soundwire: remove master data port properties soundwire: add port-related definitions soundwire: mipi_disco: fix master/link error soundwire: intel: filter SoundWire controller device search soundwire: cdns: Fix compilation error on arm64 commit ca95c7bf3d29716916baccdc77c3c2284b703069 Author: Takashi Iwai Date: Thu Jul 4 16:31:12 2019 +0200 ALSA: usb-audio: Fix parse of UAC2 Extension Units Extension Unit (XU) is used to have a compatible layout with Processing Unit (PU) on UAC1, and the usb-audio driver code assumed it for parsing the descriptors. Meanwhile, on UAC2, XU became slightly incompatible with PU; namely, XU has a one-byte bmControls bitmap while PU has two bytes bmControls bitmap. This incompatibility results in the read of a wrong address for the last iExtension field, which ended up with an incorrect string for the mixer element name, as recently reported for Focusrite Scarlett 18i20 device. This patch corrects this misalignment by introducing a couple of new macros and calling them depending on the descriptor type. Fixes: 23caaf19b11e ("ALSA: usb-mixer: Add support for Audio Class v2.0") Reported-by: Stefan Sauer Cc: Signed-off-by: Takashi Iwai commit c382cbc6dbf513d73cf896ad43a3789ad42c2e2f Author: Eric Farman Date: Tue Jul 2 20:09:28 2019 +0200 vfio-ccw: Fix the conversion of Format-0 CCWs to Format-1 When processing Format-0 CCWs, we use the "len" variable as the number of CCWs to convert to Format-1. But that variable contains zero here, and is not a meaningful CCW count until ccwchain_calc_length() returns. Since that routine requires and expects Format-1 CCWs to identify the chaining behavior, the format conversion must be done first. Convert the 2KB we copied even if it's more than we need. Fixes: 7f8e89a8f2fd ("vfio-ccw: Factor out the ccw0-to-ccw1 transition") Reported-by: Farhan Ali Signed-off-by: Eric Farman Reviewed-by: Cornelia Huck Message-Id: <20190702180928.18113-1-farman@linux.ibm.com> Signed-off-by: Cornelia Huck commit 2bc8bb813cba6e699b29fd0b30720288866a5e5d Merge: 214cc39d175c 034252e37b31 Author: Greg Kroah-Hartman Date: Fri Jul 5 07:19:28 2019 +0200 Merge tag 'usb-ci-v5.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/peter.chen/usb into usb-next - Add imx7ulp support. - Some tiny improvements, no function change. * tag 'usb-ci-v5.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/peter.chen/usb: usb: chipidea: msm: Use devm_platform_ioremap_resource() usb: chipidea: imx: Use devm_platform_ioremap_resource() usb: chipidea: Use dev_err() instead of pr_err() usb: chipidea: imx: "fsl,usbphy" phandle is not mandatory now usb: chipidea: imx: add imx7ulp support commit 037f11b4752f717201143a1dc5d6acf3cb71ddfa Author: Al Viro Date: Sat Jun 1 18:09:44 2019 -0400 mnt_init(): call shmem_init() unconditionally No point having two call sites (earlier in init_rootfs() from mnt_init() in case we are going to use shmem-style rootfs, later from do_basic_setup() unconditionally), along with the logics in shmem_init() itself to make the second call a no-op... Signed-off-by: Al Viro commit 33488845f211afcdb7e5c00a3152890e06cdc78e Author: Al Viro Date: Fri May 31 20:09:15 2019 -0400 constify ksys_mount() string arguments Signed-off-by: Al Viro commit fd3e007f6c6a0f677e4ee8aca4b9bab8ad6cab9a Author: Al Viro Date: Thu May 30 17:48:35 2019 -0400 don't bother with registering rootfs init_mount_tree() can get to rootfs_fs_type directly and that simplifies a lot of things. We don't need to register it, we don't need to look it up *and* we don't need to bother with preventing subsequent userland mounts. That's the way we should've done that from the very beginning. There is a user-visible change, namely the disappearance of "rootfs" from /proc/filesystems. Note that it's been unmountable all along and it didn't show up in /proc/mounts; however, it *is* a user-visible change and theoretically some script might've been using its presence in /proc/filesystems to tell 2.4.11+ from earlier kernels. *IF* any complaints about behaviour change do show up, we could fake it in /proc/filesystems. I very much doubt we'll have to, though. Signed-off-by: Al Viro commit 14a253ce4210cd2ef133b392062477e9d656db4a Author: Al Viro Date: Thu May 30 15:59:57 2019 -0400 init_rootfs(): don't bother with init_ramfs_fs() the only thing done by the latter is making ramfs visible to mount(2); we don't need it there - rootfs is separate and, in fact, made visible to mount(2) in the same init_rootfs(). Signed-off-by: Al Viro commit 5afdd0f1e6a7e56264fd933065884a7903375106 Author: David Howells Date: Mon Mar 25 16:38:31 2019 +0000 vfs: Convert smackfs to use the new mount API Convert the smackfs filesystem to the new internal mount API as the old one will be obsoleted and removed. This allows greater flexibility in communication of mount parameters between userspace, the VFS and the filesystem. See Documentation/filesystems/mount_api.txt for more information. Signed-off-by: David Howells cc: Casey Schaufler cc: linux-security-module@vger.kernel.org Signed-off-by: Al Viro commit 920f50b2a44bbc5e332a3f84f7ad4040ee62fcc6 Author: David Howells Date: Mon Mar 25 16:38:30 2019 +0000 vfs: Convert selinuxfs to use the new mount API Convert the selinuxfs filesystem to the new internal mount API as the old one will be obsoleted and removed. This allows greater flexibility in communication of mount parameters between userspace, the VFS and the filesystem. See Documentation/filesystems/mount_api.txt for more information. Signed-off-by: David Howells cc: Paul Moore cc: Stephen Smalley cc: Eric Paris cc: selinux@vger.kernel.org cc: linux-security-module@vger.kernel.org Signed-off-by: Al Viro commit 5c86d7e0433acb6f5d5f3cc2adf8ea3f6bc6bbda Author: David Howells Date: Mon Mar 25 16:38:30 2019 +0000 vfs: Convert securityfs to use the new mount API Convert the securityfs filesystem to the new internal mount API as the old one will be obsoleted and removed. This allows greater flexibility in communication of mount parameters between userspace, the VFS and the filesystem. See Documentation/filesystems/mount_api.txt for more information. Signed-off-by: David Howells cc: linux-security-module@vger.kernel.org Signed-off-by: Al Viro commit b0ecc9da5ff64b59c810d1e9c82d06488805da77 Author: David Howells Date: Mon Mar 25 16:38:30 2019 +0000 vfs: Convert apparmorfs to use the new mount API Convert the apparmorfs filesystem to the new internal mount API as the old one will be obsoleted and removed. This allows greater flexibility in communication of mount parameters between userspace, the VFS and the filesystem. See Documentation/filesystems/mount_api.txt for more information. Signed-off-by: David Howells cc: John Johansen cc: apparmor@lists.ubuntu.com cc: linux-security-module@vger.kernel.org Signed-off-by: Al Viro commit 7ab2fa7693c3f0ce8445fd4e9e4e58e34e6a2213 Author: David Howells Date: Mon Mar 25 16:38:30 2019 +0000 vfs: Convert openpromfs to use the new mount API Convert the openpromfs filesystem to the new internal mount API as the old one will be obsoleted and removed. This allows greater flexibility in communication of mount parameters between userspace, the VFS and the filesystem. See Documentation/filesystems/mount_api.txt for more information. Signed-off-by: David Howells Signed-off-by: Al Viro commit 2345771f87dfd53c1c38a64be1638658ef31f460 Author: David Howells Date: Mon Mar 25 16:38:30 2019 +0000 vfs: Convert xenfs to use the new mount API Convert the xenfs filesystem to the new internal mount API as the old one will be obsoleted and removed. This allows greater flexibility in communication of mount parameters between userspace, the VFS and the filesystem. See Documentation/filesystems/mount_api.txt for more information. Signed-off-by: David Howells Reviewed-by: Juergen Gross cc: Boris Ostrovsky cc: Stefano Stabellini cc: xen-devel@lists.xenproject.org Signed-off-by: Al Viro commit e5d82a7360d124ae1a38c2a5eac92ba49b125191 Author: David Howells Date: Mon Mar 25 16:38:30 2019 +0000 vfs: Convert gadgetfs to use the new mount API Convert the gadgetfs filesystem to the new internal mount API as the old one will be obsoleted and removed. This allows greater flexibility in communication of mount parameters between userspace, the VFS and the filesystem. See Documentation/filesystems/mount_api.txt for more information. Signed-off-by: David Howells Acked-by: Felipe Balbi cc: linux-usb@vger.kernel.org Signed-off-by: Al Viro commit c6a2c720d206d37e67e533af898c45d62fb07505 Author: David Howells Date: Mon Mar 25 16:38:30 2019 +0000 vfs: Convert oprofilefs to use the new mount API Convert the oprofilefs filesystem to the new internal mount API as the old one will be obsoleted and removed. This allows greater flexibility in communication of mount parameters between userspace, the VFS and the filesystem. See Documentation/filesystems/mount_api.txt for more information. Signed-off-by: David Howells cc: Robert Richter cc: oprofile-list@lists.sf.net Signed-off-by: Al Viro commit 129f809d2aa9c02cd1ab9714b265d828db3691ec Author: David Howells Date: Mon Mar 25 16:38:29 2019 +0000 vfs: Convert ibmasmfs to use the new mount API Convert the ibmasmfs filesystem to the new internal mount API as the old one will be obsoleted and removed. This allows greater flexibility in communication of mount parameters between userspace, the VFS and the filesystem. See Documentation/filesystems/mount_api.txt for more information. Signed-off-by: David Howells cc: Arnd Bergmann cc: Greg Kroah-Hartman Signed-off-by: Al Viro commit 7515c22cc8c80b241b7317fb17d853691dab0221 Author: David Howells Date: Mon Mar 25 16:38:29 2019 +0000 vfs: Convert qib_fs/ipathfs to use the new mount API Convert the qib_fs/ipathfs filesystem to the new internal mount API as the old one will be obsoleted and removed. This allows greater flexibility in communication of mount parameters between userspace, the VFS and the filesystem. See Documentation/filesystems/mount_api.txt for more information. [Q] Can qib_remove() race with qibfs_kill_super()? Should qib_super accesses be serialised with some sort of lock? [A] yes, it can and no, that's not the right solution. See vfs.git #qibfs for an old attempt to handle that cleanly. Infiniband folks were not interested... Signed-off-by: David Howells Reviewed-by: Dennis Dalessandro cc: Mike Marciniszyn cc: linux-rdma@vger.kernel.org Signed-off-by: Al Viro commit 4799974555de565df0d0aca86c15bbea70105a19 Author: David Howells Date: Mon Mar 25 16:38:29 2019 +0000 vfs: Convert efivarfs to use the new mount API Convert the efivarfs filesystem to the new internal mount API as the old one will be obsoleted and removed. This allows greater flexibility in communication of mount parameters between userspace, the VFS and the filesystem. [AV: get rid of efivarfs_sb nonsense - it has never been used] See Documentation/filesystems/mount_api.txt for more information. Signed-off-by: David Howells cc: Matthew Garrett cc: Jeremy Kerr cc: Ard Biesheuvel cc: linux-efi@vger.kernel.org Signed-off-by: Al Viro commit 6bc62f2067d30f90621c42a2794c2515eff7bf11 Author: David Howells Date: Mon Mar 25 16:38:29 2019 +0000 vfs: Convert configfs to use the new mount API Convert the configfs filesystem to the new internal mount API as the old one will be obsoleted and removed. This allows greater flexibility in communication of mount parameters between userspace, the VFS and the filesystem. See Documentation/filesystems/mount_api.txt for more information. Signed-off-by: David Howells cc: Joel Becker cc: Christoph Hellwig Signed-off-by: Al Viro commit bc99a664e9be24e49e09da1250ede0c598d958d1 Author: David Howells Date: Mon Mar 25 16:38:28 2019 +0000 vfs: Convert binfmt_misc to use the new mount API Convert the binfmt_misc filesystem to the new internal mount API as the old one will be obsoleted and removed. This allows greater flexibility in communication of mount parameters between userspace, the VFS and the filesystem. See Documentation/filesystems/mount_api.txt for more information. Signed-off-by: David Howells cc: Alexander Viro cc: linux-fsdevel@vger.kernel.org Signed-off-by: Al Viro commit c23a0bbab30cc1714b6b1d6a1c153a5ccab3f0d8 Author: Al Viro Date: Wed May 22 21:23:39 2019 -0400 convenience helper: get_tree_single() counterpart of mount_single(); switch fusectl to it Signed-off-by: Al Viro commit 2ac295d4f0c095310addbcb03d91d2a4c9f7d435 Author: Al Viro Date: Sat Jun 1 20:48:55 2019 -0400 convenience helper get_tree_nodev() counterpart of mount_nodev(). Switch hugetlb and pseudo to it. Signed-off-by: Al Viro commit 371b86897d0125738cdb9dc76d16f12bcabdef9d Author: Liguang Zhang Date: Tue Jun 25 13:15:28 2019 +0800 ACPI / APEI: Remove needless __ghes_check_estatus() calls Function __ghes_check_estatus() is always called after __ghes_peek_estatus(), but it is already called in __ghes_peek_estatus(). So we should remove some needless __ghes_check_estatus() calls. Signed-off-by: Liguang Zhang Reviewed-by: James Morse Signed-off-by: Rafael J. Wysocki commit e4e59906cfe4e215a4360962bedb3d6e5cca5158 Author: Al Viro Date: Sat Jun 29 12:58:42 2019 -0400 fs/namespace.c: shift put_mountpoint() to callers of unhash_mnt() make unhash_mnt() return the mountpoint to be dropped, let callers deal with it. Signed-off-by: Al Viro commit adc9b5c09129fd8df17d83ca9a5b0532632a1b77 Author: Al Viro Date: Sat Jun 29 12:06:51 2019 -0400 __detach_mounts(): lookup_mountpoint() can't return ERR_PTR() anymore ... not since 1e9c75fb9c47 ("mnt: fix __detach_mounts infinite loop") Signed-off-by: Al Viro commit 1cfb7072c1cc07d3000d3185b8ae8219d520a9b0 Author: Al Viro Date: Fri Jun 28 00:44:02 2019 -0400 nfs: dget_parent() never returns NULL Signed-off-by: Al Viro commit 516162b92d1b72995ce796b98bb8c7992d9f5b5f Author: Al Viro Date: Thu Jun 27 22:25:23 2019 -0400 ceph: don't open-code the check for dead lockref Signed-off-by: Al Viro commit 3f57fe28f84d636ca6238f33afe8b88d27c34d1b Author: Nick Crews Date: Wed May 8 14:38:25 2019 -0600 power_supply: wilco_ec: Add charging config driver Add a driver to control the charging algorithm used on Wilco devices. See Documentation/ABI/testing/sysfs-class-power-wilco for the userspace interface and other info. Signed-off-by: Nick Crews Reviewed-by: Enric Balletbo i Serra Signed-off-by: Sebastian Reichel commit 1e10694d535fd1158c4ff16a841c23400af4d01e Merge: 2ffb500d824b 0c0b7ea23aed Author: Sebastian Reichel Date: Fri Jul 5 00:54:27 2019 +0200 Merge tag 'tags/ib-chrome-psy-5.3' into psy-next Immutable branch between Power Supply and Chrome Platform due for the v5.3 merge window Signed-off-by: Sebastian Reichel commit 8338d93788950e63d12bd1d5eb09e239550e80e9 Author: Shay Agroskin Date: Tue Jul 2 23:55:11 2019 +0000 net/mlx5: Added devlink info callback The callback is invoked using 'devlink dev info ' command and returns the running and pending firmware version of the HCA and the name of the kernel driver. If there is a pending firmware version (a new version is burned but the HCA still runs with the previous) it is returned as the stored firmware version. Otherwise, the running version is returned for this field. Output example: $ devlink dev info pci/0000:00:06.0 pci/0000:00:06.0: driver mlx5_core versions: fixed: fw.psid MT_0000000009 running: fw.version 16.26.0100 stored: fw.version 16.26.0100 Signed-off-by: Shay Agroskin Reviewed-by: Jakub Kicinski Signed-off-by: Saeed Mahameed commit 9c86b07e306979de852423dd11135173caeab138 Author: Shay Agroskin Date: Tue Jul 2 23:55:09 2019 +0000 net/mlx5: Added fw version query command Using the MCQI and MCQS registers, we query the running and pending fw version of the HCA. The MCQS is queried with sequentially increasing component index, until a component of type BOOT_IMG is found. Querying this component's version using the MCQI register yields the running and pending fw version of the HCA. Querying MCQI for the pending fw version should be done only after validating that such fw version exists. This is done my checking 'component update state' field in MCQS output. Signed-off-by: Shay Agroskin Reviewed-by: Jakub Kicinski Signed-off-by: Saeed Mahameed commit e08a976a16cafc20931db1d17aed9183202bfa8d Merge: e2c746944e26 f8efee08dd9d Author: Saeed Mahameed Date: Thu Jul 4 16:40:32 2019 -0400 Merge branch 'mlx5-next' of git://git.kernel.org/pub/scm/linux/kernel/git/mellanox/linux Misc updates from mlx5-next branch: 1) Add the required HW definitions and structures for upcoming TLS support. 2) Add support for MCQI and MCQS hardware registers for fw version query. 3) Added hardware bits and structures definitions for sub-functions 4) Small code cleanup and improvement for PF pci driver. 5) Bluefield (ECPF) updates and refactoring for better E-Switch management on ECPF embedded CPU NIC: 5.1) Consolidate querying eswitch number of VFs 5.2) Register event handler at the correct E-Switch init stage 5.3) Setup PF's inline mode and vlan pop when the ECPF is the E-Swtich manager ( the host PF is basically a VF ). 5.4) Handle Vport UC address changes in switchdev mode. 6) Cleanup the rep and netdev reference when unloading IB rep. Signed-off-by: Saeed Mahameed i# All conflicts fixed but you are still merging. commit c4cde5804d512a2f8934017dbf7df642dfbdf2ad Merge: e2c746944e26 e5a3e259ef23 Author: David S. Miller Date: Thu Jul 4 12:48:21 2019 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next Daniel Borkmann says: ==================== pull-request: bpf-next 2019-07-03 The following pull-request contains BPF updates for your *net-next* tree. There is a minor merge conflict in mlx5 due to 8960b38932be ("linux/dim: Rename externally used net_dim members") which has been pulled into your tree in the meantime, but resolution seems not that bad ... getting current bpf-next out now before there's coming more on mlx5. ;) I'm Cc'ing Saeed just so he's aware of the resolution below: ** First conflict in drivers/net/ethernet/mellanox/mlx5/core/en_main.c: <<<<<<< HEAD static int mlx5e_open_cq(struct mlx5e_channel *c, struct dim_cq_moder moder, struct mlx5e_cq_param *param, struct mlx5e_cq *cq) ======= int mlx5e_open_cq(struct mlx5e_channel *c, struct net_dim_cq_moder moder, struct mlx5e_cq_param *param, struct mlx5e_cq *cq) >>>>>>> e5a3e259ef239f443951d401db10db7d426c9497 Resolution is to take the second chunk and rename net_dim_cq_moder into dim_cq_moder. Also the signature for mlx5e_open_cq() in ... drivers/net/ethernet/mellanox/mlx5/core/en.h +977 ... and in mlx5e_open_xsk() ... drivers/net/ethernet/mellanox/mlx5/core/en/xsk/setup.c +64 ... needs the same rename from net_dim_cq_moder into dim_cq_moder. ** Second conflict in drivers/net/ethernet/mellanox/mlx5/core/en_main.c: <<<<<<< HEAD int cpu = cpumask_first(mlx5_comp_irq_get_affinity_mask(priv->mdev, ix)); struct dim_cq_moder icocq_moder = {0, 0}; struct net_device *netdev = priv->netdev; struct mlx5e_channel *c; unsigned int irq; ======= struct net_dim_cq_moder icocq_moder = {0, 0}; >>>>>>> e5a3e259ef239f443951d401db10db7d426c9497 Take the second chunk and rename net_dim_cq_moder into dim_cq_moder as well. Let me know if you run into any issues. Anyway, the main changes are: 1) Long-awaited AF_XDP support for mlx5e driver, from Maxim. 2) Addition of two new per-cgroup BPF hooks for getsockopt and setsockopt along with a new sockopt program type which allows more fine-grained pass/reject settings for containers. Also add a sock_ops callback that can be selectively enabled on a per-socket basis and is executed for every RTT to help tracking TCP statistics, both features from Stanislav. 3) Follow-up fix from loops in precision tracking which was not propagating precision marks and as a result verifier assumed that some branches were not taken and therefore wrongly removed as dead code, from Alexei. 4) Fix BPF cgroup release synchronization race which could lead to a double-free if a leaf's cgroup_bpf object is released and a new BPF program is attached to the one of ancestor cgroups in parallel, from Roman. 5) Support for bulking XDP_TX on veth devices which improves performance in some cases by around 9%, from Toshiaki. 6) Allow for lookups into BPF devmap and improve feedback when calling into bpf_redirect_map() as lookup is now performed right away in the helper itself, from Toke. 7) Add support for fq's Earliest Departure Time to the Host Bandwidth Manager (HBM) sample BPF program, from Lawrence. 8) Various cleanups and minor fixes all over the place from many others. ==================== Signed-off-by: David S. Miller commit e2c746944e26609f63661cedb7c7c31f0578c58f Author: René van Dorst Date: Wed Jul 3 20:42:04 2019 +0200 net: ethernet: mediatek: Fix overlapping capability bits. Both MTK_TRGMII_MT7621_CLK and MTK_PATH_BIT are defined as bit 10. This can causes issues on non-MT7621 devices which has the MTK_PATH_BIT(MTK_ETH_PATH_GMAC1_RGMII) and MTK_TRGMII capability set. The wrong TRGMII setup code can be executed. The current wrongly executed code doesn’t do any harm on MT7623 and the TRGMII setup for the MT7623 SOC side is done in MT7530 driver So it wasn’t noticed in the test. Move all capability bits in one enum so that they are all unique and easy to expand in the future. Because mtk_eth_path enum is merged in to mkt_eth_capabilities, the variable path value is no longer between 0 to number of paths, mtk_eth_path_name can’t be used anymore in this form. Convert the mtk_eth_path_name array to a function to lookup the pathname. The old code walked thru the mtk_eth_path enum, which is also merged with mkt_eth_capabilities. Expand array mtk_eth_muxc so it can store the name and capability bit of the mux. Convert the code so it can walk thru the mtk_eth_muxc array. Fixes: 8efaa653a8a5 ("net: ethernet: mediatek: Add MT7621 TRGMII mode support") Signed-off-by: René van Dorst v1->v2: - Move all capability bits in one enum, suggested by Willem de Bruijn - Convert the mtk_eth_path_name array to a function to lookup the pathname - Expand array mtk_eth_muxc so it can also store the name and capability bit of the mux - Updated commit message Signed-off-by: David S. Miller commit c3efed5ad1b05cf825aa9d5a9068d9f41cb17139 Author: Weifeng Voon Date: Thu Jul 4 00:59:10 2019 +0800 net: stmmac: Enable dwmac4 jumbo frame more than 8KiB Enable GMAC v4.xx and beyond to support 16KiB buffer. Signed-off-by: Weifeng Voon Signed-off-by: Ong Boon Leong Signed-off-by: David S. Miller commit 07a4ddec3ce9b0a533b5f90f582f1057390d5e63 Author: Vincent Bernat Date: Tue Jul 2 19:43:54 2019 +0200 bonding: add an option to specify a delay between peer notifications Currently, gratuitous ARP/ND packets are sent every `miimon' milliseconds. This commit allows a user to specify a custom delay through a new option, `peer_notif_delay'. Like for `updelay' and `downdelay', this delay should be a multiple of `miimon' to avoid managing an additional work queue. The configuration logic is copied from `updelay' and `downdelay'. However, the default value cannot be set using a module parameter: Netlink or sysfs should be used to configure this feature. When setting `miimon' to 100 and `peer_notif_delay' to 500, we can observe the 500 ms delay is respected: 20:30:19.354693 ARP, Request who-has 203.0.113.10 tell 203.0.113.10, length 28 20:30:19.874892 ARP, Request who-has 203.0.113.10 tell 203.0.113.10, length 28 20:30:20.394919 ARP, Request who-has 203.0.113.10 tell 203.0.113.10, length 28 20:30:20.914963 ARP, Request who-has 203.0.113.10 tell 203.0.113.10, length 28 In bond_mii_monitor(), I have tried to keep the lock logic readable. The change is due to the fact we cannot rely on a notification to lower the value of `bond->send_peer_notif' as `NETDEV_NOTIFY_PEERS' is only triggered once every N times, while we need to decrement the counter each time. iproute2 also needs to be updated to be able to specify this new attribute through `ip link'. Signed-off-by: Vincent Bernat Signed-off-by: David S. Miller commit 2368a870d6408d8a834ebb2b9f1576144c96a78f Author: Colin Ian King Date: Thu Jul 4 13:36:51 2019 +0100 net: ethernet: sun: remove redundant assignment to variable err The variable err is being assigned with a value that is never read and it is being updated in the next statement with a new value. The assignment is redundant and can be removed. Addresses-Coverity: ("Unused value") Signed-off-by: Colin Ian King Signed-off-by: David S. Miller commit f8efee08dd9d41ab71010e9b16c9ead51753b7d6 Author: Mark Zhang Date: Tue Jul 2 13:02:30 2019 +0300 net/mlx5: Add rts2rts_qp_counters_set_id field in hca cap Add rts2rts_qp_counters_set_id field in hca cap so that RTS2RTS qp modification can be used to change the counter of a QP. Signed-off-by: Mark Zhang Reviewed-by: Majd Dibbiny Acked-by: Saeed Mahameed Signed-off-by: Leon Romanovsky commit f1d72c55d94e6ae2f612043f2117b6ad1c82e137 Author: YueHaibing Date: Thu Jul 4 14:46:49 2019 +0800 remoteproc: qcom: q6v5-mss: Fix build error without QCOM_MDT_LOADER If QCOM_Q6V5_MSS is set but QCOM_MDT_LOADER is not, building will fails: drivers/remoteproc/qcom_q6v5_mss.o: In function `q6v5_start': qcom_q6v5_mss.c:(.text+0x3260): undefined reference to `qcom_mdt_read_metadata' Add QCOM_MDT_LOADER dependency for QCOM_Q6V5_MSS. Reported-by: Hulk Robot Fixes: f04b91383456 ("remoteproc: qcom: q6v5-mss: Support loading non-split images") Signed-off-by: YueHaibing Signed-off-by: Bjorn Andersson commit bcde9a83b13ede042fd76e4cf0b759b6d6c0abe9 Author: Daniel Kranzdorf Date: Sun Jun 30 17:53:02 2019 +0300 RDMA/efa: Entropy in admin commands id Make admin commands id easier to distinguish by using relevant bits from the producer counter. This allows us to differentiate admin commands with the same producer index (happens after admin queue overlap), which is helpful when debugging. Signed-off-by: Daniel Kranzdorf Reviewed-by: Firas JahJah Reviewed-by: Yossi Leybovich Signed-off-by: Gal Pressman Signed-off-by: Jason Gunthorpe commit 91b01061fef9c57d2f5b712a6322ef51061f4efd Author: Valentine Fatiev Date: Sun Jun 30 16:48:41 2019 +0300 IB/ipoib: Add child to parent list only if device initialized Despite failure in ipoib_dev_init() we continue with initialization flow and creation of child device. It causes to the situation where this child device is added too early to parent device list. Change the logic, so in case of failure we properly return error from ipoib_dev_init() and add child only in success path. Fixes: eaeb39842508 ("IB/ipoib: Move init code to ndo_init") Signed-off-by: Valentine Fatiev Reviewed-by: Feras Daoud Signed-off-by: Leon Romanovsky Reviewed-by: Jason Gunthorpe Signed-off-by: Jason Gunthorpe commit 50ba3c18a4e549ba6a5a4672dfb3eb30fcb7d570 Author: Leon Romanovsky Date: Sun Jun 30 18:48:32 2019 +0300 RDMA/mlx5: Use proper allocation API to get zeroed memory There is no need in custom memory zeroing, because it can be done by using kzalloc from the beginning. Signed-off-by: Leon Romanovsky Reviewed-by: Jason Gunthorpe Signed-off-by: Jason Gunthorpe commit 0bddcff628db5f516b046019b31f2430e7a8eaba Author: Colin Ian King Date: Thu Jul 4 13:50:27 2019 +0100 RDMA/uverbs: remove redundant assignment to variable ret The variable ret is being initialized with a value that is never read and it is being updated later with a new value. The initialization is redundant and can be removed. Addresses-Coverity: ("Unused value") Signed-off-by: Colin Ian King Reviewed-by: Jason Gunthorpe Signed-off-by: Jason Gunthorpe commit 9a601fc43ee0157a2575fe81beffe653c25edcd6 Author: Lijun Ou Date: Thu Jul 4 14:22:58 2019 +0800 RDMA/hns: Fix building modular hns The patch below wasn't fully tested for all combinations of module and configs, and causes a compile failure: WARNING: modpost: missing MODULE_LICENSE() in drivers/infiniband/hw/hns/hns_roce_ah.o see include/linux/module.h for more information WARNING: modpost: missing MODULE_LICENSE() in drivers/infiniband/hw/hns/hns_roce_alloc.o see include/linux/module.h for more information WARNING: modpost: missing MODULE_LICENSE() in drivers/infiniband/hw/hns/hns_roce_cmd.o see include/linux/module.h for more information WARNING: modpost: missing MODULE_LICENSE() in drivers/infiniband/hw/hns/hns_roce_cq.o see include/linux/module.h for more information WARNING: modpost: missing MODULE_LICENSE() in drivers/infiniband/hw/hns/hns_roce_db.o see include/linux/module.h for more information WARNING: modpost: missing MODULE_LICENSE() in drivers/infiniband/hw/hns/hns_roce_hem.o see include/linux/module.h for more information WARNING: modpost: missing MODULE_LICENSE() in drivers/infiniband/hw/hns/hns_roce_mr.o see include/linux/module.h for more information WARNING: modpost: missing MODULE_LICENSE() in drivers/infiniband/hw/hns/hns_roce_pd.o see include/linux/module.h for more information WARNING: modpost: missing MODULE_LICENSE() in drivers/infiniband/hw/hns/hns_roce_qp.o see include/linux/module.h for more information WARNING: modpost: missing MODULE_LICENSE() in drivers/infiniband/hw/hns/hns_roce_restrack.o see include/linux/module.h for more information WARNING: modpost: missing MODULE_LICENSE() in drivers/infiniband/hw/hns/hns_roce_srq.o see include/linux/module.h for more information ERROR: "hns_roce_bitmap_cleanup" [drivers/infiniband/hw/hns/hns_roce_srq.ko] undefined! ERROR: "hns_roce_bitmap_init" [drivers/infiniband/hw/hns/hns_roce_srq.ko] undefined! ERROR: "hns_roce_free_cmd_mailbox" [drivers/infiniband/hw/hns/hns_roce_srq.ko] undefined! ERROR: "hns_roce_alloc_cmd_mailbox" [drivers/infiniband/hw/hns/hns_roce_srq.ko] undefined! ERROR: "hns_roce_table_get" [drivers/infiniband/hw/hns/hns_roce_srq.ko] undefined! ERROR: "hns_roce_bitmap_alloc" [drivers/infiniband/hw/hns/hns_roce_srq.ko] undefined! ERROR: "hns_roce_table_find" [drivers/infiniband/hw/hns/hns_roce_srq.ko] undefined! The fix is to put the module sub components in the right line. Fixes: e9816ddf2a33 ("RDMA/hns: Cleanup unnecessary exported symbols") Reported-by: Stephen Rothwell Signed-off-by: Xi Wang Signed-off-by: Lijun Ou Signed-off-by: Jason Gunthorpe commit 26ac56506b0ea598bd0b52dcbd2d697282af98ed Merge: 106dbe24d414 924b5867e7bd Author: Mark Brown Date: Thu Jul 4 17:35:11 2019 +0100 Merge remote-tracking branch 'spi/topic/pump-rt' into spi-next commit 106dbe24d4146c0804cb025e450ac7af42d72356 Merge: 2337ff45293f 8cc7720470a1 Author: Mark Brown Date: Thu Jul 4 17:35:07 2019 +0100 Merge branch 'spi-5.3' into spi-next commit 2337ff45293f36efa79247b3680223b9c9154392 Merge: 6fbc7275c7a9 2b947137f2b8 Author: Mark Brown Date: Thu Jul 4 17:35:03 2019 +0100 Merge branch 'spi-5.2' into spi-linus commit 0ed4513c9a32a479b4dc41685be68edf1e99c139 Merge: 65244e5b1f4f d22b85a1b97d Author: Mark Brown Date: Thu Jul 4 17:34:34 2019 +0100 Merge remote-tracking branch 'regulator/topic/coupled' into regulator-next commit 65244e5b1f4fade54b490b47b871cefe1d7d07f0 Merge: f0386617dca6 3c7577d442a7 Author: Mark Brown Date: Thu Jul 4 17:34:32 2019 +0100 Merge branch 'regulator-5.3' into regulator-next commit f0386617dca6deaca241a01efb9a579d0d727e7f Merge: 6fbc7275c7a9 9d83dcb3e455 Author: Mark Brown Date: Thu Jul 4 17:34:30 2019 +0100 Merge branch 'regulator-5.2' into regulator-linus commit aaccf3863ce22108ae1d3bac82604eec9d8ae44c Merge: ea09b3e21f18 eff5a8500171 Author: Mark Brown Date: Thu Jul 4 17:33:59 2019 +0100 Merge branch 'regmap-5.3' into regmap-next commit ea09b3e21f18a5e190b26388c6c5f51e174d845f Merge: 6fbc7275c7a9 db057679de3e Author: Mark Brown Date: Thu Jul 4 17:33:56 2019 +0100 Merge branch 'regmap-5.2' into regmap-linus commit 3c7577d442a76c2015dd765497395fb394b78051 Author: Bartosz Golaszewski Date: Wed Jul 3 18:10:35 2019 +0200 regulator: max77650: use vsel_step Use the new vsel_step field in the regulator description to instruct the regulator API on the required voltage ramping. Switch to using the generic regmap helpers for voltage setting and remove the old set_voltage callback that handcoded the selector stepping. Signed-off-by: Bartosz Golaszewski Link: https://lore.kernel.org/r/20190703161035.31808-3-brgl@bgdev.pl Signed-off-by: Mark Brown commit 2da8d9473e20a2f6645dcb0cea4848a2c1e83af9 Author: Bartosz Golaszewski Date: Wed Jul 3 18:10:34 2019 +0200 regulator: implement selector stepping Some regulators require that the requested voltage be reached gradually by setting all or some of the intermediate values. Implement a new field in the regulator description struct that allows users to specify the number of selectors by which the regulator API should step when ramping the voltage up/down. Signed-off-by: Bartosz Golaszewski Link: https://lore.kernel.org/r/20190703161035.31808-2-brgl@bgdev.pl Signed-off-by: Mark Brown commit 264bffad4d08f967ab3d6690bb15757a526b186a Author: Christophe Leroy Date: Fri Jun 14 10:16:25 2019 +0000 powerpc/boot: Add lzo support for uImage This patch allows to generate lzo compressed uImage Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman commit 1cc9a21b0bb36debdf96dbcc4b139d6639373018 Author: Christophe Leroy Date: Fri Jun 14 10:16:24 2019 +0000 powerpc/boot: Add lzma support for uImage This patch allows to generate lzma compressed uImage Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman commit fbded57c962e7c42c932e1a46c8d801441726662 Author: Christophe Leroy Date: Fri Jun 14 10:16:23 2019 +0000 powerpc/boot: don't force gzipped uImage This patch modifies the generation of uImage by handing over the selected compression type instead of forcing gzip Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman commit 43db76f41824aea0a31f817e69ad304a95cf068a Author: Christophe Leroy Date: Fri Jun 14 06:41:47 2019 +0000 powerpc/8xx: Add microcode patch to move SMC parameter RAM. Some SCC functions like the QMC requires an extended parameter RAM. On modern 8xx (ie 866 and 885), SPI area can already be relocated, allowing the use of those functions on SCC2. But SCC3 and SCC4 parameter RAM collide with SMC1 and SMC2 parameter RAMs. This patch adds microcode to allow the relocation of both SMC1 and SMC2, and relocate them at offsets 0x1ec0 and 0x1fc0. Those offsets are by default for the CPM1 DSP1 and DSP2, but there is no kernel driver using them at the moment so this area can be reused. This microcode is provided by Freescale/NXP in Engineering Bulletin EB662 ("MPC8xx I2C/SPI and SMC Relocation Microcode Packages") dated 2006. The binary code is public. The source is not available. Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman commit c3eec5d7da3f77c6e505b44241205ca0aff1df24 Author: Christophe Leroy Date: Fri Jun 14 06:41:46 2019 +0000 powerpc/8xx: Use IO accessors in microcode programming. Change microcode functions to use IO accessors and get rid of volatile attributes. Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman commit 647d5ed0ae8a9942de8615f33790be7ac940056c Author: Christophe Leroy Date: Fri Jun 14 06:41:45 2019 +0000 powerpc/8xx: replace #ifdefs by IS_ENABLED() in microcode.c Reduce #ifdef mess by using IS_ENABLED() instead. Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman commit f5348c080e07bc7ce8f6a6c110bd2672f915c6b1 Author: Christophe Leroy Date: Fri Jun 14 06:41:44 2019 +0000 powerpc/8xx: refactor programming of microcode CPM params. The CPM registers RCCR and CPMCR1..4 registers has to be set in accordance with the microcode patch beeing programmed. Lets define them as part of the patch set and refactor their programming from that definition. Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman commit 5cfd5d8943fc9eb48030a7904e82c6e7d2056027 Author: Christophe Leroy Date: Fri Jun 14 06:41:43 2019 +0000 powerpc/8xx: refactor printing of microcode patch name. Define patch name together with the patch code, and refactor the associated printk() while replacing it by a pr_info() Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman commit 11597ff20b6b3cf039577e46e53bf1a94dda3098 Author: Christophe Leroy Date: Fri Jun 14 06:41:42 2019 +0000 powerpc/8xx: Refactor microcode write Add empty microcode tables so that all tables are defined all the time. Regroup the writing of the 3 tables regardless of the selected microcode. Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman commit 372fba9c76af11f1c7d162d22cff94e46f467bfb Author: Christophe Leroy Date: Fri Jun 14 06:41:41 2019 +0000 powerpc/8xx: refactor writing of CPM microcode arrays Create a function to refactor the writing of CPM microcode arrays. Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman commit 9fb7e639f6ad4a67296c897bf22110b0d38e42a4 Author: Christophe Leroy Date: Fri Jun 14 06:41:40 2019 +0000 powerpc/8xx: compact microcode arrays Compact obscure microcode arrays by putting 4 values per line in order to reduce number of lines in the file to increase readability. Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman commit 4d6d9c6db51275cba0f447ee04218bdf03d41453 Author: Christophe Leroy Date: Fri Jun 14 06:41:39 2019 +0000 powerpc/8xx: drop verify_patch() verify_patch() has been opted out since many years, and the comment suggests it doesn't work. So drop it. Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman commit 4128a89ac80d3714babde5b2811ffd058b09c229 Author: Christophe Leroy Date: Fri Jun 14 06:41:38 2019 +0000 powerpc/8xx: move CPM1 related files from sysdev/ to platforms/8xx Only 8xx selects CPM1 and related CONFIG options are already in platforms/8xx/Kconfig Move the related C files to platforms/8xx/. Signed-off-by: Christophe Leroy [mpe: Minor formatting fixes] Signed-off-by: Michael Ellerman commit 22e9c88d486a0536d337d6e0973968be0a4cd4b2 Author: Christophe Leroy Date: Tue May 14 09:05:16 2019 +0000 powerpc/64: reuse PPC32 static inline flush_dcache_range() This patch drops the assembly PPC64 version of flush_dcache_range() and re-uses the PPC32 static inline version. With GCC 8.1, the following code is generated: void flush_test(unsigned long start, unsigned long stop) { flush_dcache_range(start, stop); } 0000000000000130 <.flush_test>: 130: 3d 22 00 00 addis r9,r2,0 132: R_PPC64_TOC16_HA .data+0x8 134: 81 09 00 00 lwz r8,0(r9) 136: R_PPC64_TOC16_LO .data+0x8 138: 3d 22 00 00 addis r9,r2,0 13a: R_PPC64_TOC16_HA .data+0xc 13c: 80 e9 00 00 lwz r7,0(r9) 13e: R_PPC64_TOC16_LO .data+0xc 140: 7d 48 00 d0 neg r10,r8 144: 7d 43 18 38 and r3,r10,r3 148: 7c 00 04 ac hwsync 14c: 4c 00 01 2c isync 150: 39 28 ff ff addi r9,r8,-1 154: 7c 89 22 14 add r4,r9,r4 158: 7c 83 20 50 subf r4,r3,r4 15c: 7c 89 3c 37 srd. r9,r4,r7 160: 41 82 00 1c beq 17c <.flush_test+0x4c> 164: 7d 29 03 a6 mtctr r9 168: 60 00 00 00 nop 16c: 60 00 00 00 nop 170: 7c 00 18 ac dcbf 0,r3 174: 7c 63 42 14 add r3,r3,r8 178: 42 00 ff f8 bdnz 170 <.flush_test+0x40> 17c: 7c 00 04 ac hwsync 180: 4c 00 01 2c isync 184: 4e 80 00 20 blr 188: 60 00 00 00 nop 18c: 60 00 00 00 nop Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman commit d98fc70fc139b72ae098d24fde42ad70c8ff2f81 Author: Christophe Leroy Date: Tue May 14 09:05:15 2019 +0000 powerpc/32: define helpers to get L1 cache sizes. This patch defines C helpers to retrieve the size of cache blocks and uses them in the cacheflush functions. Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman commit 1cfb725fb1899dc6fdc88f8b5354a65e8ad260c6 Author: Christophe Leroy Date: Tue May 14 09:05:13 2019 +0000 powerpc/64: flush_inval_dcache_range() becomes flush_dcache_range() On most arches having function flush_dcache_range(), including PPC32, this function does a writeback and invalidation of the cache bloc. On PPC64, flush_dcache_range() only does a writeback while flush_inval_dcache_range() does the invalidation in addition. In addition it looks like within arch/powerpc/, there are no PPC64 platforms using flush_dcache_range() This patch drops the existing 64 bits version of flush_dcache_range() and renames flush_inval_dcache_range() into flush_dcache_range(). Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman commit 6c5875843b87c3adea2beade9d1b8b3d4523900a Author: Christophe Leroy Date: Fri May 10 09:24:48 2019 +0000 powerpc: slightly improve cache helpers Cache instructions (dcbz, dcbi, dcbf and dcbst) take two registers that are summed to obtain the target address. Using 'Z' constraint and '%y0' argument gives GCC the opportunity to use both registers instead of only one with the second being forced to 0. Suggested-by: Segher Boessenkool Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman commit d95c3885865b71e56d8d60c8617f2ce1f0fa079d Merge: 0bcfa628f8a3 5cd3f2e98cca 8dd8f005bdd4 9378bfeaafcb ceedd5f74d8c 29fcea8ce7f3 Author: Joerg Roedel Date: Thu Jul 4 17:26:48 2019 +0200 Merge branches 'x86/vt-d', 'x86/amd', 'arm/smmu', 'arm/omap', 'generic-dma-ops' and 'core' into next commit 28a32d2b1a6d7860e0b364c34a6b4205dce85537 Author: Josef Bacik Date: Wed Jun 19 15:12:01 2019 -0400 btrfs: move the subvolume reservation stuff out of extent-tree.c This is just two functions, put it in root-tree.c since it involves root items. Signed-off-by: Josef Bacik Signed-off-by: David Sterba commit 9378bfeaafcbbdf234daeee93db31a3f2c815513 Author: Greg Kroah-Hartman Date: Thu Jul 4 16:36:49 2019 +0200 iommu/omap: No need to check return value of debugfs_create functions When calling debugfs functions, there is no need to ever check the return value. The function can work or not, but the code logic should never do something different based on this. Cc: Joerg Roedel Cc: iommu@lists.linux-foundation.org Signed-off-by: Greg Kroah-Hartman Signed-off-by: Joerg Roedel commit 867363429d706984915cb4b1f299ce05f8413e23 Author: Josef Bacik Date: Wed Jun 19 15:12:00 2019 -0400 btrfs: migrate the delalloc space stuff to it's own home We have code for data and metadata reservations for delalloc. There's quite a bit of code here, and it's used in a lot of places so I've separated it out to it's own file. inode.c and file.c are already pretty large, and this code is complicated enough to live in its own space. Signed-off-by: Josef Bacik Signed-off-by: David Sterba commit fb6dea26601b60e41d70c310537dd1e2617b25b6 Author: Josef Bacik Date: Wed Jun 19 15:11:59 2019 -0400 btrfs: migrate btrfs_trans_release_chunk_metadata Move this into transaction.c with the rest of the transaction related code. Signed-off-by: Josef Bacik Signed-off-by: David Sterba commit 6ef03debdb3d82d7deec65f96e143b9adcfb2cd4 Author: Josef Bacik Date: Wed Jun 19 15:11:58 2019 -0400 btrfs: migrate the delayed refs rsv code These belong with the delayed refs related code, not in extent-tree.c. Signed-off-by: Josef Bacik Signed-off-by: David Sterba commit 9978059be8a1afd68bc0f7ab4c1883633ddd0312 Author: Goldwyn Rodrigues Date: Fri Jun 21 10:02:54 2019 -0500 btrfs: Evaluate io_tree in find_lock_delalloc_range() Simplification. No point passing the tree variable when it can be evaluated from inode. The tests now use the io_tree from btrfs_inode as opposed to creating one. Signed-off-by: Goldwyn Rodrigues Reviewed-by: David Sterba Signed-off-by: David Sterba commit bb4cb25dd319fa5630cc304c5bfa926266736935 Author: Andreas Gruenbacher Date: Wed Jul 3 22:12:13 2019 +0200 gfs2: Remove unused gfs2_iomap_alloc argument Remove the unused flags argument of gfs2_iomap_alloc. Signed-off-by: Andreas Gruenbacher commit bf3cb394479210a9ebcf8fef7a7f8fcabc7b9928 Author: Darrick J. Wong Date: Wed Jul 3 20:36:29 2019 -0700 xfs: allow single bulkstat of special inodes Create a new bulk ireq flag that enables userspace to ask us for a special inode number instead of interpreting @ino as a literal inode number. This enables us to query the root inode easily. The reason for adding the ability to query specifically the root directory inode is that certain programs (xfsdump and xfsrestore) want to confirm when they've been pointed to the root directory. The userspace code assumes the root directory is always the first result from calling bulkstat with lastino == 0, but this isn't true if the (initial btree roots + initial AGFL + inode alignment padding) is itself long enough to be allocated to new inodes if all of those blocks should happen to be free at the same time. Rather than make userspace guess at internal filesystem state, we provide a direct query. Signed-off-by: Darrick J. Wong Reviewed-by: Allison Collins Reviewed-by: Brian Foster commit 13d59a2a61cbbb4cda13a0cba6d4d1fc537f5dd4 Author: Darrick J. Wong Date: Wed Jul 3 20:36:28 2019 -0700 xfs: specify AG in bulk req Add a new xfs_bulk_ireq flag to constrain the iteration to a single AG. If the passed-in startino value is zero then we start with the first inode in the AG that the user passes in; otherwise, we iterate only within the same AG as the passed-in inode. Signed-off-by: Darrick J. Wong Reviewed-by: Allison Collins Reviewed-by: Brian Foster commit ac25ba68fa4001c85395f0488b1c7a2421c5aada Author: Aneesh Kumar K.V Date: Tue May 28 11:06:26 2019 +0530 powerpc/mm/hugetlb: Don't enable HugeTLB if we don't have a page table cache This makes sure we don't enable HugeTLB if the cache is not configured. I am still not sure about this. IMHO hugetlb support should be a hardware support derivative and any cache allocation failure should be handled as I did in the earlier patch. But then if we were not able to create hugetlb page table cache, we can as well declare hugetlb support disabled thereby avoiding calling into allocation routines. Signed-off-by: Aneesh Kumar K.V Signed-off-by: Michael Ellerman commit 5d49275a27310233964fc3edc8dd097a094ce338 Author: Aneesh Kumar K.V Date: Tue May 28 11:06:25 2019 +0530 powerpc/mm/hugetlb: Fix kernel crash if we fail to allocate page table caches We only check for hugetlb allocations, because with hugetlb we do conditional registration. For PGD/PUD/PMD levels we register them always in pgtable_cache_init. Signed-off-by: Aneesh Kumar K.V Signed-off-by: Michael Ellerman commit 2230ebf6e6dd0b7751e2921b40f6cfe34f09bb16 Author: Aneesh Kumar K.V Date: Tue May 28 11:06:24 2019 +0530 powerpc/mm: Handle page table allocation failures This fixes kernel crash that arises due to not handling page table allocation failures while allocating hugetlb page table. Fixes: e2b3d202d1db ("powerpc: Switch 16GB and 16MB explicit hugepages to a different page table format") Signed-off-by: Aneesh Kumar K.V Signed-off-by: Michael Ellerman commit 57caddae6ef43531a9f09a7f123c670db0789dad Author: Aneesh Kumar K.V Date: Tue May 14 11:33:02 2019 +0530 powerpc/mm: Remove radix dependency on HugeTLB page Now that we have switched the page table walk to use pmd_is_leaf we can now revert commit 8adddf349fda ("powerpc/mm/radix: Make Radix require HUGETLB_PAGE") Signed-off-by: Aneesh Kumar K.V Signed-off-by: Michael Ellerman commit 1ecf2cdc74fc7f79b4b45dd34f89c4a8e6ada96f Author: Aneesh Kumar K.V Date: Tue May 14 11:33:01 2019 +0530 powerpc/mm: pmd_devmap implies pmd_large(). large devmap usage is dependent on THP. Hence once check is sufficient. Signed-off-by: Aneesh Kumar K.V Signed-off-by: Michael Ellerman commit d6eacedd1f0ebf00bdf1c77715d194f7c1036fd4 Author: Aneesh Kumar K.V Date: Tue May 14 11:33:00 2019 +0530 powerpc/book3s: Use config independent helpers for page table walk Even when we have HugeTLB and THP disabled, kernel linear map can still be mapped with hugepages. This is only an issue with radix translation because hash MMU doesn't map kernel linear range in linux page table and other kernel map areas are not mapped using hugepage. Add config independent helpers and put WARN_ON() when we don't expect things to be mapped via hugepages. Signed-off-by: Aneesh Kumar K.V Signed-off-by: Michael Ellerman commit 259a948c4ba1829ae4a3c31bb6e40ad458a21254 Author: Aneesh Kumar K.V Date: Fri Jun 7 12:17:05 2019 +0530 powerpc/pseries/scm: Use a specific endian format for storing uuid from the device tree We used uuid_parse to convert uuid string from device tree to two u64 components. We want to make sure we look at the uuid read from device tree in an endian-neutral fashion. For now, I am picking little-endian to be format so that we don't end up doing an additional conversion. The reason to store in a specific endian format is to enable reading the namespace created with a little-endian kernel config on a big-endian kernel. We do store the device tree uuid string as a 64-bit little-endian cookie in the label area. When booting the kernel we also compare this cookie against what is read from the device tree. For this, to work we have to store and compare these values in a CPU endian config independent fashion. Signed-off-by: Aneesh Kumar K.V Signed-off-by: Michael Ellerman commit 53e80bd042773c8ddeed856bd1b68ca74c3b8b46 Author: Aneesh Kumar K.V Date: Fri Jun 7 12:15:11 2019 +0530 powerpc/nvdimm: Add support for multibyte read/write for metadata SCM_READ/WRITE_MEATADATA hcall supports multibyte read/write. This patch updates the metadata read/write to use 1, 2, 4 or 8 byte read/write as mentioned in PAPR document. READ/WRITE_METADATA hcall supports the 1, 2, 4, or 8 bytes read/write. For other values hcall results H_P3. Hypervisor stores the metadata contents in big-endian format and in-order to enable read/write in different granularity, we need to switch the contents to big-endian before calling HCALL. Based on an patch from Oliver O'Halloran Signed-off-by: Aneesh Kumar K.V Signed-off-by: Michael Ellerman commit 2a0ffbd4789b25cd5a80bfd8f3d28fb629eae1a7 Author: Aneesh Kumar K.V Date: Fri Jun 7 12:14:07 2019 +0530 powerpc/pseries/scm: Mark the region volatile if cache flush not required The device tree node is documented as below: “ibm,cache-flush-required”: property name indicates Cache Flush Required for this Persistent Memory Segment to persist memory prop-encoded-array: None, this is a name only property. Signed-off-by: Aneesh Kumar K.V Signed-off-by: Michael Ellerman commit c0b1b23b9c87569d5f90d06e86f26b31b544fa1e Author: Aneesh Kumar K.V Date: Mon Jul 1 20:03:38 2019 +0530 powerpc/mm/nvdimm: Add an informative message if we fail to allocate altmap block Allocation from altmap area can fail based on vmemmap page size used. Add kernel info message to indicate the failure. That allows the user to identify whether they are really using persistent memory reserved space for per-page metadata. The message looks like: [ 136.587212] altmap block allocation failed, falling back to system memory Signed-off-by: Aneesh Kumar K.V Reviewed-by: Oliver O'Halloran Signed-off-by: Michael Ellerman commit 495c2ff4c88108d1f7730dd0966d4f8b03f0046e Author: Aneesh Kumar K.V Date: Mon Jul 1 20:06:26 2019 +0530 powerpc/mm: Consolidate numa_enable check and min_common_depth check If we fail to parse min_common_depth from device tree we boot with numa disabled. Reflect the same by updating numa_enabled variable to false. Also, switch all min_common_depth failure check to if (!numa_enabled) check. This helps us to avoid checking for both in different code paths. Signed-off-by: Aneesh Kumar K.V Signed-off-by: Michael Ellerman commit f52741c410cfb76582df21f02e4c062ee732b882 Author: Aneesh Kumar K.V Date: Mon Jul 1 20:06:25 2019 +0530 powerpc/mm: Fix node look up with numa=off boot If we boot with numa=off, we need to make sure we return NUMA_NO_NODE when looking up associativity details of resources. Without this, we hit crash like below BUG: Unable to handle kernel data access at 0x40000000008 Faulting instruction address: 0xc000000008f31704 cpu 0x1b: Vector: 380 (Data SLB Access) at [c00000000b9bb320] pc: c000000008f31704: _raw_spin_lock+0x14/0x100 lr: c0000000083f41fc: ____cache_alloc_node+0x5c/0x290 sp: c00000000b9bb5b0 msr: 800000010280b033 dar: 40000000008 current = 0xc00000000b9a2700 paca = 0xc00000000a740c00 irqmask: 0x03 irq_happened: 0x01 pid = 1, comm = swapper/27 Linux version 5.2.0-rc4-00925-g74e188c620b1 (root@linux-d8ip) (gcc version 7.4.1 20190424 [gcc-7-branch revision 270538] (SUSE Linux)) #34 SMP Sat Jun 29 00:41:02 EDT 2019 enter ? for help [link register ] c0000000083f41fc ____cache_alloc_node+0x5c/0x290 [c00000000b9bb5b0] 0000000000000dc0 (unreliable) [c00000000b9bb5f0] c0000000083f48c8 kmem_cache_alloc_node_trace+0x138/0x360 [c00000000b9bb670] c000000008aa789c devres_alloc_node+0x4c/0xa0 [c00000000b9bb6a0] c000000008337218 devm_memremap+0x58/0x130 [c00000000b9bb6f0] c000000008aed00c devm_nsio_enable+0xdc/0x170 [c00000000b9bb780] c000000008af3b6c nd_pmem_probe+0x4c/0x180 [c00000000b9bb7b0] c000000008ad84cc nvdimm_bus_probe+0xac/0x260 [c00000000b9bb840] c000000008aa0628 really_probe+0x148/0x500 [c00000000b9bb8d0] c000000008aa0d7c driver_probe_device+0x19c/0x1d0 [c00000000b9bb950] c000000008aa11bc device_driver_attach+0xcc/0x100 [c00000000b9bb990] c000000008aa12ec __driver_attach+0xfc/0x1e0 [c00000000b9bba10] c000000008a9d0a4 bus_for_each_dev+0xb4/0x130 [c00000000b9bba70] c000000008a9fc04 driver_attach+0x34/0x50 [c00000000b9bba90] c000000008a9f118 bus_add_driver+0x1d8/0x300 [c00000000b9bbb20] c000000008aa2358 driver_register+0x98/0x1a0 [c00000000b9bbb90] c000000008ad7e6c __nd_driver_register+0x5c/0x100 [c00000000b9bbbf0] c0000000093efbac nd_pmem_driver_init+0x34/0x48 [c00000000b9bbc10] c0000000080106c0 do_one_initcall+0x60/0x2d0 [c00000000b9bbce0] c00000000938463c kernel_init_freeable+0x384/0x48c [c00000000b9bbdb0] c000000008010a5c kernel_init+0x2c/0x160 [c00000000b9bbe20] c00000000800ba54 ret_from_kernel_thread+0x5c/0x68 Reported-and-debugged-by: Vaibhav Jain Signed-off-by: Aneesh Kumar K.V Signed-off-by: Michael Ellerman commit ea9f5b702fe0215188fba2eda117419e4ae90a67 Author: Aneesh Kumar K.V Date: Mon Jul 1 20:06:24 2019 +0530 powerpc/mm/drconf: Use NUMA_NO_NODE on failures instead of node 0 If we fail to parse the associativity array we should default to NUMA_NO_NODE instead of NODE 0. Rest of the code fallback to the right default if we find the numa node value NUMA_NO_NODE. Signed-off-by: Aneesh Kumar K.V Signed-off-by: Michael Ellerman commit 89a3496e0664577043666791ec07fb731d57c950 Author: Aneesh Kumar K.V Date: Mon Jul 1 20:04:42 2019 +0530 powerpc/mm/radix: Use the right page size for vmemmap mapping We use mmu_vmemmap_psize to find the page size for mapping the vmmemap area. With radix translation, we are suboptimally setting this value to PAGE_SIZE. We do check for 2M page size support and update mmu_vmemap_psize to use hugepage size but we suboptimally reset the value to PAGE_SIZE in radix__early_init_mmu(). This resulted in always mapping vmemmap area with 64K page size. Fixes: 2bfd65e45e87 ("powerpc/mm/radix: Add radix callbacks for early init routines") Signed-off-by: Aneesh Kumar K.V Signed-off-by: Michael Ellerman commit 78c949888549a6318ae420802703408caae999f5 Author: Aneesh Kumar K.V Date: Mon Jul 1 20:04:41 2019 +0530 powerpc/mm/hash/4k: Don't use 64K page size for vmemmap with 4K pagesize With hash translation and 4K PAGE_SIZE config, we need to make sure we don't use 64K page size for vmemmap. Signed-off-by: Aneesh Kumar K.V Signed-off-by: Michael Ellerman commit b8c8a524ccad1244916a203ae40292e2786e1b26 Author: Aneesh Kumar K.V Date: Mon Jul 1 20:07:00 2019 +0530 powerpc/mm: Remove unused variable declaration Since commit 0034d395f89d ("powerpc/mm/hash64: Map all the kernel regions in the same 0xc range") __kernel_virt_size is not used anymore. Signed-off-by: Aneesh Kumar K.V Signed-off-by: Michael Ellerman commit 8c0993621c3e5fa52e5425ef2a0f67a0cde07092 Merge: d9deea28a896 b108ad53bb65 Author: Olof Johansson Date: Thu Jul 4 07:05:21 2019 -0700 Merge tag 'reset-for-v5.3' of git://git.pengutronix.de/git/pza/linux into arm/drivers Reset controller changes for v5.3 This tag adds support for the Bitmain BM1880 reset controller to the reset-simple driver and fixes a spelling mistake in the i.MX7 reset controller binding document. * tag 'reset-for-v5.3' of git://git.pengutronix.de/git/pza/linux: dt-bindings: reset: imx7: Fix the spelling of 'indices' reset: Add reset controller support for BM1880 SoC dt-bindings: reset: Add devicetree binding for BM1880 reset controller Link: https://lore.kernel.org/r/1562236632.6641.14.camel@pengutronix.de Signed-off-by: Olof Johansson commit d9deea28a896e01f6593b8a5c18ccff530620cb2 Merge: b27aca2e555f a71dcd3757e2 Author: Olof Johansson Date: Thu Jul 4 07:04:13 2019 -0700 Merge tag 'reset-fixes-for-v5.2' of git://git.pengutronix.de/git/pza/linux into arm/drivers Reset controller fix for v5.2 This tag removes a redundant device pointer NULL check from __reset_control_get_from_lookup to fix a static code checker warning. * tag 'reset-fixes-for-v5.2' of git://git.pengutronix.de/git/pza/linux: reset: remove redundant null check on pointer dev Link: https://lore.kernel.org/r/1562236626.6641.13.camel@pengutronix.de Signed-off-by: Olof Johansson commit 4471e44f972fb240601dcb1e1ae050faf316f46d Merge: 5ded680cf12f 0bb9d1876c06 Author: Olof Johansson Date: Thu Jul 4 07:02:29 2019 -0700 Merge tag 'sunxi-dt64-for-5.3-round-2' of https://git.kernel.org/pub/scm/linux/kernel/git/sunxi/linux into arm/dt Allwinner DT64 Changes for 5.3 - Round 2 One extra change wiring up the interrupt line for the external RTC chip on the Pine H64. * tag 'sunxi-dt64-for-5.3-round-2' of https://git.kernel.org/pub/scm/linux/kernel/git/sunxi/linux: arm64: dts: allwinner: h6: Pine H64: Add interrupt line for RTC Link: https://lore.kernel.org/r/20190704065326.GA19010@wens.csie.org Signed-off-by: Olof Johansson commit 35a4ed0164e992c9c7b82eb1370081a292131904 Author: Fugang Duan Date: Thu Jul 4 21:40:07 2019 +0800 tty: serial: fsl_lpuart: add imx8qxp support The lpuart of imx8ulp is basically the same as imx7ulp, but it has new feature support based on imx7ulp, like it can assert a DMA request on EOP(end-of-packet). imx8ulp lpuart use two clocks, one is ipg bus clock that is used to access registers, the other is baud clock that is used to transmit-receive data. Signed-off-by: Fugang Duan Link: https://lore.kernel.org/r/20190704134007.2316-1-fugang.duan@nxp.com Signed-off-by: Greg Kroah-Hartman commit 335399362a6edeec5a365ed0fbb0b6902cacc4e4 Author: Colin Ian King Date: Thu Jul 4 13:44:25 2019 +0100 ALSA: hda/ca0132 - remove redundant assignment to variable 'changed' The variable 'changed' is being initialized with a value that is never read and it is being updated later with a new value. The initialization is redundant and can be removed. Addresses-Coverity: ("Unused value") Signed-off-by: Colin Ian King Signed-off-by: Takashi Iwai commit d07a9a4f66e944fcc900812cbc2f6817bde6a43d Author: Kailang Yang Date: Thu Jul 4 16:02:10 2019 +0800 ALSA: hda/realtek - Headphone Mic can't record after S3 Dell headset mode platform with ALC236. It doesn't recording after system resume from S3. S3 mode was deep. s2idle was not has this issue. S3 deep will cut of codec power. So, the register will back to default after resume back. This patch will solve this issue. Signed-off-by: Kailang Yang Cc: Signed-off-by: Takashi Iwai commit 2438ac954bf506d4d7ad398f733103d7c9adbbfd Author: Naveen N. Rao Date: Wed Jul 3 22:34:02 2019 +0530 powerpc/pseries: Add documentation for vcpudispatch_stats Add a document describing the fields provided by /proc/powerpc/vcpudispatch_stats. Signed-off-by: Naveen N. Rao Signed-off-by: Michael Ellerman commit 18a593c8b5426f6a08bcb353636d761a83f78d9e Author: Naveen N. Rao Date: Wed Jul 3 22:34:01 2019 +0530 powerpc/pseries: Protect against hogging the cpu while setting up the stats When enabling or disabling the vcpu dispatch statistics, we do a lot of work including allocating/deallocating memory across all possible cpus for the DTL buffer. In order to guard against hogging the cpu for too long, track the time we're taking and yield the processor if necessary. Signed-off-by: Naveen N. Rao Signed-off-by: Michael Ellerman commit d62c8deeb6e69cd7815c21171a218301822e4a06 Author: Naveen N. Rao Date: Wed Jul 3 22:34:00 2019 +0530 powerpc/pseries: Provide vcpu dispatch statistics For Shared Processor LPARs, the POWER Hypervisor maintains a relatively static mapping of the LPAR processors (vcpus) to physical processor chips (representing the "home" node) and tries to always dispatch vcpus on their associated physical processor chip. However, under certain scenarios, vcpus may be dispatched on a different processor chip (away from its home node). The actual physical processor number on which a certain vcpu is dispatched is available to the guest in the 'processor_id' field of each DTL entry. The guest can discover the home node of each vcpu through the H_HOME_NODE_ASSOCIATIVITY(flags=1) hcall. The guest can also discover the associativity of physical processors, as represented in the DTL entry, through the H_HOME_NODE_ASSOCIATIVITY(flags=2) hcall. These can then be compared to determine if the vcpu was dispatched on its home node or not. If the vcpu was not dispatched on the home node, it is possible to determine if the vcpu was dispatched in a different chip, socket or drawer. Introduce a procfs file /proc/powerpc/vcpudispatch_stats that can be used to obtain these statistics. Writing '1' to this file enables collecting the statistics, while writing '0' disables the statistics. The statistics themselves are available by reading the procfs file. By default, the DTLB log for each vcpu is processed 50 times a second so as not to miss any entries. This processing frequency can be changed through /proc/powerpc/vcpudispatch_stats_freq. Signed-off-by: Naveen N. Rao Signed-off-by: Michael Ellerman commit 5a1ea4774ddc2c6bc3ba1415880091eccf1a901e Author: Naveen N. Rao Date: Wed Jul 3 22:33:59 2019 +0530 powerpc/pseries: Move mm/book3s64/vphn.c under platforms/pseries/ hcall_vphn() is specific to pseries and will be used in a subsequent patch. So, move it to a more appropriate place under arch/powerpc/platforms/pseries. Also merge vphn.h into lppaca.h and update vphn selftest to use the new files. Signed-off-by: Naveen N. Rao Signed-off-by: Michael Ellerman commit ef34e0efa22a867f8db16feb79fba9964cfbe253 Author: Naveen N. Rao Date: Wed Jul 3 22:33:58 2019 +0530 powerpc/pseries: Generalize hcall_vphn() H_HOME_NODE_ASSOCIATIVITY hcall can take two different flags and return different associativity information in each case. Generalize the existing hcall_vphn() function to take flags as an argument and to return the result. Update the only existing user to pass the proper arguments. Signed-off-by: Naveen N. Rao Signed-off-by: Michael Ellerman commit 06220d78f24a20549757be1014e57c382406cc92 Author: Naveen N. Rao Date: Wed Jul 3 22:33:57 2019 +0530 powerpc/pseries: Introduce rwlock to gatekeep DTLB usage Since we would be introducing a new user of the DTL buffer in a subsequent patch, we need a way to gatekeep use of the DTL buffer. The current debugfs interface for DTL allows registering and opening cpu-specific DTL buffers. Cpu specific files are exposed under debugfs 'powerpc/dtl/' node, and changing 'dtl_event_mask' in the same directory enables controlling the event mask used when registering DTL buffer for a particular cpu. Subsequently, we will be introducing a user of the DTL buffers that registers access to the DTL buffers across all cpus with the same event mask. To ensure these two users do not step on each other, we introduce a rwlock to gatekeep DTL buffer access. This fits the requirement of the current debugfs interface wanting to allow multiple independent cpu-specific users (read lock), and the subsequent user wanting exclusive access (write lock). Suggested-by: Michael Ellerman Signed-off-by: Naveen N. Rao Signed-off-by: Michael Ellerman commit 1c85a2a1945cbafcd2e7cebc6e23d0e206aeda3d Author: Naveen N. Rao Date: Wed Jul 3 22:33:56 2019 +0530 powerpc/pseries: Factor out DTL buffer allocation and registration routines Introduce new helpers for DTL buffer allocation and registration and have the existing code use those. Signed-off-by: Naveen N. Rao [mpe: Don't split error messages across lines, for grepability] Signed-off-by: Michael Ellerman commit 5b3306f084590b298c1fe1b02aca5bac1abbbc34 Author: Naveen N. Rao Date: Wed Jul 3 22:33:55 2019 +0530 powerpc/pseries: Do not save the previous DTL mask value When CONFIG_VIRT_CPU_ACCOUNTING_NATIVE is enabled, we always initialize DTL enable mask to DTL_LOG_PREEMPT (0x2). There are no other places where the mask is changed. As such, when reading the DTL log buffer through debugfs, there is no need to save and restore the previous mask value. We don't need to save and restore the earlier mask value if CONFIG_VIRT_CPU_ACCOUNTING_NATIVE is not enabled. So, remove the field from the structure as well. Acked-by: Nathan Lynch Signed-off-by: Naveen N. Rao Signed-off-by: Michael Ellerman commit 515bbc8ab488e4bc16fe26df097502c04d3649d4 Author: Naveen N. Rao Date: Wed Jul 3 22:33:54 2019 +0530 powerpc/pseries: Use macros for referring to the DTL enable mask Introduce macros to encode the DTL enable mask fields and use those instead of hardcoding numbers. Acked-by: Nathan Lynch Signed-off-by: Naveen N. Rao Signed-off-by: Michael Ellerman commit eff5a850017193ae879948944be05cc814c29621 Author: YueHaibing Date: Thu Jul 4 17:35:53 2019 +0800 regmap: select CONFIG_REGMAP while REGMAP_SCCB is set REGMAP_SCCB is selected by ov772x and ov9650 drivers, but CONFIG_REGMAP may not, so building will fails: rivers/media/i2c/ov772x.c: In function ov772x_probe: drivers/media/i2c/ov772x.c:1360:22: error: variable ov772x_regmap_config has initializer but incomplete type static const struct regmap_config ov772x_regmap_config = { ^~~~~~~~~~~~~ drivers/media/i2c/ov772x.c:1361:4: error: const struct regmap_config has no member named reg_bits Reported-by: Hulk Robot Fixes: 5bbf32217bf9 ("media: ov772x: use SCCB regmap") Signed-off-by: YueHaibing Link: https://lore.kernel.org/r/20190704093553.49904-1-yuehaibing@huawei.com Signed-off-by: Mark Brown commit 1bcc1fd64e4dd903f4d868a9e053986e3b102713 Author: Wen Yang Date: Thu Jul 4 16:38:50 2019 +0800 ASoC: audio-graph-card: fix use-after-free in graph_for_each_link After calling of_node_put() on the codec_ep and codec_port variables, they are still being used, which may result in use-after-free. We fix this issue by calling of_node_put() after the last usage. Fixes: fce9b90c1ab7 ("ASoC: audio-graph-card: cleanup DAI link loop method - step2") Signed-off-by: Wen Yang Cc: Liam Girdwood Cc: Mark Brown Cc: Jaroslav Kysela Cc: Takashi Iwai Cc: Kuninori Morimoto Cc: alsa-devel@alsa-project.org Cc: linux-kernel@vger.kernel.org Link: https://lore.kernel.org/r/1562229530-8121-1-git-send-email-wen.yang99@zte.com.cn Signed-off-by: Mark Brown commit 6ae3483d411638e471ca0498629b17939f1c20f4 Author: Sebastian Ott Date: Thu Jun 27 15:47:13 2019 +0200 s390/pci: correctly handle MIO opt-out Do not issue CLP_SET_ENABLE_MIO after opting out of MIO instruction usage. This should not fix a bug but reduce overhead within firmware. Signed-off-by: Sebastian Ott Signed-off-by: Vasily Gorbik commit c7ff0e918a7cb39f6bfb2a7bdc30199986ff1571 Author: Sebastian Ott Date: Thu Jun 27 15:13:05 2019 +0200 s390/pci: deal with devices that have no support for MIO instructions Unfortunately we have to handle a class of devices that don't support the new MIO instructions. Adjust resource assignment and mapping accordingly. Signed-off-by: Sebastian Ott Signed-off-by: Vasily Gorbik commit 214cc39d175c89cafa5acfe4df22502e8d86c506 Author: Greg Kroah-Hartman Date: Thu Jul 4 13:05:59 2019 +0200 Revert "usb: gadget: storage: Remove warning message" This reverts commit e70b3f5da00119e057b7faa557753fee7f786f17. EJ writes: Thinh found this patch might cause a failure in USB CV TD 9.13 Set Configuration Test. We are trying to fix it. Could you please defer the merging of this patch until we fix it? So am now dropping it. Reported-by: EJ Hsu Cc: Alan Stern Cc: Felipe Balbi Signed-off-by: Greg Kroah-Hartman commit 31afa05bf90ea5561307be83893c670555bd736d Author: Satheesh Rajendran Date: Tue Jul 2 21:17:45 2019 +0530 powerpc: Enable CONFIG_IPV6 in ppc64_defconfig Enable CONFIG_IPV6 in ppc64_defconfig to enable certain network functionalities required for tests. Signed-off-by: Michael Ellerman Signed-off-by: Satheesh Rajendran Signed-off-by: Michael Ellerman commit 65d71f0095f611eb090bb9c1cca086a8967936e5 Author: Greg Kroah-Hartman Date: Thu Jul 4 13:02:18 2019 +0200 Revert "dt-bindings: add binding for USBSS-DRD controller." This reverts commit e8a8b40cc8922b38f91c6562d525f21f312f235c. It's broken. Reported-by: Stephen Rothwell Cc: Felipe Balbi Cc: Pawel Laszczak Signed-off-by: Greg Kroah-Hartman commit 332694f8a4f7e49b8b7278734d0ce331f954b20e Author: Greg Kroah-Hartman Date: Thu Jul 4 13:02:09 2019 +0200 Revert "usb:gadget Separated decoding functions from dwc3 driver." This reverts commit 3db1b636c07e15ff7410db782832dc2e7ffd2bce. It's broken. Reported-by: Stephen Rothwell Cc: Felipe Balbi Cc: Pawel Laszczak Signed-off-by: Greg Kroah-Hartman commit 8265fb7c2559a4d245fed095b6af97bd8629d233 Author: Greg Kroah-Hartman Date: Thu Jul 4 13:02:00 2019 +0200 Revert "usb:gadget Patch simplify usb_decode_set_clear_feature function." This reverts commit ca888ce7495e4e1578c86c37b0c82f6709da477c. It's broken. Reported-by: Stephen Rothwell Cc: Felipe Balbi Cc: Pawel Laszczak Signed-off-by: Greg Kroah-Hartman commit 40abbef1c9af849fcdd23a7061b3f9a29067067b Author: Greg Kroah-Hartman Date: Thu Jul 4 13:01:48 2019 +0200 Revert "usb:gadget Simplify usb_decode_get_set_descriptor function." This reverts commit c2af6b07803ebd099950cd608f404a7bff9037b2. It's broken. Reported-by: Stephen Rothwell Cc: Felipe Balbi Cc: Pawel Laszczak Signed-off-by: Greg Kroah-Hartman commit de4ad1b157eb4b72aada89a18ec9864e8f711754 Author: Greg Kroah-Hartman Date: Thu Jul 4 13:01:33 2019 +0200 Revert "usb:cdns3 Add Cadence USB3 DRD Driver" This reverts commit 8bc1901ca7b07d864fca11461b3875b31f949765. It's broken. Reported-by: Stephen Rothwell Cc: Felipe Balbi Cc: Pawel Laszczak Signed-off-by: Greg Kroah-Hartman commit bff2a75bd77f668e538fbdf0558b1114933fbf87 Author: Greg Kroah-Hartman Date: Thu Jul 4 13:00:50 2019 +0200 Revert "usb:cdns3 Fix for stuck packets in on-chip OUT buffer." This reverts commit 573aff747ee350a0541c3a24cacd92a286fb9522. It's broken. Reported-by: Stephen Rothwell Cc: Felipe Balbi Cc: Pawel Laszczak Signed-off-by: Greg Kroah-Hartman commit 4ca96aa99f3e1e530f63559c0cc63ae186ecd677 Author: Geert Uytterhoeven Date: Mon Jul 1 16:00:09 2019 +0200 lib/vsprintf: Reinstate printing of legacy clock IDs When using the legacy clock framework, clock pointers are no longer printed as IDs, as the !CONFIG_COMMON_CLK case was accidentally considered an error case. Fix this by reverting to the old behavior, which allows to distinguish clocks by ID, as the legacy clock framework does not store names with clocks. Fixes: 0b74d4d763fd4ee9 ("vsprintf: Consolidate handling of unknown pointer specifiers") Link: http://lkml.kernel.org/r/20190701140009.23683-1-geert+renesas@glider.be Cc: Sergey Senozhatsky Cc: Andy Shevchenko Cc: linux-kernel@vger.kernel.org Signed-off-by: Geert Uytterhoeven Signed-off-by: Petr Mladek commit 996cdfaf538f159f822f2619d55449c587b86cb6 Author: Sai Prakash Ranjan Date: Thu Jul 4 15:23:05 2019 +0530 coresight: Do not default to CPU0 for missing CPU phandle Coresight platform support assumes that a missing "cpu" phandle defaults to CPU0. This could be problematic and unnecessarily binds components to CPU0, where they may not be. In coresight etm and cpu-debug drivers, abort the probe for such cases. Signed-off-by: Sai Prakash Ranjan Reviewed-by: Suzuki K Poulose Tested-by: Mathieu Poirier Reviewed-by: Mathieu Poirier Link: https://lore.kernel.org/r/f1955ea19c714cf64ea54ec356a9aa85f3cd17b8.1562229018.git.saiprakash.ranjan@codeaurora.org Signed-off-by: Greg Kroah-Hartman commit 1141301c20706acd444637d7c5c6b201ad878c6e Author: Sai Prakash Ranjan Date: Thu Jul 4 15:23:04 2019 +0530 dt-bindings: coresight: Change CPU phandle to required property Do not assume the affinity to CPU0 if cpu phandle is omitted. Update the DT binding rules to reflect the same by changing it to a required property. Signed-off-by: Sai Prakash Ranjan Reviewed-by: Suzuki K Poulose Tested-by: Mathieu Poirier Reviewed-by: Mathieu Poirier Link: https://lore.kernel.org/r/0f7f4105d5ffea6ca4313271f3b3fee69da2106a.1562229018.git.saiprakash.ranjan@codeaurora.org Signed-off-by: Greg Kroah-Hartman commit 2ebca1cbb4a5a31f8d89f22d9d410b432a97f7a7 Author: Christoph Hellwig Date: Mon May 20 08:33:26 2019 +0200 riscv: remove free_initrd_mem The RISC-V free_initrd_mem is identical to the default one, except that it doesn't poison the freed memory. Remove it so that the default implementations gets used instead. Signed-off-by: Christoph Hellwig Reviewed-by: Anup Patel Reviewed-by: Palmer Dabbelt Signed-off-by: Paul Walmsley commit df7e9059cf6bdf4a8c11edeee30231f49815b071 Author: Yash Shah Date: Mon Jul 1 16:10:30 2019 +0530 riscv: ccache: Remove unused variable Reading the count register clears the interrupt signal. Currently, the count registers are read into 'regval' variable but the variable is never used. Therefore remove it. V2 of this patch add comments to justify the readl calls without checking the return value. Signed-off-by: Yash Shah Signed-off-by: Paul Walmsley commit a71dcd3757e29cc8b43383ff18595d707cf08345 Author: Colin Ian King Date: Fri May 10 10:58:32 2019 +0100 reset: remove redundant null check on pointer dev Pointer dev is being dereferenced when passed to the inlined functon dev_name, however, dev is later being null checked so at first this seems like a potential null pointer dereference. In fact, _reset_control_get_from_lookup is only ever called from __reset_control_get, right after checking dev->of_node hence dev can never be null. Clean this up by removing the redundant null check. Thanks to Philipp Zabel for spotting that dev can never be null. Addresses-Coverity: ("Dereference before null check") Fixes: 6691dffab0ab ("reset: add support for non-DT systems") Signed-off-by: Colin Ian King Reviewed-by: Bartosz Golaszewski Signed-off-by: Philipp Zabel commit ede2001569c32e5bafd2203c7272bbd3249e942e Author: Gustavo A. R. Silva Date: Fri May 31 12:35:32 2019 -0500 i3c: master: Use struct_size() helper Make use of the struct_size() helper instead of an open-coded version in order to avoid any potential type mistakes, in particular in the context in which this code is being used. So, replace the following form: sizeof(*defslvs) + ((ndevs - 1) * sizeof(struct i3c_ccc_dev_desc)) with: struct_size(defslvs, slaves, ndevs - 1) This code was detected with the help of Coccinelle. Signed-off-by: Gustavo A. R. Silva Signed-off-by: Boris Brezillon commit ea3bfeec6bf77033608b81a5e9a7cd6d686ab054 Author: Qii Wang Date: Mon Jul 1 14:42:02 2019 +0800 dt-bindings: i3c: cdns: Use correct cells for I2C device I2C device reg should be "reg = <0x52 0x0 0x10>;" Fixes: e29d0d9c90c9 ("dt-bindings: i3c: Document Cadence I3C master bindings") Signed-off-by: Qii Wang Signed-off-by: Boris Brezillon commit 02bd45a28bf32993e396fdcfd7d7c7cdc0847ed1 Author: Rafael J. Wysocki Date: Thu Jul 4 01:05:38 2019 +0200 PM: sleep: Drop dev_pm_skip_next_resume_phases() After recent hibernation-related changes, there are no more callers of dev_pm_skip_next_resume_phases() except for the PM core itself in which it is more straightforward to run the statements from that function directly, so do that and drop it. Signed-off-by: Rafael J. Wysocki Reviewed-by: Mika Westerberg commit 9ed411c06dd1cdf6171b992f68c37bc2d66054f9 Author: Rafael J. Wysocki Date: Thu Jul 4 01:02:49 2019 +0200 ACPI: PM: Unexport acpi_device_get_power() Using acpi_device_get_power() outside of ACPI device initialization and ACPI sysfs is problematic due to the way in which power resources are handled by it, so unexport it and add a paragraph explaining the pitfalls to its kerneldoc comment. Signed-off-by: Rafael J. Wysocki Reviewed-by: Mika Westerberg commit 208637b37824c8956fe28d277835a403ee35fa84 Author: Viresh Kumar Date: Thu Jul 4 13:06:20 2019 +0530 PM / QoS: Add support for MIN/MAX frequency constraints This patch introduces the min-frequency and max-frequency device constraints, which will be used by the cpufreq core to begin with. Reviewed-by: Matthias Kaehlcke Reviewed-by: Ulf Hansson Signed-off-by: Viresh Kumar Signed-off-by: Rafael J. Wysocki commit 2a79ea5ec53973c8711b54d33ace5c77659dc8f8 Author: Viresh Kumar Date: Thu Jul 4 13:06:19 2019 +0530 PM / QOS: Pass request type to dev_pm_qos_read_value() In order to allow dev_pm_qos_read_value() to read values for different QoS requests, pass request type as a parameter to these routines. For now, it only supports resume-latency request type but will be extended to frequency limit (min/max) constraints later on. Reviewed-by: Matthias Kaehlcke Reviewed-by: Ulf Hansson Signed-off-by: Viresh Kumar Signed-off-by: Rafael J. Wysocki commit 8262331eaaf751076fb2c781f492bafd8344591d Author: Viresh Kumar Date: Thu Jul 4 13:06:18 2019 +0530 PM / QOS: Rename __dev_pm_qos_read_value() and dev_pm_qos_raw_read_value() dev_pm_qos_read_value() will soon need to support more constraint types (min/max frequency) and will have another argument to it, i.e. type of the constraint. While that is fine for the existing users of dev_pm_qos_read_value(), but not that optimal for the callers of __dev_pm_qos_read_value() and dev_pm_qos_raw_read_value() as all the callers of these two routines are only looking for resume latency constraint. Lets make these two routines care only about the resume latency constraint and rename them to __dev_pm_qos_resume_latency() and dev_pm_qos_raw_resume_latency(). Suggested-by: Rafael J. Wysocki Signed-off-by: Viresh Kumar Signed-off-by: Rafael J. Wysocki commit 0b07ee944701dabcddc294d903b5e8e21c2c5d95 Author: Viresh Kumar Date: Thu Jul 4 13:06:17 2019 +0530 PM / QOS: Pass request type to dev_pm_qos_{add|remove}_notifier() In order to use the same set of routines to register notifiers for different request types, update the existing dev_pm_qos_{add|remove}_notifier() routines with an additional parameter: request-type. For now, it only supports resume-latency request type but will be extended to frequency limit (min/max) constraints later on. Reviewed-by: Matthias Kaehlcke Reviewed-by: Ulf Hansson Signed-off-by: Viresh Kumar Signed-off-by: Rafael J. Wysocki commit 5d1532482943403eb11911898565628fa45863d7 Author: Simon Sandström Date: Thu Jul 4 08:08:11 2019 +0200 staging: kpc2000: simplify comparison to NULL in fileops.c Fixes checkpatch warning "Comparison to NULL could be written [...]". Signed-off-by: Simon Sandström Link: https://lore.kernel.org/r/20190704060811.10330-4-simon@nikanor.nu Signed-off-by: Greg Kroah-Hartman commit a50d99d40199db24e0c321457bd3da2df107dd71 Author: Simon Sandström Date: Thu Jul 4 08:08:10 2019 +0200 staging: kpc2000: simplify comparison to NULL in dma.c Fixes checkpatch warning "Comparison to NULL could be written [...]". Signed-off-by: Simon Sandström Link: https://lore.kernel.org/r/20190704060811.10330-3-simon@nikanor.nu Signed-off-by: Greg Kroah-Hartman commit 209ff937b0d4d70bb054890a8c1722cec3fc70fe Author: Simon Sandström Date: Thu Jul 4 08:08:09 2019 +0200 staging: kpc2000: simplify comparison to NULL in kpc2000_spi.c Fixes checkpatch warning "Comparison to NULL could be written [...]". Signed-off-by: Simon Sandström Link: https://lore.kernel.org/r/20190704060811.10330-2-simon@nikanor.nu Signed-off-by: Greg Kroah-Hartman commit f584dd32edc5d4400d7ceb92111a89f0c1f6651f Merge: a328a259ced0 049331f277fe Author: Ingo Molnar Date: Thu Jul 4 10:36:20 2019 +0200 Merge branch 'x86/cpu' into perf/core, to pick up revert perf/core has an earlier version of the x86/cpu tree merged, to avoid conflicts, and due to this we want to pick up this ABI impacting revert as well: 049331f277fe: ("x86/fsgsbase: Revert FSGSBASE support") Signed-off-by: Ingo Molnar commit 0979cf95d201f7e9c7c060b96795f39733d2ed6e Author: Greg Kroah-Hartman Date: Thu Jul 4 10:28:36 2019 +0200 orangefs: fix build warning from debugfs cleanup patch Stephen writes: After merging the driver-core tree, today's linux-next build (x86_64 allmodconfig) produced this warning: fs/orangefs/orangefs-debugfs.c: In function 'orangefs_debugfs_init': fs/orangefs/orangefs-debugfs.c:193:1: warning: label 'out' defined but not used [-Wunused-label] out: ^~~ fs/orangefs/orangefs-debugfs.c: In function 'orangefs_kernel_debug_init': fs/orangefs/orangefs-debugfs.c:204:17: warning: unused variable 'ret' [-Wunused-variable] struct dentry *ret; ^~~ Fix this up and change the return type of the function to void as it can not fail, which cleans up some more code and variables as well. Cc: Mike Marshall Cc: Martin Brandenburg Cc: devel@lists.orangefs.org Reported-by: Stephen Rothwell Fixes: f095adba36bb ("orangefs: no need to check return value of debugfs_create functions") Signed-off-by: Greg Kroah-Hartman commit a94de2e7a380064a6e8a4c3e5e10d97e8aa711f4 Merge: 60e8523e2ea1 e8960ca06bb2 Author: Greg Kroah-Hartman Date: Thu Jul 4 10:20:48 2019 +0200 Merge tag 'misc-habanalabs-next-2019-07-04' of git://people.freedesktop.org/~gabbayo/linux into char-misc-next Oded writes: This tag contains the following changes for kernel 5.3: - Change the way the device's CPU access the host memory. This allows the driver to use the kernel API of setting DMA mask in a standard way (call it once). - Add a new debugfs entry to show the status of the internal DMA and compute engines. This is very helpful for debugging in case a command submission get stuck. - Return to the user a mask of the internal engines indicating their busy state. - Make sure to restore registers that can be modified by the user to their default values. Only applies to registers that are initialized by the driver. - Elimination of redundant and dead-code. - Support memset of the device's memory with size larger then 4GB - Force the user to set the device to debug mode before configuring the device's coresight infrastructure - Improve error printing in case of interrupts from the device * tag 'misc-habanalabs-next-2019-07-04' of git://people.freedesktop.org/~gabbayo/linux: (31 commits) habanalabs: Add busy engines bitmask to HW idle IOCTL habanalabs: Add debugfs node for engines status habanalabs: Update the device idle check habanalabs: Allow accessing host mapped addresses via debugfs habanalabs: add WARN in case of bad MMU mapping habanalabs: remove DMA mask hack for Goya habanalabs: set Goya CPU to use ASIC MMU habanalabs: add MMU mappings for Goya CPU habanalabs: initialize MMU context for driver habanalabs: de-couple MMU and VM module initialization habanalabs: initialize device CPU queues after MMU init docs/habanalabs: update text for some entries in sysfs habanalabs: add rate-limit to an error message habanalabs: remove simulator dedicated code habanalabs: restore unsecured registers default values habanalabs: clear sobs and monitors in context switch habanalabs: make tpc registers secured habanalabs: don't limit packet size for device CPU habanalabs: support device memory memset > 4GB habanalabs: print event name for fatal and non-RAZWI events ... commit 658829dfe75c49e879e0c4c9cbcd3bd1e4fbdcf5 Author: Geliang Tang Date: Sat May 6 23:37:20 2017 +0800 powerpc/cell: set no_llseek in spufs_cntl_fops In spufs_cntl_fops, since we use nonseekable_open() to open, we should use no_llseek() to seek, not generic_file_llseek(). Signed-off-by: Geliang Tang Signed-off-by: Michael Ellerman commit 8dd8f005bdd45823fc153ef490239558caf6ff20 Author: Jean-Philippe Brucker Date: Wed Jul 3 12:19:20 2019 +0100 iommu/arm-smmu-v3: Invalidate ATC when detaching a device We make the invalid assumption in arm_smmu_detach_dev() that the ATC is clear after calling pci_disable_ats(). For one thing, only enabling the PCIe ATS capability constitutes an implicit invalidation event, so the comment was wrong. More importantly, the ATS capability isn't necessarily disabled by pci_disable_ats() in a PF, if the associated VFs have ATS enabled. Explicitly invalidate all ATC entries in arm_smmu_detach_dev(). The endpoint cannot form new ATC entries because STE.EATS is clear. Fixes: 9ce27afc0830 ("iommu/arm-smmu-v3: Add support for PCI ATS") Reported-by: Manoj Kumar Reported-by: Robin Murphy Signed-off-by: Jean-Philippe Brucker Acked-by: Will Deacon Signed-off-by: Joerg Roedel commit eb0a2daa45b83d67b69a620243ed844e9dfa671b Author: Andy Shevchenko Date: Wed Jul 3 18:15:54 2019 +0300 pinctrl: baytrail: Use GENMASK() consistently Use GENMASK() macro for all definitions where it's appropriate. No functional change intended. Signed-off-by: Andy Shevchenko Link: https://lore.kernel.org/r/20190703151554.30454-1-andriy.shevchenko@linux.intel.com Acked-by: Mika Westerberg Signed-off-by: Linus Walleij commit b482e48d29f1461fd0d059a17f32bcfa274127b3 Author: Johannes Berg Date: Wed Jul 3 10:52:01 2019 +0200 um: fix build without CONFIG_UML_TIME_TRAVEL_SUPPORT When CONFIG_UML_TIME_TRAVEL_SUPPORT isn't set, the build was broken. Fix this. Fixes: 065038706f77 ("um: Support time travel mode") Signed-off-by: Johannes Berg Signed-off-by: Richard Weinberger commit 4f010b936b2ba3cb426e94284a3d57c2605bea88 Author: Andy Shevchenko Date: Wed Jul 3 03:30:18 2019 +0300 pinctrl: baytrail: Re-use data structures from pinctrl-intel.h We have some data structures duplicated across the drivers. Let's deduplicate them by using ones that being provided by pinctrl-intel.h. Signed-off-by: Andy Shevchenko Link: https://lore.kernel.org/r/20190703003018.75186-2-andriy.shevchenko@linux.intel.com Acked-by: Mika Westerberg Signed-off-by: Linus Walleij commit a705f9c1798d1da0f4b67956371ef539c273b31c Author: Andy Shevchenko Date: Wed Jul 3 03:30:17 2019 +0300 pinctrl: baytrail: Use defined macro instead of magic in byt_get_gpio_mux() By the fact byt_get_gpio_mux() returns a value of mux settings as it is represented in hardware. Use defined macro instead of magic numbers to clarify this. Signed-off-by: Andy Shevchenko Link: https://lore.kernel.org/r/20190703003018.75186-1-andriy.shevchenko@linux.intel.com Reviewed-By: Enrico Weigelt Acked-by: Mika Westerberg Signed-off-by: Linus Walleij commit 57218371d5ed1a6790675aad3a17c453baf2d1f2 Author: Prasad Sodagudi Date: Tue Jul 2 16:20:45 2019 +0530 pinctrl: qcom: Add SM8150 pinctrl driver Add initial pinctrl driver to support pin configuration with pinctrl framework for SM8150 Signed-off-by: Prasad Sodagudi Signed-off-by: Isaac J. Manjarres [vkoul: modify to use upstream tile support use upstream code style order the functions and squash functions] Signed-off-by: Vinod Koul Link: https://lore.kernel.org/r/20190702105045.27646-4-vkoul@kernel.org Reviewed-by: Bjorn Andersson Signed-off-by: Linus Walleij commit 7f1fee22a2bb4073ddd2f4b06b6710a561ef3815 Author: Prasad Sodagudi Date: Tue Jul 2 16:20:44 2019 +0530 dt-bindings: pinctrl: qcom: Add SM8150 pinctrl binding Add the binding for the TLMM pinctrl block found in the SM8150 platform. Signed-off-by: Prasad Sodagudi Signed-off-by: Isaac J. Manjarres [vkoul: add missing nodes of gpio range and reserved rewrote function names and order them] Signed-off-by: Vinod Koul Link: https://lore.kernel.org/r/20190702105045.27646-3-vkoul@kernel.org Reviewed-by: Bjorn Andersson Signed-off-by: Linus Walleij commit 80327437e377bd4d3f696ccec94b78895e6359f9 Author: Vinod Koul Date: Tue Jul 2 16:20:43 2019 +0530 dt-bindings: pinctrl: qcom: Document missing gpio nodes The bindings for msm8998-pinctrl was missing gpio-ranges and gpio-reserved-ranges, so document them as well Signed-off-by: Vinod Koul Link: https://lore.kernel.org/r/20190702105045.27646-2-vkoul@kernel.org Reviewed-by: Bjorn Andersson Signed-off-by: Linus Walleij commit 5099837d2f809c75d45efa32595c712ca245a432 Author: Martin Blumenstingl Date: Wed Jul 3 00:32:48 2019 +0200 gpio: stp-xway: allow compile-testing Enable compile-testing of the stp-xway GPIO driver now that it does not depend on any architecture specific includes anymore. Signed-off-by: Martin Blumenstingl Link: https://lore.kernel.org/r/20190702223248.31934-5-martin.blumenstingl@googlemail.com Signed-off-by: Linus Walleij commit c0ec7012385939d0c885c976c8849084d7aeb2fb Author: Martin Blumenstingl Date: Wed Jul 3 00:32:47 2019 +0200 gpio: stp-xway: get rid of the #include dependency Use the xway_stp_{r,w}32 helpers in xway_stp_w32_mask instead of relying on ltq_{r,w}32 from the architecture specific . This will allow the driver to be compile-tested on all architectures that support MMIO. Signed-off-by: Martin Blumenstingl Link: https://lore.kernel.org/r/20190702223248.31934-4-martin.blumenstingl@googlemail.com Signed-off-by: Linus Walleij commit bd791c48808a1f39a768a0096940d71e05bb0889 Author: Martin Blumenstingl Date: Wed Jul 3 00:32:46 2019 +0200 gpio: stp-xway: improve module clock error handling Three module clock error handling improvements: - use devm_clk_get() so the clock instance can be freed if devm_gpiochip_add_data() fails later on - switch to clk_prepare_enable() so the driver is ready whenever the lantiq target switches to the common clock framework - disable the clock again (using clk_disable_unprepare()) if devm_gpiochip_add_data() All of these are virtually no-ops with the current lantiq target. However, these will be relevant if we switch to the common clock framework. Signed-off-by: Martin Blumenstingl Link: https://lore.kernel.org/r/20190702223248.31934-3-martin.blumenstingl@googlemail.com Signed-off-by: Linus Walleij commit 8a7b179781e865ca2c7fe4ce9a7976f45c070f53 Author: Martin Blumenstingl Date: Wed Jul 3 00:32:45 2019 +0200 gpio: stp-xway: simplify error handling in xway_stp_probe() Return early if devm_gpiochip_add_data() returns an error instead of having two consecutive "if (!ret) ..." statements. Also make xway_stp_hw_init() return void because it unconditionally returns 0. While here also update the kerneldoc comment for xway_stp_hw_init(). These changes makes the error handling within the driver consistent. No functional changes intended. Signed-off-by: Martin Blumenstingl Link: https://lore.kernel.org/r/20190702223248.31934-2-martin.blumenstingl@googlemail.com Signed-off-by: Linus Walleij commit 827a9b8bbfdc976775eb0dc650d8485081271e27 Author: Geert Uytterhoeven Date: Mon Jul 1 16:28:09 2019 +0200 gpiolib: Clarify use of non-sleeping functions Obviously functions that are safe to be called from atomic contexts, can be called from non-atomic contexts, too. Signed-off-by: Geert Uytterhoeven Link: https://lore.kernel.org/r/20190701142809.25308-1-geert+renesas@glider.be Signed-off-by: Linus Walleij commit 3285170f28a850638794cdfe712eb6d93e51e706 Author: Geert Uytterhoeven Date: Mon Jul 1 16:27:38 2019 +0200 gpiolib: Fix references to gpiod_[gs]et_*value_cansleep() variants Commit 372e722ea4dd4ca1 ("gpiolib: use descriptors internally") renamed the functions to use a "gpiod" prefix, and commit 79a9becda8940deb ("gpiolib: export descriptor-based GPIO interface") introduced the "raw" variants, but both changes forgot to update the comments. Readd a similar reference to gpiod_set_value(), which was accidentally removed by commit 1e77fc82110ac36f ("gpio: Add missing open drain/source handling to gpiod_set_value_cansleep()"). Signed-off-by: Geert Uytterhoeven Link: https://lore.kernel.org/r/20190701142738.25219-1-geert+renesas@glider.be Signed-off-by: Linus Walleij commit f99d479bcb78ecc0243f1fcc53d7081fa150d7eb Author: Geert Uytterhoeven Date: Mon Jul 1 16:26:50 2019 +0200 gpiolib: Document new gpio_chip.init_valid_mask field A new field init_valid_mask was added to struct gpio_chip, but it was not documented. Fixes: f8ec92a9f63b3b11 ("gpiolib: Add init_valid_mask exported function") Signed-off-by: Geert Uytterhoeven Link: https://lore.kernel.org/r/20190701142650.25122-1-geert+renesas@glider.be Signed-off-by: Linus Walleij commit 01f14c52591dd9028b93d0641136a34b388b773d Author: Geert Uytterhoeven Date: Mon Jul 1 16:10:05 2019 +0200 Documentation: gpio: Fix reference to gpiod_get_array() The function is called gpiod_get_array(), not gpiod_array_get(). Fixes: 77588c14ac868cae ("gpiolib: Pass array info to get/set array functions") Signed-off-by: Geert Uytterhoeven Link: https://lore.kernel.org/r/20190701141005.24631-1-geert+renesas@glider.be Signed-off-by: Linus Walleij commit c197922f0a8072d286dff8001f8ad0d4b95ec1dd Author: Geliang Tang Date: Tue Dec 20 22:02:17 2016 +0800 powerpc/perf/24x7: use rb_entry To make the code clearer, use rb_entry() instead of container_of() to deal with rbtree. Signed-off-by: Geliang Tang Signed-off-by: Michael Ellerman commit 7505a13f85bdcb8713551a067dfc92ac3c7ba902 Author: Anton Blanchard Date: Tue Jun 4 15:42:57 2019 +1000 powerpc/configs: Disable latencytop latencytop adds almost 4kB to each and every task struct and as such it doesn't deserve to be in our defconfigs. Signed-off-by: Anton Blanchard Signed-off-by: Michael Ellerman commit 4f44e8aeaf1937d9148dfcc4c028cd8aff27902e Author: Enrico Weigelt, metux IT consult Date: Wed Jul 3 18:04:13 2019 +0200 powerpc/Kconfig: Clean up formatting Formatting of Kconfig files doesn't look so pretty, so let the Great White Handkerchief come around and clean it up. Also convert "---help---" as requested. Signed-off-by: Enrico Weigelt, metux IT consult Signed-off-by: Michael Ellerman commit d71cac5971192049a3a375a2e68b63f4092bd6a1 Author: Greg Kroah-Hartman Date: Thu Jul 4 08:32:10 2019 +0200 ubifs: fix build warning after debugfs cleanup patch Stephen writes: After merging the driver-core tree, today's linux-next build (arm multi_v7_defconfig) produced this warning: fs/ubifs/debug.c: In function 'dbg_debugfs_init_fs': fs/ubifs/debug.c:2812:6: warning: unused variable 'err' [-Wunused-variable] int err, n; ^~~ So fix this up properly. Reported-by: Stephen Rothwell Cc: Richard Weinberger Cc: Artem Bityutskiy Cc: Adrian Hunter Cc: linux-mtd@lists.infradead.org Signed-off-by: Greg Kroah-Hartman commit f017da5c7077bddbe0c351cd32b7c7dc18ed2175 Author: Krzysztof Kozlowski Date: Thu Jul 4 13:33:52 2019 +0800 nios2: configs: Remove useless UEVENT_HELPER_PATH Remove the CONFIG_UEVENT_HELPER_PATH because: 1. It is disabled since commit 1be01d4a5714 ("driver: base: Disable CONFIG_UEVENT_HELPER by default") as its dependency (UEVENT_HELPER) was made default to 'n', 2. It is not recommended (help message: "This should not be used today [...] creates a high system load") and was kept only for ancient userland, 3. Certain userland specifically requests it to be disabled (systemd README: "Legacy hotplug slows down the system and confuses udev"). Signed-off-by: Krzysztof Kozlowski Signed-off-by: Ley Foon Tan commit 4cf643a39221af24a151ad2cff4e3f95f12f368e Merge: 44c153671296 440e80ce02cd Author: Dave Airlie Date: Thu Jul 4 14:52:50 2019 +1000 Merge tag 'drm-next-5.3-2019-06-27' of git://people.freedesktop.org/~agd5f/linux into drm-next drm-next-5.3-2019-06-27: amdgpu: - Fix warning on 32 bit ARM - Fix compilation on big endian - Misc bug fixes ttm: - Live lock fix Signed-off-by: Dave Airlie From: Alex Deucher Link: https://patchwork.freedesktop.org/patch/msgid/20190628015555.3384-1-alexander.deucher@amd.com commit 44c153671296ecdee7c75aaf778f054ffaf1ee00 Merge: f07b56e7d0b2 daed277e4d5a Author: Dave Airlie Date: Thu Jul 4 14:19:40 2019 +1000 Merge tag 'drm-misc-next-fixes-2019-06-27' of git://anongit.freedesktop.org/drm/drm-misc into drm-next drm-misc-next-fixes for v5.3: - Fixes to the tfp410 bridge. - Small build fix for vga_switcheroo to prevent building against modular fbcon. Signed-off-by: Dave Airlie From: Maarten Lankhorst Link: https://patchwork.freedesktop.org/patch/msgid/20a62234-bc27-00eb-e0e2-22b55eec1cb2@linux.intel.com commit f07b56e7d0b21b49d809b301837c6ba39c27309a Merge: a22719cce54b 837567c1e9d5 Author: Dave Airlie Date: Thu Jul 4 14:08:07 2019 +1000 Merge tag 'for-airlie-armada' of git://git.armlinux.org.uk/~rmk/linux-arm into drm-next Armada DRM updates: - Fix interlace support. - use __drm_atomic_helper_plane_reset in overlay reset. - since the overlay and video planes use essentially the same format registers, precompute their values while validating. - fix a long-standing deficiency with overlay planes and interlace modes - calculate plane starting address at atomic_check stage rather than when we're programming the registers. - add gamma support. - ensure mode adjustments made by other components are properly handled in the driver and applied to the CRTC-programmed mode. - add and use register definitions for the "REG4F" register. - use drm_atomic_helper_shutdown() when tearing down to ensure that the hardware is properly shutdown. - add CRTC-level mode validation to ensure that we don't allow a mode that the CRTC-level hardware can not support. - improve the clocking selection for Armada 510 support. - move CRTC debugfs files into the crtc-specific directory, using the DRM helper to create these files. - patch from Lubomir Rintel to replace a simple framebuffer. - use the OF graph walker rather than open-coding this. - eliminate a useless check for the availability of the remote's parent which isn't required. Signed-off-by: Dave Airlie From: Russell King Link: https://patchwork.freedesktop.org/patch/msgid/20190702091313.GA23442@rmk-PC.armlinux.org.uk commit fba9760a433634067ec01e7d4cdd581d17b149e0 Author: Darrick J. Wong Date: Wed Jul 3 20:36:28 2019 -0700 xfs: wire up the v5 inumbers ioctl Wire up the v5 INUMBERS ioctl. Signed-off-by: Darrick J. Wong Reviewed-by: Brian Foster commit 0448b6f488fa66e353a9e00022441cd4aca7f2cf Author: Darrick J. Wong Date: Wed Jul 3 20:36:27 2019 -0700 xfs: wire up new v5 bulkstat ioctls Wire up the new v5 BULKSTAT ioctl. Signed-off-by: Darrick J. Wong Reviewed-by: Brian Foster commit 5f19c7fc6873351a3d81bbbb98c928343902d8d6 Author: Darrick J. Wong Date: Wed Jul 3 20:36:27 2019 -0700 xfs: introduce v5 inode group structure Introduce a new "v5" inode group structure that fixes the alignment and padding problems of the existing structure. Signed-off-by: Darrick J. Wong Reviewed-by: Brian Foster commit 7035f9724f8497c709077c08df2073bfcde9c2f5 Author: Darrick J. Wong Date: Wed Jul 3 20:36:26 2019 -0700 xfs: introduce new v5 bulkstat structure Introduce a new version of the in-core bulkstat structure that supports our new v5 format features. This structure also fills the gaps in the previous structure. We leave wiring up the ioctls for the next patch. Signed-off-by: Darrick J. Wong Reviewed-by: Allison Collins Reviewed-by: Brian Foster commit 8bfe9d1810e657aaa1b4137f43fae83560e6d71d Author: Darrick J. Wong Date: Wed Jul 3 20:36:26 2019 -0700 xfs: rename bulkstat functions Rename the bulkstat functions to 'fsbulkstat' so that they match the ioctl names. We will be introducing a new set of bulkstat/inumbers ioctls soon, and it will be important to keep the names straight. Signed-off-by: Darrick J. Wong Reviewed-by: Allison Collins Reviewed-by: Brian Foster commit 6f71fb683879c78ba356ca78f2972289443f26eb Author: Darrick J. Wong Date: Wed Jul 3 20:36:25 2019 -0700 xfs: remove various bulk request typedef usage Remove xfs_bstat_t, xfs_fsop_bulkreq_t, xfs_inogrp_t, and similarly named compat typedefs. Signed-off-by: Darrick J. Wong Reviewed-by: Allison Collins Reviewed-by: Brian Foster commit 029f162ab09d254e03050908c8554f6328d3908a Author: Masahiro Yamada Date: Fri Jun 14 14:04:23 2019 +0800 nios2: remove pointless second entry for CONFIG_TRACE_IRQFLAGS_SUPPORT Strangely enough, NIOS2 defines TRACE_IRQFLAGS_SUPPORT twice with different values, which is pointless and confusing. [1] arch/nios2/Kconfig config TRACE_IRQFLAGS_SUPPORT def_bool n [2] arch/nios2/Kconfig.debug config TRACE_IRQFLAGS_SUPPORT def_bool y [1] is included before [2]. In the Kconfig syntax, the first one is effective. So, TRACE_IRQFLAGS_SUPPORT is always 'n'. The second define in arch/nios2/Kconfig.debug is dead code. Signed-off-by: Masahiro Yamada Signed-off-by: Ley Foon Tan commit b27aca2e555f87d384cdf60059dd1a1b61c215ef Author: Arnd Bergmann Date: Wed Jul 3 17:30:59 2019 +0200 soc: rockchip: work around clang warning clang emits a warning about a negative shift count for an unused part of a conditional constant expression: drivers/soc/rockchip/pm_domains.c:795:21: error: shift count is negative [-Werror,-Wshift-count-negative] [RK3328_PD_VIO] = DOMAIN_RK3328(-1, 8, 8, false), ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/soc/rockchip/pm_domains.c:129:2: note: expanded from macro 'DOMAIN_RK3328' DOMAIN_M(pwr, pwr, req, (req) + 10, req, wakeup) ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/soc/rockchip/pm_domains.c:105:33: note: expanded from macro 'DOMAIN_M' .status_mask = (status >= 0) ? BIT(status) : 0, \ ^~~~~~~~~~~ include/linux/bits.h:6:24: note: expanded from macro 'BIT' This is a bug in clang that will be fixed in the future, but in order to build cleanly with clang-8, it would be helpful to shut up this warning. This file is the only instance reported by kernelci at the moment. The best solution I could come up with is to move the BIT() usage out of the macro into the instantiation, so we can avoid using BIT(-1). Link: https://lore.kernel.org/r/20190703153112.2767411-1-arnd@arndb.de Link: https://bugs.llvm.org/show_bug.cgi?id=38789 Signed-off-by: Arnd Bergmann Reviewed-by: Nathan Chancellor Signed-off-by: Olof Johansson commit a22719cce54bc18001a7c8be9c713ba629f5801c Merge: 53e155f2bbd4 156bdac99061 Author: Dave Airlie Date: Thu Jul 4 11:46:02 2019 +1000 Merge tag 'exynos-drm-next-for-v5.3' of git://git.kernel.org/pub/scm/linux/kernel/git/daeinki/drm-exynos into drm-next - Drop the use of drmP.h header file drmP.h header file has been deprecated so this patch drops the use of this header, and instead includes appropriate header files required. - Add COMPILE_TEST flag This patch adds COMPILE_TEST dependency to exynos drm driver to increase build test coverage. And also, it includes vmalloc.h header file to fix one build warning which is introduced when building the Linux kernel using sh. Signed-off-by: Dave Airlie From: Inki Dae Link: https://patchwork.freedesktop.org/patch/msgid/CAAQKjZMdBdD8oEa0cNv78FjrpOqu20ozTTvuPEm_XnVo2gRhCQ@mail.gmail.com commit 791234448d4798f589110c17d2baaf1bbcc56cb8 Author: J. Bruce Fields Date: Wed Jun 5 12:42:05 2019 -0400 nfsd: decode implementation id Decode the implementation ID and display in nfsd/clients/#/info. It may be help identify the client. It won't be used otherwise. (When this went into the protocol, I thought the implementation ID would be a slippery slope towards implementation-specific workarounds as with the http user-agent. But I guess I was wrong, the risk seems pretty low now.) Signed-off-by: J. Bruce Fields commit 6f7b841bc939e7c811ad32427b58d54edbcfa6ed Author: Vadim Fedorenko Date: Mon Jul 1 19:49:34 2019 +0300 ipvs: allow tunneling with gre encapsulation windows real servers can handle gre tunnels, this patch allows gre encapsulation with the tunneling method, thereby letting ipvs be load balancer for windows-based services Signed-off-by: Vadim Fedorenko Acked-by: Julian Anastasov Signed-off-by: Simon Horman Signed-off-by: Pablo Neira Ayuso commit 0d9cb300acad29f25ea23d2592e69970bc61f14c Author: Florian Westphal Date: Tue Jul 2 20:41:14 2019 +0200 netfilter: nf_queue: remove unused hook entries pointer Its not used anywhere, so remove this. Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit eca27f14b1168a8962023571b29d2ec593788b61 Author: Markus Elfring Date: Tue Jul 2 20:06:30 2019 +0200 netfilter: nf_log: Replace a seq_printf() call by seq_puts() in seq_show() A string which did not contain a data format specification should be put into a sequence. Thus use the corresponding function “seq_puts”. This issue was detected by using the Coccinelle software. Signed-off-by: Markus Elfring Signed-off-by: Pablo Neira Ayuso commit f0c1aab2bd1ad131d9d7528b9dcbf9253a74e5da Author: Pablo Neira Ayuso Date: Fri Jun 21 17:37:48 2019 +0200 netfilter: rename nf_SYNPROXY.h to nf_synproxy.h Uppercase is a reminiscence from the iptables infrastructure, rename this header before this is included in stable kernels. Signed-off-by: Pablo Neira Ayuso commit 876a0600896c1857c79cb58625ff012b27fea9fd Author: Nathan Chancellor Date: Thu Jun 27 12:14:48 2019 -0700 kbuild: Add ability to test Clang's integrated assembler There are some people interested in experimenting with Clang's integrated assembler. To make it easy to do so without source modification, allow the user to specify 'AS=clang' as part of the make command to avoid adding '-no-integrated-as' to the {A,C}FLAGS. Link: https://github.com/ClangBuiltLinux/linux/issues/577 Suggested-by: Dmitry Golovin Signed-off-by: Nathan Chancellor Reviewed-by: Nick Desaulniers Tested-by: Nick Desaulniers Signed-off-by: Masahiro Yamada commit 9aa0cf79568e7078c32710034b0df8946db6cdad Author: Srinivas Kandagatla Date: Wed Jul 3 13:31:02 2019 +0100 ASoC: qdsp6: q6afe-dai: Add missing Slimbus0 audio route For some reason SLIMBus RX0 playback is not added to audio routes. This patch adds the missing route. Signed-off-by: Srinivas Kandagatla Link: https://lore.kernel.org/r/20190703123102.12626-1-srinivas.kandagatla@linaro.org Signed-off-by: Mark Brown commit 74b35a74f80e02bdd69db9cf96d3f4fe78b67064 Author: Srinivas Kandagatla Date: Wed Jul 3 13:30:02 2019 +0100 ASoC: core: Return -ENOTSUPP from set_channel_map() if no operation provided It makes it easier for common code to work with snd_soc_dai_set_channel_map() by distinguishing between operation not being supported and an error. This is done inline with others snd_soc_dai.* apis. Signed-off-by: Srinivas Kandagatla Link: https://lore.kernel.org/r/20190703123002.12427-1-srinivas.kandagatla@linaro.org Signed-off-by: Mark Brown commit 02a93f35f57fe5d4d1bac0ac8496884235e2fd2e Author: Bob Moore Date: Wed Jul 3 13:15:40 2019 -0700 ACPICA: Update version to 20190703 ACPICA commit 450ffd8b9c100db561ecf23063620cb107d68c30 Version 20190703. Link: https://github.com/acpica/acpica/commit/450ffd8b Signed-off-by: Bob Moore Signed-off-by: Erik Schmauss Signed-off-by: Rafael J. Wysocki commit c522ad0637cacca1775a3849c2b554f46577b98d Author: Erik Schmauss Date: Wed Jul 3 13:15:39 2019 -0700 ACPICA: Update table load object initialization ACPICA commit c7ef9f3526765bed8930825dda1eed1a274b9668 Use the common internal "initialize objects" interface Affects: Load() load_table() acpi_load_table Link: https://github.com/acpica/acpica/commit/c7ef9f35 Signed-off-by: Bob Moore Signed-off-by: Erik Schmauss Signed-off-by: Rafael J. Wysocki commit 86a33cf3b6dc8733295bc7b54d090833f4d7109c Author: Bob Moore Date: Wed Jul 3 13:15:38 2019 -0700 ACPICA: Update for object initialization sequence ACPICA commit 106c72a97f5ca972f29956e5e9a0429b8c4a2723 1) Do not allow the objects to be initialized twice 2) Only package objects require a deferred initialization 3) Cleanup initialization output Link: https://github.com/acpica/acpica/commit/106c72a9 Signed-off-by: Bob Moore Signed-off-by: Erik Schmauss Signed-off-by: Rafael J. Wysocki commit 8894f52a14277701caab1827d21173101518e140 Author: Erik Schmauss Date: Wed Jul 3 13:15:37 2019 -0700 ACPICA: remove legacy module-level code due to deprecation ACPICA commit 1ca34b1a7b960ef321eae5dcddfff77707c88aef There have been several places that have been calling functions regarding module level code blocks. This change removes all old vestiges in the codebase. This is dead code. Link: https://github.com/acpica/acpica/commit/1ca34b1a Signed-off-by: Erik Schmauss Signed-off-by: Bob Moore Signed-off-by: Rafael J. Wysocki commit f79c8e4136eac37255ead8875593ae33a2c16d20 Author: Bob Moore Date: Wed Jul 3 13:15:36 2019 -0700 ACPICA: Namespace: simplify creation of the initial/default namespace ACPICA commit 76658f55d8cc498a763bdb92f8e0d934822a129c For the objects that are created by default (_GPE, _SB_, etc) there is no need to use the heavyweight ns_lookup function. Instead, simply create each object and link it in as the namespace is built. Link: https://github.com/acpica/acpica/commit/76658f55 Signed-off-by: Bob Moore Signed-off-by: Erik Schmauss Signed-off-by: Rafael J. Wysocki commit d4ca763eed3bcc227f220beb11ff4eb2fa548755 Merge: 44758bafa536 d06c47e3dd07 Author: Rafael J. Wysocki Date: Thu Jul 4 00:59:15 2019 +0200 Merge ACPI tables handling changes for v5.3. commit 2ee7a4ef98e309a1f496be2b0bf9307b5a7a31e5 Author: Christoph Hellwig Date: Sun Jun 30 18:43:47 2019 +0200 MIPS: only select ARCH_HAS_UNCACHED_SEGMENT for non-coherent platforms While mips might architecturally have the uncached segment all the time, the infrastructure to use it is only need on platforms where DMA is at least partially incoherent. Only select it for those configuration to fix a build failure as the arch_dma_prep_coherent symbol is also only provided for non-coherent platforms. Fixes: 2e96e04d25ca ("MIPS: use the generic uncached segment support in dma-direct") Reported-by: Guenter Roeck Signed-off-by: Christoph Hellwig Acked-by: Paul Burton Tested-by: Guenter Roeck commit 9e953cda5cdf1c230a3c9b7fc4d5e94f15885a9b Author: Alexandre Ghiti Date: Sun May 26 08:50:38 2019 -0400 riscv: Introduce huge page support for 32/64bit kernel This patch implements both 4MB huge page support for 32bit kernel and 2MB/1GB huge pages support for 64bit kernel. Signed-off-by: Alexandre Ghiti Reviewed-by: Christoph Hellwig Signed-off-by: Paul Walmsley commit 3876d4a38ae22bb56311abf5ea418eac46090c00 Author: Alexandre Ghiti Date: Thu Jun 27 15:00:11 2019 -0700 x86, arm64: Move ARCH_WANT_HUGE_PMD_SHARE config in arch/Kconfig ARCH_WANT_HUGE_PMD_SHARE config was declared in both architectures: move this declaration in arch/Kconfig and make those architectures select it. Signed-off-by: Alexandre Ghiti Reviewed-by: Palmer Dabbelt Acked-by: Ingo Molnar Acked-by: Catalin Marinas # for arm64 Reviewed-by: Hanjun Guo Reviewed-by: Christoph Hellwig Signed-off-by: Paul Walmsley commit 6f4859b8a72638f60c7051247aac63a761f01933 Author: J. Bruce Fields Date: Wed Jun 19 14:30:33 2019 -0400 nfsd: create xdr_netobj_dup helper Move some repeated code to a common helper. No change in behavior. Signed-off-by: J. Bruce Fields commit 89c905beccbbafa88490c8c4c35eaec5ce4c1329 Author: J. Bruce Fields Date: Wed Jun 19 12:43:11 2019 -0400 nfsd: allow forced expiration of NFSv4 clients NFSv4 clients are automatically expired and all their locks removed if they don't contact the server for a certain amount of time (the lease period, 90 seconds by default). There can still be situations where that's not enough, so allow userspace to force expiry by writing "expire\n" to the new nfsd/client/#/ctl file. (The generic "ctl" name is because I expect we may want to allow other operations on clients in the future.) The write will not return until the client is expired and all of its locks and other state removed. The fault injection code also provides a way of expiring clients, but it fails if there are any in-progress RPC's referencing the client. Also, its method of selecting a client to expire is a little more primitive--it uses an IP address, which can't always uniquely specify an NFSv4 client. Signed-off-by: J. Bruce Fields commit a204f25e372d942245dc0fdccd12f5c16483bbc1 Author: J. Bruce Fields Date: Wed Jun 19 12:54:45 2019 -0400 nfsd: create get_nfsdfs_clp helper Factor our some common code. No change in behavior. Signed-off-by: J. Bruce Fields commit 0c4b62b042fe3a4a0b18449eae26989611955db1 Author: J. Bruce Fields Date: Tue May 14 15:52:57 2019 -0400 nfsd4: show layout stateids These are also minimal for now, I'm not sure what information would be useful. Signed-off-by: J. Bruce Fields commit 16d36e099980d825feb5b851f06d714a6519b85b Author: J. Bruce Fields Date: Fri May 10 15:27:50 2019 -0400 nfsd: show lock and deleg stateids These entries are pretty minimal for now. Signed-off-by: J. Bruce Fields commit 78599c42ae3c70300a38b0d1271a85bc9f2d704a Author: J. Bruce Fields Date: Mon Apr 22 15:26:23 2019 -0400 nfsd4: add file to display list of client's opens Add a nfsd/clients/#/opens file to list some information about all the opens held by the given client, including open modes, device numbers, inode numbers, and open owners. Open owners are totally opaque but seem to sometimes have some useful ascii strings included, so passing through printable ascii characters and escaping the rest seems useful while still being machine-readable. Signed-off-by: J. Bruce Fields commit 169319f13cb874e90471463ba4a8d5689c23de2d Author: J. Bruce Fields Date: Wed Jun 19 12:39:46 2019 -0400 nfsd: add more information to client info file Add ip address, full client-provided identifier, and minor version. There's much more that could possibly be useful but this is a start. Signed-off-by: J. Bruce Fields commit ea053e164cc812f0c00a58cbbf8c65e27ceb6148 Author: J. Bruce Fields Date: Wed Jun 19 12:30:13 2019 -0400 nfsd: escape high characters in binary data I'm exposing some information about NFS clients in pseudofiles. I expect to eventually have simple tools to help read those pseudofiles. But it's also helpful if the raw files are human-readable to the extent possible. It aids debugging and makes them usable on systems that don't have the latest nfs-utils. A minor challenge there is opaque client-generated protocol objects like state owners and client identifiers. Some clients generate those to include handy information in plain ascii. But they may also include arbitrary byte sequences. I think the simplest approach is to limit to isprint(c) && isascii(c) and escape everything else. That means you can just cat the file and get something that looks OK. Also, I'm trying to keep these files legal YAML, which requires them to UTF-8, and this is a simple way to guarantee that. Acked-by: Kees Cook Signed-off-by: J. Bruce Fields commit 3bade247fcb18c9f31e59b46fb2d67ed6b2f7cef Author: J. Bruce Fields Date: Tue May 14 21:38:11 2019 -0400 nfsd: copy client's address including port number to cl_addr rpc_copy_addr() copies only the IP address and misses any port numbers. It seems potentially useful to keep the port number around too. Signed-off-by: J. Bruce Fields commit 97ad4031e29521894fc28765f14247e79b0ef263 Author: J. Bruce Fields Date: Tue Apr 9 15:56:57 2019 -0400 nfsd4: add a client info file Add a new nfsd/clients/#/info file with some basic information about each NFSv4 client. Signed-off-by: J. Bruce Fields commit bf5ed3e3bb84c39d70ad10b2f8e47ec62f4c63b1 Author: J. Bruce Fields Date: Thu Mar 14 16:20:19 2019 -0400 nfsd: make client/ directory names small ints We want clientid's on the wire to be randomized for reasons explained in ebd7c72c63ac "nfsd: randomize SETCLIENTID reply to help distinguish servers". But I'd rather have mostly small integers for the clients/ directory. Signed-off-by: J. Bruce Fields commit e8a79fb14f6b76b502218fce10696f4df9ff19b1 Author: J. Bruce Fields Date: Fri Mar 22 11:11:06 2019 -0400 nfsd: add nfsd/clients directory I plan to expose some information about nfsv4 clients here. Signed-off-by: J. Bruce Fields commit 59f8e91b75ecf16f22d62eca0659c13901eff5f3 Author: J. Bruce Fields Date: Wed Mar 20 20:03:02 2019 -0400 nfsd4: use reference count to free client Keep a second reference count which is what is really used to decide when to free the client's memory. Next I'm going to add an nfsd/clients/ directory with a subdirectory for each NFSv4 client. File objects under nfsd/clients/ will hold these references. Signed-off-by: J. Bruce Fields commit 14ed14cc7c062bbed7821be0a93938dc78a49803 Author: J. Bruce Fields Date: Wed Mar 20 11:54:11 2019 -0400 nfsd: rename cl_refcount Rename this to a more descriptive name: it counts the number of in-progress rpc's referencing this client. Next I'm going to add a second refcount with a slightly different use. Signed-off-by: J. Bruce Fields commit 2c830dd7209bf67863ae0b83c7dde847967ea43c Author: J. Bruce Fields Date: Fri Dec 14 09:40:56 2018 -0500 nfsd: persist nfsd filesystem across mounts Keep around one internal mount of the nfsd filesystem so that we can add stuff to it when clients come and go, regardless of whether anyone has it mounted. Signed-off-by: J. Bruce Fields commit 855c9e766a358b72c7acd4a43fd524d0942a4278 Author: J. Bruce Fields Date: Tue Jun 18 16:43:11 2019 -0400 nfs: fix out-of-date connectathon talk URL Reported-by: David Wysochanski Signed-off-by: J. Bruce Fields commit 689d7ba4895b803244f596e56ffa3d9e4f24acdc Author: J. Bruce Fields Date: Wed Jun 5 18:03:52 2019 -0400 nfsd: fix cleanup of nfsd_reply_cache_init on failure The failure to unregister the shrinker results will result in corruption when the nfsd_net is freed. Also clean up the drc_slab while we're here. Reported-by: syzbot+83a43746cebef3508b49@syzkaller.appspotmail.com Fixes: db17b61765c2 ("nfsd4: drc containerization") Signed-off-by: J. Bruce Fields commit 30498dcc12e5fd0aa7395ef80da8466854ff6a41 Author: J. Bruce Fields Date: Wed Jun 5 12:50:02 2019 -0400 nfsd4: remove outdated nfsd4_decode_time comment Commit bf8d909705e "nfsd: Decode and send 64bit time values" fixed the code without updating the comment. Signed-off-by: J. Bruce Fields commit bdba53687e450dcbae614ba06d0bc8be5e4e34c5 Author: J. Bruce Fields Date: Wed Jun 5 14:17:42 2019 -0400 nfsd: use 64-bit seconds fields in nfsd v4 code After commit 95582b008388 "vfs: change inode times to use struct timespec64" there are spots in the NFSv4 decoding where we decode the protocol into a struct timeval and then convert that into a timeval64. That's unnecesary in the NFSv4 case since the on-the-wire protocol also uses 64-bit values. So just fix up our code to use timeval64 everywhere. Signed-off-by: J. Bruce Fields commit e977cc8308620c4839a8bd4069625f93c458a586 Author: Geert Uytterhoeven Date: Mon May 27 14:21:32 2019 +0200 nfsd: Spelling s/EACCESS/EACCES/ The correct spelling is EACCES: include/uapi/asm-generic/errno-base.h:#define EACCES 13 /* Permission denied */ Signed-off-by: Geert Uytterhoeven Signed-off-by: J. Bruce Fields commit 291adeb25481d6d515d1bafbcbddbf2cf5f74574 Author: YueHaibing Date: Tue May 28 17:06:52 2019 +0800 lockd: Make two symbols static Fix sparse warnings: fs/lockd/clntproc.c:57:6: warning: symbol 'nlmclnt_put_lockowner' was not declared. Should it be static? fs/lockd/svclock.c:409:35: warning: symbol 'nlmsvc_lock_ops' was not declared. Should it be static? Reported-by: Hulk Robot Signed-off-by: YueHaibing Signed-off-by: J. Bruce Fields commit f85d93385e9fe6886a751f647f6812a89bf6bee3 Author: Benjamin Coddington Date: Thu May 23 10:45:48 2019 -0400 locks: Cleanup lm_compare_owner and lm_owner_key After the update to use nlm_lockowners for the NLM server, there are no more users of lm_compare_owner and lm_owner_key. Signed-off-by: Benjamin Coddington Signed-off-by: J. Bruce Fields commit 646d73e91b4222ea972953bad4374a5ca903e79d Author: Benjamin Coddington Date: Thu May 23 10:45:47 2019 -0400 lockd: Show pid of lockd for remote locks Use the pid of lockd instead of the remote lock's svid for the fl_pid for local POSIX locks. This allows proper enumeration of which local process owns which lock. The svid is meaningless to local lock readers. Signed-off-by: Benjamin Coddington Signed-off-by: J. Bruce Fields commit 9adfac6d730db5e9c4c294798f5f191b621f8bc3 Author: Benjamin Coddington Date: Thu May 23 10:45:46 2019 -0400 lockd: Remove lm_compare_owner and lm_owner_key Now that the NLM server allocates an nlm_lockowner for fl_owner, there's no need for special hashing or comparison. Signed-off-by: Benjamin Coddington Signed-off-by: J. Bruce Fields commit 89e0edfbea103d9b274efa10a8fc7a88bdac8f76 Author: Benjamin Coddington Date: Thu May 23 10:45:45 2019 -0400 lockd: Convert NLM service fl_owner to nlm_lockowner Do as the NLM client: allocate and track a struct nlm_lockowner for use as the fl_owner for locks created by the NLM sever. This allows us to keep the svid within this structure for matching locks, and will allow us to track the pid of lockd in a future patch. It should also allow easier reference of the nlm_host in conflicting locks, and simplify lock hashing and comparison. Signed-off-by: Benjamin Coddington [bfields@redhat.com: fix type of some error returns] Signed-off-by: J. Bruce Fields commit 9de3ec1d57113e270638254868675d9c048b071e Author: Benjamin Coddington Date: Thu May 23 10:45:44 2019 -0400 lockd: prepare nlm_lockowner for use by the server The nlm_lockowner structure that the client uses to track locks is generally useful to the server as well. Very similar functions to handle allocation and tracking of the nlm_lockowner will follow. Rename the client functions for clarity. Signed-off-by: Benjamin Coddington Signed-off-by: J. Bruce Fields commit 22a46eb44016eec3384da3731a2d47a5d3c91955 Author: J. Bruce Fields Date: Fri May 17 16:22:18 2019 -0400 nfsd: note inadequate stats locking After 89a26b3d295d "nfsd: split DRC global spinlock into per-bucket locks", there is no longer a single global spinlock to protect these stats. So, really we need to fix that. For now, at least fix the comment. Signed-off-by: J. Bruce Fields commit 3ba75830ce175550ef45c6524ec62faab8f62c1b Author: J. Bruce Fields Date: Fri May 17 09:03:38 2019 -0400 nfsd4: drc containerization The nfsd duplicate reply cache should not be shared between network namespaces. The most straightforward way to fix this is just to move every global in the code to per-net-namespace memory, so that's what we do. Still todo: sort out which members of nfsd_stats should be global and which per-net-namespace. Signed-off-by: J. Bruce Fields commit b401170f6d9cd4270e0159d9b016f4ccb06caa85 Author: J. Bruce Fields Date: Thu May 16 14:24:40 2019 -0400 nfsd: don't call nfsd_reply_cache_shutdown twice The caller is cleaning up on ENOMEM, don't try to do it here too. Signed-off-by: J. Bruce Fields commit a51df9f8da43e8bf9e508143630849b7d696e053 Author: Colin Ian King Date: Wed Jul 3 17:50:37 2019 +0100 gve: fix -ENOMEM null check on a page allocation Currently the check to see if a page is allocated is incorrect and is checking if the pointer page is null, not *page as intended. Fix this. Addresses-Coverity: ("Dereference before null check") Fixes: f5cedc84a30d ("gve: Add transmit and receive support") Signed-off-by: Colin Ian King Signed-off-by: David S. Miller commit e227701c4583f0408cac33eca0fa96ac4b8ff7d9 Merge: 2559d7c4dd0e 6f24080e8a1e Author: David S. Miller Date: Wed Jul 3 13:51:54 2019 -0700 Merge branch 'net-ICW-sendmsg-recvmsg' Paolo Abeni says: ==================== net: use ICW for sk_proto->{send,recv}msg This series extends ICW usage to one of the few remaining spots in fast-path still hitting per packet retpoline overhead, namely the sk_proto->{send,recv}msg calls. The first 3 patches in this series refactor the existing code so that applying the ICW macros is straight-forward: we demux inet_{recv,send}msg in ipv4 and ipv6 variants so that each of them can easily select the appropriate TCP or UDP direct call. While at it, a new helper is created to avoid excessive code duplication, and the current ICWs for inet_{recv,send}msg are adjusted accordingly. The last 2 patches really introduce the new ICW use-case, respectively for the ipv6 and the ipv4 code path. This gives up to 5% performance improvement under UDP flood, and smaller but measurable gains for TCP RR workloads. v1 -> v2: - drop inet6_{recv,send}msg declaration from header file, prefer ICW macro instead - avoid unneeded reclaration for udp_sendmsg, as suggested by Willem ==================== Acked-by: Willem de Bruijn Signed-off-by: David S. Miller commit 6f24080e8a1e5572045067507c7905cbe6bc64cc Author: Paolo Abeni Date: Wed Jul 3 16:06:56 2019 +0200 ipv4: use indirect call wrappers for {tcp, udp}_{recv, send}msg() This avoids an indirect call per syscall for common ipv4 transports v1 -> v2: - avoid unneeded reclaration for udp_sendmsg, as suggested by Willem Signed-off-by: Paolo Abeni Signed-off-by: David S. Miller commit 164c51fe82de2265bd6b2aac3aaa45cc92fa28f4 Author: Paolo Abeni Date: Wed Jul 3 16:06:55 2019 +0200 ipv6: use indirect call wrappers for {tcp, udpv6}_{recv, send}msg() This avoids an indirect call per syscall for common ipv6 transports Signed-off-by: Paolo Abeni Signed-off-by: David S. Miller commit a648a592dc7c20873eb0aee78fa93e869714f42a Author: Paolo Abeni Date: Wed Jul 3 16:06:54 2019 +0200 net: adjust socket level ICW to cope with ipv6 variant of {recv, send}msg After the previous patch we have ipv{6,4} variants for {recv,send}msg, we should use the generic _INET ICW variant to call into the proper build-in. This also allows dropping the now unused and rather ugly _INET4 ICW macro v1 -> v2: - use ICW macro to declare inet6_{recv,send}msg - fix a couple of checkpatch offender in the code context Signed-off-by: Paolo Abeni Signed-off-by: David S. Miller commit 68ab5d1496a35f3a76b68fed57719bfc46a51e07 Author: Paolo Abeni Date: Wed Jul 3 16:06:53 2019 +0200 ipv6: provide and use ipv6 specific version for {recv, send}msg This will simplify indirect call wrapper invocation in the following patch. No functional change intended, any - out-of-tree - IPv6 user of inet_{recv,send}msg can keep using the existing functions. SCTP code still uses the existing version even for ipv6: as this series will not add ICW for SCTP, moving to the new helper would not give any benefit. The only other in-kernel user of inet_{recv,send}msg is pvcalls_conn_back_read(), but psvcalls explicitly creates only IPv4 socket, so no need to update that code path, too. v1 -> v2: drop inet6_{recv,send}msg declaration from header file, prefer ICW macro instead Signed-off-by: Paolo Abeni Signed-off-by: David S. Miller commit e473093639945cb0a07ad4d51d5fd3fc3c3708cf Author: Paolo Abeni Date: Wed Jul 3 16:06:52 2019 +0200 inet: factor out inet_send_prepare() The same code is replicated verbatim in multiple places, and the next patches will introduce an additional user for it. Factor out a helper and use it where appropriate. No functional change intended. Signed-off-by: Paolo Abeni Signed-off-by: David S. Miller commit 9d1bc24b52fb8c5d859f9a47084bf1179470e04c Author: Cong Wang Date: Mon Jul 1 20:40:24 2019 -0700 bonding: validate ip header before check IPPROTO_IGMP bond_xmit_roundrobin() checks for IGMP packets but it parses the IP header even before checking skb->protocol. We should validate the IP header with pskb_may_pull() before using iph->protocol. Reported-and-tested-by: syzbot+e5be16aa39ad6e755391@syzkaller.appspotmail.com Fixes: a2fd940f4cff ("bonding: fix broken multicast with round-robin mode") Cc: Jay Vosburgh Cc: Veaceslav Falico Cc: Andy Gospodarek Signed-off-by: Cong Wang Signed-off-by: David S. Miller commit 5832fdd35e61bf4793da0f0480fb873af645a7b4 Author: Yishai Hadas Date: Sun Jun 30 19:23:34 2019 +0300 IB/mlx5: DEVX cleanup mdev No need any more to hold mlx5_core_dev on the devx_object, it can be accessed from ib_dev. Signed-off-by: Yishai Hadas Signed-off-by: Leon Romanovsky Reviewed-by: Jason Gunthorpe Signed-off-by: Jason Gunthorpe commit ef1659ade3590e4a29a999c6f0cb2272857638a6 Author: Yishai Hadas Date: Sun Jun 30 19:23:33 2019 +0300 IB/mlx5: Add DEVX support for CQ events Add DEVX support for CQ events by creating and destroying the CQ via mlx5_core and set an handler to manage its completions. Signed-off-by: Yishai Hadas Signed-off-by: Leon Romanovsky Reviewed-by: Jason Gunthorpe Signed-off-by: Jason Gunthorpe commit 5ec9d8ee87c627a2c981d871e41f6e2a942f53fd Author: Yishai Hadas Date: Sun Jun 30 19:23:32 2019 +0300 IB/mlx5: Implement DEVX dispatching event Implement DEVX dispatching event by looking up for the applicable subscriptions for the reported event and using their target fd to signal/set the event. Signed-off-by: Yishai Hadas Signed-off-by: Leon Romanovsky Reviewed-by: Jason Gunthorpe Signed-off-by: Jason Gunthorpe commit 7597385371425febdaa8c6a1da3625d4ffff16f5 Author: Yishai Hadas Date: Sun Jun 30 19:23:31 2019 +0300 IB/mlx5: Enable subscription for device events over DEVX Enable subscription for device events over DEVX. Each subscription is added to the two level xarray data structure according to its event number and the DEVX object information in case was given with the given target fd. Those events will be reported over the given fd once will occur. Downstream patches will mange the dispatching to any subscription. Signed-off-by: Yishai Hadas Signed-off-by: Leon Romanovsky Reviewed-by: Jason Gunthorpe Signed-off-by: Jason Gunthorpe commit e337dd53ce4cc3db79e52704e554f648c46d5e91 Author: Yishai Hadas Date: Sun Jun 30 19:23:30 2019 +0300 IB/mlx5: Register DEVX with mlx5_core to get async events Register DEVX with with mlx5_core to get async events. This will enable to dispatch the applicable events to its consumers in down stream patches. Signed-off-by: Yishai Hadas Signed-off-by: Leon Romanovsky Reviewed-by: Jason Gunthorpe Signed-off-by: Jason Gunthorpe commit 2afc5e1b9c340ff20848c8dd8fb60342617bce52 Author: Yishai Hadas Date: Sun Jun 30 19:23:29 2019 +0300 IB/mlx5: Introduce MLX5_IB_OBJECT_DEVX_ASYNC_EVENT_FD Introduce MLX5_IB_OBJECT_DEVX_ASYNC_EVENT_FD and its initial implementation. This object is from type class FD and will be used to read DEVX async events. Signed-off-by: Yishai Hadas Signed-off-by: Leon Romanovsky Reviewed-by: Jason Gunthorpe Signed-off-by: Jason Gunthorpe commit 0718edf528c552c66a5dc3525ffb145971efa766 Author: Tariq Toukan Date: Tue Jul 2 17:12:09 2019 +0300 net/mlx5: Properly name the generic WQE control field A generic WQE control field is used for different purposes in different cases. Use union to allow using the proper name in each case. Signed-off-by: Tariq Toukan Signed-off-by: Saeed Mahameed commit a12ff35e0fb770b4d060298be147189313ec002c Author: Eran Ben Elisha Date: Wed Apr 3 13:05:50 2019 +0300 net/mlx5: Introduce TLS TX offload hardware bits and structures Add TLS offload related IFC structs, layouts and enumerations. Signed-off-by: Eran Ben Elisha Signed-off-by: Tariq Toukan Signed-off-by: Saeed Mahameed commit dd28087c14777a7f2571260d44394eb709a59368 Author: Parav Pandit Date: Fri Jun 7 07:16:58 2019 -0500 net/mlx5: Refactor mlx5_esw_query_functions for modularity Functions change event output data size changes when functions other than VFs will be enabled in HCA CAP. With current API, multiple callers needs to align, calculate accurate size of the output data depending on number on non VF functions enabled in the device. Instead of duplicating such math at multiple places, refactor mlx5_esw_query_functions() to return raw output allocated by itself. Caller must free the allocated memory using kvfree() as described in the function comment section. This hides calcuation within mlx5_esw_query_functions() and provides simpler API. Signed-off-by: Parav Pandit Signed-off-by: Saeed Mahameed commit 7e736f9ae3d12272fec5a2b24e41b78ed58525a4 Author: Parav Pandit Date: Fri Jun 7 06:44:17 2019 -0500 net/mlx5: E-Switch prepare functions change handler to be modular Eswitch function change handler will service multiple type of events for VFs and non VF functions update. Hence, introduce and use the helper function esw_vfs_changed_event_handler() for handling change in num VFs to improve the code readability. Signed-off-by: Parav Pandit Signed-off-by: Saeed Mahameed commit 2752b823169b216db142c4466b43269281962dcf Author: Parav Pandit Date: Wed May 15 00:04:27 2019 -0500 net/mlx5: Introduce and use mlx5_eswitch_get_total_vports() Instead MLX5_TOTAL_VPORTS, use mlx5_eswitch_get_total_vports(). mlx5_eswitch_get_total_vports() in subsequent patch accounts for SF vports as well. Expanding MLX5_TOTAL_VPORTS macro would require exposing SF internals to more generic vport.h header file. Such exposure is not desired. Hence a mlx5_eswitch_get_total_vports() is introduced. Given that mlx5_eswitch_get_total_vports() API wants to work on const mlx5_core_dev*, change its helper functions also to accept const *dev. Signed-off-by: Parav Pandit Signed-off-by: Saeed Mahameed commit 69ea0582f3ce7a72d312da7305e455801a8dc5a4 Merge: 2f40cf30c864 e4075c442876 Author: Jason Gunthorpe Date: Wed Jul 3 16:43:45 2019 -0300 Merge mlx5-next into rdma for-next From git://git.kernel.org/pub/scm/linux/kernel/git/mellanox/linux Required for dependencies in the next patches. Resolved the conflicts: - esw_destroy_offloads_acl_tables() use the newer mlx5_esw_for_all_vports() version - esw_offloads_steering_init() drop the cap test - esw_offloads_init() drop the extra function arguments * branch 'mlx5-next': (39 commits) net/mlx5: Expose device definitions for object events net/mlx5: Report EQE data upon CQ completion net/mlx5: Report a CQ error event only when a handler was set net/mlx5: mlx5_core_create_cq() enhancements net/mlx5: Expose the API to register for ANY event net/mlx5: Use event mask based on device capabilities net/mlx5: Fix mlx5_core_destroy_cq() error flow net/mlx5: E-Switch, Handle UC address change in switchdev mode net/mlx5: E-Switch, Consider host PF for inline mode and vlan pop net/mlx5: E-Switch, Use iterator for vlan and min-inline setups net/mlx5: E-Switch, Reg/unreg function changed event at correct stage net/mlx5: E-Switch, Consolidate eswitch function number of VFs net/mlx5: E-Switch, Refactor eswitch SR-IOV interface net/mlx5: Handle host PF vport mac/guid for ECPF net/mlx5: E-Switch, Use correct flags when configuring vlan net/mlx5: Reduce dependency on enabled_vfs counter and num_vfs net/mlx5: Don't handle VF func change if host PF is disabled net/mlx5: Limit scope of mlx5_get_next_phys_dev() to PCI PF devices net/mlx5: Move pci status reg access mutex to mlx5_pci_init net/mlx5: Rename mlx5_pci_dev_type to mlx5_coredev_type ... Signed-off-by: Jason Gunthorpe commit a5b1615529ae088200e6990f3776ff019df672b4 Author: Felix Kuehling Date: Thu Jun 20 14:54:35 2019 -0400 drm/amdkfd: Disable idle optimization for chained runlist This works around difficult-to-reproduce soft hangs on oversubscribed runlists. Signed-off-by: Felix Kuehling Reviewed-by: Oak Zeng Signed-off-by: Alex Deucher commit 7a049244a000c4b597e66c77b0e89aa35e88f6ea Author: Felix Kuehling Date: Thu Jun 20 14:50:52 2019 -0400 drm/amdkfd: Add chained_runlist_idle_disable flag to pm4_mes_runlist New flag to disable an idle runlist optimization that is causing soft hangs with some diffult-to-reproduce customer workloads. This will serve as a workaround until the problem can be reproduced and the root-cause determined. Signed-off-by: Felix Kuehling Reviewed-by: Oak Zeng Signed-off-by: Alex Deucher commit f4fd28b6c78cef054daf8d8b8dff8ef614ddfc00 Author: Felix Kuehling Date: Sat Jun 29 01:50:35 2019 -0400 drm/amdgpu: Fix tracking of invalid userptrs Restore the code that resets mem->invalid. Othewise so mapping userptrs after they got an MMU notifiers would always be skipped. This also avoids unnecessarily calling get_user_pages on BOs that have not been invalidated since the last try. Signed-off-by: Felix Kuehling Reviewed-by: Philip Yang Signed-off-by: Alex Deucher commit e7e2505326496c140db26c797fafea48a492b8c2 Author: Felix Kuehling Date: Fri Jun 7 11:33:21 2019 -0400 drm/amdgpu: Use FENCE_OWNER_KFD in process_sync_pds_resv We don't want eviction fences to trigger when waiting for page table updates to complete during restore. In theory there shouldn't be any unsignaled eviction fences in the PD reservation object, but I'm seeing them in instrumented code for reasons not fully understood. Signed-off-by: Felix Kuehling Reviewed-by: Philip Yang Signed-off-by: Alex Deucher commit 819ec5acf7593bfb84063d1b3890e80b30e1c6fa Author: Felix Kuehling Date: Thu Jun 20 15:37:37 2019 -0400 drm/amdkfd: Print a warning when the runlist becomes oversubscribed Oversubscription of queues or processes results in poor performance mostly because HWS blinbly schedules busy and idle queues, resulting in poor occupancy if many queues are idle. Let users know with a warning message when transitioning from a non-oversubscribed to an oversubscribed runlist. Signed-off-by: Felix Kuehling Reviewed-by: Oak Zeng Signed-off-by: Alex Deucher commit 60e8523e2ea18dc0c0cea69d6c1d69a065019062 Author: Alastair D'Silva Date: Thu Jun 20 14:12:01 2019 +1000 ocxl: Allow contexts to be attached with a NULL mm If an OpenCAPI context is to be used directly by a kernel driver, there may not be a suitable mm to use. The patch makes the mm parameter to ocxl_context_attach optional. Signed-off-by: Alastair D'Silva Acked-by: Andrew Donnellan Acked-by: Frederic Barrat Acked-by: Nicholas Piggin Link: https://lore.kernel.org/r/20190620041203.12274-1-alastair@au1.ibm.com Signed-off-by: Greg Kroah-Hartman commit 62a6bc3a1e4f4ee9ae0076fa295f9af1c3725ce3 Author: Thierry Reding Date: Fri Jun 21 17:17:25 2019 +0200 driver: core: Allow subsystems to continue deferring probe Some subsystems, such as pinctrl, allow continuing to defer probe indefinitely. This is useful for devices that depend on resources provided by devices that are only probed after the init stage. One example of this can be seen on Tegra, where the DPAUX hardware contains pinmuxing controls for pins that it shares with an I2C controller. The I2C controller is typically used for communication with a monitor over HDMI (DDC). However, other instances of the I2C controller are used to access system critical components, such as a PMIC. The I2C controller driver will therefore usually be a builtin driver, whereas the DPAUX driver is part of the display driver that is loaded from a module to avoid bloating the kernel image with all of the DRM/KMS subsystem. In this particular case the pins used by this I2C/DDC controller become accessible very late in the boot process. However, since the controller is only used in conjunction with display, that's not an issue. Unfortunately the driver core currently outputs a warning message when a device fails to get the pinctrl before the end of the init stage. That can be confusing for the user because it may sound like an unwanted error occurred, whereas it's really an expected and harmless situation. In order to eliminate this warning, this patch allows callers of the driver_deferred_probe_check_state() helper to specify that they want to continue deferring probe, regardless of whether we're past the init stage or not. All of the callers of that function are updated for the new signature, but only the pinctrl subsystem passes a true value in the new persist parameter if appropriate. Signed-off-by: Thierry Reding Reviewed-by: Rafael J. Wysocki Reviewed-by: Linus Walleij Link: https://lore.kernel.org/r/20190621151725.20414-1-thierry.reding@gmail.com Signed-off-by: Greg Kroah-Hartman commit 83b44fe343b5abfcb1b2261289bd0cfcfcfd60a8 Author: James Morse Date: Mon Jun 24 18:36:56 2019 +0100 drivers: base: cacheinfo: Ensure cpu hotplug work is done before Intel RDT The cacheinfo structures are alloced/freed by cpu online/offline callbacks. Originally these were only used by sysfs to expose the cache topology to user space. Without any in-kernel dependencies CPUHP_AP_ONLINE_DYN was an appropriate choice. resctrl has started using these structures to identify CPUs that share a cache. It updates its 'domain' structures from cpu online/offline callbacks. These depend on the cacheinfo structures (resctrl_online_cpu()->domain_add_cpu()->get_cache_id()-> get_cpu_cacheinfo()). These also run as CPUHP_AP_ONLINE_DYN. Now that there is an in-kernel dependency, move the cacheinfo work earlier so we know its done before resctrl's CPUHP_AP_ONLINE_DYN work runs. Fixes: 2264d9c74dda1 ("x86/intel_rdt: Build structures for each resource based on cache topology") Cc: Cc: Fenghua Yu Cc: Reinette Chatre Signed-off-by: James Morse Link: https://lore.kernel.org/r/20190624173656.202407-1-james.morse@arm.com Signed-off-by: Greg Kroah-Hartman commit 5ff88144f5880f7fafcb6a8e913eadca4cb233c8 Author: Maxime Ripard Date: Wed Jul 3 11:55:13 2019 +0200 dt-bindings: usb: ehci: Fix example warnings The example of the EHCI binding generates a bunch of warnings now that the examples are validated too. Most notably, phy-names isn't used at all, and the node name should be USB. Signed-off-by: Maxime Ripard Signed-off-by: Rob Herring commit 67d0da99163f99eb39a931e79b128cbf0647dfdb Author: Maxime Ripard Date: Wed Jul 3 11:55:12 2019 +0200 dt-bindings: net: Use phy-mode instead of phy-connection-type When adding support for the DWMAC (and derivatives) bindings, phy-connection-type was required, even though the previous binding required the equivalent phy-mode. Let's fix this by using phy-mode as we should have. Signed-off-by: Maxime Ripard Signed-off-by: Rob Herring commit ed8e3f51b6b7c0565840683328ce6e4b830cea9f Author: Maxime Ripard Date: Wed Jul 3 11:55:11 2019 +0200 dt-bindings: simple-framebuffer: Add requirement for pipelines Both the allwinner and amlogic compatibles require that either the allwinner,pipeline or the amlogic,pipeline property is set. This was dropped during the conversion since we didn't have conditionals back then, but we can express this properly now. Signed-off-by: Maxime Ripard Signed-off-by: Rob Herring commit f4913aeed73fd917782043db36b362c8f5686128 Author: Maxime Ripard Date: Wed Jul 3 11:55:10 2019 +0200 dt-bindings: display: Fix simple-framebuffer example The simple-framebuffer binding has a compatible that isn't one of the valid options. Since an Allwinner pipeline is being described, let's add the matching compatible. Signed-off-by: Maxime Ripard Signed-off-by: Rob Herring commit 5b19b6c31c21d33fde74f3bf3c2a3ae3d010f114 Author: Maxime Ripard Date: Wed Jul 3 11:55:09 2019 +0200 dt-bindings: net: mdio: Add child nodes The child nodes of a mdio bus are supposed to be ethernet PHYs, with a reg property. Make sure that's validated as well. Signed-off-by: Maxime Ripard Signed-off-by: Rob Herring commit 960ebc8ac65e9eb9605f5cbee9fc189fed7c052f Author: Maxime Ripard Date: Wed Jul 3 11:55:08 2019 +0200 dt-bindings: net: mdio: Add address and size cells MDIO controllers should have child nodes with a singe value in their reg properties being the ID of the PHY in the bus. Let's add the proper constraints on #address-cells and #size-cells. Signed-off-by: Maxime Ripard Signed-off-by: Rob Herring commit 4c2c04c27df9d2e48153e0bf8a59aec97101fb8c Author: Maxime Ripard Date: Wed Jul 3 11:55:07 2019 +0200 dt-bindings: net: mdio: Add a nodename pattern The node name of an MDIO controller should be MDIO. Let's add a rule for this. Signed-off-by: Maxime Ripard Signed-off-by: Rob Herring commit 7ce98fb6c53d2311b3e9faae90b1a9c1a96534db Author: Eddie James Date: Wed Jun 26 13:56:55 2019 -0500 fsi: sbefifo: Don't fail operations when in SBE IPL state SBE fifo operations should be allowed while the SBE is in any of the "IPL" states. Operations should succeed in this state. Fixes: 9f4a8a2d7f9d fsi/sbefifo: Add driver for the SBE FIFO Reviewed-by: Joel Stanley Tested-by: Alistair Popple Signed-off-by: Eddie James Link: https://lore.kernel.org/r/1561575415-3282-1-git-send-email-eajames@linux.ibm.com Signed-off-by: Greg Kroah-Hartman commit 17c20f329a139e90e4b049b811ca6d1a2ae967e0 Author: Suzuki K Poulose Date: Fri Jun 21 11:52:05 2019 -0600 coresight: tmc: Smatch: Fix potential NULL pointer dereference Based on the following report from Smatch, fix the potential NULL pointer dereference check. The patch 743256e214e8: "coresight: tmc: Clean up device specific data" from May 22, 2019, leads to the following Smatch complaint: drivers/hwtracing/coresight/coresight-tmc-etr.c:625 tmc_etr_free_flat_buf() warn: variable dereferenced before check 'flat_buf' (see line 623) drivers/hwtracing/coresight/coresight-tmc-etr.c 622 struct etr_flat_buf *flat_buf = etr_buf->private; 623 struct device *real_dev = flat_buf->dev->parent; ^^^^^^^^^^ The patch introduces a new NULL check 624 625 if (flat_buf && flat_buf->daddr) ^^^^^^^^ but the existing code assumed it can be NULL. 626 dma_free_coherent(real_dev, flat_buf->size, 627 flat_buf->vaddr, flat_buf->daddr); Cc: Dan Carpenter Cc: Mathieu Poirier Signed-off-by: Suzuki K Poulose Signed-off-by: Mathieu Poirier Link: https://lore.kernel.org/r/20190621175205.24551-3-mathieu.poirier@linaro.org Signed-off-by: Greg Kroah-Hartman commit 020601622323d02e09cebe05e7976b3d4b44e05d Author: Suzuki K Poulose Date: Fri Jun 21 11:52:04 2019 -0600 coresight: etm3x: Smatch: Fix potential NULL pointer dereference Based on the following report from Smatch tool, make sure we have a valid drvdata before we dereference it to find the real dev. The patch 21d26b905c05: "coresight: etm: Clean up device specific data" from May 22, 2019, leads to the following Smatch complaint: ./drivers/hwtracing/coresight/coresight-etm3x.c:460 etm_get_trace_id() warn: variable dereferenced before check 'drvdata' (see line 458) ./drivers/hwtracing/coresight/coresight-etm3x.c 457 int trace_id = -1; 458 struct device *etm_dev = drvdata->csdev->dev.parent; ^^^^^^^^^ New dereference 459 460 if (!drvdata) ^^^^^^^^ Checked too late. Delete the check? 461 goto out; 462 Cc: Mathieu Poirier Cc: Dan Carpenter Signed-off-by: Suzuki K Poulose Signed-off-by: Mathieu Poirier Link: https://lore.kernel.org/r/20190621175205.24551-2-mathieu.poirier@linaro.org Signed-off-by: Greg Kroah-Hartman commit 0530ef6b41e80c5cc979e0e50682302161edb6b7 Author: Dan Carpenter Date: Thu Jun 20 16:12:37 2019 -0600 coresight: Potential uninitialized variable in probe() The "drvdata->atclk" clock is optional, but if it gets set to an error pointer then we're accidentally return an uninitialized variable instead of success. Fixes: 78e6427b4e7b ("coresight: funnel: Support static funnel") Signed-off-by: Dan Carpenter Signed-off-by: Mathieu Poirier Cc: stable Link: https://lore.kernel.org/r/20190620221237.3536-6-mathieu.poirier@linaro.org Signed-off-by: Greg Kroah-Hartman commit 730766bae3280a25d40ea76a53dc6342e84e6513 Author: Suzuki K Poulose Date: Thu Jun 20 16:12:36 2019 -0600 coresight: etb10: Do not call smp_processor_id from preemptible During a perf session we try to allocate buffers on the "node" associated with the CPU the event is bound to. If it is not bound to a CPU, we use the current CPU node, using smp_processor_id(). However this is unsafe in a pre-emptible context and could generate the splats as below : BUG: using smp_processor_id() in preemptible [00000000] code: perf/2544 Use NUMA_NO_NODE hint instead of using the current node for events not bound to CPUs. Fixes: 2997aa4063d97fdb39 ("coresight: etb10: implementing AUX API") Cc: Mathieu Poirier Signed-off-by: Suzuki K Poulose Cc: stable # 4.6+ Signed-off-by: Mathieu Poirier Link: https://lore.kernel.org/r/20190620221237.3536-5-mathieu.poirier@linaro.org Signed-off-by: Greg Kroah-Hartman commit 024c1fd9dbcc1d8a847f1311f999d35783921b7f Author: Suzuki K Poulose Date: Thu Jun 20 16:12:35 2019 -0600 coresight: tmc-etf: Do not call smp_processor_id from preemptible During a perf session we try to allocate buffers on the "node" associated with the CPU the event is bound to. If it is not bound to a CPU, we use the current CPU node, using smp_processor_id(). However this is unsafe in a pre-emptible context and could generate the splats as below : BUG: using smp_processor_id() in preemptible [00000000] code: perf/2544 caller is tmc_alloc_etf_buffer+0x5c/0x60 CPU: 2 PID: 2544 Comm: perf Not tainted 5.1.0-rc6-147786-g116841e #344 Hardware name: ARM LTD ARM Juno Development Platform/ARM Juno Development Platform, BIOS EDK II Feb 1 2019 Call trace: dump_backtrace+0x0/0x150 show_stack+0x14/0x20 dump_stack+0x9c/0xc4 debug_smp_processor_id+0x10c/0x110 tmc_alloc_etf_buffer+0x5c/0x60 etm_setup_aux+0x1c4/0x230 rb_alloc_aux+0x1b8/0x2b8 perf_mmap+0x35c/0x478 mmap_region+0x34c/0x4f0 do_mmap+0x2d8/0x418 vm_mmap_pgoff+0xd0/0xf8 ksys_mmap_pgoff+0x88/0xf8 __arm64_sys_mmap+0x28/0x38 el0_svc_handler+0xd8/0x138 el0_svc+0x8/0xc Use NUMA_NO_NODE hint instead of using the current node for events not bound to CPUs. Fixes: 2e499bbc1a929ac ("coresight: tmc: implementing TMC-ETF AUX space API") Cc: Mathieu Poirier Signed-off-by: Suzuki K Poulose Cc: stable # 4.7+ Signed-off-by: Mathieu Poirier Link: https://lore.kernel.org/r/20190620221237.3536-4-mathieu.poirier@linaro.org Signed-off-by: Greg Kroah-Hartman commit 3a8710392db2c70f74aed6f06b16e8bec0f05a35 Author: Suzuki K Poulose Date: Thu Jun 20 16:12:34 2019 -0600 coresight: tmc-etr: alloc_perf_buf: Do not call smp_processor_id from preemptible During a perf session we try to allocate buffers on the "node" associated with the CPU the event is bound to. If it is not bound to a CPU, we use the current CPU node, using smp_processor_id(). However this is unsafe in a pre-emptible context and could generate the splats as below : BUG: using smp_processor_id() in preemptible [00000000] code: perf/1743 caller is tmc_alloc_etr_buffer+0x1bc/0x1f0 CPU: 1 PID: 1743 Comm: perf Not tainted 5.1.0-rc6-147786-g116841e #344 Hardware name: ARM LTD ARM Juno Development Platform/ARM Juno Development Platform, BIOS EDK II Feb 1 2019 Call trace: dump_backtrace+0x0/0x150 show_stack+0x14/0x20 dump_stack+0x9c/0xc4 debug_smp_processor_id+0x10c/0x110 tmc_alloc_etr_buffer+0x1bc/0x1f0 etm_setup_aux+0x1c4/0x230 rb_alloc_aux+0x1b8/0x2b8 perf_mmap+0x35c/0x478 mmap_region+0x34c/0x4f0 do_mmap+0x2d8/0x418 vm_mmap_pgoff+0xd0/0xf8 ksys_mmap_pgoff+0x88/0xf8 __arm64_sys_mmap+0x28/0x38 el0_svc_handler+0xd8/0x138 el0_svc+0x8/0xc Use NUMA_NO_NODE hint instead of using the current node for events not bound to CPUs. Fixes: 22f429f19c4135d51e9 ("coresight: etm-perf: Add support for ETR backend") Cc: Mathieu Poirier Signed-off-by: Suzuki K Poulose Cc: stable # 4.20+ Signed-off-by: Mathieu Poirier Link: https://lore.kernel.org/r/20190620221237.3536-3-mathieu.poirier@linaro.org Signed-off-by: Greg Kroah-Hartman commit 3ff44563dbb02456a33f2a42000f04db4ef19a8f Author: Suzuki K Poulose Date: Thu Jun 20 16:12:33 2019 -0600 coresight: tmc-etr: Do not call smp_processor_id() from preemptible During a perf session we try to allocate buffers on the "node" associated with the CPU the event is bound to. If it's not bound to a CPU, we use the current CPU node, using smp_processor_id(). However this is unsafe in a pre-emptible context and could generate the splats as below : BUG: using smp_processor_id() in preemptible [00000000] code: perf/1743 caller is alloc_etr_buf.isra.6+0x80/0xa0 CPU: 1 PID: 1743 Comm: perf Not tainted 5.1.0-rc6-147786-g116841e #344 Hardware name: ARM LTD ARM Juno Development Platform/ARM Juno Development Platform, BIOS EDK II Feb 1 2019 Call trace: dump_backtrace+0x0/0x150 show_stack+0x14/0x20 dump_stack+0x9c/0xc4 debug_smp_processor_id+0x10c/0x110 alloc_etr_buf.isra.6+0x80/0xa0 tmc_alloc_etr_buffer+0x12c/0x1f0 etm_setup_aux+0x1c4/0x230 rb_alloc_aux+0x1b8/0x2b8 perf_mmap+0x35c/0x478 mmap_region+0x34c/0x4f0 do_mmap+0x2d8/0x418 vm_mmap_pgoff+0xd0/0xf8 ksys_mmap_pgoff+0x88/0xf8 __arm64_sys_mmap+0x28/0x38 el0_svc_handler+0xd8/0x138 el0_svc+0x8/0xc Use NUMA_NO_NODE hint instead of using the current node for events not bound to CPUs. Fixes: 855ab61c16bf70b646 ("coresight: tmc-etr: Refactor function tmc_etr_setup_perf_buf()") Cc: Mathieu Poirier Signed-off-by: Suzuki K Poulose Signed-off-by: Mathieu Poirier Cc: stable Link: https://lore.kernel.org/r/20190620221237.3536-2-mathieu.poirier@linaro.org Signed-off-by: Greg Kroah-Hartman commit 9b5db89ea4bfdbb23d4f85f3a7fbf2cd36d20146 Author: Mauro Carvalho Chehab Date: Fri Jun 28 18:23:13 2019 -0300 docs: misc-devices: convert files without extension to ReST Those files are also text files. Convert them to ReST and add to the misc-files index.rst. Signed-off-by: Mauro Carvalho Chehab Link: https://lore.kernel.org/r/b7dc829809673bd8cffe0e7bbe9c9308681c6fe2.1561756511.git.mchehab+samsung@kernel.org Signed-off-by: Greg Kroah-Hartman commit c3ead2df9776ab22490d78a7f68a8ec58700e07f Merge: 0d581ba311a2 455302d1c9ae Author: David S. Miller Date: Wed Jul 3 12:09:00 2019 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf Daniel Borkmann says: ==================== pull-request: bpf 2019-07-03 The following pull-request contains BPF updates for your *net* tree. The main changes are: 1) Fix the interpreter to properly handle BPF_ALU32 | BPF_ARSH on BE architectures, from Jiong. 2) Fix several bugs in the x32 BPF JIT for handling shifts by 0, from Luke and Xi. 3) Fix NULL pointer deref in btf_type_is_resolve_source_only(), from Stanislav. 4) Properly handle the check that forwarding is enabled on the device in bpf_ipv6_fib_lookup() helper code, from Anton. 5) Fix UAPI bpf_prog_info fields alignment for archs that have 16 bit alignment such as m68k, from Baruch. 6) Fix kernel hanging in unregister_netdevice loop while unregistering device bound to XDP socket, from Ilya. 7) Properly terminate tail update in xskq_produce_flush_desc(), from Nathan. 8) Fix broken always_inline handling in test_lwt_seg6local, from Jiri. 9) Fix bpftool to use correct argument in cgroup errors, from Jakub. 10) Fix detaching dummy prog in XDP redirect sample code, from Prashant. 11) Add Jonathan to AF_XDP reviewers, from Björn. ==================== Signed-off-by: David S. Miller commit 0d581ba311a27762fe1a14e5db5f65d225b3d844 Author: Yonglong Liu Date: Wed Jul 3 19:12:30 2019 +0800 net: hns: add support for vlan TSO The hip07 chip support vlan TSO, this patch adds NETIF_F_TSO and NETIF_F_TSO6 flags to vlan_features to improve the performance after adding vlan to the net ports. Signed-off-by: Yonglong Liu Signed-off-by: David S. Miller commit 7af033010214f2c7cff31147d8970484d46cc14c Author: Xin Long Date: Wed Jul 3 18:20:20 2019 +0800 sctp: count data bundling sack chunk for outctrlchunks Now all ctrl chunks are counted for asoc stats.octrlchunks and net SCTP_MIB_OUTCTRLCHUNKS either after queuing up or bundling, other than the chunk maked and bundled in sctp_packet_bundle_sack, which caused 'outctrlchunks' not consistent with 'inctrlchunks' in peer. This issue exists since very beginning, here to fix it by increasing both net SCTP_MIB_OUTCTRLCHUNKS and asoc stats.octrlchunks when sack chunk is maked and bundled in sctp_packet_bundle_sack. Reported-by: Ja Ram Jeon Signed-off-by: Xin Long Acked-by: Marcelo Ricardo Leitner Acked-by: Neil Horman Signed-off-by: David S. Miller commit 2559d7c4dd0eb17e6454fc7f52f9c5ea63a272df Author: Colin Ian King Date: Wed Jul 3 09:32:14 2019 +0100 qlcnic: remove redundant assignment to variable err The variable err is being initialized with a value that is never read and it is being updated later with a new value. The initialization is redundant and can be removed. Addresses-Coverity: ("Unused value") Signed-off-by: Colin Ian King Signed-off-by: David S. Miller commit b70d846cf446f71eda352be46a94e330e3255406 Author: Colin Ian King Date: Wed Jul 3 08:53:58 2019 +0100 atl1c: remove redundant assignment to variable tpd_req The variable tpd_req is being initialized with a value that is never read and it is being updated later with a new value. The initialization is redundant and can be removed. Addresses-Coverity: ("Unused value") Signed-off-by: Colin Ian King Signed-off-by: David S. Miller commit 9fae54186c64db6faec85c194812fb2e5e970f77 Author: Hayes Wang Date: Wed Jul 3 15:11:56 2019 +0800 r8152: move calling r8153b_rx_agg_chg_indicate() r8153b_rx_agg_chg_indicate() needs to be called after enabling TX/RX and before calling rxdy_gated_en(tp, false). Otherwise, the change of the settings of RX aggregation wouldn't work. Besides, adjust rtl8152_set_coalesce() for the same reason. If rx_coalesce_usecs is changed, restart TX/RX to let the setting work. Signed-off-by: Hayes Wang Signed-off-by: David S. Miller commit cedeac9df4b8386bc96b589d91e4f40e0b4b441b Author: Sudarsana Reddy Kalluru Date: Tue Jul 2 23:01:59 2019 -0700 qed: Add support for Timestamping the unicast PTP packets. This patch adds driver changes to detect/timestamp the unicast PTP packets. Changes from previous version: ------------------------------- v2: Defined a macro for unicast ptp param mask. Please consider applying this to "net-next". Signed-off-by: Sudarsana Reddy Kalluru Signed-off-by: Ariel Elior Signed-off-by: David S. Miller commit 3c13ce74b6f885c2dcb2537b7f61a8e5afab002e Author: Catherine Sullivan Date: Tue Jul 2 15:46:57 2019 -0700 gve: Fix u64_stats_sync to initialize start u64_stats_fetch_begin needs to initialize start. Signed-off-by: Catherine Sullivan Reported-by: kbuild test robot Signed-off-by: David S. Miller commit 1e64d7cbfdce4887008314d5b367209582223f27 Author: Stephen Hemminger Date: Tue Jul 2 15:20:21 2019 -0700 net: don't warn in inet diag when IPV6 is disabled If IPV6 was disabled, then ss command would cause a kernel warning because the command was attempting to dump IPV6 socket information. The fix is to just remove the warning. Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=202249 Fixes: 432490f9d455 ("net: ip, diag -- Add diag interface for raw sockets") Signed-off-by: Stephen Hemminger Signed-off-by: David S. Miller commit d62962b37cebdc936e2bfcd69ea685da2c433727 Author: Mahesh Bandewar Date: Tue Jul 2 23:16:31 2019 -0700 loopback: fix lockdep splat dev_init_scheduler() and dev_activate() expect the caller to hold RTNL. Since we don't want blackhole device to be initialized per ns, we are initializing at init. [ 3.855027] Call Trace: [ 3.855034] dump_stack+0x67/0x95 [ 3.855037] lockdep_rcu_suspicious+0xd5/0x110 [ 3.855044] dev_init_scheduler+0xe3/0x120 [ 3.855048] ? net_olddevs_init+0x60/0x60 [ 3.855050] blackhole_netdev_init+0x45/0x6e [ 3.855052] do_one_initcall+0x6c/0x2fa [ 3.855058] ? rcu_read_lock_sched_held+0x8c/0xa0 [ 3.855066] kernel_init_freeable+0x1e5/0x288 [ 3.855071] ? rest_init+0x260/0x260 [ 3.855074] kernel_init+0xf/0x180 [ 3.855076] ? rest_init+0x260/0x260 [ 3.855078] ret_from_fork+0x24/0x30 Fixes: 4de83b88c66 ("loopback: create blackhole net device similar to loopack.") Reported-by: Geert Uytterhoeven Cc: Eric Dumazet Signed-off-by: Mahesh Bandewar Tested-by: Geert Uytterhoeven Signed-off-by: David S. Miller commit 0fd33116c1d8f8f9ff973c3d17280148068d77f4 Author: Geert Uytterhoeven Date: Mon May 27 14:27:03 2019 +0200 arch_topology: Remove error messages on out-of-memory conditions There is no need to print error messages if kcalloc() or alloc_cpumask_var() fail, as the memory allocation core already takes care of that. Signed-off-by: Geert Uytterhoeven Link: https://lore.kernel.org/r/20190527122703.6303-1-geert+renesas@glider.be Signed-off-by: Greg Kroah-Hartman commit 2f40cf30c8644360d37287861d5288f00eab35e5 Author: Parav Pandit Date: Sun Jun 30 10:52:52 2019 +0300 IB/mlx5: Fixed reporting counters on 2nd port for Dual port RoCE Currently during dual port IB device registration in below code flow, ib_register_device() ib_device_register_sysfs() ib_setup_port_attrs() add_port() get_counter_table() get_perf_mad() process_mad() mlx5_ib_process_mad() mlx5_ib_process_mad() fails on 2nd port when both the ports are not fully setup at the device level (because 2nd port is unaffiliated). As a result, get_perf_mad() registers different PMA counter group for 1st and 2nd port, namely pma_counter_ext and pma_counter. However both ports have the same capability and counter offsets. Due to this when counters are read by the user via sysfs in below code flow, counters are queried from wrong location from the device mainly from PPCNT instead of VPORT counters. show_pma_counter() get_perf_mad() process_mad() mlx5_ib_process_mad() process_pma_cmd() This shows all zero counters for 2nd port. To overcome this, process_pma_cmd() is invoked, and when unaffiliated port is not yet setup during device registration phase, make the query on the first port. while at it, only process_pma_cmd() needs to work on the native port number and underlying mdev, so shift the get, put calls to where its needed inside process_pma_cmd(). Fixes: 212f2a87b74f ("IB/mlx5: Route MADs for dual port RoCE") Signed-off-by: Parav Pandit Reviewed-by: Daniel Jurgens Signed-off-by: Leon Romanovsky Signed-off-by: Jason Gunthorpe commit e4075c44287638b9a99430fea79a2d1468fbc27d Author: Yishai Hadas Date: Sun Jun 30 19:23:28 2019 +0300 net/mlx5: Expose device definitions for object events Expose an extra device definitions for objects events. It includes: object_type values for legacy objects and generic data header for any other object. Signed-off-by: Yishai Hadas Acked-by: Saeed Mahameed Signed-off-by: Leon Romanovsky commit 4e0e2ea1886afe8c001971ff767f6670312a9b04 Author: Yishai Hadas Date: Sun Jun 30 19:23:27 2019 +0300 net/mlx5: Report EQE data upon CQ completion Report EQE data upon CQ completion to let upper layers use this data. Signed-off-by: Yishai Hadas Acked-by: Saeed Mahameed Signed-off-by: Leon Romanovsky commit 70a43d3fd4efba2de97152788df723c7812bb834 Author: Yishai Hadas Date: Sun Jun 30 19:23:26 2019 +0300 net/mlx5: Report a CQ error event only when a handler was set Report a CQ error event only when a handler was set. This enables mlx5_ib to not set a handler upon CQ creation and use some other mechanism to get this event as of other events by the mlx5_eq_notifier_register API. Signed-off-by: Yishai Hadas Acked-by: Saeed Mahameed Signed-off-by: Leon Romanovsky commit 38164b771947be9baf06e78ffdfb650f8f3e908e Author: Yishai Hadas Date: Sun Jun 30 19:23:25 2019 +0300 net/mlx5: mlx5_core_create_cq() enhancements Enhance mlx5_core_create_cq() to get the command out buffer from the callers to let them use the output. Signed-off-by: Yishai Hadas Acked-by: Saeed Mahameed Signed-off-by: Leon Romanovsky commit 69416739ee3692f4ba890f153d9000e865b73c2d Author: Wu Hao Date: Thu Jun 27 17:49:39 2019 -0700 fpga: dfl: fme: align PR buffer size per PR datawidth Current driver checks if input bitstream file size is aligned or not per PR data width (default 32bits). It requires one additional step for end user when they generate the bitstream file, padding extra zeros to bitstream file to align its size per PR data width, but they don't have to as hardware will drop extra padding bytes automatically. In order to simplify the user steps, this patch aligns PR buffer size per PR data width in driver, to allow user to pass unaligned size bitstream files to driver. Signed-off-by: Xu Yilun Signed-off-by: Wu Hao Acked-by: Alan Tull Acked-by: Moritz Fischer Signed-off-by: Moritz Fischer Link: https://lore.kernel.org/r/20190628004951.6202-4-mdf@kernel.org Signed-off-by: Greg Kroah-Hartman commit 49ec630cd5e497c97c6a8a0fc4df5b2c88ca11c6 Author: Wu Hao Date: Thu Jun 27 17:49:38 2019 -0700 fpga: dfl: fme: remove copy_to_user() in ioctl for PR This patch removes copy_to_user() code in partial reconfiguration ioctl, as it's useless as user never needs to read the data structure after ioctl. Signed-off-by: Xu Yilun Signed-off-by: Wu Hao Acked-by: Moritz Fischer Acked-by: Alan Tull Signed-off-by: Moritz Fischer Link: https://lore.kernel.org/r/20190628004951.6202-3-mdf@kernel.org Signed-off-by: Greg Kroah-Hartman commit e150e3f4ad9aeda7610dee09f98ea69e0bc701b7 Author: Wu Hao Date: Thu Jun 27 17:49:37 2019 -0700 fpga: dfl-fme-mgr: fix FME_PR_INTFC_ID register address. FME_PR_INTFC_ID is used as compat_id for fpga manager and region, but high 64 bits and low 64 bits of the compat_id are swapped by mistake. This patch fixes this problem by fixing register address. Signed-off-by: Wu Hao Acked-by: Alan Tull Acked-by: Moritz Fischer Signed-off-by: Moritz Fischer Link: https://lore.kernel.org/r/20190628004951.6202-2-mdf@kernel.org Signed-off-by: Greg Kroah-Hartman commit c0670781f54839fb9d0b2c0eaee58862601981bf Author: Yishai Hadas Date: Sun Jun 30 19:23:24 2019 +0300 net/mlx5: Expose the API to register for ANY event Expose the API to register for ANY event, mlx5_ib will be able to use this functionality for its needs. Signed-off-by: Yishai Hadas Acked-by: Saeed Mahameed Signed-off-by: Leon Romanovsky commit b9a7ba5562074855e8a3f92ea7e1174b61a3e87d Author: Yishai Hadas Date: Sun Jun 30 19:23:23 2019 +0300 net/mlx5: Use event mask based on device capabilities Use the reported device capabilities for the supported user events (i.e. affiliated and un-affiliated) to set the EQ mask. As the event mask can be up to 256 defined by 4 entries of u64 change the applicable code to work accordingly. Signed-off-by: Yishai Hadas Acked-by: Saeed Mahameed Signed-off-by: Leon Romanovsky commit 1d49ce1e05f804d9238eda66d6010eb492668a37 Author: Yishai Hadas Date: Sun Jun 30 19:23:22 2019 +0300 net/mlx5: Fix mlx5_core_destroy_cq() error flow The firmware command to destroy a CQ might fail when the object is referenced by other object and the ref count is managed by the firmware. To enable a second successful destruction post the first failure need to change mlx5_eq_del_cq() to be a void function. As an error in mlx5_eq_del_cq() is quite fatal from the option to recover, a debug message inside it should be good enougth and it was changed to be void. Signed-off-by: Yishai Hadas Acked-by: Saeed Mahameed Signed-off-by: Leon Romanovsky commit 6044414fa849e14fa0de60a75e3f85ea048c89db Author: YueHaibing Date: Wed Jul 3 03:10:21 2019 +0000 RDMA/hns: Remove set but not used variable 'fclr_write_fail_flag' Fixes gcc '-Wunused-but-set-variable' warning: drivers/infiniband/hw/hns/hns_roce_hw_v2.c: In function 'hns_roce_function_clear': drivers/infiniband/hw/hns/hns_roce_hw_v2.c:1135:7: warning: variable 'fclr_write_fail_flag' set but not used [-Wunused-but-set-variable] It is never used, so can be removed. Signed-off-by: YueHaibing Reviewed-by: Leon Romanovsky Reviewed-by: Jason Gunthorpe Signed-off-by: Jason Gunthorpe commit 2e67e775845373905d2c2aecb9062c2c4352a535 Author: Liu, Changcheng Date: Fri Jun 28 14:16:13 2019 +0800 RDMA/i40iw: Set queue pair state when being queried The API for ib_query_qp requires the driver to set qp_state and cur_qp_state on return, add the missing sets. Fixes: d37498417947 ("i40iw: add files for iwarp interface") Signed-off-by: Changcheng Liu Acked-by: Shiraz Saleem Reviewed-by: Jason Gunthorpe Signed-off-by: Jason Gunthorpe commit 011bd05d1f5d99eeb91e8a6f81f00654a2b8d3d1 Author: Sergey Organov Date: Wed Jun 26 17:11:30 2019 +0300 serial: imx: set_termios(): preserve RTS state imx_set_termios() cleared RTS on every call, now fixed. Reviewed-by: Sascha Hauer Tested-by: Sascha Hauer Signed-off-by: Sergey Organov Link: https://lore.kernel.org/r/1561558293-7683-5-git-send-email-sorganov@gmail.com Signed-off-by: Greg Kroah-Hartman commit ddf89e7503deb931403add648b67545ec196c3fe Author: Sergey Organov Date: Wed Jun 26 17:11:29 2019 +0300 serial: imx: set_termios(): clarify RTS/CTS bits calculation Avoid repeating the same code for rs485 twice. Make it obvious we clear CRTSCTS bit in termios->c_cflag whenever sport->have_rtscts is false. Make it obvious we clear UCR2_IRTS whenever CRTSCTS is set. Reviewed-by: Sascha Hauer Tested-by: Sascha Hauer Signed-off-by: Sergey Organov Link: https://lore.kernel.org/r/1561558293-7683-4-git-send-email-sorganov@gmail.com Signed-off-by: Greg Kroah-Hartman commit 41ffa48ea7b21330d2e7d87558bb710700da4609 Author: Sergey Organov Date: Wed Jun 26 17:11:28 2019 +0300 serial: imx: set_termios(): factor-out 'ucr2' initial value Set common bits in a separate statement to make initialization explicit and not repeat the common part. Reviewed-by: Sascha Hauer Tested-by: Sascha Hauer Signed-off-by: Sergey Organov Reviewed-by: Uwe Kleine-Knig Link: https://lore.kernel.org/r/1561558293-7683-3-git-send-email-sorganov@gmail.com Signed-off-by: Greg Kroah-Hartman commit cda8cf56d8e29c70dc8a3d989846c66ed1638e74 Author: Fuqian Huang Date: Thu Jul 4 00:27:42 2019 +0800 IB/i40iw: Use kmemdup rather than open coding Use kmemdump instead of kzmalloc + memcpy. Signed-off-by: Fuqian Huang Reviewed-by: Jason Gunthorpe Signed-off-by: Jason Gunthorpe commit 775b7ffd7d6d5db320d99b0a485c51e04dfcf9f1 Author: Geert Uytterhoeven Date: Mon Jun 24 14:35:40 2019 +0200 serial: sh-sci: Terminate TX DMA during buffer flushing While the .flush_buffer() callback clears sci_port.tx_dma_len since commit 1cf4a7efdc71cab8 ("serial: sh-sci: Fix race condition causing garbage during shutdown"), it does not terminate a transmit DMA operation that may be in progress. Fix this by terminating any pending DMA operations, and resetting the corresponding cookie. Signed-off-by: Geert Uytterhoeven Reviewed-by: Eugeniu Rosca Tested-by: Eugeniu Rosca Link: https://lore.kernel.org/r/20190624123540.20629-3-geert+renesas@glider.be Signed-off-by: Greg Kroah-Hartman commit 8493eab02608b0e82f67b892aa72882e510c31d0 Author: Geert Uytterhoeven Date: Mon Jun 24 14:35:39 2019 +0200 serial: sh-sci: Fix TX DMA buffer flushing and workqueue races When uart_flush_buffer() is called, the .flush_buffer() callback zeroes the tx_dma_len field. This may race with the work queue function handling transmit DMA requests: 1. If the buffer is flushed before the first DMA API call, dmaengine_prep_slave_single() may be called with a zero length, causing the DMA request to never complete, leading to messages like: rcar-dmac e7300000.dma-controller: Channel Address Error happen and, with debug enabled: sh-sci e6e88000.serial: sci_dma_tx_work_fn: ffff800639b55000: 0...0, cookie 126 and DMA timeouts. 2. If the buffer is flushed after the first DMA API call, but before the second, dma_sync_single_for_device() may be called with a zero length, causing the transmit data not to be flushed to RAM, and leading to stale data being output. Fix this by: 1. Letting sci_dma_tx_work_fn() return immediately if the transmit buffer is empty, 2. Extending the critical section to cover all DMA preparational work, so tx_dma_len stays consistent for all of it, 3. Using local copies of circ_buf.head and circ_buf.tail, to make sure they match the actual operation above. Reported-by: Eugeniu Rosca Suggested-by: Yoshihiro Shimoda Signed-off-by: Geert Uytterhoeven Reviewed-by: Eugeniu Rosca Tested-by: Eugeniu Rosca Link: https://lore.kernel.org/r/20190624123540.20629-2-geert+renesas@glider.be Signed-off-by: Greg Kroah-Hartman commit ecd6bf67da3126e8ec731c2dd8cb6c2f17d9563a Author: Mark Greer Date: Wed Jun 26 09:05:53 2019 -0700 serial: mpsc: Remove obsolete MPSC driver Support for the Marvell MV64x60 line of bridge chips that contained MPSC controllers has been removed and there are no other components that have that controller so remove its driver. Signed-off-by: Mark Greer Link: https://lore.kernel.org/r/20190626160553.28518-1-mgreer@animalcreek.com Signed-off-by: Greg Kroah-Hartman commit b7a8f766482fa5893ca95cbf83195e60e96e389e Author: Wei Yongjun Date: Wed Jul 3 05:59:08 2019 +0000 serial: 8250: 8250_core: Fix missing unlock on error in serial8250_register_8250_port() Add the missing unlock before return from function serial8250_register_8250_port() in the error handling case. Signed-off-by: Wei Yongjun Link: https://lore.kernel.org/r/20190703055908.141294-1-weiyongjun1@huawei.com Signed-off-by: Greg Kroah-Hartman commit 5d7d78eaecc5c91c9b2001e544a0ae2788d40d1c Author: Fuqian Huang Date: Fri Jun 28 01:38:04 2019 +0800 IB/ipoib: Remove memset after vzalloc in ipoib_cm.c vzalloc has already zeroed the memory. So a memset is unneeded. Signed-off-by: Fuqian Huang Reviewed-by: Jason Gunthorpe Signed-off-by: Jason Gunthorpe commit 4c44d4634b5c90993fccca9f155347221df6f877 Author: Fuqian Huang Date: Fri Jun 28 10:47:19 2019 +0800 IB: Remove unneeded memset In commit af7ddd8a627c ("Merge tag 'dma-mapping-4.21' of git://git.infradead.org/users/hch/dma-mapping"), dma_alloc_coherent/dmam_alloc_coherent always zeroed the returned memory. So the memset after a coherent allocation function is not needed. Signed-off-by: Fuqian Huang Reviewed-by: Jason Gunthorpe Signed-off-by: Jason Gunthorpe commit a387fd90d4685b97352f1f6b2773b9402d26ec54 Author: Nikhil Badola Date: Mon Jun 24 15:22:19 2019 +0800 usb :fsl: Change string format for errata property Remove USB errata checking code from driver. Applicability of erratum is retrieved by reading corresponding property in device tree. This property is written during device tree fixup. Signed-off-by: Ramneek Mehresh Signed-off-by: Nikhil Badola Signed-off-by: Yinbo Zhu Link: https://lore.kernel.org/r/20190624072219.15258-5-yinbo.zhu@nxp.com Signed-off-by: Greg Kroah-Hartman commit c1f9d2e4110cbcbbba844406e58ed41120166a73 Author: Ramneek Mehresh Date: Mon Jun 24 15:22:18 2019 +0800 usb: host: Stops USB controller init if PLL fails to lock USB erratum-A006918 workaround tries to start internal PHY inside uboot (when PLL fails to lock). However, if the workaround also fails, then USB initialization is also stopped inside Linux. Erratum-A006918 workaround failure creates "fsl,erratum_a006918" node in device-tree. Presence of this node in device-tree is used to stop USB controller initialization in Linux Signed-off-by: Ramneek Mehresh Signed-off-by: Suresh Gupta Signed-off-by: Yinbo Zhu Link: https://lore.kernel.org/r/20190624072219.15258-4-yinbo.zhu@nxp.com Signed-off-by: Greg Kroah-Hartman commit 1a4dcb8aed681c426954b1cf7e4b78aab465690e Author: Yinbo Zhu Date: Mon Jun 24 15:22:17 2019 +0800 usb: linux/fsl_device: Add platform member has_fsl_erratum_a006918 This patch is to add member has_fsl_erratum_a006918 in platform data Signed-off-by: Yinbo Zhu Link: https://lore.kernel.org/r/20190624072219.15258-3-yinbo.zhu@nxp.com Signed-off-by: Greg Kroah-Hartman commit 5dfff995f9cb21c2910e40f5d4da53473356a792 Author: Suresh Gupta Date: Mon Jun 24 15:22:16 2019 +0800 usb: phy: Workaround for USB erratum-A005728 PHY_CLK_VALID bit for UTMI PHY in USBDR does not set even if PHY is providing valid clock. Workaround for this involves resetting of PHY and check PHY_CLK_VALID bit multiple times. If PHY_CLK_VALID bit is still not set even after 5 retries, it would be safe to deaclare that PHY clock is not available. This erratum is applicable for USBDR less then ver 2.4. Signed-off-by: Suresh Gupta Signed-off-by: Yinbo Zhu Link: https://lore.kernel.org/r/20190624072219.15258-2-yinbo.zhu@nxp.com Signed-off-by: Greg Kroah-Hartman commit 4f182835508c2d3dc6f5cc0e56b65b4c1ca325f8 Author: Nikhil Badola Date: Mon Jun 24 15:22:15 2019 +0800 usb: fsl: Set USB_EN bit to select ULPI phy Set USB_EN bit to select ULPI phy for USB controller version 2.5 Signed-off-by: Nikhil Badola Signed-off-by: Yinbo Zhu Link: https://lore.kernel.org/r/20190624072219.15258-1-yinbo.zhu@nxp.com Signed-off-by: Greg Kroah-Hartman commit e244c4699f859cf7149b0781b1894c7996a8a1df Author: Lee, Chiasheng Date: Thu Jun 20 10:56:04 2019 +0300 usb: Handle USB3 remote wakeup for LPM enabled devices correctly With Link Power Management (LPM) enabled USB3 links transition to low power U1/U2 link states from U0 state automatically. Current hub code detects USB3 remote wakeups by checking if the software state still shows suspended, but the link has transitioned from suspended U3 to enabled U0 state. As it takes some time before the hub thread reads the port link state after a USB3 wake notification, the link may have transitioned from U0 to U1/U2, and wake is not detected by hub code. Fix this by handling U1/U2 states in the same way as U0 in USB3 wakeup handling This patch should be added to stable kernels since 4.13 where LPM was kept enabled during suspend/resume Cc: # v4.13+ Signed-off-by: Lee, Chiasheng Signed-off-by: Mathias Nyman Signed-off-by: Greg Kroah-Hartman commit 2681795b5e7a5bf336537661010072f4c22cea31 Author: Nikolaus Voss Date: Fri Jun 28 11:01:09 2019 +0200 drivers/usb/typec/tps6598x.c: fix 4CC cmd write Writing 4CC commands with tps6598x_write_4cc() already has a pointer arg, don't reference it when using as arg to tps6598x_block_write(). Correcting this enforces the constness of the pointer to propagate to tps6598x_block_write(), so add the const qualifier there to avoid the warning. Fixes: 0a4c005bd171 ("usb: typec: driver for TI TPS6598x USB Power Delivery controllers") Signed-off-by: Nikolaus Voss Acked-by: Heikki Krogerus Cc: stable Signed-off-by: Greg Kroah-Hartman commit 05da75fc651138e51ff74ace97174349910463f5 Author: Nikolaus Voss Date: Fri Jun 28 11:01:08 2019 +0200 drivers/usb/typec/tps6598x.c: fix portinfo width Portinfo bit field is 3 bits wide, not 2 bits. This led to a wrong driver configuration for some tps6598x configurations. Fixes: 0a4c005bd171 ("usb: typec: driver for TI TPS6598x USB Power Delivery controllers") Signed-off-by: Nikolaus Voss Acked-by: Heikki Krogerus Cc: stable Signed-off-by: Greg Kroah-Hartman commit 349148785b8cea9781af520fd53c29ee8087ee74 Author: Marcos Paulo de Souza Date: Tue Jun 18 19:44:54 2019 -0300 usb: storage: scsiglue: Do not skip VPD if try_vpd_pages is set If BLIST_TRY_VPD_PAGES is set for a device, even for an USB, it should be honored, so only set skip_vpd_pages is try_vpd_pages is not set. Signed-off-by: Marcos Paulo de Souza Acked-by: Alan Stern Signed-off-by: Greg Kroah-Hartman commit 5b2736ce361989882636d4b105d1146ca3382f47 Author: Colin Ian King Date: Wed Jul 3 09:14:34 2019 +0100 staging: rtl8723bs: hal: remove redundant assignment to packetType Local variable packetType is being assigned a value that is never read just before a return statement. The assignment is redundant and can be removed. Addresses-Coverity: ("Unused value") Signed-off-by: Colin Ian King Link: https://lore.kernel.org/r/20190703081434.17489-1-colin.king@canonical.com Signed-off-by: Greg Kroah-Hartman commit 14c77a18375db381426d3a0e6e7aaf87af9a8143 Author: Nishka Dasgupta Date: Tue Jul 2 12:31:32 2019 +0530 staging: rtl8723bs: Change return type of hal_btcoex_IsBtDisabled() Change return type of hal_btcoex_IsBtDisabled from u8 to bool as the only possible return values are true and false. Where needed, modify accordingly the type of the variables used to store this return value. Signed-off-by: Nishka Dasgupta Link: https://lore.kernel.org/r/20190702070132.6997-9-nishkadg.linux@gmail.com Signed-off-by: Greg Kroah-Hartman commit 66e8fafb70c206e2c5953ad8df6277fb2b0516da Author: Nishka Dasgupta Date: Tue Jul 2 12:31:31 2019 +0530 staging: rtl8723bs: Remove rtw_btcoex_DisplayBtCoexInfo() Remove function rtw_btcoex_DisplayBtCoexInfo as all it does is call hal_btcoex_DisplayBtCoexInfo. Modify call site accordingly. Issue found with Coccinelle. Signed-off-by: Nishka Dasgupta Link: https://lore.kernel.org/r/20190702070132.6997-8-nishkadg.linux@gmail.com Signed-off-by: Greg Kroah-Hartman commit eb408965f0e1846631cf82cfcbb3320bca79b456 Author: Nishka Dasgupta Date: Tue Jul 2 12:31:30 2019 +0530 staging: rtl8723bs: Remove function rtw_btcoex_GetDBG() Remove function rtw_btcoex_GetDBG as all it does is call hal_btcoex_GetDBG. Modify call site accordingly. Issue found with Coccinelle. Signed-off-by: Nishka Dasgupta Link: https://lore.kernel.org/r/20190702070132.6997-7-nishkadg.linux@gmail.com Signed-off-by: Greg Kroah-Hartman commit 24c4326e342d55f5a87d0da13bdcaa1335216d8b Author: Nishka Dasgupta Date: Tue Jul 2 12:31:29 2019 +0530 staging: rtl8723bs: Remove function rtw_btcoex_SetDBG() Remove function rtw_btcoex_SetDBG as all it does is call hal_btcoex_setDBG. Modify call sites accordingly. Include the header file for hal_btcoex in the file that now calls hal_btcoex_SetDBG instead of rtw_btcoex_SetDBG. Issue found with Coccinelle. Signed-off-by: Nishka Dasgupta Link: https://lore.kernel.org/r/20190702070132.6997-6-nishkadg.linux@gmail.com Signed-off-by: Greg Kroah-Hartman commit d312a47f35f71af0a3da9be7783d4c91b91fedce Author: Nishka Dasgupta Date: Tue Jul 2 12:31:28 2019 +0530 staging: rtl8723bs: Remove rtw_btcoex_IsBTCoexCtrlAMPDUSize() Remove function rtw_btcoex_IsBTCoexCtrlAMPDUSize as it does nothing except call hal_btcoex_IsBTCoexCtrlAMPDUSize. Modify call site accordingly. Issue found with Coccinelle. Signed-off-by: Nishka Dasgupta Link: https://lore.kernel.org/r/20190702070132.6997-5-nishkadg.linux@gmail.com Signed-off-by: Greg Kroah-Hartman commit aa0963a11669f0d10f8e263885e253d7ced4937a Author: Nishka Dasgupta Date: Tue Jul 2 12:31:27 2019 +0530 staging: rtl8723bs: Remove rtw_btcoex_BtInfoNotify() Remove function rtw_btcoex_BtInfoNotify as it does nothing except call hal_btcoex_BtInfoNotify. Modify call sites accordingly. Issue found with Coccinelle. Signed-off-by: Nishka Dasgupta Link: https://lore.kernel.org/r/20190702070132.6997-4-nishkadg.linux@gmail.com Signed-off-by: Greg Kroah-Hartman commit a47a70c25777ac06c9d2e09030377cfee851edee Author: Nishka Dasgupta Date: Tue Jul 2 12:31:26 2019 +0530 staging: rtl8723bs: Remove rtw_btcoex_ScanNotify() Remove function rtw_btcoex_ScanNotify as all it does is call hal_btcoex_ScanNotify. Modify call sites accordingly. Issue found with Coccinelle. Signed-off-by: Nishka Dasgupta Link: https://lore.kernel.org/r/20190702070132.6997-3-nishkadg.linux@gmail.com Signed-off-by: Greg Kroah-Hartman commit b3a74e04f1c890bceba0737da27f000d2805333f Author: Nishka Dasgupta Date: Tue Jul 2 12:31:25 2019 +0530 staging: rtl8723bs: Remove rtw_btcoex_SetSingleAntPath() Remove function rtw_btcoex_SetSingleAntPath as all it does is call hal_btcoex_SetSingleAntPath. Modify call site. Issue found with Coccinelle. Signed-off-by: Nishka Dasgupta Link: https://lore.kernel.org/r/20190702070132.6997-2-nishkadg.linux@gmail.com Signed-off-by: Greg Kroah-Hartman commit db3592d9852aaaf9205f7aea8b52a5195ee53e50 Author: Nishka Dasgupta Date: Tue Jul 2 12:31:24 2019 +0530 staging: rtl8723bs: Remove rtw_btcoex_SetPGAntNum() Remove function rtw_btcoex_SetPGAntNum as it does nothing except call hal_btcoex_SetPgAntNum. Modify call site accordingly. Issue found with Coccinelle. Signed-off-by: Nishka Dasgupta Link: https://lore.kernel.org/r/20190702070132.6997-1-nishkadg.linux@gmail.com Signed-off-by: Greg Kroah-Hartman commit 2d9164321b6c9710326c12c9db19af6e2ce3dc85 Author: Colin Ian King Date: Tue Jul 2 10:56:47 2019 +0100 staging: rtl8192e: remove redundant initialization of rtstatus Variable rtstatus is being initialized with a value that is never read as it is being overwritten inside a do-while loop. Clean up the code by removing the redundant initialization. Addresses-Coverity: ("Unused value") Signed-off-by: Colin Ian King Link: https://lore.kernel.org/r/20190702095647.26378-1-colin.king@canonical.com Signed-off-by: Greg Kroah-Hartman commit 69fa65f92d930a82c51352b071089f5316fbdc32 Author: Nishka Dasgupta Date: Mon Jul 1 14:48:17 2019 +0530 staging: rtl8723bs: Remove rtw_btcoex_GetRaMask() Remove function rtw_btcoex_GetRaMask as all it does is call hal_btcoex_GetRaMask. Modify call site accordingly. Issue found with Coccinelle. Signed-off-by: Nishka Dasgupta Link: https://lore.kernel.org/r/20190701091817.12759-10-nishkadg.linux@gmail.com Signed-off-by: Greg Kroah-Hartman commit efa6b6c9c4c3d868db79753578a44da9742f6da1 Author: Nishka Dasgupta Date: Mon Jul 1 14:48:16 2019 +0530 staging: rtl8723bs: Remove rtw_btcoex_SetChipType() Remove function rtw_btcoex_SetChipType as it does nothing but call hal_btcoex_SetChipType. Modify call site accordingly. Issue found with Coccinelle. Signed-off-by: Nishka Dasgupta Link: https://lore.kernel.org/r/20190701091817.12759-9-nishkadg.linux@gmail.com Signed-off-by: Greg Kroah-Hartman commit 8739e064de6f1fc0369851510c5dccd8632c5d17 Author: Nishka Dasgupta Date: Mon Jul 1 14:48:15 2019 +0530 staging: rtl8723bs: Remove rtw_btcoex_ConnectNotify() Remove function rtw_btcoex_ConnectNotify as all it does is call hal_btcoex_ConnectNotify. Modify call sites accordingly. Issue found with Coccinelle. Signed-off-by: Nishka Dasgupta Link: https://lore.kernel.org/r/20190701091817.12759-8-nishkadg.linux@gmail.com Signed-off-by: Greg Kroah-Hartman commit 5355735196369c3aea955ce41eacd8fef7db4fda Author: Nishka Dasgupta Date: Mon Jul 1 14:48:14 2019 +0530 staging: rtl8723bs: Remove rtw_btcoex_SetBTCoexist() Remove function rtw_btcoex_SetBTCoexist as it does nothing except call hal_btcoex_SetBTCoexist. Modify call sites accordingly. Issue found with Coccinelle. Signed-off-by: Nishka Dasgupta Link: https://lore.kernel.org/r/20190701091817.12759-7-nishkadg.linux@gmail.com Signed-off-by: Greg Kroah-Hartman commit d1f4b78027202d8cb8a45c885038f5fd70e0eaf2 Author: Nishka Dasgupta Date: Mon Jul 1 14:48:13 2019 +0530 staging: rtl8723bs: Remove rtw_btcoex_IsBtDisabled() Remove function rtw_btcoex_IsBtDisabled as it does nothing except call hal_btcoex_IsBtDisabled. Modify call sites accordingly. Issue found wth Coccinelle. Signed-off-by: Nishka Dasgupta Link: https://lore.kernel.org/r/20190701091817.12759-6-nishkadg.linux@gmail.com Signed-off-by: Greg Kroah-Hartman commit 606e33cead2a523ce2354821c5898697adad3235 Author: Nishka Dasgupta Date: Mon Jul 1 14:48:12 2019 +0530 staging: rtl8723bs: Remove rtw_btcoex_IsBtControlLps() Remove function rtw_btcoex_IsBtControlLps as it does nothing except call hal_btcoex_IsBtControlLps. Modify call sites accordingly. Issue found with Coccinelle. Signed-off-by: Nishka Dasgupta Link: https://lore.kernel.org/r/20190701091817.12759-5-nishkadg.linux@gmail.com Signed-off-by: Greg Kroah-Hartman commit a158111d54d4801f3507b10dcffe5701f3009cb3 Author: Nishka Dasgupta Date: Mon Jul 1 14:48:11 2019 +0530 staging: rtl8723bs: Remove rtw_btcoex_Handler() Remove function rtw_btcoex_Handler as it does nothing except call hal_btcoex_Handler. Modify call site accordingly. Issue found with Coccinelle. Signed-off-by: Nishka Dasgupta Link: https://lore.kernel.org/r/20190701091817.12759-4-nishkadg.linux@gmail.com Signed-off-by: Greg Kroah-Hartman commit ee8e2ce55df0109af56b0a4278db8ebe52886634 Author: Nishka Dasgupta Date: Mon Jul 1 14:48:10 2019 +0530 staging: rtl8723bs: Remove rtw_btcoex_LpsVal() Remove function rtw_btcoex_LpsVal as all it does is call hal_btcoex_LpsVal. Modify call sites accordingly. Issue found with Coccinelle. Signed-off-by: Nishka Dasgupta Link: https://lore.kernel.org/r/20190701091817.12759-3-nishkadg.linux@gmail.com Signed-off-by: Greg Kroah-Hartman commit f0ef8d3e200db6b884be9240cef213ecf56197bd Author: Nishka Dasgupta Date: Mon Jul 1 14:48:09 2019 +0530 staging: rtl8723bs: Remove rtw_btcoex_RecordPwrMode() Remove function rtw_btcoex_RecordPwrMode as all it does is call hal_btcoex_RecordPwrMode. Modify call sites accordingly. Issue found with Coccinelle. Signed-off-by: Nishka Dasgupta Link: https://lore.kernel.org/r/20190701091817.12759-2-nishkadg.linux@gmail.com Signed-off-by: Greg Kroah-Hartman commit 78c5f096d7ea92276c0c3aca40b6dcdedcb9bb8f Author: Nishka Dasgupta Date: Mon Jul 1 14:48:08 2019 +0530 staging: rtl8723bs: Remove rtw_btcoex_RpwmVal() Remove function rtw_btcoex_RpwmVal as all it does is call hal_btcoex_RpwmVal. Modify call sites accordingly. Issue found with Coccinelle. Signed-off-by: Nishka Dasgupta Link: https://lore.kernel.org/r/20190701091817.12759-1-nishkadg.linux@gmail.com Signed-off-by: Greg Kroah-Hartman commit 6a2ac8d4bf91d56c6335db0fc0585b9788397a3b Author: Simon Sandström Date: Mon Jul 1 11:18:19 2019 +0200 staging: kpc2000: fix brace issues in kpc2000_spi.c Fixes issues found by checkpatch: - "WARNING: braces {} are not necessary for single statement blocks" - "WARNING: braces {} are not necessary for any arm of this statement" Signed-off-by: Simon Sandström Link: https://lore.kernel.org/r/20190701091819.18528-1-simon@nikanor.nu Signed-off-by: Greg Kroah-Hartman commit feb20855a32ae62315038bac59a92d6489ea9cbe Author: Nishka Dasgupta Date: Mon Jul 1 14:45:52 2019 +0530 staging: rtl8192u: Replace function rtl8192_rx_enable() Remove function rtl8192_rx_enable as all it does is call rtl8192_rx_initiate. Rename rtl8192_rx_initiate to rtl8192_rx_enable and change its type from static to non-static to maintain compatibility with call sites of rtl8192_rx_enable. Issue found with Coccinelle. Signed-off-by: Nishka Dasgupta Link: https://lore.kernel.org/r/20190701091552.12696-1-nishkadg.linux@gmail.com Signed-off-by: Greg Kroah-Hartman commit 0dbc8368edf0f1b55c4835019450d4c54cc9f6fe Author: Christian Müller Date: Mon Jul 1 10:27:07 2019 +0200 drivers/staging/rtl8192u: style nonstyled comments The coding-styles.rst states, that multiline comments should allways contain a leading "*" in each line. For multiline comments in general they /* * should look * like this. */ For multiline comments in either net/ or drivers/net/ however, they should /* omit * the first * empty line. */ Since this file is part of a networking driver, the goal for it would be to reside in drivers/net/ one day. This patch changes comments, that were in neither form of the two listed above, to have the style that is specified for drivers/net/. Signed-off-by: Christian Müller Signed-off-by: Felix Trommer Link: https://lore.kernel.org/r/20190701082707.25198-2-muellerch-privat@web.de Signed-off-by: Greg Kroah-Hartman commit d8718e45e2544251c11332655cce93ba9e080811 Author: Christian Müller Date: Mon Jul 1 10:27:06 2019 +0200 drivers/staging/rtl8192u: drop first comment line As stated in coding-styles.rst multiline comments should be structured in a way, that the actual comment starts on the second line of the commented portion. E.g: /* * Multiline comments * should look like * this. */ However, there is an exception to files in drivers/net/ and net/, where multiline comments are prefered to look like this: /* Mutliline comments for * drivers/net/ should look * like this. */ The comments in this file initially looked like the first example. But since this file is part of a networking driver and thus should be moved to drivers/net/ one day, this patch adjusts the comments such that they are fitting to the style imposed for drivers/net/. Signed-off-by: Christian Müller Signed-off-by: Felix Trommer Link: https://lore.kernel.org/r/20190701082707.25198-1-muellerch-privat@web.de Signed-off-by: Greg Kroah-Hartman commit baa3477f06af2238bc88a74db22d7e8ea5782dda Author: NeilBrown Date: Mon Jul 1 10:43:07 2019 +1000 staging: mt7621-dts: add support for second network interface The mt7621 has two network interfaces, one that connects to an internal switch, and one that can connect to either that switch or an external phy, or possibly an internal phy. The Gnubee-PC2 has an external phy for use with the second interface. This patch add some support for the second interface to mt7621.dtsi and add a gbpc2.dts which makes use of this. This allows the second interface to be used. I don't fully understand how to configure this interface - the documentation is thin - so there could well be room for improvement here. Signed-off-by: NeilBrown Link: https://lore.kernel.org/r/156194178766.1430.12784163026696670896.stgit@noble.brown Signed-off-by: Greg Kroah-Hartman commit cf8e49ae200baa05b8536e99fbee37faf9c2cebb Author: NeilBrown Date: Mon Jul 1 10:43:07 2019 +1000 staging: mt7621-dts: update sdhci config. The mtk-sd driver has been updated to support the IP in the mt7621, so update our configuration to work with it. Signed-off-by: NeilBrown Link: https://lore.kernel.org/r/156194178761.1430.1625105851941268306.stgit@noble.brown Signed-off-by: Greg Kroah-Hartman commit fd315da57dc37b7d9f3f145f88eb66085279d48a Author: Nishka Dasgupta Date: Mon Jul 1 12:30:25 2019 +0530 staging: comedi: mite: Replace function mite_request_channel_in_range() Remove function mite_request_channel_in_range as all it does is call __mite_request_channel. Rename __mite_request_channel to mite_request_channel_in_range and change its type from static to non-static to maintain compatibility with call sites. Change only remaining call site of __mite_request_channel to call mite_request_channel_in_range_instead. Issue found with Coccinelle. Signed-off-by: Nishka Dasgupta Reviewed-by: Ian Abbott Link: https://lore.kernel.org/r/20190701070025.3838-3-nishkadg.linux@gmail.com Signed-off-by: Greg Kroah-Hartman commit 931282a9c7a6ea366c5a8a3c5a0f021681d19d9d Author: Nishka Dasgupta Date: Mon Jul 1 12:30:24 2019 +0530 staging: comedi: amplc_dio200: Remove function gat_sce() Remove function gat_sce as all it does is call clk_gat_sce. Modify call sites of the former to call the latter directly. Issue found with Coccinelle. Signed-off-by: Nishka Dasgupta Reviewed-by: Ian Abbott Link: https://lore.kernel.org/r/20190701070025.3838-2-nishkadg.linux@gmail.com Signed-off-by: Greg Kroah-Hartman commit 18e75e3282f7fabcb0bbfc4223d3209e6b0f5083 Author: Nishka Dasgupta Date: Mon Jul 1 12:30:23 2019 +0530 staging: comedi: amplc_dio200: Remove function clk_sce() Remove function clk_sce as all it does is call clk_gat_sce. Modify call site of clk_sce to call clk_gat_sce instead. Issue found with Coccinelle. Signed-off-by: Nishka Dasgupta Reviewed-by: Ian Abbott Link: https://lore.kernel.org/r/20190701070025.3838-1-nishkadg.linux@gmail.com Signed-off-by: Greg Kroah-Hartman commit 8f9e3a519d56f420d2d4cee6521bae48b8273abf Author: Christian Gromm Date: Mon Jul 1 15:49:33 2019 +0200 staging: most: remove data sanity check This patch removes the data check in the set_cfg_* functions, because the modules infacing the hardware (usb, i2c, ...) already have it. Signed-off-by: Christian Gromm Link: https://lore.kernel.org/r/1561988973-301-1-git-send-email-christian.gromm@microchip.com Signed-off-by: Greg Kroah-Hartman commit 23a4388f24f5356fa0bef07911c7b4fbc97619ac Author: Nishka Dasgupta Date: Wed Jul 3 13:48:42 2019 +0530 staging: android: ion: Remove file ion_chunk_heap.c Remove file ion_chunk_heap.c as its functions and definitions are not used anywhere else. Issue found with Coccinelle. Signed-off-by: Nishka Dasgupta Acked-by: Laura Abbott Link: https://lore.kernel.org/r/20190703081842.22872-2-nishkadg.linux@gmail.com Signed-off-by: Greg Kroah-Hartman commit eadbf7a34e44e8fb2e63142b992bf264ffb72bf9 Author: Nishka Dasgupta Date: Wed Jul 3 13:48:41 2019 +0530 staging: android: ion: Remove file ion_carveout_heap.c Remove file ion_carveout_heap.c as its functions and definitions are not used anywhere. Issue found with Coccinelle. Signed-off-by: Nishka Dasgupta Acked-by: Laura Abbott Link: https://lore.kernel.org/r/20190703081842.22872-1-nishkadg.linux@gmail.com Signed-off-by: Greg Kroah-Hartman commit af89bcef55ff6d488d5f64d0068042b1a1092d33 Author: Gao Xiang Date: Wed Jul 3 14:52:09 2019 +0800 staging: erofs: fix LZ4 limited bounced page mis-reuse Like all lz77-based algrithms, lz4 has a dynamically populated ("sliding window") dictionary and the maximum lookback distance is 65535. Therefore the number of bounced pages could be limited by erofs based on this property. However, just now we observed some lz4 sequences in the extreme case cannot be decompressed correctly after this feature is enabled, the root causes after analysis are clear as follows: 1) max bounced pages should be 17 rather than 16 pages; 2) considering the following case, the broken implementation could reuse unsafely in advance (in other words, reuse it less than a safe distance), 0 1 2 ... 16 17 18 ... 33 34 b p b b note that the bounce page that we are concerned was allocated at 0, and it reused at 18 since page 17 exists, but it mis-reused at 34 in advance again, which causes decompress failure. This patch resolves the issue by introducing a bitmap to mark whether the page in the same position of last round is a bounced page or not, and a micro stack data structure to store all available bounced pages. Fixes: 7fc45dbc938a ("staging: erofs: introduce generic decompression backend") Reviewed-by: Chao Yu Signed-off-by: Gao Xiang Signed-off-by: Greg Kroah-Hartman commit 4969c06a0d83c9c3dc50b8efcdc8eeedfce896f6 Author: Jaegeuk Kim Date: Mon Jul 1 19:15:29 2019 -0700 f2fs: support swap file w/ DIO Signed-off-by: Jaegeuk Kim commit f505e91ef511a20b2bc3d0eaca41faecdb715027 Author: Alexander Shishkin Date: Thu Jun 27 15:51:47 2019 +0300 intel_th: msu: Start read iterator from a non-empty window In multi-window mode, the read iterator is supposed to start from the window with the oldest data, which is, chronologically, the next window after the one with the newest data. This, however, fails to take into account the potentially empty windows, so in short trace sessions it's possible to have a lot of zeroes read from the character device first. Fix this by skipping over the empty windows in initialization of the read iterator. Signed-off-by: Alexander Shishkin Reviewed-by: Andy Shevchenko Link: https://lore.kernel.org/r/20190627125152.54905-5-alexander.shishkin@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit bbbc08a154a1750371f8347a5353819551d11abb Author: Alexander Shishkin Date: Thu Jun 27 15:51:46 2019 +0300 intel_th: msu: Split sgt array and pointer in multiwindow mode To allow the use of externally allocated SG tables further down the line, change the code to reference the table via a pointer and make it point to the locally allocated table by default. Signed-off-by: Alexander Shishkin Reviewed-by: Andy Shevchenko Link: https://lore.kernel.org/r/20190627125152.54905-4-alexander.shishkin@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit fa52b3fe5e9383022f83382f5ffcb386b9b11b4f Author: Alexander Shishkin Date: Thu Jun 27 15:51:45 2019 +0300 intel_th: msu: Support multipage blocks Now that the MSU is using scatterlist, we can support multipage blocks. At the moment, the code assumes that all blocks are page-sized, but in larger buffers it may make sense to chunk together larger blocks of memory. One place where one-to-many relationship needs to be handled is the MSU buffer's mmap path. Get rid of the implicit assumption that all blocks are page-sized. Signed-off-by: Alexander Shishkin Reviewed-by: Andy Shevchenko Link: https://lore.kernel.org/r/20190627125152.54905-3-alexander.shishkin@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit 4aa5aed2b6f267592705a526f57518a5d715b769 Author: Alexander Shishkin Date: Fri Jun 21 19:19:30 2019 +0300 intel_th: pci: Add Ice Lake NNPI support This adds Ice Lake NNPI support to the Intel(R) Trace Hub. Signed-off-by: Alexander Shishkin Reviewed-by: Andy Shevchenko Cc: stable Link: https://lore.kernel.org/r/20190621161930.60785-5-alexander.shishkin@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit 918b8646497b5dba6ae82d4a7325f01b258972b9 Author: Alexander Shishkin Date: Fri Jun 21 19:19:29 2019 +0300 intel_th: msu: Fix single mode with disabled IOMMU Commit 4e0eaf239fb3 ("intel_th: msu: Fix single mode with IOMMU") switched the single mode code to use dma mapping pages obtained from the page allocator, but with IOMMU disabled, that may lead to using SWIOTLB bounce buffers and without additional sync'ing, produces empty trace buffers. Fix this by using a DMA32 GFP flag to the page allocation in single mode, as the device supports full 32-bit DMA addressing. Signed-off-by: Alexander Shishkin Fixes: 4e0eaf239fb3 ("intel_th: msu: Fix single mode with IOMMU") Reviewed-by: Andy Shevchenko Reported-by: Ammy Yi Cc: stable Link: https://lore.kernel.org/r/20190621161930.60785-4-alexander.shishkin@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit 9800db282dff675dd700d5985d90b605c34b5ccd Author: YueHaibing Date: Fri Jun 21 19:19:28 2019 +0300 intel_th: msu: Remove set but not used variable 'last' Commit aad14ad3cf3a ("intel_th: msu: Add current window tracking") added the following gcc warning: > drivers/hwtracing/intel_th/msu.c: In function msc_win_switch: > drivers/hwtracing/intel_th/msu.c:1389:21: warning: variable last set but > not used [-Wunused-but-set-variable] Fix it by removing the variable. Signed-off-by: YueHaibing Fixes: aad14ad3cf3a ("intel_th: msu: Add current window tracking") Reviewed-by: Andy Shevchenko Signed-off-by: Alexander Shishkin Cc: stable Link: https://lore.kernel.org/r/20190621161930.60785-3-alexander.shishkin@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit b96fb368b08f1637cbf780a6b83e36c2c5ed4ff5 Author: Shaokun Zhang Date: Fri Jun 21 19:19:27 2019 +0300 intel_th: msu: Fix unused variable warning on arm64 platform Commit ba39bd8306057 ("intel_th: msu: Switch over to scatterlist") introduced the following warnings on non-x86 architectures, as a result of reordering the multi mode buffer allocation sequence: > drivers/hwtracing/intel_th/msu.c: In function ‘msc_buffer_win_alloc’: > drivers/hwtracing/intel_th/msu.c:783:21: warning: unused variable ‘i’ > [-Wunused-variable] > int ret = -ENOMEM, i; > ^ > drivers/hwtracing/intel_th/msu.c: In function ‘msc_buffer_win_free’: > drivers/hwtracing/intel_th/msu.c:863:6: warning: unused variable ‘i’ > [-Wunused-variable] > int i; > ^ Fix this compiler warning by factoring out set_memory sequences and making them x86-only. Suggested-by: Alexander Shishkin Signed-off-by: Shaokun Zhang Fixes: ba39bd8306057 ("intel_th: msu: Switch over to scatterlist") Reviewed-by: Andy Shevchenko Signed-off-by: Alexander Shishkin Cc: stable Link: https://lore.kernel.org/r/20190621161930.60785-2-alexander.shishkin@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit a7a9250e18b3a6f4243acae4e9be6f455a46effe Author: Hariprasad Kelam Date: Wed Jul 3 07:34:18 2019 -0700 fs: xfs: xfs_log: Change return type from int to void Change return types of below functions as they never fails xfs_log_mount_cancel xlog_recover_cancel xlog_recover_cancel_intents fix below issue reported by coccicheck fs/xfs/xfs_log_recover.c:4886:7-12: Unneeded variable: "error". Return "0" on line 4926 Signed-off-by: Hariprasad Kelam Reviewed-by: Eric Sandeen Reviewed-by: Carlos Maiolino Reviewed-by: Darrick J. Wong Signed-off-by: Darrick J. Wong commit 3e5a428b264eca8c7f1c261cffbe139538d7965f Author: Darrick J. Wong Date: Wed Jul 3 07:33:27 2019 -0700 xfs: poll waiting for quotacheck Create a pwork destroy function that uses polling instead of uninterruptible sleep to wait for work items to finish so that we can touch the softlockup watchdog. IOWs, gross hack. Signed-off-by: Darrick J. Wong Reviewed-by: Brian Foster commit 56f3364aba8866d0f7f8c965e7acf07f35679701 Author: Greg Kroah-Hartman Date: Wed Jun 12 17:36:13 2019 +0200 lib: notifier-error-inject: no need to check return value of debugfs_create functions When calling debugfs functions, there is no need to ever check the return value. The function can work or not, but the code logic should never do something different based on this. Cc: Thomas Gleixner Cc: linux-kernel@vger.kernel.org Signed-off-by: Greg Kroah-Hartman Link: https://lore.kernel.org/r/20190612153613.GA21239@kroah.com Signed-off-by: Greg Kroah-Hartman commit 1be51474f99bcfdecef3f34b9a9a8cf4393fd8f9 Author: Greg Kroah-Hartman Date: Wed Jun 12 16:43:14 2019 +0200 swiotlb: no need to check return value of debugfs_create functions When calling debugfs functions, there is no need to ever check the return value. The function can work or not, but the code logic should never do something different based on this. Cc: Konrad Rzeszutek Wilk Cc: Christoph Hellwig Cc: Marek Szyprowski Cc: Robin Murphy Cc: iommu@lists.linux-foundation.org Signed-off-by: Greg Kroah-Hartman Link: https://lore.kernel.org/r/20190612144314.GA16803@kroah.com Signed-off-by: Greg Kroah-Hartman commit 1a829ff2a6c37187ff8020488e84ec392cb94854 Author: Greg Kroah-Hartman Date: Wed Jun 12 16:55:38 2019 +0200 ceph: no need to check return value of debugfs_create functions When calling debugfs functions, there is no need to ever check the return value. The function can work or not, but the code logic should never do something different based on this. This cleanup allows the return value of the functions to be made void, as no logic should care if these files succeed or not. Cc: "Yan, Zheng" Cc: Sage Weil Cc: Ilya Dryomov Cc: "David S. Miller" Cc: ceph-devel@vger.kernel.org Signed-off-by: Greg Kroah-Hartman Link: https://lore.kernel.org/r/20190612145538.GA18772@kroah.com Signed-off-by: Greg Kroah-Hartman commit 0a0762c6c604bb0ce8afe4ee052514e0208152a0 Author: Greg Kroah-Hartman Date: Wed Jun 12 16:56:22 2019 +0200 sunrpc: no need to check return value of debugfs_create functions When calling debugfs functions, there is no need to ever check the return value. The function can work or not, but the code logic should never do something different based on this. Cc: "J. Bruce Fields" Cc: Jeff Layton Cc: Trond Myklebust Cc: Anna Schumaker Cc: linux-nfs@vger.kernel.org Cc: netdev@vger.kernel.org Signed-off-by: Greg Kroah-Hartman Link: https://lore.kernel.org/r/20190612145622.GA18839@kroah.com Signed-off-by: Greg Kroah-Hartman commit 702d6a834b497a7c387722bd796e0dc18bb55360 Author: Greg Kroah-Hartman Date: Wed Jun 12 17:21:20 2019 +0200 ubifs: no need to check return value of debugfs_create functions When calling debugfs functions, there is no need to ever check the return value. The function can work or not, but the code logic should never do something different based on this. Cc: Richard Weinberger Cc: Artem Bityutskiy Cc: Adrian Hunter Cc: linux-mtd@lists.infradead.org Signed-off-by: Greg Kroah-Hartman Link: https://lore.kernel.org/r/20190612152120.GA17450@kroah.com Signed-off-by: Greg Kroah-Hartman commit f095adba36bb7f6947135f6893b5837760961b3d Author: Greg Kroah-Hartman Date: Wed Jun 12 17:22:04 2019 +0200 orangefs: no need to check return value of debugfs_create functions When calling debugfs functions, there is no need to ever check the return value. The function can work or not, but the code logic should never do something different based on this. Cc: Mike Marshall Cc: Martin Brandenburg Cc: devel@lists.orangefs.org Signed-off-by: Greg Kroah-Hartman Link: https://lore.kernel.org/r/20190612152204.GA17511@kroah.com Signed-off-by: Greg Kroah-Hartman commit 15b6ff951630eb5825936f98d940c2a4596ff224 Author: Greg Kroah-Hartman Date: Wed Jun 12 17:26:03 2019 +0200 nfsd: no need to check return value of debugfs_create functions When calling debugfs functions, there is no need to ever check the return value. The function can work or not, but the code logic should never do something different based on this. Cc: "J. Bruce Fields" Cc: Jeff Layton Cc: linux-nfs@vger.kernel.org Signed-off-by: Greg Kroah-Hartman Link: https://lore.kernel.org/r/20190612152603.GB18440@kroah.com Signed-off-by: Greg Kroah-Hartman commit 352bce2ee19f9d479832c060548974da2ba51153 Author: Greg Kroah-Hartman Date: Wed Jun 12 17:34:40 2019 +0200 lib: 842: no need to check return value of debugfs_create functions When calling debugfs functions, there is no need to ever check the return value. The function can work or not, but the code logic should never do something different based on this. Cc: Haren Myneni Cc: linux-kernel@vger.kernel.org Signed-off-by: Greg Kroah-Hartman Link: https://lore.kernel.org/r/20190612153440.GA21006@kroah.com Signed-off-by: Greg Kroah-Hartman commit d03ae4778b3b61fc329615c30972074ee3496b0a Author: Greg Kroah-Hartman Date: Wed Jul 3 09:16:52 2019 +0200 debugfs: provide pr_fmt() macro Use a common "debugfs: " prefix for all pr_* calls in a single place. Cc: Mark Brown Reviewed-by: Takashi Iwai Reviewed-by: Rafael J. Wysocki Signed-off-by: Greg Kroah-Hartman Link: https://lore.kernel.org/r/20190703071653.2799-1-gregkh@linuxfoundation.org Signed-off-by: Greg Kroah-Hartman commit 43e23b6c0b0151e308acbd6530bb80e2d2e53161 Author: Greg Kroah-Hartman Date: Wed Jul 3 09:16:53 2019 +0200 debugfs: log errors when something goes wrong As it is not recommended that debugfs calls be checked, it was pointed out that major errors should still be logged somewhere so that developers and users have a chance to figure out what went wrong. To help with this, error logging has been added to the debugfs core so that it is not needed to be present in every individual file that calls debugfs. Reported-by: Mark Brown Reported-by: Takashi Iwai Reviewed-by: Mark Brown Reviewed-by: Takashi Iwai Reviewed-by: Rafael J. Wysocki Signed-off-by: Greg Kroah-Hartman Link: https://lore.kernel.org/r/20190703071653.2799-2-gregkh@linuxfoundation.org Signed-off-by: Greg Kroah-Hartman commit e5a3e259ef239f443951d401db10db7d426c9497 Merge: d2f5bbbc3500 d78e3f0614f8 Author: Daniel Borkmann Date: Wed Jul 3 16:52:03 2019 +0200 Merge branch 'bpf-tcp-rtt-hook' Stanislav Fomichev says: ==================== Congestion control team would like to have a periodic callback to track some TCP statistics. Let's add a sock_ops callback that can be selectively enabled on a socket by socket basis and is executed for every RTT. BPF program frequency can be further controlled by calling bpf_ktime_get_ns and bailing out early. I run neper tcp_stream and tcp_rr tests with the sample program from the last patch and didn't observe any noticeable performance difference. v2: * add a comment about second accept() in selftest (Yonghong Song) * refer to tcp_bpf.readme in sample program (Yonghong Song) ==================== Suggested-by: Eric Dumazet Cc: Eric Dumazet Cc: Priyaranjan Jha Cc: Yuchung Cheng Cc: Soheil Hassas Yeganeh Acked-by: Soheil Hassas Yeganeh Acked-by: Yuchung Cheng Acked-by: Yonghong Song Acked-by: Lawrence Brakmo Signed-off-by: Daniel Borkmann commit d78e3f0614f866d4456f860dc5773a6176eb9937 Author: Stanislav Fomichev Date: Tue Jul 2 09:14:03 2019 -0700 samples/bpf: fix tcp_bpf.readme detach command Copy-paste, should be detach, not attach. Signed-off-by: Stanislav Fomichev Acked-by: Soheil Hassas Yeganeh Acked-by: Yuchung Cheng Signed-off-by: Daniel Borkmann commit 395338843de1e47f6876e58adfe75b6483f96fff Author: Stanislav Fomichev Date: Tue Jul 2 09:14:02 2019 -0700 samples/bpf: add sample program that periodically dumps TCP stats Uses new RTT callback to dump stats every second. $ mkdir -p /tmp/cgroupv2 $ mount -t cgroup2 none /tmp/cgroupv2 $ mkdir -p /tmp/cgroupv2/foo $ echo $$ >> /tmp/cgroupv2/foo/cgroup.procs $ bpftool prog load ./tcp_dumpstats_kern.o /sys/fs/bpf/tcp_prog $ bpftool cgroup attach /tmp/cgroupv2/foo sock_ops pinned /sys/fs/bpf/tcp_prog $ bpftool prog tracelog $ # run neper/netperf/etc Used neper to compare performance with and without this program attached and didn't see any noticeable performance impact. Sample output: -0 [015] ..s. 2074.128800: 0: dsack_dups=0 delivered=242526 -0 [015] ..s. 2074.128808: 0: delivered_ce=0 icsk_retransmits=0 -0 [015] ..s. 2075.130133: 0: dsack_dups=0 delivered=323599 -0 [015] ..s. 2075.130138: 0: delivered_ce=0 icsk_retransmits=0 -0 [005] .Ns. 2076.131440: 0: dsack_dups=0 delivered=404648 -0 [005] .Ns. 2076.131447: 0: delivered_ce=0 icsk_retransmits=0 Cc: Eric Dumazet Cc: Priyaranjan Jha Cc: Yuchung Cheng Cc: Soheil Hassas Yeganeh Acked-by: Soheil Hassas Yeganeh Acked-by: Yuchung Cheng Signed-off-by: Stanislav Fomichev Signed-off-by: Daniel Borkmann commit b55873984dab0eda6db00d19db4c43dce5c11d98 Author: Stanislav Fomichev Date: Tue Jul 2 09:14:01 2019 -0700 selftests/bpf: test BPF_SOCK_OPS_RTT_CB Make sure the callback is invoked for syn-ack and data packet. Cc: Eric Dumazet Cc: Priyaranjan Jha Cc: Yuchung Cheng Cc: Soheil Hassas Yeganeh Acked-by: Soheil Hassas Yeganeh Acked-by: Yuchung Cheng Signed-off-by: Stanislav Fomichev Signed-off-by: Daniel Borkmann commit 692cbaa99fe446ed30bfb7e53fb2b4cc518331a1 Author: Stanislav Fomichev Date: Tue Jul 2 09:14:00 2019 -0700 bpf/tools: sync bpf.h Sync new bpf_tcp_sock fields and new BPF_PROG_TYPE_SOCK_OPS RTT callback. Cc: Eric Dumazet Cc: Priyaranjan Jha Cc: Yuchung Cheng Cc: Soheil Hassas Yeganeh Acked-by: Soheil Hassas Yeganeh Acked-by: Yuchung Cheng Signed-off-by: Stanislav Fomichev Signed-off-by: Daniel Borkmann commit c2cb5e82a720c05b707701c75dfeb356fe184787 Author: Stanislav Fomichev Date: Tue Jul 2 09:13:59 2019 -0700 bpf: add icsk_retransmits to bpf_tcp_sock Add some inet_connection_sock fields to bpf_tcp_sock that might be useful for debugging congestion control issues. Cc: Eric Dumazet Cc: Priyaranjan Jha Cc: Yuchung Cheng Cc: Soheil Hassas Yeganeh Acked-by: Soheil Hassas Yeganeh Acked-by: Yuchung Cheng Signed-off-by: Stanislav Fomichev Signed-off-by: Daniel Borkmann commit 0357746d1e40a8226f68a42c8d7222a12d7c451f Author: Stanislav Fomichev Date: Tue Jul 2 09:13:58 2019 -0700 bpf: add dsack_dups/delivered{, _ce} to bpf_tcp_sock Add more fields to bpf_tcp_sock that might be useful for debugging congestion control issues. Cc: Eric Dumazet Cc: Priyaranjan Jha Cc: Yuchung Cheng Cc: Soheil Hassas Yeganeh Acked-by: Soheil Hassas Yeganeh Acked-by: Yuchung Cheng Signed-off-by: Stanislav Fomichev Signed-off-by: Daniel Borkmann commit 2377b81de52750997726d6d43b4114e5842c4bf9 Author: Stanislav Fomichev Date: Tue Jul 2 09:13:57 2019 -0700 bpf: split shared bpf_tcp_sock and bpf_sock_ops implementation We've added bpf_tcp_sock member to bpf_sock_ops and don't expect any new tcp_sock fields in bpf_sock_ops. Let's remove CONVERT_COMMON_TCP_SOCK_FIELDS so bpf_tcp_sock can be independently extended. Cc: Eric Dumazet Cc: Priyaranjan Jha Cc: Yuchung Cheng Cc: Soheil Hassas Yeganeh Acked-by: Soheil Hassas Yeganeh Acked-by: Yuchung Cheng Signed-off-by: Stanislav Fomichev Signed-off-by: Daniel Borkmann commit 23729ff23186424e54b4d6678fcd526cdacef4d3 Author: Stanislav Fomichev Date: Tue Jul 2 09:13:56 2019 -0700 bpf: add BPF_CGROUP_SOCK_OPS callback that is executed on every RTT Performance impact should be minimal because it's under a new BPF_SOCK_OPS_RTT_CB_FLAG flag that has to be explicitly enabled. Suggested-by: Eric Dumazet Cc: Eric Dumazet Cc: Priyaranjan Jha Cc: Yuchung Cheng Cc: Soheil Hassas Yeganeh Acked-by: Soheil Hassas Yeganeh Acked-by: Yuchung Cheng Signed-off-by: Stanislav Fomichev Signed-off-by: Daniel Borkmann commit 049331f277fef1c3f2527c2c9afa1d285e9a1247 Author: Thomas Gleixner Date: Wed Jul 3 14:19:36 2019 +0200 x86/fsgsbase: Revert FSGSBASE support The FSGSBASE series turned out to have serious bugs and there is still an open issue which is not fully understood yet. The confidence in those changes has become close to zero especially as the test cases which have been shipped with that series were obviously never run before sending the final series out to LKML. ./fsgsbase_64 >/dev/null Segmentation fault As the merge window is close, the only sane decision is to revert FSGSBASE support. The revert is necessary as this branch has been merged into perf/core already and rebasing all of that a few days before the merge window is not the most brilliant idea. I could definitely slap myself for not noticing the test case fail when merging that series, but TBH my expectations weren't that low back then. Won't happen again. Revert the following commits: 539bca535dec ("x86/entry/64: Fix and clean up paranoid_exit") 2c7b5ac5d5a9 ("Documentation/x86/64: Add documentation for GS/FS addressing mode") f987c955c745 ("x86/elf: Enumerate kernel FSGSBASE capability in AT_HWCAP2") 2032f1f96ee0 ("x86/cpu: Enable FSGSBASE on 64bit by default and add a chicken bit") 5bf0cab60ee2 ("x86/entry/64: Document GSBASE handling in the paranoid path") 708078f65721 ("x86/entry/64: Handle FSGSBASE enabled paranoid entry/exit") 79e1932fa3ce ("x86/entry/64: Introduce the FIND_PERCPU_BASE macro") 1d07316b1363 ("x86/entry/64: Switch CR3 before SWAPGS in paranoid entry") f60a83df4593 ("x86/process/64: Use FSGSBASE instructions on thread copy and ptrace") 1ab5f3f7fe3d ("x86/process/64: Use FSBSBASE in switch_to() if available") a86b4625138d ("x86/fsgsbase/64: Enable FSGSBASE instructions in helper functions") 8b71340d702e ("x86/fsgsbase/64: Add intrinsics for FSGSBASE instructions") b64ed19b93c3 ("x86/cpu: Add 'unsafe_fsgsbase' to enable CR4.FSGSBASE") Signed-off-by: Thomas Gleixner Acked-by: Ingo Molnar Cc: Chang S. Bae Cc: Andy Lutomirski Cc: Borislav Petkov Cc: Peter Zijlstra Cc: Andi Kleen Cc: Ravi Shankar Cc: Dave Hansen Cc: H. Peter Anvin commit 40786717c88c2d4cb426cc2eb99ac50000e5a910 Author: Darrick J. Wong Date: Wed Jul 3 07:33:26 2019 -0700 xfs: multithreaded iwalk implementation Create a parallel iwalk implementation and switch quotacheck to use it. Signed-off-by: Darrick J. Wong Reviewed-by: Brian Foster commit 697096b14444f458fb81212d1c82d7846e932455 Author: Andy Lutomirski Date: Tue Jul 2 20:43:04 2019 -0700 selftests/x86/fsgsbase: Fix some test case bugs This refactors do_unexpected_base() to clean up some code. It also fixes the following bugs in test_ptrace_write_gsbase(): - Incorrect printf() format string caused crashes. - Hardcoded 0x7 for the gs selector was not reliably correct. It also documents the fact that the test is expected to fail on old kernels. Fixes: a87730cc3acc ("selftests/x86/fsgsbase: Test ptracer-induced GSBASE write with FSGSBASE") Fixes: 1b6858d5a2eb ("selftests/x86/fsgsbase: Test ptracer-induced GSBASE write") Signed-off-by: Andy Lutomirski Signed-off-by: Thomas Gleixner Cc: "BaeChang Seok" Cc: Borislav Petkov Cc: Peter Zijlstra Cc: "H . Peter Anvin" Cc: Andi Kleen Cc: H. Peter Anvin Cc: "BaeChang Seok" Link: https://lkml.kernel.org/r/bab29c84f2475e2c30ddb00f1b877fcd7f4f96a8.1562125333.git.luto@kernel.org commit 90f15ac9fa7e7ff66e0980309d8184bff0611624 Author: Fuqian Huang Date: Wed Jul 3 21:17:27 2019 +0800 ext2: Use kmemdup rather than duplicating its implementation kmemdup is introduced to duplicate a region of memory in a neat way. Rather than kmalloc/kzalloc + memset, which the programmer needs to write the size twice (sometimes lead to mistakes), kmemdup improves readability, leads to smaller code and also reduce the chances of mistakes. Suggestion to use kmemdup rather than using kmalloc/kzalloc + memset. Signed-off-by: Fuqian Huang Link: https://lore.kernel.org/r/20190703131727.25735-1-huangfq.daxian@gmail.com Signed-off-by: Jan Kara commit f3880a23564e3172437285ebcb5b8a124539fdae Author: Lionel Debieve Date: Fri Jun 28 13:26:55 2019 +0200 crypto: stm32/hash - remove interruptible condition for dma When DMA is used, waiting for completion must not be interruptible as it can generate an error that is not handle by the driver. There is no need to put the completion interruptible in this driver. Signed-off-by: Lionel Debieve Signed-off-by: Herbert Xu commit 0acabecebc912b3ba06289e4ef40476acc499a37 Author: Lionel Debieve Date: Fri Jun 28 13:26:54 2019 +0200 crypto: stm32/hash - Fix hmac issue more than 256 bytes Correct condition for the second hmac loop. Key must be only set in the first loop. Initial condition was wrong, HMAC_KEY flag was not properly checked. Signed-off-by: Lionel Debieve Signed-off-by: Herbert Xu commit fdbd643a74efb353a20ecde94a2200e13a283b66 Author: Lionel Debieve Date: Fri Jun 28 13:26:41 2019 +0200 crypto: stm32/crc32 - rename driver file Use the same naming convention for all stm32 crypto drivers. Signed-off-by: Lionel Debieve Signed-off-by: Herbert Xu commit 7be373b6de503cd1eed6be4f2780925a5af03230 Author: Wanpeng Li Date: Fri Jun 14 09:15:48 2019 +0800 KVM: LAPIC: remove the trailing newline used in the fmt parameter of TP_printk The trailing newlines will lead to extra newlines in the trace file which looks like the following output, so remove it. qemu-system-x86-15695 [002] ...1 15774.839240: kvm_hv_timer_state: vcpu_id 0 hv_timer 1 qemu-system-x86-15695 [002] ...1 15774.839309: kvm_hv_timer_state: vcpu_id 0 hv_timer 1 Cc: Paolo Bonzini Cc: Radim Krčmář Signed-off-by: Wanpeng Li Signed-off-by: Paolo Bonzini commit d647eb63e67156fae44d2b467b1f314fc676de7a Author: Paolo Bonzini Date: Thu Jun 20 14:13:33 2019 +0200 KVM: svm: add nrips module parameter Allow testing code for old processors that lack the next RIP save feature, by disabling usage of the next_rip field. Nested hypervisors however get the feature unconditionally. Signed-off-by: Paolo Bonzini commit 66d9c1cf9f95d96aa211d9f732cd42e93e2c1508 Author: Fuqian Huang Date: Fri Jun 28 10:46:31 2019 +0800 crypto: amcc - remove memset after dma_alloc_coherent In commit af7ddd8a627c ("Merge tag 'dma-mapping-4.21' of git://git.infradead.org/users/hch/dma-mapping"), dma_alloc_coherent has already zeroed the memory. So memset is not needed. Signed-off-by: Fuqian Huang Signed-off-by: Herbert Xu commit 600bac009ea9822d371aae03d33fc05991c5b5a2 Author: Hook, Gary Date: Thu Jun 27 16:23:29 2019 +0000 crypto: ccp - Switch to SPDX license identifiers Add an SPDX identifier and remove any specific statements. Signed-off-by: Gary R Hook Signed-off-by: Herbert Xu commit 52393d617af7b554f03531e6756facf2ea687d2e Author: Hook, Gary Date: Thu Jun 27 16:16:23 2019 +0000 crypto: ccp - Validate the the error value used to index error messages The error code read from the queue status register is only 6 bits wide, but we need to verify its value is within range before indexing the error messages. Fixes: 81422badb3907 ("crypto: ccp - Make syslog errors human-readable") Cc: Reported-by: Cfir Cohen Signed-off-by: Gary R Hook Signed-off-by: Herbert Xu commit ae400be94b84206e8344e8f10d896aeb3ea2f505 Author: Hook, Gary Date: Tue Jun 25 23:43:50 2019 +0000 crypto: doc - Fix formatting of new crypto engine content Tidy up the formatting/grammar in crypto_engine.rst. Use bulleted lists where appropriate. Signed-off-by: Gary R Hook Signed-off-by: Herbert Xu commit 5a35316d97914d56d6be8b3748b2437785e74790 Author: Hook, Gary Date: Tue Jun 25 23:43:43 2019 +0000 crypto: doc - Add parameter documentation Fill in missing parameter descriptions for the compression algorithm, then pick them up to document for the compression_alg structure. Signed-off-by: Gary R Hook Signed-off-by: Herbert Xu commit 7367bfeb2c141fb3ddff6b09bb5dfeb739b3d245 Author: Ard Biesheuvel Date: Mon Jun 24 19:38:31 2019 +0200 crypto: arm64/aes-ce - implement 5 way interleave for ECB, CBC and CTR This implements 5-way interleaving for ECB, CBC decryption and CTR, resulting in a speedup of ~11% on Marvell ThunderX2, which has a very deep pipeline and therefore a high issue latency for NEON instructions operating on the same registers. Note that XTS is left alone: implementing 5-way interleave there would either involve spilling of the calculated tweaks to the stack, or recalculating them after the encryption operation, and doing either of those would most likely penalize low end cores. For ECB, this is not a concern at all, given that we have plenty of spare registers. For CTR and CBC decryption, we take advantage of the fact that v16 is not used by the CE version of the code (which is the only one targeted by the optimization), and so we can reshuffle the code a bit and avoid having to spill to memory (with the exception of one extra reload in the CBC routine) Signed-off-by: Ard Biesheuvel Signed-off-by: Herbert Xu commit e217413964a453fc2eeb437c32deb00581cf899d Author: Ard Biesheuvel Date: Mon Jun 24 19:38:30 2019 +0200 crypto: arm64/aes-ce - add 5 way interleave routines In preparation of tweaking the accelerated AES chaining mode routines to be able to use a 5-way stride, implement the core routines to support processing 5 blocks of input at a time. While at it, drop the 2 way versions, which have been unused for a while now. Signed-off-by: Ard Biesheuvel Signed-off-by: Herbert Xu commit d45b1714e25e39b94df3da10ba8e95e63865b278 Author: Christophe Leroy Date: Mon Jun 24 07:20:17 2019 +0000 crypto: talitos - drop icv_ool icv_ool is not used anymore, drop it. Fixes: e345177ded17 ("crypto: talitos - fix AEAD processing.") Signed-off-by: Christophe Leroy Signed-off-by: Herbert Xu commit 58cdbc6d2263beb36954408522762bbe73169306 Author: Christophe Leroy Date: Mon Jun 24 07:20:16 2019 +0000 crypto: talitos - fix hash on SEC1. On SEC1, hash provides wrong result when performing hashing in several steps with input data SG list has more than one element. This was detected with CONFIG_CRYPTO_MANAGER_EXTRA_TESTS: [ 44.185947] alg: hash: md5-talitos test failed (wrong result) on test vector 6, cfg="random: may_sleep use_finup src_divs=[25.88%@+8063, 24.19%@+9588, 28.63%@+16333, 4.60%@+6756, 16.70%@+16281] dst_divs=[71.61%@alignmask+16361, 14.36%@+7756, 14.3%@+" [ 44.325122] alg: hash: sha1-talitos test failed (wrong result) on test vector 3, cfg="random: inplace use_final src_divs=[16.56%@+16378, 52.0%@+16329, 21.42%@alignmask+16380, 10.2%@alignmask+16380] iv_offset=39" [ 44.493500] alg: hash: sha224-talitos test failed (wrong result) on test vector 4, cfg="random: use_final nosimd src_divs=[52.27%@+7401, 17.34%@+16285, 17.71%@+26, 12.68%@+10644] iv_offset=43" [ 44.673262] alg: hash: sha256-talitos test failed (wrong result) on test vector 4, cfg="random: may_sleep use_finup src_divs=[60.6%@+12790, 17.86%@+1329, 12.64%@alignmask+16300, 8.29%@+15, 0.40%@+13506, 0.51%@+16322, 0.24%@+16339] dst_divs" This is due to two issues: - We have an overlap between the buffer used for copying the input data (SEC1 doesn't do scatter/gather) and the chained descriptor. - Data copy is wrong when the previous hash left less than one blocksize of data to hash, implying a complement of the previous block with a few bytes from the new request. Fix it by: - Moving the second descriptor after the buffer, as moving the buffer after the descriptor would make it more complex for other cipher operations (AEAD, ABLKCIPHER) - Skip the bytes taken from the new request to complete the previous one by moving the SG list forward. Fixes: 37b5e8897eb5 ("crypto: talitos - chain in buffered data for ahash on SEC1") Cc: stable@vger.kernel.org Signed-off-by: Christophe Leroy Signed-off-by: Herbert Xu commit d44769e4ccb636e8238adbc151f25467a536711b Author: Christophe Leroy Date: Mon Jun 24 07:20:15 2019 +0000 crypto: talitos - move struct talitos_edesc into talitos.h Moves struct talitos_edesc into talitos.h so that it can be used from any place in talitos.c It will be required for next patch ("crypto: talitos - fix hash on SEC1") Signed-off-by: Christophe Leroy Cc: stable@vger.kernel.org Signed-off-by: Herbert Xu commit aeb87246537a83c2aff482f3f34a2e0991e02cbc Author: Christophe Leroy Date: Mon Jun 24 07:20:14 2019 +0000 lib/scatterlist: Fix mapping iterator when sg->offset is greater than PAGE_SIZE All mapping iterator logic is based on the assumption that sg->offset is always lower than PAGE_SIZE. But there are situations where sg->offset is such that the SG item is on the second page. In that case sg_copy_to_buffer() fails properly copying the data into the buffer. One of the reason is that the data will be outside the kmapped area used to access that data. This patch fixes the issue by adjusting the mapping iterator offset and pgoffset fields such that offset is always lower than PAGE_SIZE. Signed-off-by: Christophe Leroy Fixes: 4225fc8555a9 ("lib/scatterlist: use page iterator in the mapping iterator") Cc: stable@vger.kernel.org Signed-off-by: Herbert Xu commit 06013b647c708e4f3179b7b0cf3adf28cb8cbfcf Author: Alex Williamson Date: Thu Jun 13 16:57:20 2019 -0600 PCI/IOV: Assume SR-IOV VFs support extended config space. The SR-IOV specification requires both PFs and VFs to implement a PCIe capability. Generally this is sufficient to assume extended config space is present, but we generally also perform additional tests to make sure the extended config space is reachable and not simply an alias of standard config space. For a VF to exist extended config space must be accessible on the PF, therefore we can also assume it to be accessible on the VF. This enables a micro performance optimization previously implemented in commit 975bb8b4dc93 ("PCI/IOV: Use VF0 cached config space size for other VFs") to speed up probing of VFs. Signed-off-by: Alex Williamson Signed-off-by: Bjorn Helgaas Reviewed-by: Kuppuswamy Sathyanarayanan Cc: KarimAllah Ahmed Cc: Hao Zheng commit 76bf6a8634a1ac04d3075993c31a6d94a7f75580 Author: Alex Williamson Date: Thu Jun 13 16:57:12 2019 -0600 Revert "PCI/IOV: Use VF0 cached config space size for other VFs" Revert 975bb8b4dc93 ("PCI/IOV: Use VF0 cached config space size for other VFs"), which attempted to cache the config space size from the first VF to re-use for subsequent VFs. The cached value was determined prior to discovering the PCIe capability on the VF, which resulted in the first VF reporting the correct config space size (4K), as it has a special case through pci_cfg_space_size(), while all the other VFs only reported 256 bytes. As this was only a performance optimization, we're better off without it. Fixes: 975bb8b4dc93 ("PCI/IOV: Use VF0 cached config space size for other VFs") Link: https://lore.kernel.org/r/156046663197.29869.3633634445109057665.stgit@gimli.home Signed-off-by: Alex Williamson Signed-off-by: Bjorn Helgaas Cc: KarimAllah Ahmed Cc: Kuppuswamy Sathyanarayanan Cc: Hao Zheng commit a328a259ced0c0fa5aabcd29238779a536335884 Merge: a041ede09011 15a108af1a18 Author: Ingo Molnar Date: Wed Jul 3 15:55:48 2019 +0200 Merge tag 'perf-core-for-mingo-5.3-20190703' of git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux into perf/core Pull perf/core improvements and fixes from Arnaldo Carvalho de Melo: perf metrics: Andi Kleen: - Fixes for SkylakeX and CascadeLakeX Intel vendor events. - Avoid extra ':' for --raw metrics. - Don't include duration_time in group. perf script: Arnaldo Carvalho de Melo/Jiri Olsa: - Fix processing guest samples. perf diff: Jin Yao: - Do diffs by basic blocks. objtool: Jiri Olsa: - Fix build by linking against tools/lib/ctype.o sources. perf pmu: John Garry: - Support more complex PMU event aliasing. - Add support for Hisi hip08 DDRC, HHA and L3C PMU aliasing. Signed-off-by: Arnaldo Carvalho de Melo Signed-off-by: Ingo Molnar commit a041ede090119510bb56396dd0df0ee0b3173b47 Merge: fd7d55172d1e 06c642c0e9fc Author: Ingo Molnar Date: Wed Jul 3 15:54:24 2019 +0200 Merge tag 'perf-core-for-mingo-5.3-20190701' of git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux into perf/core Pull perf/core improvements and fixes from Arnaldo Carvalho de Melo: perf annotate: Mao Han: - Add support for the csky processor architecture. perf stat: Andi Kleen: - Fix metrics with --no-merge. - Don't merge events in the same PMU. - Fix group lookup for metric group. Intel PT: Adrian Hunter: - Improve CBR (Core to Bus Ratio) packets support. - Fix thread stack return from kernel for kernel only case. - Export power and ptwrite events to sqlite and postgresql. core libraries: Arnaldo Carvalho de Melo: - Find routines in tools/perf/util/ that have implementations in the kernel libraries (lib/*.c), such as strreplace(), strim(), skip_spaces() and reuse them after making a copy into tools/lib and tools/include/. This continues the effort of having tools/ code looking as much as possible like kernel source code, to help encourage people to work on both the kernel and in tools hosted in the kernel sources. That in turn will help moving stuff that uses those routines to tools/lib/perf/ where they will be made available for use in other tools. In the process ditch old cruft, remove unused variables and add missing include directives for headers providing things used in places that were building by sheer luck. Kyle Meyer: - Bump MAX_NR_CPUS and MAX_CACHES to get these tools to work on more machines. Signed-off-by: Arnaldo Carvalho de Melo Signed-off-by: Ingo Molnar commit d665e12aa713e598a1100a320e5679c3f73823ed Author: Christoph Hellwig Date: Wed Jul 3 05:24:35 2019 -0700 block: nr_phys_segments needs to be zero for REQ_OP_WRITE_ZEROES Fix a regression introduced when removing bi_phys_segments for Write Zeroes requests, which need to have a segment count of zero, as they don't have a payload. Fixes: 14ccb66b3f58 ("block: remove the bi_phys_segments field in struct bio") Reported-by: Jens Axboe Signed-off-by: Christoph Hellwig Signed-off-by: Jens Axboe commit c9093486f283c3447439f234eb0124129e8e7834 Author: Anshuman Khandual Date: Fri Jun 21 21:39:18 2019 +0530 mips/kprobes: Export kprobe_fault_handler() Generic kprobe_page_fault() calls into kprobe_fault_handler() which must be available with and without CONFIG_KPROBES. There is one stub implementation for !CONFIG_KPROBES. For CONFIG_KPROBES all subscribing archs must provide a kprobe_fault_handler() definition. Currently mips has an implementation which is defined as 'static inline'. Make it available for generic kprobes to comply with the above new requirement. Cc: Ralf Baechle Cc: Paul Burton Cc: James Hogan Cc: Andrew Morton Cc: linux-mips@vger.kernel.org Cc: linux-mm@kvack.org Reported-by: kbuild test robot Signed-off-by: Anshuman Khandual Signed-off-by: Paul Burton Fixes: 773734b44557 ("mm, kprobes: generalize and rename notify_page_fault() as kprobe_page_fault()") Cc: linux-kernel@vger.kernel.org commit 455302d1c9ae9318660aaeb9748a01ff414c9741 Author: Ilya Maximets Date: Fri Jun 28 11:04:07 2019 +0300 xdp: fix hang while unregistering device bound to xdp socket Device that bound to XDP socket will not have zero refcount until the userspace application will not close it. This leads to hang inside 'netdev_wait_allrefs()' if device unregistering requested: # ip link del p1 < hang on recvmsg on netlink socket > # ps -x | grep ip 5126 pts/0 D+ 0:00 ip link del p1 # journalctl -b Jun 05 07:19:16 kernel: unregister_netdevice: waiting for p1 to become free. Usage count = 1 Jun 05 07:19:27 kernel: unregister_netdevice: waiting for p1 to become free. Usage count = 1 ... Fix that by implementing NETDEV_UNREGISTER event notification handler to properly clean up all the resources and unref device. This should also allow socket killing via ss(8) utility. Fixes: 965a99098443 ("xsk: add support for bind for Rx") Signed-off-by: Ilya Maximets Acked-by: Jonathan Lemon Signed-off-by: Daniel Borkmann commit 162c820ed8965bf94d2685f97388aea5aee9e258 Author: Ilya Maximets Date: Fri Jun 28 11:04:06 2019 +0300 xdp: hold device for umem regardless of zero-copy mode Device pointer stored in umem regardless of zero-copy mode, so we heed to hold the device in all cases. Fixes: c9b47cc1fabc ("xsk: fix bug when trying to use both copy and zero-copy on one queue id") Signed-off-by: Ilya Maximets Acked-by: Jonathan Lemon Signed-off-by: Daniel Borkmann commit 11aca65ec4db09527d3e9b6b41a0615b7da4386b Author: Jiri Benc Date: Tue Jul 2 19:40:31 2019 +0200 selftests: bpf: fix inlines in test_lwt_seg6local Selftests are reporting this failure in test_lwt_seg6local.sh: + ip netns exec ns2 ip -6 route add fb00::6 encap bpf in obj test_lwt_seg6local.o sec encap_srh dev veth2 Error fetching program/map! Failed to parse eBPF program: Operation not permitted The problem is __attribute__((always_inline)) alone is not enough to prevent clang from inserting those functions in .text. In that case, .text is not marked as relocateable. See the output of objdump -h test_lwt_seg6local.o: Idx Name Size VMA LMA File off Algn 0 .text 00003530 0000000000000000 0000000000000000 00000040 2**3 CONTENTS, ALLOC, LOAD, READONLY, CODE This causes the iproute bpf loader to fail in bpf_fetch_prog_sec: bpf_has_call_data returns true but bpf_fetch_prog_relo fails as there's no relocateable .text section in the file. To fix this, convert to 'static __always_inline'. v2: Use 'static __always_inline' instead of 'static inline __attribute__((always_inline))' Fixes: c99a84eac026 ("selftests/bpf: test for seg6local End.BPF action") Signed-off-by: Jiri Benc Acked-by: Yonghong Song Signed-off-by: Daniel Borkmann commit d2f5bbbc350050895d9f33c2744a61f9e0af1caa Author: Jiri Benc Date: Tue Jul 2 20:26:51 2019 +0200 selftests: bpf: standardize to static __always_inline The progs for bpf selftests use several different notations to force function inlining. Standardize to what most of them use, static __always_inline. Suggested-by: Song Liu Signed-off-by: Jiri Benc Signed-off-by: Daniel Borkmann commit 71634d7f92093062e7b8b2a9efffa5569edcca8b Author: brakmo Date: Tue Jul 2 15:09:52 2019 -0700 bpf: Add support for fq's EDT to HBM Adds support for fq's Earliest Departure Time to HBM (Host Bandwidth Manager). Includes a new BPF program supporting EDT, and also updates corresponding programs. It will drop packets with an EDT of more than 500us in the future unless the packet belongs to a flow with less than 2 packets in flight. This is done so each flow has at least 2 packets in flight, so they will not starve, and also to help prevent delayed ACK timeouts. It will also work with ECN enabled traffic, where the packets will be CE marked if their EDT is more than 50us in the future. The table below shows some performance numbers. The flows are back to back RPCS. One server sending to another, either 2 or 4 flows. One flow is a 10KB RPC, the rest are 1MB RPCs. When there are more than one flow of a given RPC size, the numbers represent averages. The rate limit applies to all flows (they are in the same cgroup). Tests ending with "-edt" ran with the new BPF program supporting EDT. Tests ending with "-hbt" ran on top HBT qdisc with the specified rate (i.e. no HBM). The other tests ran with the HBM BPF program included in the HBM patch-set. EDT has limited value when using DCTCP, but it helps in many cases when using Cubic. It usually achieves larger link utilization and lower 99% latencies for the 1MB RPCs. HBM ends up queueing a lot of packets with its default parameter values, reducing the goodput of the 10KB RPCs and increasing their latency. Also, the RTTs seen by the flows are quite large. Aggr 10K 10K 10K 1MB 1MB 1MB Limit rate drops RTT rate P90 P99 rate P90 P99 Test rate Flows Mbps % us Mbps us us Mbps ms ms -------- ---- ----- ---- ----- --- ---- ---- ---- ---- ---- ---- cubic 1G 2 904 0.02 108 257 511 539 647 13.4 24.5 cubic-edt 1G 2 982 0.01 156 239 656 967 743 14.0 17.2 dctcp 1G 2 977 0.00 105 324 408 744 653 14.5 15.9 dctcp-edt 1G 2 981 0.01 142 321 417 811 660 15.7 17.0 cubic-htb 1G 2 919 0.00 1825 40 2822 4140 879 9.7 9.9 cubic 200M 2 155 0.30 220 81 532 655 74 283 450 cubic-edt 200M 2 188 0.02 222 87 1035 1095 101 84 85 dctcp 200M 2 188 0.03 111 77 912 939 111 76 325 dctcp-edt 200M 2 188 0.03 217 74 1416 1738 114 76 79 cubic-htb 200M 2 188 0.00 5015 8 14ms 15ms 180 48 50 cubic 1G 4 952 0.03 110 165 516 546 262 38 154 cubic-edt 1G 4 973 0.01 190 111 1034 1314 287 65 79 dctcp 1G 4 951 0.00 103 180 617 905 257 37 38 dctcp-edt 1G 4 967 0.00 163 151 732 1126 272 43 55 cubic-htb 1G 4 914 0.00 3249 13 7ms 8ms 300 29 34 cubic 5G 4 4236 0.00 134 305 490 624 1310 10 17 cubic-edt 5G 4 4865 0.00 156 306 425 759 1520 10 16 dctcp 5G 4 4936 0.00 128 485 221 409 1484 7 9 dctcp-edt 5G 4 4924 0.00 148 390 392 623 1508 11 26 v1 -> v2: Incorporated Andrii's suggestions v2 -> v3: Incorporated Yonghong's suggestions v3 -> v4: Removed credit update that is not needed Signed-off-by: Lawrence Brakmo Acked-by: Yonghong Song Signed-off-by: Daniel Borkmann commit 35af80aef99b34993783c34029d2196717e693c8 Author: Christoph Hellwig Date: Mon Jul 1 23:54:38 2019 +0200 gfs2: don't use buffer_heads in gfs2_allocate_page_backing Rewrite gfs2_allocate_page_backing to call gfs2_iomap_get_alloc and operate on struct iomap directly. Signed-off-by: Christoph Hellwig Signed-off-by: Andreas Gruenbacher commit 7770c93a46e6d2dc6e7c2172d83f2f5aca947cf7 Author: Christoph Hellwig Date: Mon Jul 1 23:54:36 2019 +0200 gfs2: use iomap_bmap instead of generic_block_bmap No need to indirect through get_blocks and buffer_heads when we can just use the iomap version. Signed-off-by: Christoph Hellwig Signed-off-by: Andreas Gruenbacher commit 378b6cbfb82f2a8bb47ae3b1dac0419b57d84a36 Author: Christoph Hellwig Date: Mon Jul 1 23:54:35 2019 +0200 gfs2: mark stuffed_readpage static Signed-off-by: Christoph Hellwig Signed-off-by: Andreas Gruenbacher commit 59c01c5046cc0cf567d58cc7b59a704a36a06899 Author: Christoph Hellwig Date: Mon Jul 1 23:54:34 2019 +0200 gfs2: merge gfs2_writepage_common into gfs2_writepage There is no need to keep these two functions separate. Signed-off-by: Christoph Hellwig Signed-off-by: Andreas Gruenbacher commit eadd753580469f281912e28114a80e5822622cbe Author: Christoph Hellwig Date: Mon Jul 1 23:54:33 2019 +0200 gfs2: merge gfs2_writeback_aops and gfs2_ordered_aops The only difference between the two is that gfs2_ordered_aops sets the set_page_dirty method to __set_page_dirty_buffers, but given that __set_page_dirty_buffers is the default, if no method is set, there is no need to to do that. Merge the two sets of operations into one. Signed-off-by: Christoph Hellwig Signed-off-by: Andreas Gruenbacher commit c09c6071310df430619df57d67e7ab59902f99ad Author: Harry Pan Date: Wed Jun 19 16:28:01 2019 +0800 platform/x86: intel_pmc_core: transform Pkg C-state residency from TSC ticks into microseconds Refer to the Intel SDM Vol.4, the package C-state residency counters of modern IA micro-architecture are all ticking in TSC frequency, hence we can apply simple math to transform the ticks into microseconds. i.e., residency (ms) = count / tsc_khz residency (us) = count / tsc_khz * 1000 This also aligns to other sysfs debug entries of residency counter in the same metric in microseconds, benefits reading and scripting. v2: restore the accidentally deleted newline, no function change. v3: apply kernel do_div() macro to calculate division Signed-off-by: Harry Pan Signed-off-by: Andy Shevchenko commit 8e8fe446a91caf4537f512572e4bf52f8f2154a9 Author: Fuqian Huang Date: Mon Jul 1 11:24:26 2019 +0800 platform/x86: asus-wmi: Use dev_get_drvdata() Using dev_get_drvdata directly. Signed-off-by: Fuqian Huang Signed-off-by: Andy Shevchenko commit ba07e3aacc08de2e6f6cd199c3618fbbc2c45f0c Author: Vadim Pasternak Date: Sun Jun 23 12:16:29 2019 +0000 Documentation/ABI: Add new attribute for mlxreg-io sysfs interfaces Add documentation for the new attributes for exposing reset causes for the next type of resets: caused by different watchdog, BIOS reload, ASIC reset request. Signed-off-by: Vadim Pasternak Signed-off-by: Andy Shevchenko commit 262d861bf7d6dfb80f720d09d8fc901c8b24f9f7 Author: Vadim Pasternak Date: Sun Jun 23 12:16:28 2019 +0000 platform/x86: mlx-platform: Add more reset cause attributes Add more attributes for reset cause indication for the cases when system reset has been caused by watchdog, BIOS reload and COMEX thermal shutdown. Signed-off-by: Vadim Pasternak Signed-off-by: Andy Shevchenko commit cb636bb1dcfb514e85b70ff482b6c583f3eb7960 Author: Vadim Pasternak Date: Sun Jun 23 12:16:27 2019 +0000 platform/x86: mlx-platform: Modify DMI matching order Modify DMI matching order: perform matching based on DMI_BOARD_NAME before matching based on DMI_BOARD_VENDOR and DMI_PRODUCT_NAME in order to reduce the number of ‘dmi_table’ entries necessary for new systems support and keep matching order in logical way. For example, the existing check for DMI_PRODUCT_NAME with prefixes “MSN27", “MSN24”, "MSB” matches systems MSN2700-BXXXX, MSN2700-XXXX, MSN2410-BXXXX, MSB7800-XXXX, where ‘XXXX’ specifies some systems hardware flavors. At the same time these systems also matched by DMI_BOARD_NAME “VMOD0001”, because they all have the same platform configuration (LED, interrupt control, mux etcetera). New systems with different platform configuration, but with similar DMI_PRODUCT_NAME MSN2700-2XXXX, MSN2700-2XXXX, MSB7800-2XXXX are about to be added. These system have similar DMI_PRODUCT_NAME, since they have same ports configuration as their predecessors. All new systems will be matched by DMI_BOARD_NAME “VMOD0008”. With the change provided in the patch it is enough just to add “VMOD0008” match following natural after “VMOD0007”, otherwise “VMOD0008” or all “MSN2700-2XXXX”, “MSN2700-2XXXX”, “MSB7800-2XXXX” should be added on top of ‘mlxplat_dmi_table” in order to be matched before “MSN27", “MSN24”, "MSB”. Signed-off-by: Vadim Pasternak Signed-off-by: Andy Shevchenko commit a7ff2f99eb547867377f4db7eeae853804d78d96 Author: Vadim Pasternak Date: Sun Jun 23 12:16:26 2019 +0000 platform/x86: mlx-platform: Add regmap structure for the next generation systems Use separated regamp structures for old and next generation systems. Next generation systems don’t require write protection removing. Signed-off-by: Vadim Pasternak Signed-off-by: Andy Shevchenko commit d66656262a23c20cb6d88b772b65ad26fa3fc38b Author: Vadim Pasternak Date: Sun Jun 23 12:16:25 2019 +0000 platform/x86: mlx-platform: Change API for i2c-mlxcpld driver activation Activate 'i2c-mlxcpld' driver with 'platform_device_register_resndata' instead off 'platform_device_register_simple' in order to pass platform specific info. Add platform i2c data for the next generation systems. Signed-off-by: Vadim Pasternak Signed-off-by: Andy Shevchenko commit 6b266e91a0715dae9923a2791e0b98165163e91f Author: Vadim Pasternak Date: Sun Jun 23 12:16:24 2019 +0000 platform/x86: mlx-platform: Move regmap initialization before all drivers activation Initialize regmap prior drivers starting to allow passing regmap handle to 'i2c_mlxcpld' driver. Signed-off-by: Vadim Pasternak Signed-off-by: Andy Shevchenko commit 3dda617a14327fb5f7c796b0cda2d211e9a2169e Author: Srinivas Pandruvada Date: Tue Jul 2 18:53:31 2019 -0700 MAINTAINERS: Update for Intel Speed Select Technology Added myself as the maintainer. Signed-off-by: Srinivas Pandruvada Acked-by: Rafael J. Wysocki Signed-off-by: Andy Shevchenko commit 3fb4f7cd472c7f5905c91508e988f6b28372210d Author: Srinivas Pandruvada Date: Sun Jun 30 10:14:08 2019 -0700 tools/power/x86: A tool to validate Intel Speed Select commands The Intel(R) Speed select technologies contains four features. Performance profile:An non architectural mechanism that allows multiple optimized performance profiles per system via static and/or dynamic adjustment of core count, workload, Tjmax, and TDP, etc. aka ISS in the documentation. Base Frequency: Enables users to increase guaranteed base frequency on certain cores (high priority cores) in exchange for lower base frequency on remaining cores (low priority cores). aka PBF in the documenation. Turbo frequency: Enables the ability to set different turbo ratio limits to cores based on priority. aka FACT in the documentation. Core power: An Interface that allows user to define per core/tile priority. There is a multi level help for commands and options. This can be used to check required arguments for each feature and commands for the feature. To start navigating the features start with $sudo intel-speed-select --help For help on a specific feature for example $sudo intel-speed-select perf-profile --help To get help for a command for a feature for example $sudo intel-speed-select perf-profile get-lock-status --help Signed-off-by: Srinivas Pandruvada Acked-by: Len Brown Acked-by: Rafael J. Wysocki Signed-off-by: Andy Shevchenko commit 4d19addd6b2fdf825978bc76c83356709c175611 Author: Enrico Weigelt Date: Wed Jul 3 11:42:24 2019 +0200 gpio: pl061: drop duplicate printing of device name The dev_info() call already prints the device name, so there's no need to explicitly include it in the message for second time.